@plurnk/plurnk-service 1.4.0 → 1.6.0

package/migrations/001_schema.sql

@@ -11,7 +11,6 @@ CREATE TABLE IF NOT EXISTS workspaces (
     version                   INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
     name                      TEXT    NOT NULL UNIQUE CHECK (length(name) > 0),
     created_at                TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    cost_usd                  REAL             DEFAULT 0 CHECK (cost_usd IS NULL OR cost_usd >= 0),
     project_root              TEXT,
     -- {§operator-config} validated client workspace settings; each field composes
     -- with operator configuration at its owning use site.
@@ -27,9 +26,12 @@ CREATE TABLE IF NOT EXISTS workers (
     workspace_id    INTEGER NOT NULL,
     name            TEXT    NOT NULL CHECK (length(name) > 0),
     created_at      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    -- {§worker-provider-identity}: provider affinity must not collide when
+    -- independent databases reuse local integer ids.
+    provider_identity TEXT NOT NULL DEFAULT (lower(hex(randomblob(16))))
+        CHECK (length(provider_identity) = 32 AND provider_identity NOT GLOB '*[^0-9a-f]*'),
     -- workers fork via parent_worker_id; workspaces carry no parent — {§machine-processes-no-fork-workspace}
     parent_worker_id INTEGER          CHECK (parent_worker_id IS NULL OR parent_worker_id != id),
-    cost_usd        REAL             DEFAULT 0 CHECK (cost_usd IS NULL OR cost_usd >= 0),
     origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', 'plurnk')),
     -- {§methods-model-worker}: durable identity for the workspace's stable
     -- default conversation; unrelated to its human-facing, reclaimable name.
@@ -44,6 +46,7 @@ CREATE TABLE IF NOT EXISTS workers (
 
 CREATE        INDEX IF NOT EXISTS workers_workspace_id_created_at ON workers (workspace_id, created_at);
 CREATE        INDEX IF NOT EXISTS workers_parent_worker_id         ON workers (parent_worker_id);
+CREATE UNIQUE INDEX IF NOT EXISTS workers_provider_identity         ON workers (provider_identity);
 CREATE UNIQUE INDEX IF NOT EXISTS workers_workspace_default_conversation
     ON workers (workspace_id) WHERE default_conversation = 1;
 -- NOT unique: a name is frozen per worker ({§machine-processes-worker-origin}) but RECLAIMABLE across
@@ -52,6 +55,13 @@ CREATE UNIQUE INDEX IF NOT EXISTS workers_workspace_default_conversation
 -- → worker_live_by_name → 409), never by this index. Indexed for the by-name resolve/spawn lookup.
 CREATE        INDEX IF NOT EXISTS workers_workspace_name          ON workers (workspace_id, name);
 
+CREATE TRIGGER IF NOT EXISTS workers_provider_identity_immutable
+BEFORE UPDATE OF provider_identity ON workers
+WHEN NEW.provider_identity != OLD.provider_identity
+BEGIN
+    SELECT RAISE(ABORT, 'workers.provider_identity is immutable');
+END;
+
 -- {§env-delta-log-pull}: one append-only occurrence journal gives every ambient
 -- producer a shared monotonic order. It snapshots only what the observer row
 -- needs; shared-world contents remain owned by entries/files, never copied here.
@@ -70,14 +80,21 @@ CREATE TABLE IF NOT EXISTS ambient_events (
     pathname           TEXT,
     rx                 TEXT,
     attrs              TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
+    tags               TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(tags) AND json_type(tags) = 'array'),
     status_rx          INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
-    prompt             TEXT,
     terminated_by      TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
     created_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     CHECK (
-        (kind = 'edit' AND op = 'EDIT' AND rx IS NOT NULL AND prompt IS NULL AND terminated_by IS NULL)
+        (kind = 'edit' AND op = 'EDIT' AND rx IS NOT NULL AND terminated_by IS NULL)
         OR
-        (kind = 'loop_termination' AND op = 'SEND' AND scheme = 'worker' AND prompt IS NOT NULL)
+        (kind = 'loop_termination'
+            AND op = 'SEND'
+            AND scheme = 'worker'
+            AND rx IS NOT NULL
+            AND json_valid(rx)
+            AND json_type(rx) = 'object'
+            AND json_type(rx, '$.status') = 'integer'
+            AND json_extract(rx, '$.status') = status_rx)
     ),
     FOREIGN KEY (workspace_id)       REFERENCES workspaces(id) ON DELETE CASCADE,
     FOREIGN KEY (producer_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
@@ -102,6 +119,7 @@ CREATE TABLE IF NOT EXISTS loops (
     prompt   TEXT    NOT NULL,
     flags    TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(flags)),
     provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(provider_spec)),
+    child_provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(child_provider_spec)),
     max_turns INTEGER NOT NULL DEFAULT 50 CHECK (max_turns >= -1),
     -- {§methods-loop-run-open-paths}: the initial prompt frame's selected paths,
     -- held here until turn 1 materializes that frame (string[] JSON).
@@ -110,22 +128,56 @@ CREATE TABLE IF NOT EXISTS loops (
     -- complete orphan frame set of one concluded source loop.
     orphan_source_loop_id INTEGER,
     -- {§worker-scheme} loop-termination delta: terminated_at is stamped by the trigger
-    -- below when status crosses into terminal (every death-path, uniformly);
-    -- terminal_message is the deliverable — the SEND[200] body or the abandonment
-    -- reason — set by the guarded terminal lifecycle transition.
+    -- below when status crosses into terminal (every death-path, uniformly).
     terminated_at    TEXT,
-    terminal_message TEXT,
-    terminal_result  TEXT                      CHECK (terminal_result IS NULL OR json_valid(terminal_result)),
+    terminal_result  TEXT,
     -- {§loop-terminal-authorship}: 'cancel' names an external loop.cancel;
     -- NULL covers model terminals and engine verdicts whose result carries the story.
     terminated_by    TEXT                      CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
+    CONSTRAINT loops_terminal_result_contract CHECK (
+        CASE
+            WHEN status IN (100, 102, 202) THEN terminal_result IS NULL
+            WHEN terminal_result IS NULL OR NOT json_valid(terminal_result) THEN 0
+            ELSE
+                json_type(terminal_result) IS 'object'
+                AND json_type(terminal_result, '$.status') IS 'integer'
+                AND (
+                    json_extract(terminal_result, '$.status') = status
+                    OR (
+                        status = 200
+                        AND json_extract(terminal_result, '$.status') BETWEEN 200 AND 399
+                        AND json_extract(terminal_result, '$.status') != 202
+                    )
+                    OR (
+                        status = 500
+                        AND json_extract(terminal_result, '$.status') BETWEEN 400 AND 599
+                    )
+                )
+                AND CASE
+                    WHEN json_extract(terminal_result, '$.status') < 400 THEN
+                        json_type(terminal_result, '$.problem') IS NULL
+                    ELSE
+                        json_type(terminal_result, '$.problem') IS 'object'
+                        AND json_type(terminal_result, '$.problem.status') IS 'integer'
+                        AND json_extract(terminal_result, '$.problem.status')
+                            = json_extract(terminal_result, '$.status')
+                        AND json_type(terminal_result, '$.problem.type') IS 'text'
+                        AND length(json_extract(terminal_result, '$.problem.type')) > 0
+                        AND json_type(terminal_result, '$.problem.title') IS 'text'
+                        AND length(json_extract(terminal_result, '$.problem.title')) > 0
+                        AND json_type(terminal_result, '$.problem.detail') IS 'text'
+                        AND length(json_extract(terminal_result, '$.problem.detail')) > 0
+                        AND json_type(terminal_result, '$.problem.instance') IS 'text'
+                        AND length(json_extract(terminal_result, '$.problem.instance')) > 0
+                END
+        END
+    ),
     FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
     FOREIGN KEY (orphan_source_loop_id) REFERENCES loops(id)
 ) STRICT;
 
