@plurnk/plurnk-service 1.6.1 → 1.8.0

package/migrations/001_schema.sql

@@ -19,6 +19,32 @@ CREATE TABLE IF NOT EXISTS workspaces (
 
 CREATE INDEX IF NOT EXISTS workspaces_created_at ON workspaces (created_at);
 
+-- {§module-workspace-state}: one opaque, provider-validated JSON snapshot per
+-- module owner and workspace. Core owns isolation and lifecycle only.
+CREATE TABLE IF NOT EXISTS workspace_module_state (
+    workspace_id       INTEGER NOT NULL,
+    namespace_owner    TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
+    state              TEXT    NOT NULL CHECK (json_valid(state)),
+    updated_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    PRIMARY KEY (workspace_id, namespace_owner),
+    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+) STRICT;
+
+-- model_routes — the immutable resolved model route ({§worker-model-selection}). One row per
+-- complete resolved tuple; append-only. Alias is provenance plus a tuning scope,
+-- not route identity, and is absent on a direct provider/model selection.
+CREATE TABLE IF NOT EXISTS model_routes (
+    id         INTEGER NOT NULL PRIMARY KEY,
+    alias      TEXT             CHECK (alias IS NULL OR length(alias) > 0),
+    provider   TEXT    NOT NULL CHECK (length(provider) > 0),
+    model      TEXT    NOT NULL CHECK (length(model) > 0),
+    base_url   TEXT             CHECK (base_url IS NULL OR length(base_url) > 0),
+    created_at TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+) STRICT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS model_routes_identity
+ON model_routes (coalesce(alias, ''), provider, model, coalesce(base_url, ''));
+
 -- workers
 CREATE TABLE IF NOT EXISTS workers (
     id              INTEGER NOT NULL PRIMARY KEY,
@@ -30,16 +56,31 @@ CREATE TABLE IF NOT EXISTS workers (
     -- independent databases reuse local integer ids.
     provider_identity TEXT NOT NULL DEFAULT (lower(hex(randomblob(16))))
         CHECK (length(provider_identity) = 32 AND provider_identity NOT GLOB '*[^0-9a-f]*'),
+    -- {§worker-model-selection}: the worker's durable resolved model, NULL for non-model
+    -- workers or a deliberately modelless unresolved worker. spawn_model_route_id is the
+    -- persistent spawn override; NULL means "use my model."
+    model_route_id       INTEGER          REFERENCES model_routes(id),
+    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
+    -- {§worker-reasoning-policy}: nullable only while the worker has no model;
+    -- once selected, model and reasoning policy form one durable generation policy.
+    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR reasoning_policy IN ('off', 'adaptive', 'low', 'medium', 'high')),
     -- workers fork via parent_worker_id; workspaces carry no parent — {§machine-processes-no-fork-workspace}
     parent_worker_id INTEGER          CHECK (parent_worker_id IS NULL OR parent_worker_id != id),
-    origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', 'plurnk')),
+    origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', '_plurnk')),
     -- {§methods-model-worker}: durable identity for the workspace's stable
     -- default conversation; unrelated to its human-facing, reclaimable name.
     default_conversation INTEGER NOT NULL DEFAULT 0 CHECK (default_conversation IN (0, 1)),
+    -- {§worker-settings}: the worker's own behavioral rules inside the workspace's
+    -- world — the workspace is how things are; each worker carries the rules its
+    -- loops obey. Client-declared at worker creation, mutable between loops,
+    -- validated at the client-input boundary (closed known-key set; unknown keys
+    -- never persist).
+    settings TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(settings)),
     -- {§env-delta-log-pull}: monotonic observation progress, not a private world snapshot.
     -- NULL means the worker has not established its first-turn baseline yet.
     ambient_event_cursor INTEGER      CHECK (ambient_event_cursor IS NULL OR ambient_event_cursor >= 0),
     CHECK (default_conversation = 0 OR (origin = 'model' AND parent_worker_id IS NULL)),
+    CHECK ((model_route_id IS NULL) = (reasoning_policy IS NULL)),
     FOREIGN KEY (workspace_id)    REFERENCES workspaces(id) ON DELETE CASCADE,
     FOREIGN KEY (parent_worker_id) REFERENCES workers(id)     ON DELETE CASCADE
 ) STRICT;
@@ -118,8 +159,11 @@ CREATE TABLE IF NOT EXISTS loops (
     status   INTEGER NOT NULL DEFAULT 102 CHECK (status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)),
     prompt   TEXT    NOT NULL,
     flags    TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(flags)),
-    provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(provider_spec)),
-    child_provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(child_provider_spec)),
