@plurnk/plurnk-service 1.7.0 → 1.9.0

package/migrations/001_schema.sql

@@ -19,17 +19,21 @@ CREATE TABLE IF NOT EXISTS workspaces (
 
 CREATE INDEX IF NOT EXISTS workspaces_created_at ON workspaces (created_at);
 
--- {§module-workspace-state}: one opaque, provider-validated JSON snapshot per
--- module owner and workspace. Core owns isolation and lifecycle only.
-CREATE TABLE IF NOT EXISTS workspace_module_state (
-    workspace_id       INTEGER NOT NULL,
-    namespace_owner    TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
-    state              TEXT    NOT NULL CHECK (json_valid(state)),
-    updated_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    PRIMARY KEY (workspace_id, namespace_owner),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+-- model_routes — the immutable resolved model route ({§worker-model-selection}). One row per
+-- complete resolved tuple; append-only. Alias is provenance plus a tuning scope,
+-- not route identity, and is absent on a direct provider/model selection.
+CREATE TABLE IF NOT EXISTS model_routes (
+    id         INTEGER NOT NULL PRIMARY KEY,
+    alias      TEXT             CHECK (alias IS NULL OR length(alias) > 0),
+    provider   TEXT    NOT NULL CHECK (length(provider) > 0),
+    model      TEXT    NOT NULL CHECK (length(model) > 0),
+    base_url   TEXT             CHECK (base_url IS NULL OR length(base_url) > 0),
+    created_at TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
 ) STRICT;
 
+CREATE UNIQUE INDEX IF NOT EXISTS model_routes_identity
+ON model_routes (coalesce(alias, ''), provider, model, coalesce(base_url, ''));
+
 -- workers
 CREATE TABLE IF NOT EXISTS workers (
     id              INTEGER NOT NULL PRIMARY KEY,
@@ -41,16 +45,34 @@ CREATE TABLE IF NOT EXISTS workers (
     -- independent databases reuse local integer ids.
     provider_identity TEXT NOT NULL DEFAULT (lower(hex(randomblob(16))))
         CHECK (length(provider_identity) = 32 AND provider_identity NOT GLOB '*[^0-9a-f]*'),
+    -- {§worker-model-selection}: the worker's durable resolved model, NULL for non-model
+    -- workers or a deliberately modelless unresolved worker. spawn_model_route_id is the
+    -- persistent spawn override; NULL means "use my model."
+    model_route_id       INTEGER          REFERENCES model_routes(id),
+    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
+    -- {§worker-reasoning-policy}: nullable only while the worker has no model;
+    -- once selected, model and reasoning policy form one durable generation policy.
+    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR reasoning_policy IN ('off', 'adaptive', 'low', 'medium', 'high')),
     -- workers fork via parent_worker_id; workspaces carry no parent — {§machine-processes-no-fork-workspace}
     parent_worker_id INTEGER          CHECK (parent_worker_id IS NULL OR parent_worker_id != id),
-    origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', 'plurnk')),
+    origin          TEXT    NOT NULL DEFAULT 'client' CHECK (origin IN ('model', 'client', '_plurnk')),
     -- {§methods-model-worker}: durable identity for the workspace's stable
     -- default conversation; unrelated to its human-facing, reclaimable name.
     default_conversation INTEGER NOT NULL DEFAULT 0 CHECK (default_conversation IN (0, 1)),
+    -- {§worker-settings}: the worker's own behavioral rules inside the workspace's
+    -- world — the workspace is how things are; each worker carries the rules its
+    -- loops obey. Client-declared at worker creation, mutable between loops,
+    -- validated at the client-input boundary (closed known-key set; unknown keys
+    -- never persist).
+    settings TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(settings)),
     -- {§env-delta-log-pull}: monotonic observation progress, not a private world snapshot.
-    -- NULL means the worker has not established its first-turn baseline yet.
+    -- Creation captures the workspace high-water; a fork instead copies its
+    -- parent's cursor and records the closed event boundary of its snapshot.
     ambient_event_cursor INTEGER      CHECK (ambient_event_cursor IS NULL OR ambient_event_cursor >= 0),
+    fork_event_boundary INTEGER       CHECK (fork_event_boundary IS NULL OR fork_event_boundary >= 0),
+    CHECK (fork_event_boundary IS NULL OR parent_worker_id IS NOT NULL),
     CHECK (default_conversation = 0 OR (origin = 'model' AND parent_worker_id IS NULL)),
+    CHECK ((model_route_id IS NULL) = (reasoning_policy IS NULL)),
     FOREIGN KEY (workspace_id)    REFERENCES workspaces(id) ON DELETE CASCADE,
     FOREIGN KEY (parent_worker_id) REFERENCES workers(id)     ON DELETE CASCADE
 ) STRICT;
@@ -73,48 +95,133 @@ BEGIN
     SELECT RAISE(ABORT, 'workers.provider_identity is immutable');
 END;
 