 CREATE UNIQUE INDEX IF NOT EXISTS loops_worker_id_sequence ON loops (worker_id, sequence);
 CREATE UNIQUE INDEX IF NOT EXISTS loops_orphan_source_loop_id ON loops (orphan_source_loop_id);
-
 -- {§worker-scheme}: a loop crossing into a terminal status stamps terminated_at, so sibling
 -- workers pull the termination as a folded ambient delta — caught uniformly across every
 -- death-path (SEND, grinder, max-turns, strike, KILL). The stamp updates terminated_at,
@@ -147,100 +199,19 @@ WHEN NEW.status IN (200, 413, 429, 499, 500, 504, 508) AND OLD.status NOT IN (20
 BEGIN
     INSERT INTO ambient_events (
         workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, pathname, rx, status_rx, prompt, terminated_by
+        op, scheme, pathname, rx, status_rx, terminated_by
     )
     SELECT w.workspace_id, NEW.worker_id, 'loop_termination', NEW.id, NULL,
-           'SEND', 'worker', '/' || w.name, NEW.terminal_message, NEW.status, NEW.prompt, NEW.terminated_by
+           'SEND', 'worker', '/' || w.name, NEW.terminal_result,
+           json_extract(NEW.terminal_result, '$.status'), NEW.terminated_by
     FROM workers w
     WHERE w.id = NEW.worker_id;
 END;
 
-CREATE TRIGGER IF NOT EXISTS loops_result_contract_insert
-BEFORE INSERT ON loops
-WHEN NEW.status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)
-AND NOT (
-    (NEW.status IN (100, 102, 202) AND NEW.terminal_result IS NULL)
-    OR (
-        NEW.status IN (200, 413, 429, 499, 500, 504, 508)
-        AND NEW.terminal_result IS NOT NULL
-        AND json_valid(NEW.terminal_result)
-        AND json_type(NEW.terminal_result, '$.status') = 'integer'
-        AND (
-            json_extract(NEW.terminal_result, '$.status') = NEW.status
-            OR (
-                NEW.status = 200
-                AND json_extract(NEW.terminal_result, '$.status') BETWEEN 200 AND 399
-                AND json_extract(NEW.terminal_result, '$.status') != 202
-            )
-            OR (
-                NEW.status = 500
-                AND json_extract(NEW.terminal_result, '$.status') BETWEEN 400 AND 599
-            )
-        )
-        AND (
-            (NEW.status < 400 AND json_type(NEW.terminal_result, '$.problem') IS NULL)
-            OR (
-                NEW.status >= 400
-                AND json_type(NEW.terminal_result, '$.problem') = 'object'
-                AND json_extract(NEW.terminal_result, '$.problem.status')
-                    = json_extract(NEW.terminal_result, '$.status')
-                AND length(json_extract(NEW.terminal_result, '$.problem.type')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.title')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.detail')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.instance')) > 0
-            )
-        )
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'loop terminal result violates the operation-result contract');
-END;
-
-CREATE TRIGGER IF NOT EXISTS loops_result_contract_update
-BEFORE UPDATE OF status, terminal_result ON loops
-WHEN NEW.status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)
-AND NOT (
-    (NEW.status IN (100, 102, 202) AND NEW.terminal_result IS NULL)
-    OR (
-        NEW.status IN (200, 413, 429, 499, 500, 504, 508)
-        AND NEW.terminal_result IS NOT NULL
-        AND json_valid(NEW.terminal_result)
-        AND json_type(NEW.terminal_result, '$.status') = 'integer'
-        AND (
-            json_extract(NEW.terminal_result, '$.status') = NEW.status
-            OR (
-                NEW.status = 200
-                AND json_extract(NEW.terminal_result, '$.status') BETWEEN 200 AND 399
-                AND json_extract(NEW.terminal_result, '$.status') != 202
-            )
-            OR (
-                NEW.status = 500
-                AND json_extract(NEW.terminal_result, '$.status') BETWEEN 400 AND 599
-            )
-        )
-        AND (
-            (NEW.status < 400 AND json_type(NEW.terminal_result, '$.problem') IS NULL)
-            OR (
-                NEW.status >= 400
-                AND json_type(NEW.terminal_result, '$.problem') = 'object'
-                AND json_extract(NEW.terminal_result, '$.problem.status')
-                    = json_extract(NEW.terminal_result, '$.status')
-                AND length(json_extract(NEW.terminal_result, '$.problem.type')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.title')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.detail')) > 0
-                AND length(json_extract(NEW.terminal_result, '$.problem.instance')) > 0
-            )
-        )
-    )
-)
-BEGIN
-    SELECT RAISE(ABORT, 'loop terminal result violates the operation-result contract');
-END;
-
 -- turns
--- finish_reason / model: provider-call metadata from the provider response contract.
--- Properties of the call, not of the model's emission payload — kept on
--- the Turn row alongside usage rather than nested into packet.assistant.
+-- finish_reason / model: accepted provider-call metadata from the provider
+-- response contract. Physical request accounting is normalized beneath the
+-- logical emission attempt that caused it.
 CREATE TABLE IF NOT EXISTS turns (
     id               INTEGER NOT NULL PRIMARY KEY,
     version          INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -248,12 +219,6 @@ CREATE TABLE IF NOT EXISTS turns (
     sequence         INTEGER NOT NULL           CHECK (sequence >= 1),
     timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     status           INTEGER NOT NULL           CHECK (status BETWEEN 100 AND 599),
-    usage_prompt     INTEGER NOT NULL DEFAULT 0 CHECK (usage_prompt >= 0),
-    usage_completion INTEGER NOT NULL DEFAULT 0 CHECK (usage_completion >= 0),
-    usage_reasoning  INTEGER NOT NULL DEFAULT 0 CHECK (usage_reasoning >= 0),
-    usage_cached     INTEGER NOT NULL DEFAULT 0 CHECK (usage_cached >= 0),
-    usage_cost       TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(usage_cost) AND json_type(usage_cost) = 'array'),
-    usage_cost_usd   REAL             DEFAULT 0 CHECK (usage_cost_usd IS NULL OR usage_cost_usd >= 0),
     -- Effective packet allowance for this turn's provider and policy; NULL is
     -- uncapped or unknown. {§tokenomics-client-gauge}
     usage_prompt_budget INTEGER                  CHECK (usage_prompt_budget IS NULL OR usage_prompt_budget >= 1),
@@ -298,38 +263,254 @@ CREATE TABLE IF NOT EXISTS turns (
 CREATE UNIQUE INDEX IF NOT EXISTS turns_loop_id_sequence ON turns (loop_id, sequence);
 CREATE        INDEX IF NOT EXISTS turns_timestamp        ON turns (timestamp);
 