+    -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
+    -- effective spawn route (was provider_spec/child_provider_spec JSON).
+    model_route_id       INTEGER          REFERENCES model_routes(id),
+    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
+    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR reasoning_policy IN ('off', 'adaptive', 'low', 'medium', 'high')),
     max_turns INTEGER NOT NULL DEFAULT 50 CHECK (max_turns >= -1),
     -- {§methods-loop-run-open-paths}: the initial prompt frame's selected paths,
     -- held here until turn 1 materializes that frame (string[] JSON).
@@ -134,6 +178,9 @@ CREATE TABLE IF NOT EXISTS loops (
     -- {§loop-terminal-authorship}: 'cancel' names an external loop.cancel;
     -- NULL covers model terminals and engine verdicts whose result carries the story.
     terminated_by    TEXT                      CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
+    CONSTRAINT loops_generation_policy_contract CHECK (
+        (model_route_id IS NULL) = (reasoning_policy IS NULL)
+    ),
     CONSTRAINT loops_terminal_result_contract CHECK (
         CASE
             WHEN status IN (100, 102, 202) THEN terminal_result IS NULL
@@ -180,7 +227,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS loops_worker_id_sequence ON loops (worker_id,
 CREATE UNIQUE INDEX IF NOT EXISTS loops_orphan_source_loop_id ON loops (orphan_source_loop_id);
 -- {§worker-scheme}: a loop crossing into a terminal status stamps terminated_at, so sibling
 -- workers pull the termination as a folded ambient delta — caught uniformly across every
--- death-path (SEND, grinder, max-turns, strike, KILL). The stamp updates terminated_at,
+-- death-path (SEND, overflow recovery, max-turns, strike, KILL). The stamp updates terminated_at,
 -- never status, so it cannot re-fire this trigger. Terminals: 200 done · 413 budget ·
 -- 429 turn-ceiling · 499 cancel · 500 fail · 504 wall-clock timeout · 508 runaway. (202 = parked/sleeping, NOT terminal.)
 CREATE TRIGGER IF NOT EXISTS loops_stamp_terminated_at
@@ -218,7 +265,15 @@ CREATE TABLE IF NOT EXISTS turns (
     loop_id          INTEGER NOT NULL,
     sequence         INTEGER NOT NULL           CHECK (sequence >= 1),
     timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    -- {§turn-record}: producer and purpose define the turn. Packet/provider
+    -- evidence below is an optional inference specialization.
+    producer         TEXT    NOT NULL           CHECK (producer IN ('model', 'client', '_plurnk', 'plugin')),
+    kind             TEXT    NOT NULL           CHECK (kind IN ('inference', 'initialization', 'overflow', 'operation')),
     status           INTEGER NOT NULL           CHECK (status BETWEEN 100 AND 599),
+    -- NULL while the producer still owns this turn. Status 102 is both the
+    -- provisional running value and the exact completed continue disposition;
+    -- completed_at distinguishes those states without inventing another status.
+    completed_at     TEXT DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     -- Provider-derived curation calibration for this turn; NULL when input
     -- capacity is unknown. {§tokenomics-client-gauge}
     usage_curation_budget INTEGER                CHECK (usage_curation_budget IS NULL OR usage_curation_budget >= 1),
@@ -253,16 +308,59 @@ CREATE TABLE IF NOT EXISTS turns (
         END
     ),
     finish_reason    TEXT,
-    model            TEXT    NOT NULL DEFAULT 'unknown' CHECK (length(model) >= 1),
-    -- Opaque provider→client metadata plus engine rail keys; JSON-valid but
-    -- otherwise unenforced. {§meta-passthrough}, {§rail-truth-engine-verdict}
-    meta             TEXT    NOT NULL DEFAULT '{}'     CHECK (json_valid(meta)),
+    model            TEXT                       CHECK (model IS NULL OR length(model) >= 1),
+    -- Opaque provider→client metadata plus engine rail keys; absent outside
+    -- recorded inference evidence. {§meta-passthrough}, {§rail-truth-engine-verdict}
+    meta             TEXT                       CHECK (meta IS NULL OR json_valid(meta)),
+    CHECK (completed_at IS NOT NULL OR status = 102),
+    CHECK ((producer = 'model') = (kind = 'inference')),
+    CHECK (kind NOT IN ('initialization', 'overflow') OR producer = '_plurnk'),
+    CHECK (
+        kind = 'inference'
+        OR (
+            usage_curation_budget IS NULL
+            AND packet IS NULL
+            AND finish_reason IS NULL
+            AND model IS NULL
+            AND meta IS NULL
+        )
+    ),
     FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE
 ) STRICT;
 
 CREATE UNIQUE INDEX IF NOT EXISTS turns_loop_id_sequence ON turns (loop_id, sequence);
 CREATE        INDEX IF NOT EXISTS turns_timestamp        ON turns (timestamp);
 
+-- Producer and purpose are immutable except for the single pre-inference
+-- diversion into overflow recovery. The transition is allowed only before any
+-- model or non-kernel evidence exists.
+CREATE TRIGGER IF NOT EXISTS turns_identity_forward_only
+BEFORE UPDATE OF producer, kind ON turns
+WHEN NOT (
+    OLD.producer = NEW.producer
+    AND OLD.kind = NEW.kind
+)
+AND NOT (
+    OLD.producer = 'model'
+    AND OLD.kind = 'inference'
+    AND NEW.producer = '_plurnk'
+    AND NEW.kind = 'overflow'
+    AND OLD.completed_at IS NULL
+    AND OLD.packet IS NULL
+    AND OLD.usage_curation_budget IS NULL
+    AND OLD.finish_reason IS NULL
+    AND OLD.model IS NULL
+    AND OLD.meta IS NULL
+    AND NOT EXISTS (SELECT 1 FROM model_calls WHERE turn_id = OLD.id)
+    AND NOT EXISTS (
+        SELECT 1 FROM log_entries
+        WHERE turn_id = OLD.id AND origin != '_plurnk'
+    )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'turn producer and kind are immutable outside pre-inference overflow diversion');
+END;
+
 -- One logical provider.generate call. Emission attempts and BARE inferences
 -- share response/failure evidence and cardinal physical request accounting;
 -- operation-specific semantics live in their specializing relations.
@@ -310,6 +408,17 @@ CREATE TABLE IF NOT EXISTS model_calls (
 
 CREATE INDEX IF NOT EXISTS model_calls_turn_id ON model_calls (turn_id, sequence);
 
+CREATE TRIGGER IF NOT EXISTS model_calls_inference_turn_only
+BEFORE INSERT ON model_calls
+WHEN COALESCE((
+    SELECT producer = 'model' AND kind = 'inference'
+    FROM turns
+    WHERE id = NEW.turn_id
+), 0) != 1
+BEGIN
+    SELECT RAISE(ABORT, 'model call requires a model inference turn');
+END;
+
 CREATE TRIGGER IF NOT EXISTS model_calls_request_identity_immutable
 BEFORE UPDATE OF turn_id, sequence, kind, attributions, timestamp ON model_calls
 BEGIN
@@ -521,9 +630,9 @@ BEGIN
 END;
 
 -- derivations
--- Content-addressed deep projections. Entries point at a COMPLETE artifact by
--- deep_hash; graph, FTS, and vectors are stored once regardless of how many
--- workspace/worktree paths carry identical content under the same reader/config.
+-- Content-addressed deep projections. Entry channels and log projections point
+-- at a COMPLETE artifact by deep_hash; graph, FTS, and vectors are stored once
+-- regardless of how many addresses carry identical content under the same reader/config.
 -- A building row is unattached and safely replaceable after interruption.
 CREATE TABLE IF NOT EXISTS derivations (
     id          INTEGER NOT NULL PRIMARY KEY,
@@ -532,6 +641,14 @@ CREATE TABLE IF NOT EXISTS derivations (
     disposition TEXT    CHECK (disposition IN ('vector', 'lexical', 'excluded', 'nonsemantic', 'failed')),
     reason      TEXT,
     parse_issues INTEGER CHECK (parse_issues IS NULL OR parse_issues > 0),
+    summary     TEXT    CHECK (
+        summary IS NULL OR (
+            length(summary) > 0
+            AND summary = trim(summary)
+            AND instr(summary, char(10)) = 0
+            AND instr(summary, char(13)) = 0
+        )
+    ),
     CHECK ((state = 'building' AND disposition IS NULL) OR (state = 'complete' AND disposition IS NOT NULL))
 ) STRICT;
 
@@ -561,11 +678,6 @@ CREATE TABLE IF NOT EXISTS entries (
     -- == members; 'client'/'constraint' (model-created, add-glob) are not git's to reclaim.
     -- NULL = not a file member (other schemes don't carry origin).
     membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'client', 'constraint')),
-    -- {§membership-change-gated-sync}: hash of the body content at the last
-    -- deep-channel derivation. The manifest-add pass re-derives symbols/refs (and
-    -- embeddings, later) ONLY when this differs from the current body hash — an
-    -- unchanged entry is skipped, never re-metadatafied every turn.
-    deep_hash TEXT,
     -- SPEC {§membership-change-gated-sync} — the per-member sync stat-detect:
     -- "<mtimeMs>:<size>" of the disk file at its last materialization, or `absent`
     -- after an observed deletion. The pre-turn
@@ -573,13 +685,13 @@ CREATE TABLE IF NOT EXISTS entries (
     -- signature changed; an unchanged member is a no-op. NULL = never synced.
     synced_sig TEXT,
     -- User Note 5 — manifest cache-friendliness. Last-modified stamp, bumped on every
-    -- channel write by entries_touch_on_channel_write; engine_list_workspace_entries orders
-    -- the catalog by it ASC so dormant entries hold the stable prompt-cache prefix.
+    -- addressable representation change; engine_list_workspace_entries orders the catalog
+    -- by it ASC so dormant entries hold the stable prompt-cache prefix. Private derivation
+    -- attachment does not make an entry recently touched.
     updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     CHECK (workspace_id IS NOT NULL),
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE,
-    FOREIGN KEY (deep_hash)    REFERENCES derivations(deep_hash)
+    FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE
 ) STRICT;
 