--- Provider calls are attempts beneath one engine turn. Rejected and interrupted
--- response evidence persists without becoming a turn or entering model-visible
--- history.
-CREATE TABLE IF NOT EXISTS turn_attempts (
+-- One logical provider.generate call. Emission attempts and BARE inferences
+-- share response/failure evidence and cardinal physical request accounting;
+-- operation-specific semantics live in their specializing relations.
+CREATE TABLE IF NOT EXISTS model_calls (
     id               INTEGER NOT NULL PRIMARY KEY,
     turn_id          INTEGER NOT NULL,
     sequence         INTEGER NOT NULL CHECK (sequence >= 1),
-    accepted         INTEGER NOT NULL CHECK (accepted IN (0, 1)),
-    response         TEXT    NOT NULL CHECK (json_valid(response)),
-    parse_errors     TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(parse_errors)),
-    -- Exact opaque tag set forwarded with this response-bearing provider call.
+    kind             TEXT    NOT NULL CHECK (kind IN ('emission', 'bare')),
+    state            TEXT    NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'response', 'error')),
+    response         TEXT             CHECK (response IS NULL OR json_valid(response)),
+    failure          TEXT             CHECK (failure IS NULL OR json_valid(failure)),
+    -- Exact opaque tag set forwarded with this provider call.
     -- {§attribution}
     attributions     TEXT    NOT NULL DEFAULT '[]' CHECK (
         json_valid(attributions) AND json_type(attributions) = 'array'
     ),
-    usage_prompt     INTEGER NOT NULL DEFAULT 0 CHECK (usage_prompt >= 0),
-    usage_completion INTEGER NOT NULL DEFAULT 0 CHECK (usage_completion >= 0),
-    usage_reasoning  INTEGER NOT NULL DEFAULT 0 CHECK (usage_reasoning >= 0),
-    usage_cached     INTEGER NOT NULL DEFAULT 0 CHECK (usage_cached >= 0),
-    usage_cost       TEXT    NOT NULL CHECK (json_valid(usage_cost) AND json_type(usage_cost) = 'object'),
-    usage_cost_usd   REAL             CHECK (usage_cost_usd IS NULL OR usage_cost_usd >= 0),
     finish_reason    TEXT,
     model            TEXT    NOT NULL CHECK (length(model) >= 1),
     timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    completed_at     TEXT,
+    CHECK (
+        (state = 'pending'
+            AND response IS NULL AND failure IS NULL
+            AND finish_reason IS NULL AND completed_at IS NULL)
+        OR
+        (state = 'response'
+            AND response IS NOT NULL
+            AND completed_at IS NOT NULL)
+        OR
+        (state = 'error'
+            AND response IS NULL AND failure IS NOT NULL
+            AND completed_at IS NOT NULL)
+    ),
     UNIQUE (turn_id, sequence),
     FOREIGN KEY (turn_id) REFERENCES turns(id) ON DELETE CASCADE
 ) STRICT;
 
-CREATE INDEX IF NOT EXISTS turn_attempts_turn_id ON turn_attempts (turn_id);
-CREATE UNIQUE INDEX IF NOT EXISTS turn_attempts_one_accepted_per_turn
-    ON turn_attempts (turn_id)
-    WHERE accepted = 1;
+CREATE INDEX IF NOT EXISTS model_calls_turn_id ON model_calls (turn_id, sequence);
+
+CREATE TRIGGER IF NOT EXISTS model_calls_request_identity_immutable
+BEFORE UPDATE OF turn_id, sequence, kind, attributions, timestamp ON model_calls
+BEGIN
+    SELECT RAISE(ABORT, 'model call request identity is immutable');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_calls_state_forward_only
+BEFORE UPDATE OF state ON model_calls
+WHEN NOT (
+    NEW.state = OLD.state
+    OR (OLD.state = 'pending' AND NEW.state IN ('response', 'error'))
+)
+BEGIN
+    SELECT RAISE(ABORT, 'model call state may only close once');
+END;
+
+CREATE TRIGGER IF NOT EXISTS model_calls_observation_immutable
+BEFORE UPDATE OF response, failure, finish_reason, model, completed_at
+ON model_calls
+WHEN OLD.state != 'pending'
+BEGIN
+    SELECT RAISE(ABORT, 'model call observation is immutable');
+END;
+
+-- Emission admission specializes one model call without re-owning its response,
+-- provider identity, ordering, or accounting evidence.
+CREATE TABLE IF NOT EXISTS turn_attempts (
+    id               INTEGER NOT NULL PRIMARY KEY,
+    model_call_id    INTEGER NOT NULL UNIQUE,
+    accepted         INTEGER          CHECK (accepted IS NULL OR accepted IN (0, 1)),
+    parse_errors     TEXT    NOT NULL DEFAULT '[]' CHECK (
+        json_valid(parse_errors) AND json_type(parse_errors) = 'array'
+    ),
+    FOREIGN KEY (model_call_id) REFERENCES model_calls(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_request_identity_immutable
+BEFORE UPDATE OF model_call_id ON turn_attempts
+BEGIN
+    SELECT RAISE(ABORT, 'emission attempt identity is immutable');
+END;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_emission_call_only
+BEFORE INSERT ON turn_attempts
+WHEN COALESCE((SELECT kind = 'emission' FROM model_calls WHERE id = NEW.model_call_id), 0) != 1
+BEGIN
+    SELECT RAISE(ABORT, 'turn attempt requires an emission model call');
+END;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_classification_after_response
+BEFORE UPDATE OF accepted, parse_errors ON turn_attempts
+WHEN COALESCE((SELECT state = 'response' FROM model_calls WHERE id = OLD.model_call_id), 0) != 1
+BEGIN
+    SELECT RAISE(ABORT, 'emission classification requires model response evidence');
+END;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_classification_once
+BEFORE UPDATE OF accepted, parse_errors
+ON turn_attempts
+WHEN OLD.accepted IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'emission attempt classification is immutable');
+END;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_one_accepted_insert
+BEFORE INSERT ON turn_attempts
+WHEN NEW.accepted = 1 AND EXISTS (
+    SELECT 1
+    FROM turn_attempts existing
+    JOIN model_calls old_call ON old_call.id = existing.model_call_id
+    JOIN model_calls new_call ON new_call.id = NEW.model_call_id
+    WHERE old_call.turn_id = new_call.turn_id AND existing.accepted = 1
+)
+BEGIN
+    SELECT RAISE(ABORT, 'one emission may be accepted per turn');
+END;
+
+CREATE TRIGGER IF NOT EXISTS turn_attempts_one_accepted_update
+BEFORE UPDATE OF accepted ON turn_attempts
+WHEN NEW.accepted = 1 AND EXISTS (
+    SELECT 1
+    FROM turn_attempts existing
+    JOIN model_calls old_call ON old_call.id = existing.model_call_id
+    JOIN model_calls new_call ON new_call.id = NEW.model_call_id
+    WHERE old_call.turn_id = new_call.turn_id
+      AND existing.id != OLD.id
+      AND existing.accepted = 1
+)
+BEGIN
+    SELECT RAISE(ABORT, 'one emission may be accepted per turn');
+END;
+
+-- {§provider-request-accounting}: one row is opened before one physical
+-- provider request and settled exactly once with the evidence from that request.
+-- Monetary values remain canonical decimal strings; SQLite REAL is never an
+-- accounting representation.
+CREATE TABLE IF NOT EXISTS provider_requests (
+    id                       INTEGER NOT NULL PRIMARY KEY,
+    model_call_id            INTEGER NOT NULL,
+    sequence                 INTEGER NOT NULL CHECK (sequence >= 1),
+    provider                 TEXT    NOT NULL CHECK (length(provider) > 0),
+    model                    TEXT    NOT NULL CHECK (length(model) > 0),
+    state                    TEXT    NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'settled')),
+    outcome                  TEXT             CHECK (outcome IN ('response', 'error')),
+    status                   INTEGER          CHECK (status IS NULL OR status BETWEEN 100 AND 599),
+    usage_input              INTEGER          CHECK (usage_input IS NULL OR usage_input >= 0),
+    usage_output             INTEGER          CHECK (usage_output IS NULL OR usage_output >= 0),
+    usage_total              INTEGER          CHECK (usage_total IS NULL OR usage_total >= 0),
+    usage_input_no_cache     INTEGER          CHECK (usage_input_no_cache IS NULL OR usage_input_no_cache >= 0),
+    usage_input_cache_read   INTEGER          CHECK (usage_input_cache_read IS NULL OR usage_input_cache_read >= 0),
+    usage_input_cache_write  INTEGER          CHECK (usage_input_cache_write IS NULL OR usage_input_cache_write >= 0),
+    usage_output_text        INTEGER          CHECK (usage_output_text IS NULL OR usage_output_text >= 0),
+    usage_output_reasoning   INTEGER          CHECK (usage_output_reasoning IS NULL OR usage_output_reasoning >= 0),
+    cost_kind                TEXT             CHECK (cost_kind IN ('charged', 'estimated', 'unknown')),
+    cost_amount              TEXT,
+    cost_currency            TEXT,
+    cost_usd_equivalent      TEXT,
+    cost_source              TEXT,
+    cost_reason              TEXT,
+    started_at               TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    completed_at             TEXT,
+    CHECK (
+        (state = 'pending'
+            AND outcome IS NULL AND status IS NULL
+            AND usage_input IS NULL AND usage_output IS NULL AND usage_total IS NULL
+            AND usage_input_no_cache IS NULL AND usage_input_cache_read IS NULL
+            AND usage_input_cache_write IS NULL AND usage_output_text IS NULL
+            AND usage_output_reasoning IS NULL
+            AND cost_kind IS NULL AND cost_amount IS NULL AND cost_currency IS NULL
+            AND cost_usd_equivalent IS NULL AND cost_source IS NULL AND cost_reason IS NULL
+            AND completed_at IS NULL)
+        OR
+        (state = 'settled' AND outcome IS NOT NULL AND cost_kind IS NOT NULL AND completed_at IS NOT NULL)
+    ),
+    CHECK (
+        cost_amount IS NULL OR (
+            length(cost_amount) > 0
+            AND cost_amount NOT GLOB '*[^0-9.]*'
+            AND cost_amount NOT LIKE '.%'
+            AND cost_amount NOT LIKE '%.'
+            AND cost_amount NOT LIKE '%.%.%'
+            AND (cost_amount = '0' OR cost_amount NOT GLOB '0[0-9]*')
+        )
+    ),
+    CHECK (
+        cost_usd_equivalent IS NULL OR (
+            length(cost_usd_equivalent) > 0
+            AND cost_usd_equivalent NOT GLOB '*[^0-9.]*'
+            AND cost_usd_equivalent NOT LIKE '.%'
+            AND cost_usd_equivalent NOT LIKE '%.'
+            AND cost_usd_equivalent NOT LIKE '%.%.%'
+            AND (cost_usd_equivalent = '0' OR cost_usd_equivalent NOT GLOB '0[0-9]*')
+        )
+    ),
+    CHECK (
+        cost_currency IS NULL OR (
+            length(cost_currency) BETWEEN 3 AND 12
+            AND substr(cost_currency, 1, 1) GLOB '[A-Z]'
+            AND cost_currency NOT GLOB '*[^A-Z0-9]*'
+        )
+    ),
+    CHECK (
+        cost_kind IS NULL
+        OR (cost_kind = 'charged'
+            AND cost_amount IS NOT NULL AND cost_currency IS NOT NULL
+            AND cost_source IS NOT NULL AND length(cost_source) > 0
+            AND cost_reason IS NULL)
+        OR (cost_kind = 'estimated'
+            AND cost_amount IS NOT NULL AND cost_currency IS NOT NULL
+            AND cost_usd_equivalent IS NULL
+            AND cost_source IS NOT NULL AND length(cost_source) > 0
+            AND cost_reason IS NULL)
+        OR (cost_kind = 'unknown'
+            AND cost_amount IS NULL AND cost_currency IS NULL
+            AND cost_usd_equivalent IS NULL AND cost_source IS NULL
+            AND cost_reason IS NOT NULL AND length(cost_reason) > 0)
+    ),
+    UNIQUE (model_call_id, sequence),
+    FOREIGN KEY (model_call_id) REFERENCES model_calls(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS provider_requests_model_call_id
+    ON provider_requests (model_call_id, sequence);
+
+CREATE TRIGGER IF NOT EXISTS provider_requests_identity_immutable
+BEFORE UPDATE OF model_call_id, sequence, provider, model, started_at ON provider_requests
+BEGIN
+    SELECT RAISE(ABORT, 'provider request identity is immutable');
+END;
+
+CREATE TRIGGER IF NOT EXISTS provider_requests_state_forward_only
+BEFORE UPDATE OF state ON provider_requests
+WHEN NOT (NEW.state = OLD.state OR (OLD.state = 'pending' AND NEW.state = 'settled'))
+BEGIN
+    SELECT RAISE(ABORT, 'provider request may only settle once');
+END;
+
+CREATE TRIGGER IF NOT EXISTS provider_requests_settlement_immutable
+BEFORE UPDATE OF outcome, status,
+                 usage_input, usage_output, usage_total,
+                 usage_input_no_cache, usage_input_cache_read, usage_input_cache_write,
+                 usage_output_text, usage_output_reasoning,
+                 cost_kind, cost_amount, cost_currency, cost_usd_equivalent,
+                 cost_source, cost_reason, completed_at
+ON provider_requests
+WHEN OLD.state != 'pending'
+BEGIN
+    SELECT RAISE(ABORT, 'provider request settlement is immutable');
+END;
 
 -- derivations
 -- Content-addressed deep projections. Entries point at a COMPLETE artifact by
@@ -342,6 +523,7 @@ CREATE TABLE IF NOT EXISTS derivations (
     state       TEXT    NOT NULL DEFAULT 'building' CHECK (state IN ('building', 'complete')),
     disposition TEXT    CHECK (disposition IN ('vector', 'lexical', 'excluded', 'nonsemantic', 'failed')),
     reason      TEXT,
+    parse_issues INTEGER CHECK (parse_issues IS NULL OR parse_issues > 0),
     CHECK ((state = 'building' AND disposition IS NULL) OR (state = 'complete' AND disposition IS NOT NULL))
 ) STRICT;
 