 -- {§entry-owner} / {§stream-owner-scoped} — owner is the sole visibility and identity axis.
@@ -599,6 +711,9 @@ CREATE TABLE IF NOT EXISTS entry_channels (
     -- Content identity: sha256 of content, stamped at static writes; streamed
     -- appends leave it NULL. Curation weight remains model-independent.
     content_hash TEXT,
+    -- Search derivation for this exact addressable channel representation.
+    -- Content or mimetype changes invalidate it at the owning channel row.
+    deep_hash TEXT,
     state    TEXT    NOT NULL DEFAULT 'static' CHECK (state IN ('static', 'active', 'closed', 'errored')),
     -- Exact terminal producer evidence for this representation channel. NULL is
     -- the ordinary implicit {status:200}; selection/projection metadata belongs
@@ -631,12 +746,26 @@ CREATE TABLE IF NOT EXISTS entry_channels (
         END
     ),
     PRIMARY KEY (entry_id, name),
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
+    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
+    FOREIGN KEY (deep_hash) REFERENCES derivations(deep_hash)
 ) STRICT, WITHOUT ROWID;
 
--- User Note 5 — bump the entry's updated_at on any channel write so the catalog
--- (ordered by updated_at ASC) keeps recently-touched entries at the tail and holds
--- the prompt-cache prefix stable across turns.
+-- A changed channel representation cannot retain search evidence derived from
+-- its predecessor. This trigger is the one invalidation owner for every write
+-- path, including model EDIT, plugin channel capabilities, and streams.
+CREATE TRIGGER IF NOT EXISTS entry_channels_invalidate_derivation
+AFTER UPDATE OF content, mimetype ON entry_channels
+WHEN OLD.content IS NOT NEW.content OR OLD.mimetype IS NOT NEW.mimetype
+BEGIN
+    UPDATE entry_channels
+    SET deep_hash = NULL
+    WHERE entry_id = NEW.entry_id AND name = NEW.name AND deep_hash IS NOT NULL;
+END;
+
+-- User Note 5 — bump the entry's updated_at on addressable representation or
+-- lifecycle writes so the catalog (ordered by updated_at ASC) keeps recently-
+-- touched entries at the tail and holds the prompt-cache prefix stable across
+-- turns. Content hashes and search attachments are private metadata, not touches.
 CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_write
 AFTER INSERT ON entry_channels
 BEGIN
@@ -644,7 +773,7 @@ BEGIN
 END;
 
 CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_update
-AFTER UPDATE ON entry_channels
+AFTER UPDATE OF content, mimetype, weight, state, producer_result ON entry_channels
 BEGIN
     UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
 END;
@@ -720,7 +849,8 @@ CREATE TABLE IF NOT EXISTS derivation_embeddings (
 -- status⊥state: status is the HTTP outcome, state is where in the
 -- lifecycle the entry sits. Most rows write 'resolved' directly;
 -- proposing schemes transition 'proposed' → resolved/failed/cancelled.
--- expanded: per-row visibility for OPEN/FOLD via the log:/// scheme.
+-- folded: canonical hidden log-body line intervals for OPEN/FOLD. [] is
+-- wholly open and [[1,-1]] is wholly folded.
 CREATE TABLE IF NOT EXISTS log_entries (
     id              INTEGER NOT NULL PRIMARY KEY,
     version         INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -730,7 +860,7 @@ CREATE TABLE IF NOT EXISTS log_entries (
     turn_id         INTEGER NOT NULL,
     sequence        INTEGER NOT NULL           CHECK (sequence >= 1),
     at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', 'plurnk', 'plugin')),
+    origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', '_plurnk', 'plugin')),
     -- {§env-delta-attribution}: a worker:// name or stable subsystem token ('file');
     -- NULL = the owning worker itself, rendered without causal attribution.
     source          TEXT,
@@ -739,21 +869,22 @@ CREATE TABLE IF NOT EXISTS log_entries (
     ambient_event_id INTEGER                  REFERENCES ambient_events(id),
     -- Search derivation attached to this durable log result, when available.
     deep_hash       TEXT                       REFERENCES derivations(deep_hash),
-    -- Exact logical provider call represented by a BARE result or model-emission
-    -- mirror. Other operation and ambient rows carry no model-call identity.
+    -- Exact logical provider call represented by a BARE result, admitted
+    -- model turnOps, or rejected emissionAttempt. Other operation and ambient
+    -- rows carry no model-call identity.
     model_call_id   INTEGER                    REFERENCES model_calls(id),
 
     -- 'error' is an ACTIONLESS row ({§operation-results} — errors are log items): a parse failure that
     -- produced no op still records a log entry (op='error', status_rx≥400, no target) so the model
     -- can fold/kill/recall its own mistakes like any other log row — one budget surface, the log.
-    -- Actionless artifacts carry NULL here: kernel-authored worker initialization
-    -- ({§worker-initialization-entry}) or a model emission ({§model-entry}).
+    -- Exact producer source and rejected-attempt artifacts carry NULL here
+    -- ({§turn-ops-entry}, {§rejected-emission-entry}).
     -- No op enum here: the grammar op set is grammar's contract (PlurnkOp), and this column is written
     -- only by the PlurnkOp-typed engine (grammar ops), service row selectors, or NULL for no op.
     -- A SQL enum would be a hand-copy of grammar's op list that silently goes stale on every new verb
     -- (it did — FORK/WORK). Validity lives at the parse + type layer, not duplicated in DDL.
     op              TEXT,
-    suffix          TEXT    NOT NULL DEFAULT '',
+    delimiter          TEXT    NOT NULL DEFAULT '',
     signal          TEXT                       CHECK (signal IS NULL OR json_valid(signal)),
 
     scheme          TEXT                       CHECK (scheme IS NULL OR length(scheme) > 0),
@@ -784,11 +915,16 @@ CREATE TABLE IF NOT EXISTS log_entries (
     outcome         TEXT,
     attrs           TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
 
-    expanded         INTEGER NOT NULL DEFAULT 1 CHECK (expanded IN (0, 1)),
+    folded           TEXT    NOT NULL DEFAULT '[]'
+                    CHECK (json_valid(folded) AND json_type(folded) = 'array'),
 
-    CHECK ((op IS NULL) = COALESCE(json_extract(attrs, '$.kind') IN ('initialization', 'model_emission'), 0)),
-    CHECK (json_extract(attrs, '$.kind') != 'initialization' OR origin = 'plurnk'),
-    CHECK (json_extract(attrs, '$.kind') != 'model_emission' OR origin = 'model'),
+    CHECK (
+        (op IS NULL) = COALESCE(
+            json_extract(attrs, '$.kind') IN ('turnOps', 'emissionAttempt'),
+            0
+        )
+    ),
+    CHECK (json_extract(attrs, '$.kind') != 'emissionAttempt' OR origin = 'model'),
 
     FOREIGN KEY (worker_id)  REFERENCES workers(id)  ON DELETE CASCADE,
     FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE,
@@ -806,6 +942,108 @@ CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
     ON log_entries (worker_id, ambient_event_id)
     WHERE ambient_event_id IS NOT NULL;
 