@@ -377,7 +559,8 @@ CREATE TABLE IF NOT EXISTS entries (
     -- unchanged entry is skipped, never re-metadatafied every turn.
     deep_hash TEXT,
     -- SPEC {§membership-change-gated-sync} — the per-member sync stat-detect:
-    -- "<mtimeMs>:<size>" of the disk file at its last materialization. The pre-turn
+    -- "<mtimeMs>:<size>" of the disk file at its last materialization, or `absent`
+    -- after an observed deletion. The pre-turn
     -- sync stat()s every member but re-reads/re-tokenizes/rewrites only one whose
     -- signature changed; an unchanged member is a no-op. NULL = never synced.
     synced_sig TEXT,
@@ -409,6 +592,36 @@ CREATE TABLE IF NOT EXISTS entry_channels (
     -- NULL). The per-tokenizer token cache it once keyed was retired — {§tokenomics-agnostic-ruler}.
     content_hash TEXT,
     state    TEXT    NOT NULL DEFAULT 'static' CHECK (state IN ('static', 'active', 'closed', 'errored')),
+    -- Exact terminal producer evidence for this representation channel. NULL is
+    -- the ordinary implicit {status:200}; selection/projection metadata belongs
+    -- to core and is never stored here.
+    producer_result TEXT,
+    CONSTRAINT entry_channel_producer_result_contract CHECK (
+        CASE
+            WHEN producer_result IS NULL THEN 1
+            WHEN NOT json_valid(producer_result) THEN 0
+            ELSE
+                json_type(producer_result) IS 'object'
+                AND json_type(producer_result, '$.status') IS 'integer'
+                AND json_extract(producer_result, '$.status') BETWEEN 200 AND 599
+                AND json_extract(producer_result, '$.status') != 202
+                AND CASE
+                    WHEN json_extract(producer_result, '$.status') < 400 THEN
+                        json_type(producer_result, '$.problem') IS NULL
+                    ELSE
+                        json_type(producer_result, '$.problem') IS 'object'
+                        AND json_type(producer_result, '$.problem.status') IS 'integer'
+                        AND json_extract(producer_result, '$.problem.status')
+                            = json_extract(producer_result, '$.status')
+                        AND json_type(producer_result, '$.problem.type') IS 'text'
+                        AND length(json_extract(producer_result, '$.problem.type')) > 0
+                        AND json_type(producer_result, '$.problem.title') IS 'text'
+                        AND length(json_extract(producer_result, '$.problem.title')) > 0
+                        AND json_type(producer_result, '$.problem.detail') IS 'text'
+                        AND length(json_extract(producer_result, '$.problem.detail')) > 0
+                END
+        END
+    ),
     PRIMARY KEY (entry_id, name),
     FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID;
@@ -422,14 +635,11 @@ BEGIN
     UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
 END;
 
-CREATE TABLE IF NOT EXISTS entry_tags (
-    entry_id INTEGER NOT NULL,
-    tag      TEXT    NOT NULL CHECK (length(tag) > 0),
-    PRIMARY KEY (entry_id, tag),
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
-) STRICT, WITHOUT ROWID;
-
-CREATE INDEX IF NOT EXISTS entry_tags_tag ON entry_tags (tag);
+CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_update
+AFTER UPDATE ON entry_channels
+BEGIN
+    UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
+END;
 
 -- symbol_defs
 -- @graph NODES ({§relation-indexed-dialects}). Code symbol definitions, populated
@@ -521,18 +731,20 @@ CREATE TABLE IF NOT EXISTS log_entries (
     ambient_event_id INTEGER                  REFERENCES ambient_events(id),
     -- Search derivation attached to this durable log result, when available.
     deep_hash       TEXT                       REFERENCES derivations(deep_hash),
+    -- Exact logical provider call represented by a BARE result or model-emission
+    -- mirror. Other operation and ambient rows carry no model-call identity.
+    model_call_id   INTEGER                    REFERENCES model_calls(id),
 
     -- 'error' is an ACTIONLESS row ({§operation-results} — errors are log items): a parse failure that
     -- produced no op still records a log entry (op='error', status_rx≥400, no target) so the model
     -- can fold/kill/recall its own mistakes like any other log row — one budget surface, the log.
-    -- 'model' is an ACTIONLESS row too ({§model-entry}): the model's own verbatim emission, mirrored
-    -- back as a foldable log item so it can finally SEE its prior output (born folded; the turn-0
-    -- exemplar is born open). text/vnd.plurnk-typed; OPEN/FOLD/KILL-able like any row.
+    -- Actionless artifacts carry NULL here: kernel-authored worker initialization
+    -- ({§worker-initialization-entry}) or a model emission ({§model-entry}).
     -- No op enum here: the grammar op set is grammar's contract (PlurnkOp), and this column is written
-    -- only by the PlurnkOp-typed engine (grammar ops) or with the two service markers ('error','model').
+    -- only by the PlurnkOp-typed engine (grammar ops), service row selectors, or NULL for no op.
     -- A SQL enum would be a hand-copy of grammar's op list that silently goes stale on every new verb
     -- (it did — FORK/WORK). Validity lives at the parse + type layer, not duplicated in DDL.
-    op              TEXT    NOT NULL,
+    op              TEXT,
     suffix          TEXT    NOT NULL DEFAULT '',
     signal          TEXT                       CHECK (signal IS NULL OR json_valid(signal)),
 
@@ -564,6 +776,10 @@ CREATE TABLE IF NOT EXISTS log_entries (
 
     expanded         INTEGER NOT NULL DEFAULT 1 CHECK (expanded IN (0, 1)),
 
+    CHECK ((op IS NULL) = COALESCE(json_extract(attrs, '$.kind') IN ('initialization', 'model_emission'), 0)),
+    CHECK (json_extract(attrs, '$.kind') != 'initialization' OR origin = 'plurnk'),
+    CHECK (json_extract(attrs, '$.kind') != 'model_emission' OR origin = 'model'),
+
     FOREIGN KEY (worker_id)  REFERENCES workers(id)  ON DELETE CASCADE,
     FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE,
     FOREIGN KEY (turn_id) REFERENCES turns(id) ON DELETE CASCADE
@@ -573,37 +789,388 @@ CREATE UNIQUE INDEX IF NOT EXISTS log_entries_turn_id_sequence ON log_entries (t
 CREATE        INDEX IF NOT EXISTS log_entries_worker_id           ON log_entries (worker_id);
 CREATE        INDEX IF NOT EXISTS log_entries_loop_id          ON log_entries (loop_id);
 CREATE        INDEX IF NOT EXISTS log_entries_at               ON log_entries (at);
+CREATE UNIQUE INDEX IF NOT EXISTS log_entries_model_call_id
+    ON log_entries (model_call_id)
+    WHERE model_call_id IS NOT NULL;
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
     ON log_entries (worker_id, ambient_event_id)
     WHERE ambient_event_id IS NOT NULL;
 