+-- A log row belongs to one exact worker/loop/turn chain. Its writer is either
+-- that turn's producer or `_plurnk` observing the turn. Primitive absence,
+-- enum, and foreign-key failures remain owned by their column constraints.
+CREATE TRIGGER IF NOT EXISTS log_entries_turn_ownership
+BEFORE INSERT ON log_entries
+WHEN NEW.worker_id IS NOT NULL
+ AND NEW.loop_id IS NOT NULL
+ AND NEW.turn_id IS NOT NULL
+ AND NEW.origin IN ('model', 'client', '_plurnk', 'plugin')
+ AND EXISTS (SELECT 1 FROM workers WHERE id = NEW.worker_id)
+ AND EXISTS (SELECT 1 FROM loops WHERE id = NEW.loop_id)
+ AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
+ AND NOT EXISTS (
+    SELECT 1
+    FROM turns
+    JOIN loops ON loops.id = turns.loop_id
+    WHERE turns.id = NEW.turn_id
+      AND loops.id = NEW.loop_id
+      AND loops.worker_id = NEW.worker_id
+      AND (NEW.origin = turns.producer OR NEW.origin = '_plurnk')
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry must match its turn ownership and producer');
+END;
+
+-- {§turn-ops-entry} — exact admitted source is authored by the turn producer.
+-- `_plurnk` may observe another producer's turn through ordinary operation
+-- rows, but it cannot impersonate that producer's source program.
+CREATE TRIGGER IF NOT EXISTS log_entries_turn_ops_producer
+BEFORE INSERT ON log_entries
+WHEN NEW.op IS NULL
+ AND json_extract(NEW.attrs, '$.kind') = 'turnOps'
+ AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
+ AND NOT EXISTS (
+    SELECT 1
+    FROM turns
+    WHERE turns.id = NEW.turn_id
+      AND turns.producer = NEW.origin
+ )
+BEGIN
+    SELECT RAISE(ABORT, 'actionless log entry does not match its turn producer');
+END;
+
+-- A folded interval is an inclusive [start,end] pair. Ranges are positive,
+-- sorted, disjoint, and non-adjacent; -1 is the final open-ended endpoint.
+-- Canonical intervals make visibility equality and curation effects exact.
+CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_insert
+BEFORE INSERT ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM json_each(NEW.folded) range
+    WHERE range.type != 'array'
+       OR json_array_length(range.value) != 2
+       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+       OR json_extract(range.value, '$[0]') < 1
+       OR (
+           json_extract(range.value, '$[1]') != -1
+           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+       )
+       OR EXISTS (
+           SELECT 1
+           FROM json_each(NEW.folded) previous
+           WHERE previous.key = range.key - 1
+             AND (
+                 json_extract(previous.value, '$[1]') = -1
+                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+             )
+       )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+END;
+
+CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_update
+BEFORE UPDATE OF folded ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM json_each(NEW.folded) range
+    WHERE range.type != 'array'
+       OR json_array_length(range.value) != 2
+       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+       OR json_extract(range.value, '$[0]') < 1
+       OR (
+           json_extract(range.value, '$[1]') != -1
+           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+       )
+       OR EXISTS (
+           SELECT 1
+           FROM json_each(NEW.folded) previous
+           WHERE previous.key = range.key - 1
+             AND (
+                 json_extract(previous.value, '$[1]') = -1
+                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+             )
+       )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+END;
+
 CREATE TRIGGER IF NOT EXISTS log_entries_model_call_valid
 BEFORE INSERT ON log_entries
 WHEN NEW.model_call_id IS NOT NULL
@@ -820,7 +1058,7 @@ WHEN NEW.model_call_id IS NOT NULL
           OR (
               call.kind = 'emission'
               AND NEW.op IS NULL
-              AND json_extract(NEW.attrs, '$.kind') = 'model_emission'
+              AND json_extract(NEW.attrs, '$.kind') IN ('turnOps', 'emissionAttempt')
           )
       )
  )
@@ -924,14 +1162,61 @@ BEGIN
       AND source_record_id = NEW.id;
 END;
 
+-- {§worker-initialization-entry} {§overflow-turn-script} — the turn identity
+-- classifies every row in a kernel-authored recovery/orientation turn. No
+-- caller can omit provenance from either its exact turnOps or its operation
+-- outcomes.
+CREATE TRIGGER IF NOT EXISTS log_entries_classify_plurnk_turn
+AFTER INSERT ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM turns
+    WHERE turns.id = NEW.turn_id
+      AND turns.producer = '_plurnk'
+      AND turns.kind IN ('initialization', 'overflow')
+)
+BEGIN
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    VALUES (NEW.id, '_plurnk');
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT NEW.id, CASE turns.kind
+        WHEN 'initialization' THEN 'init'
+        ELSE 'overflow'
+    END
+    FROM turns
+    WHERE turns.id = NEW.turn_id;
+END;
+
+-- Overflow admission reclassifies a would-be inference turn only after its
+-- pre-model rows exist. Apply the same turn-owned classification to those
+-- rows; later rows are covered by log_entries_classify_plurnk_turn above.
+CREATE TRIGGER IF NOT EXISTS turns_classify_existing_plurnk_rows
+AFTER UPDATE OF producer, kind ON turns
+WHEN NEW.producer = '_plurnk'
+ AND NEW.kind IN ('initialization', 'overflow')
+BEGIN
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT id, '_plurnk' FROM log_entries WHERE turn_id = NEW.id;
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT id, CASE NEW.kind
+        WHEN 'initialization' THEN 'init'
+        ELSE 'overflow'
+    END
+    FROM log_entries
+    WHERE turn_id = NEW.id;
+END;
+
 -- Successful OPEN/FOLD rows are durable curation events even though their
 -- ordinary packet projection is suppressed ({§fold-open-meta-operations}).
--- Preserve the exact selected set and each target's pre-event visibility so a
+-- Preserve the exact selected set and each target's before/after visibility so a
 -- broad selector never collapses into the lossy fact `matched: N`.
 CREATE TABLE IF NOT EXISTS log_curation_effects (
     operation_log_entry_id INTEGER NOT NULL,
     target_log_entry_id    INTEGER NOT NULL,
-    expanded_before        INTEGER NOT NULL CHECK (expanded_before IN (0, 1)),
+    folded_before          TEXT    NOT NULL
+                                  CHECK (json_valid(folded_before) AND json_type(folded_before) = 'array'),
+    folded_after           TEXT    NOT NULL
+                                  CHECK (json_valid(folded_after) AND json_type(folded_after) = 'array'),
     tags_added             TEXT    NOT NULL DEFAULT '[]'
                                   CHECK (json_valid(tags_added) AND json_type(tags_added) = 'array'),
     tags_removed           TEXT    NOT NULL DEFAULT '[]'
@@ -961,6 +1246,39 @@ BEGIN
               AND operation.status_rx < 400
               AND operation.worker_id = target.worker_id
         )
+        OR EXISTS (
+            SELECT 1
+            FROM (
+                SELECT 'before' AS side, key, value, type FROM json_each(NEW.folded_before)
+                UNION ALL
+                SELECT 'after' AS side, key, value, type FROM json_each(NEW.folded_after)
+            ) range
+            WHERE range.type != 'array'
+               OR json_array_length(range.value) != 2
+               OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+               OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+               OR json_extract(range.value, '$[0]') < 1
+               OR (
+                   json_extract(range.value, '$[1]') != -1
+                   AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+               )
+               OR EXISTS (
+                   SELECT 1
+                   FROM (
+                       SELECT key, value FROM json_each(
+                           CASE range.side
+                               WHEN 'before' THEN NEW.folded_before
+                               ELSE NEW.folded_after
+                           END
+                       )
+                   ) previous
+                   WHERE previous.key = range.key - 1
+                     AND (
+                         json_extract(previous.value, '$[1]') = -1
+                         OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+                     )
+               )
+        )
         OR EXISTS (
             SELECT 1
             FROM (
@@ -1016,7 +1334,7 @@ BEGIN
 END;
 