--- {§log-region-tagging} — named log-region curation. FOLD is the log's write-op (EDIT can't
--- reach engine-written rows): FOLD[tag] stamps a tag on a region; OPEN[tag]/FIND[tag] filter
--- by it. Mirrors entry_tags (apply additive / filter ALL-tags AND); CASCADE with the row on KILL.
+CREATE TRIGGER IF NOT EXISTS log_entries_model_call_valid
+BEFORE INSERT ON log_entries
+WHEN NEW.model_call_id IS NOT NULL
+ AND NOT EXISTS (
+    SELECT 1
+    FROM model_calls call
+    WHERE call.id = NEW.model_call_id
+      AND call.turn_id = NEW.turn_id
+      AND call.state != 'pending'
+      AND (
+          (call.kind = 'bare' AND NEW.op = 'BARE')
+          OR (
+              call.kind = 'emission'
+              AND NEW.op IS NULL
+              AND json_extract(NEW.attrs, '$.kind') = 'model_emission'
+          )
+      )
+ )
+BEGIN
+    SELECT RAISE(ABORT, 'log entry model call does not match its represented result');
+END;
+
+-- {§log-item-tags} — log classification plus OPEN/FOLD selection and mutation.
+-- CASCADE erases the classification with its row.
 CREATE TABLE IF NOT EXISTS log_tags (
     log_entry_id INTEGER NOT NULL,
-    tag          TEXT    NOT NULL CHECK (length(tag) > 0),
+    tag          TEXT    NOT NULL,
     PRIMARY KEY (log_entry_id, tag),
     FOREIGN KEY (log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID;
 
+-- The relational table owns stored tag identity. Producers and curation
+-- signals carry signs, but the stored name never does; delimiters, whitespace,
+-- and control characters cannot become durable classifications through a
+-- private SQL caller either.
+CREATE TRIGGER IF NOT EXISTS log_tags_name_valid
+BEFORE INSERT ON log_tags
+WHEN length(NEW.tag) = 0
+  OR substr(NEW.tag, 1, 1) IN ('+', '-')
+  OR instr(NEW.tag, '[') > 0
+  OR instr(NEW.tag, ']') > 0
+  OR instr(NEW.tag, ',') > 0
+  OR instr(NEW.tag, char(0)) > 0
+  OR EXISTS (
+      WITH RECURSIVE offsets(position) AS (
+          SELECT 1
+          UNION ALL
+          SELECT position + 1 FROM offsets WHERE position < length(NEW.tag)
+      )
+      SELECT 1
+      FROM offsets
+      WHERE unicode(substr(NEW.tag, position, 1)) BETWEEN 0 AND 32
+         OR unicode(substr(NEW.tag, position, 1)) BETWEEN 127 AND 159
+         OR unicode(substr(NEW.tag, position, 1)) IN (160, 5760, 8232, 8233, 8239, 8287, 12288, 65279)
+         OR unicode(substr(NEW.tag, position, 1)) BETWEEN 8192 AND 8202
+  )
+BEGIN
+    SELECT RAISE(ABORT, 'log tag name is invalid');
+END;
+
 CREATE INDEX IF NOT EXISTS log_tags_tag ON log_tags (tag);
 
--- Column-scoped immutability: the original action's identity and target
--- never change; the proposal lifecycle is allowed to mutate state,
--- outcome, status_rx, rx, expanded.
+-- Signal-derived classification is part of the log-row insert, not a later JS
+-- write. This keeps the operation, its ambient occurrence, and its complete
+-- initial folksonomy inside one SQLite commit.
+CREATE TRIGGER IF NOT EXISTS log_entries_classify_signal
+AFTER INSERT ON log_entries
+WHEN NEW.op IN ('FIND', 'READ', 'EDIT', 'COPY', 'MOVE', 'BARE')
+ AND NEW.signal IS NOT NULL
+BEGIN
+    SELECT CASE
+        WHEN json_type(NEW.signal) != 'array'
+          OR EXISTS (
+              SELECT 1 FROM json_each(NEW.signal)
+              WHERE type != 'text'
+                 OR length(value) = 0
+                 OR substr(value, 1, 1) = '-'
+                 OR (
+                    substr(value, 1, 1) = '+'
+                    AND (length(value) < 2 OR substr(value, 2, 1) IN ('+', '-'))
+                 )
+                 OR instr(value, '[') > 0
+                 OR instr(value, ']') > 0
+                 OR instr(value, ',') > 0
+                 OR instr(value, char(0)) > 0
+                 OR EXISTS (
+                     WITH RECURSIVE offsets(position) AS (
+                         SELECT 1
+                         UNION ALL
+                         SELECT position + 1 FROM offsets WHERE position < length(value)
+                     )
+                     SELECT 1
+                     FROM offsets
+                     WHERE unicode(substr(value, position, 1)) BETWEEN 0 AND 32
+                        OR unicode(substr(value, position, 1)) BETWEEN 127 AND 159
+                        OR unicode(substr(value, position, 1)) IN (160, 5760, 8232, 8233, 8239, 8287, 12288, 65279)
+                        OR unicode(substr(value, position, 1)) BETWEEN 8192 AND 8202
+                 )
+          )
+        THEN RAISE(ABORT, 'classifying log operation signal accepts only tag or +tag additions')
+    END;
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT NEW.id, CASE WHEN substr(value, 1, 1) = '+' THEN substr(value, 2) ELSE value END
+    FROM json_each(NEW.signal);
+
+    -- The ambient-event and classification AFTER INSERT triggers may run in
+    -- either order. If the event already exists, finish its initial
+    -- snapshot here; otherwise its own trigger aggregates these rows later.
+    UPDATE ambient_events
+    SET tags = COALESCE((
+        SELECT json_group_array(tag)
+        FROM (SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag)
+    ), '[]')
+    WHERE kind = 'edit'
+      AND producer_worker_id = NEW.worker_id
+      AND source_record_id = NEW.id;
+END;
+
+-- Successful OPEN/FOLD rows are durable curation events even though their
+-- ordinary packet projection is suppressed ({§fold-open-meta-operations}).
+-- Preserve the exact selected set and each target's pre-event visibility so a
+-- broad selector never collapses into the lossy fact `matched: N`.
+CREATE TABLE IF NOT EXISTS log_curation_effects (
+    operation_log_entry_id INTEGER NOT NULL,
+    target_log_entry_id    INTEGER NOT NULL,
+    expanded_before        INTEGER NOT NULL CHECK (expanded_before IN (0, 1)),
+    tags_added             TEXT    NOT NULL DEFAULT '[]'
+                                  CHECK (json_valid(tags_added) AND json_type(tags_added) = 'array'),
+    tags_removed           TEXT    NOT NULL DEFAULT '[]'
+                                  CHECK (json_valid(tags_removed) AND json_type(tags_removed) = 'array'),
+    PRIMARY KEY (operation_log_entry_id, target_log_entry_id),
+    CHECK (operation_log_entry_id != target_log_entry_id),
+    FOREIGN KEY (operation_log_entry_id) REFERENCES log_entries(id) ON DELETE CASCADE,
+    FOREIGN KEY (target_log_entry_id)    REFERENCES log_entries(id) ON DELETE CASCADE
+) STRICT, WITHOUT ROWID;
+
+CREATE INDEX IF NOT EXISTS log_curation_effects_target
+    ON log_curation_effects (target_log_entry_id);
+
+-- Make an invalid curation record structurally unavailable: the event must be
+-- one successful OPEN/FOLD row, both rows must belong to the same worker, and
+-- both exact delta sets must contain only unique canonical tag identities.
+CREATE TRIGGER IF NOT EXISTS log_curation_effects_valid
+BEFORE INSERT ON log_curation_effects
+BEGIN
+    SELECT CASE WHEN
+        NOT EXISTS (
+            SELECT 1
+            FROM log_entries operation
+            JOIN log_entries target ON target.id = NEW.target_log_entry_id
+            WHERE operation.id = NEW.operation_log_entry_id
+              AND operation.op IN ('OPEN', 'FOLD')
+              AND operation.status_rx < 400
+              AND operation.worker_id = target.worker_id
+        )
+        OR EXISTS (
+            SELECT 1
+            FROM (
+                SELECT value, type FROM json_each(NEW.tags_added)
+                UNION ALL
+                SELECT value, type FROM json_each(NEW.tags_removed)
+            ) tag
+            WHERE tag.type != 'text'
+               OR length(tag.value) = 0
+               OR substr(tag.value, 1, 1) IN ('+', '-')
+               OR instr(tag.value, '[') > 0
+               OR instr(tag.value, ']') > 0
+               OR instr(tag.value, ',') > 0
+               OR instr(tag.value, char(0)) > 0
+               OR EXISTS (
+                   WITH RECURSIVE offsets(position) AS (
+                       SELECT 1
+                       UNION ALL
+                       SELECT position + 1 FROM offsets WHERE position < length(tag.value)
+                   )
+                   SELECT 1
+                   FROM offsets
+                   WHERE unicode(substr(tag.value, position, 1)) BETWEEN 0 AND 32
+                      OR unicode(substr(tag.value, position, 1)) BETWEEN 127 AND 159
+                      OR unicode(substr(tag.value, position, 1)) IN (160, 5760, 8232, 8233, 8239, 8287, 12288, 65279)
+                      OR unicode(substr(tag.value, position, 1)) BETWEEN 8192 AND 8202
+               )
+        )
+        OR (SELECT COUNT(*) FROM json_each(NEW.tags_added))
+           != (SELECT COUNT(DISTINCT value) FROM json_each(NEW.tags_added))
+        OR (SELECT COUNT(*) FROM json_each(NEW.tags_removed))
+           != (SELECT COUNT(DISTINCT value) FROM json_each(NEW.tags_removed))
+        OR EXISTS (
+            SELECT 1
+            FROM json_each(NEW.tags_added) addition
+            JOIN json_each(NEW.tags_removed) removal ON removal.value = addition.value
+        )
+    THEN RAISE(ABORT, 'invalid log curation effect') END;
+END;
+
+-- The dispatcher binds an exact, transient curation plan into attrs on the
+-- successful OPEN/FOLD row. No other row may carry that private payload.
+CREATE TRIGGER IF NOT EXISTS log_entries_curation_payload_valid
+BEFORE INSERT ON log_entries
+WHEN json_type(NEW.attrs, '$.__plurnk_curation') IS NOT NULL
+ AND NOT (
+    NEW.op IN ('OPEN', 'FOLD')
+    AND NEW.status_rx < 400
+    AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
+ )
+BEGIN
+    SELECT RAISE(ABORT, 'private log curation payload requires a successful OPEN/FOLD row');
+END;
+
+-- One outer INSERT owns the whole landed curation event: exact selected rows,
+-- their pre-event visibility and tag deltas, the requested visibility, and the
+-- resulting classifications. Trigger failure rolls the operation row and all
+-- effects back together. The private plan is erased before INSERT returns.
+CREATE TRIGGER IF NOT EXISTS log_entries_apply_curation
+AFTER INSERT ON log_entries
+WHEN NEW.op IN ('OPEN', 'FOLD')
+ AND NEW.status_rx < 400
+ AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
+BEGIN
+    SELECT CASE WHEN
+        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.ids'), '') != 'array'
+        OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.add'), '') != 'array'
+        OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.remove'), '') != 'array'
+        OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.expanded'), '') != 'integer'
+        OR json_extract(NEW.attrs, '$.__plurnk_curation.expanded') NOT IN (0, 1)
+        OR json_array_length(NEW.attrs, '$.__plurnk_curation.ids') = 0
+        OR EXISTS (
+            SELECT 1 FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+            WHERE type != 'integer' OR value <= 0
+        )
+        OR (
+            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        ) != (
+            SELECT COUNT(DISTINCT value) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        )
+        OR EXISTS (
+            SELECT 1
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
+            LEFT JOIN log_entries target ON target.id = selected.value
+            WHERE target.id IS NULL OR target.worker_id != NEW.worker_id OR target.id = NEW.id
+        )
+        OR EXISTS (
+            SELECT 1
+            FROM (
+                SELECT value, type FROM json_each(NEW.attrs, '$.__plurnk_curation.add')
+                UNION ALL
+                SELECT value, type FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
+            ) tag
+            WHERE tag.type != 'text'
+               OR length(tag.value) = 0
+               OR substr(tag.value, 1, 1) IN ('+', '-')
+               OR instr(tag.value, '[') > 0
+               OR instr(tag.value, ']') > 0
+               OR instr(tag.value, ',') > 0
+               OR instr(tag.value, char(0)) > 0
+               OR EXISTS (
+                   WITH RECURSIVE offsets(position) AS (
+                       SELECT 1
+                       UNION ALL
+                       SELECT position + 1 FROM offsets WHERE position < length(tag.value)
+                   )
+                   SELECT 1
+                   FROM offsets
+                   WHERE unicode(substr(tag.value, position, 1)) BETWEEN 0 AND 32
+                      OR unicode(substr(tag.value, position, 1)) BETWEEN 127 AND 159
+                      OR unicode(substr(tag.value, position, 1)) IN (160, 5760, 8232, 8233, 8239, 8287, 12288, 65279)
+                      OR unicode(substr(tag.value, position, 1)) BETWEEN 8192 AND 8202
+               )
+        )
+        OR (
+            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.add')
+        ) != (
+            SELECT COUNT(DISTINCT value) FROM json_each(NEW.attrs, '$.__plurnk_curation.add')
+        )
+        OR (
+            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
+        ) != (
+            SELECT COUNT(DISTINCT value) FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
+        )
+        OR EXISTS (
+            SELECT 1
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.add') addition
+            JOIN json_each(NEW.attrs, '$.__plurnk_curation.remove') removal
+              ON removal.value = addition.value
+        )
+    THEN RAISE(ABORT, 'invalid private log curation payload') END;
+
+    INSERT INTO log_curation_effects (
+        operation_log_entry_id,
+        target_log_entry_id,
+        expanded_before,
+        tags_added,
+        tags_removed
+    )
+    SELECT
+        NEW.id,
+        target.id,
+        target.expanded,
+        COALESCE((
+            SELECT json_group_array(ordered.tag)
+            FROM (
+                SELECT addition.value AS tag
+                FROM json_each(NEW.attrs, '$.__plurnk_curation.add') addition
+                WHERE NOT EXISTS (
+                    SELECT 1 FROM log_tags
+                    WHERE log_entry_id = target.id AND tag = addition.value
+                )
+                ORDER BY addition.value
+            ) ordered
+        ), '[]'),
+        COALESCE((
+            SELECT json_group_array(ordered.tag)
+            FROM (
+                SELECT removal.value AS tag
+                FROM json_each(NEW.attrs, '$.__plurnk_curation.remove') removal
+                WHERE EXISTS (
+                    SELECT 1 FROM log_tags
+                    WHERE log_entry_id = target.id AND tag = removal.value
+                )
+                ORDER BY removal.value
+            ) ordered
+        ), '[]')
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
+    JOIN log_entries target ON target.id = selected.value;
+
+    UPDATE log_entries
+    SET expanded = json_extract(NEW.attrs, '$.__plurnk_curation.expanded')
+    WHERE id IN (
+        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+    );
+
+    DELETE FROM log_tags
+    WHERE log_entry_id IN (
+        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+    )
+      AND tag IN (
+        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
+    );
+
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT selected.value, addition.value
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
+    CROSS JOIN json_each(NEW.attrs, '$.__plurnk_curation.add') addition;
+
+    UPDATE log_entries
+    SET attrs = json_remove(attrs, '$.__plurnk_curation')
+    WHERE id = NEW.id;
+END;
+
+-- Column-scoped immutability: the original action's identity and target never
+-- change; the proposal lifecycle is allowed to mutate state, outcome,
+-- status_rx, rx, expanded. Keep attrs separate so the curation trigger's one
+-- private-payload removal cannot exempt changes to any other core column.
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
 BEFORE UPDATE OF
-    worker_id, loop_id, turn_id, sequence, at, origin, source,
+    worker_id, loop_id, turn_id, sequence, at, origin, source, model_call_id,
     op, suffix, signal,
     scheme, username, password, hostname,
     port, pathname, query, fragment,
-    lineMarker, tx, mimetype_tx, mimetype_rx, attrs
+    lineMarker, tx, mimetype_tx, mimetype_rx
 ON log_entries
 BEGIN
     SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/expanded may change');
 END;
 