 -- One outer INSERT owns the whole landed curation event: exact selected rows,
--- their pre-event visibility and tag deltas, the requested visibility, and the
+-- their before/after visibility and tag deltas, and the
 -- resulting classifications. Trigger failure rolls the operation row and all
 -- effects back together. The private plan is erased before INSERT returns.
 CREATE TRIGGER IF NOT EXISTS log_entries_apply_curation
@@ -1026,26 +1344,70 @@ WHEN NEW.op IN ('OPEN', 'FOLD')
  AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
 BEGIN
     SELECT CASE WHEN
-        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.ids'), '') != 'array'
+        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.targets'), '') != 'array'
         OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.add'), '') != 'array'
         OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.remove'), '') != 'array'
-        OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.expanded'), '') != 'integer'
-        OR json_extract(NEW.attrs, '$.__plurnk_curation.expanded') NOT IN (0, 1)
-        OR json_array_length(NEW.attrs, '$.__plurnk_curation.ids') = 0
+        OR json_array_length(NEW.attrs, '$.__plurnk_curation.targets') = 0
         OR EXISTS (
-            SELECT 1 FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
-            WHERE type != 'integer' OR value <= 0
+            SELECT 1
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+            WHERE selected.type != 'object'
+               OR COALESCE(json_type(selected.value, '$.id'), '') != 'integer'
+               OR json_extract(selected.value, '$.id') <= 0
+               OR COALESCE(json_type(selected.value, '$.before'), '') != 'array'
+               OR COALESCE(json_type(selected.value, '$.after'), '') != 'array'
+               OR EXISTS (
+                   SELECT 1 FROM json_each(selected.value) field
+                   WHERE field.key NOT IN ('id', 'before', 'after')
+               )
+               OR EXISTS (
+                   SELECT 1
+                   FROM (
+                       SELECT 'before' AS side, range.key, range.value, range.type
+                       FROM json_each(json_extract(selected.value, '$.before')) range
+                       UNION ALL
+                       SELECT 'after' AS side, range.key, range.value, range.type
+                       FROM json_each(json_extract(selected.value, '$.after')) range
+                   ) range
+                   WHERE range.type != 'array'
+                      OR json_array_length(range.value) != 2
+                      OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+                      OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+                      OR json_extract(range.value, '$[0]') < 1
+                      OR (
+                          json_extract(range.value, '$[1]') != -1
+                          AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+                      )
+                      OR EXISTS (
+                          SELECT 1
+                          FROM json_each(
+                              CASE range.side
+                                  WHEN 'before' THEN json_extract(selected.value, '$.before')
+                                  ELSE json_extract(selected.value, '$.after')
+                              END
+                          ) previous
+                          WHERE previous.key = range.key - 1
+                            AND (
+                                json_extract(previous.value, '$[1]') = -1
+                                OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+                            )
+                      )
+               )
         )
         OR (
-            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
         ) != (
-            SELECT COUNT(DISTINCT value) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+            SELECT COUNT(DISTINCT json_extract(value, '$.id'))
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
         )
         OR EXISTS (
             SELECT 1
-            FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
-            LEFT JOIN log_entries target ON target.id = selected.value
-            WHERE target.id IS NULL OR target.worker_id != NEW.worker_id OR target.id = NEW.id
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+            LEFT JOIN log_entries target ON target.id = json_extract(selected.value, '$.id')
+            WHERE target.id IS NULL
+               OR target.worker_id != NEW.worker_id
+               OR target.id = NEW.id
+               OR json(target.folded) != json(json_extract(selected.value, '$.before'))
         )
         OR EXISTS (
             SELECT 1
@@ -1096,14 +1458,16 @@ BEGIN
     INSERT INTO log_curation_effects (
         operation_log_entry_id,
         target_log_entry_id,
-        expanded_before,
+        folded_before,
+        folded_after,
         tags_added,
         tags_removed
     )
     SELECT
         NEW.id,
         target.id,
-        target.expanded,
+        json_extract(selected.value, '$.before'),
+        json_extract(selected.value, '$.after'),
         COALESCE((
             SELECT json_group_array(ordered.tag)
             FROM (
@@ -1128,26 +1492,32 @@ BEGIN
                 ORDER BY removal.value
             ) ordered
         ), '[]')
-    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
-    JOIN log_entries target ON target.id = selected.value;
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+    JOIN log_entries target ON target.id = json_extract(selected.value, '$.id');
 