+CREATE TRIGGER IF NOT EXISTS log_entries_immutable_attrs
+BEFORE UPDATE OF attrs ON log_entries
+WHEN COALESCE((
+    json_type(OLD.attrs, '$.__plurnk_curation') = 'object'
+    AND NEW.attrs = json_remove(OLD.attrs, '$.__plurnk_curation')
+), 0) = 0
+BEGIN
+    SELECT RAISE(ABORT, 'log_entries attrs are immutable outside curation payload removal');
+END;
+
 -- The engine may stamp an originating row exactly once. No later reassignment
 -- can sever or counterfeit the occurrence identity.
 CREATE TRIGGER IF NOT EXISTS log_entries_ambient_event_once
@@ -631,10 +1198,17 @@ WHEN NEW.ambient_event_id IS NULL
 BEGIN
     INSERT INTO ambient_events (
         workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, status_rx
+        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
     )
     SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs, NEW.status_rx
+           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
+           COALESCE((
+               SELECT json_group_array(ordered.tag)
+               FROM (
+                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
+               ) ordered
+           ), '[]'),
+           NEW.status_rx
     FROM workers w
     WHERE w.id = NEW.worker_id;
     UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
@@ -658,87 +1232,22 @@ WHEN OLD.state = 'proposed'
 BEGIN
     INSERT INTO ambient_events (
         workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, status_rx
+        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
     )
     SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs, NEW.status_rx
+           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
+           COALESCE((
+               SELECT json_group_array(ordered.tag)
+               FROM (
+                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
+               ) ordered
+           ), '[]'),
+           NEW.status_rx
     FROM workers w
     WHERE w.id = NEW.worker_id;
     UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
 END;
 
--- cost_rollups
--- Triggers maintaining denormalized USD totals on workers and workspaces
--- as turns insert/update. Pure denormalization (textbook trigger use);
--- no branching state-machine logic lives here.
-CREATE TRIGGER IF NOT EXISTS turns_cost_rollup_insert_worker
-AFTER INSERT ON turns
-BEGIN
-    UPDATE workers
-       SET cost_usd = (
-           SELECT CASE WHEN COUNT(*) FILTER (WHERE t.usage_cost_usd IS NULL) > 0
-                       THEN NULL ELSE COALESCE(SUM(t.usage_cost_usd), 0) END
-             FROM turns t JOIN loops l ON l.id = t.loop_id
-            WHERE l.worker_id = workers.id
-       )
-     WHERE id = (SELECT worker_id FROM loops WHERE id = NEW.loop_id);
-END;
-
-CREATE TRIGGER IF NOT EXISTS turns_cost_rollup_insert_workspace
-AFTER INSERT ON turns
-BEGIN
-    UPDATE workspaces
-       SET cost_usd = (
-           SELECT CASE WHEN COUNT(*) FILTER (WHERE t.usage_cost_usd IS NULL) > 0
-                       THEN NULL ELSE COALESCE(SUM(t.usage_cost_usd), 0) END
-             FROM turns t
-             JOIN loops l ON l.id = t.loop_id
-             JOIN workers r ON r.id = l.worker_id
-            WHERE r.workspace_id = workspaces.id
-       )
-     WHERE id = (
-         SELECT r.workspace_id
-           FROM workers r
-           JOIN loops l ON l.worker_id = r.id
-          WHERE l.id = NEW.loop_id
-     );
-END;
-
-CREATE TRIGGER IF NOT EXISTS turns_cost_rollup_update_worker
-AFTER UPDATE OF usage_cost_usd ON turns
-WHEN NEW.usage_cost_usd IS NOT OLD.usage_cost_usd
-BEGIN
-    UPDATE workers
-       SET cost_usd = (
-           SELECT CASE WHEN COUNT(*) FILTER (WHERE t.usage_cost_usd IS NULL) > 0
-                       THEN NULL ELSE COALESCE(SUM(t.usage_cost_usd), 0) END
-             FROM turns t JOIN loops l ON l.id = t.loop_id
-            WHERE l.worker_id = workers.id
-       )
-     WHERE id = (SELECT worker_id FROM loops WHERE id = NEW.loop_id);
-END;
-
-CREATE TRIGGER IF NOT EXISTS turns_cost_rollup_update_workspace
-AFTER UPDATE OF usage_cost_usd ON turns
-WHEN NEW.usage_cost_usd IS NOT OLD.usage_cost_usd
-BEGIN
-    UPDATE workspaces
-       SET cost_usd = (
-           SELECT CASE WHEN COUNT(*) FILTER (WHERE t.usage_cost_usd IS NULL) > 0
-                       THEN NULL ELSE COALESCE(SUM(t.usage_cost_usd), 0) END
-             FROM turns t
-             JOIN loops l ON l.id = t.loop_id
-             JOIN workers r ON r.id = l.worker_id
-            WHERE r.workspace_id = workspaces.id
-       )
-     WHERE id = (
-         SELECT r.workspace_id
-           FROM workers r
-           JOIN loops l ON l.worker_id = r.id
-          WHERE l.id = NEW.loop_id
-     );
-END;
-
 -- subscriptions
 -- Durable subscription lifecycle per SPEC {§subscriptions}. The row records what
 -- the worker holds and routes cancellation to a separate process-local callable;