     UPDATE log_entries
-    SET expanded = json_extract(NEW.attrs, '$.__plurnk_curation.expanded')
+    SET folded = (
+        SELECT json_extract(selected.value, '$.after')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+        WHERE json_extract(selected.value, '$.id') = log_entries.id
+    )
     WHERE id IN (
-        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        SELECT json_extract(value, '$.id')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
     );
 
     DELETE FROM log_tags
     WHERE log_entry_id IN (
-        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        SELECT json_extract(value, '$.id')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
     )
       AND tag IN (
         SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
     );
 
     INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
-    SELECT selected.value, addition.value
-    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
+    SELECT json_extract(selected.value, '$.id'), addition.value
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
     CROSS JOIN json_each(NEW.attrs, '$.__plurnk_curation.add') addition;
 
     UPDATE log_entries
@@ -1157,18 +1527,18 @@ END;
 
 -- Column-scoped immutability: the original action's identity and target never
 -- change; the proposal lifecycle is allowed to mutate state, outcome,
--- status_rx, rx, expanded. Keep attrs separate so the curation trigger's one
+-- status_rx, rx, folded. Keep attrs separate so the curation trigger's one
 -- private-payload removal cannot exempt changes to any other core column.
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
 BEFORE UPDATE OF
     worker_id, loop_id, turn_id, sequence, at, origin, source, model_call_id,
-    op, suffix, signal,
+    op, delimiter, signal,
     scheme, username, password, hostname,
     port, pathname, query, fragment,
     lineMarker, tx, mimetype_tx, mimetype_rx
 ON log_entries
 BEGIN
-    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/expanded may change');
+    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/folded may change');
 END;
 
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_attrs
@@ -1202,7 +1572,7 @@ WHEN NEW.ambient_event_id IS NULL
  AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
  AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
  AND (
-     NEW.origin != 'plurnk'
+     NEW.origin != '_plurnk'
      OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
  )
 BEGIN
@@ -1236,7 +1606,7 @@ WHEN OLD.state = 'proposed'
  AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
  AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
  AND (
-     NEW.origin != 'plurnk'
+     NEW.origin != '_plurnk'
      OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
  )
 BEGIN
@@ -1258,6 +1628,26 @@ BEGIN
     UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
 END;
 
+-- {§client-interactions}: the durable discoverable half of a client-owned
+-- interaction. The process-local lifecycle owner holds the awaiting callable;
+-- this row holds only presentation and routing facts. Settlement deletes the
+-- row, so client response payloads and owner-private continuation state are
+-- never copied into persistence.
+CREATE TABLE IF NOT EXISTS client_interactions (
+    id           INTEGER NOT NULL PRIMARY KEY,
+    worker_id    INTEGER NOT NULL,
+    loop_id      INTEGER NOT NULL,
+    turn_id      INTEGER NOT NULL,
+    request      TEXT    NOT NULL CHECK (json_valid(request) AND json_type(request) = 'object'),
+    created_at   TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
+    FOREIGN KEY (loop_id)   REFERENCES loops(id)   ON DELETE CASCADE,
+    FOREIGN KEY (turn_id)   REFERENCES turns(id)   ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS client_interactions_worker_id_id
+    ON client_interactions (worker_id, id);
+
 -- subscriptions
 -- Durable subscription lifecycle per SPEC {§subscriptions}. The row records what
 -- the worker holds and routes cancellation to a separate process-local callable;