--- {§env-delta-log-pull}: one append-only occurrence journal gives every ambient
--- producer a shared monotonic order. It snapshots only what the observer row
--- needs; shared-world contents remain owned by entries/files, never copied here.
+CREATE TRIGGER IF NOT EXISTS workers_fork_event_boundary_immutable
+BEFORE UPDATE OF fork_event_boundary ON workers
+WHEN NEW.fork_event_boundary IS NOT OLD.fork_event_boundary
+BEGIN
+    SELECT RAISE(ABORT, 'workers.fork_event_boundary is immutable');
+END;
+
+-- {§module-worker-state}: one opaque, provider-validated JSON snapshot per
+-- module owner and Worker. Core owns isolation, inheritance, and lifecycle;
+-- the module owns its state schema and semantics.
+CREATE TABLE IF NOT EXISTS worker_module_state (
+    worker_id         INTEGER NOT NULL,
+    namespace_owner  TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
+    state             TEXT    NOT NULL CHECK (json_valid(state)),
+    updated_at        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    PRIMARY KEY (worker_id, namespace_owner),
+    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE
+) STRICT;
+
+-- A child snapshots every initialized module state at birth. Later parent
+-- mutations do not propagate; the child and parent are independent authorities.
+CREATE TRIGGER IF NOT EXISTS worker_module_state_inherit
+AFTER INSERT ON workers
+WHEN NEW.parent_worker_id IS NOT NULL
+BEGIN
+    INSERT INTO worker_module_state (worker_id, namespace_owner, state, updated_at)
+    SELECT NEW.id, namespace_owner, state, updated_at
+    FROM worker_module_state
+    WHERE worker_id = NEW.parent_worker_id;
+END;
+
+-- {§env-delta-log-pull}: one append-only occurrence journal gives every
+-- producer a shared monotonic order. Audience is structural: direct parent,
+-- explicit workspace broadcast, or their union. The event snapshots exactly
+-- what an observer row needs because source-log curation cannot erase history.
 -- source_record_id is forensic identity for the originating log/loop row, not a
 -- foreign key: model log curation must not erase an already-recorded occurrence.
 CREATE TABLE IF NOT EXISTS ambient_events (
-    id                 INTEGER NOT NULL PRIMARY KEY,
-    workspace_id       INTEGER NOT NULL,
-    producer_worker_id INTEGER NOT NULL,
-    kind               TEXT    NOT NULL CHECK (kind IN ('edit', 'loop_termination')),
-    source_record_id   INTEGER NOT NULL CHECK (source_record_id >= 1),
-    source             TEXT,
-    op                 TEXT    NOT NULL CHECK (op IN ('EDIT', 'SEND')),
-    scheme             TEXT,
-    hostname           TEXT,
-    pathname           TEXT,
-    rx                 TEXT,
-    attrs              TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
-    tags               TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(tags) AND json_type(tags) = 'array'),
-    status_rx          INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
-    terminated_by      TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
-    created_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    id                      INTEGER NOT NULL PRIMARY KEY,
+    workspace_id            INTEGER NOT NULL,
+    producer_worker_id      INTEGER NOT NULL,
+    target_parent_worker_id INTEGER,
+    workspace_broadcast     INTEGER NOT NULL DEFAULT 0 CHECK (workspace_broadcast IN (0, 1)),
+    kind                    TEXT    NOT NULL CHECK (kind IN ('activity', 'loop_termination')),
+    source_record_id        INTEGER NOT NULL CHECK (source_record_id >= 1),
+    at                      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    source                  TEXT,
+    op                      TEXT    NOT NULL,
+    delimiter               TEXT    NOT NULL DEFAULT '',
+    signal                  TEXT             CHECK (signal IS NULL OR json_valid(signal)),
+    scheme                  TEXT,
+    username                TEXT,
+    password                TEXT,
+    hostname                TEXT,
+    port                    INTEGER          CHECK (port IS NULL OR (port BETWEEN 0 AND 65535)),
+    pathname                TEXT,
+    query                   TEXT,
+    fragment                TEXT,
+    line_marker             TEXT             CHECK (line_marker IS NULL OR json_valid(line_marker)),
+    tx                      TEXT    NOT NULL,
+    mimetype_tx             TEXT    NOT NULL CHECK (length(mimetype_tx) > 0),
+    rx                      TEXT    NOT NULL,
+    mimetype_rx             TEXT    NOT NULL CHECK (length(mimetype_rx) > 0),
+    status_rx               INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
+    state                   TEXT    NOT NULL CHECK (state IN ('resolved', 'failed', 'cancelled')),
+    outcome                 TEXT,
+    attrs                   TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
+    tags                    TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(tags) AND json_type(tags) = 'array'),
+    terminated_by           TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
+    created_at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    CHECK (target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1),
     CHECK (
-        (kind = 'edit' AND op = 'EDIT' AND rx IS NOT NULL AND terminated_by IS NULL)
+        (kind = 'activity' AND terminated_by IS NULL)
         OR
         (kind = 'loop_termination'
             AND op = 'SEND'
             AND scheme = 'worker'
-            AND rx IS NOT NULL
             AND json_valid(rx)
             AND json_type(rx) = 'object'
             AND json_type(rx, '$.status') = 'integer'
             AND json_extract(rx, '$.status') = status_rx)
     ),
-    FOREIGN KEY (workspace_id)       REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (producer_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
+    FOREIGN KEY (workspace_id)            REFERENCES workspaces(id) ON DELETE CASCADE,
+    FOREIGN KEY (producer_worker_id)      REFERENCES workers(id)    ON DELETE CASCADE,
+    FOREIGN KEY (target_parent_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS ambient_events_workspace_id_id
     ON ambient_events (workspace_id, id);
 CREATE INDEX IF NOT EXISTS ambient_events_producer_kind_id
     ON ambient_events (producer_worker_id, kind, id);
+CREATE INDEX IF NOT EXISTS ambient_events_parent_id
+    ON ambient_events (target_parent_worker_id, id)
+    WHERE target_parent_worker_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS ambient_events_source_identity
+    ON ambient_events (producer_worker_id, kind, source_record_id);
+
+CREATE TRIGGER IF NOT EXISTS ambient_events_structural_audience
+BEFORE INSERT ON ambient_events
+WHEN NOT EXISTS (
+    SELECT 1
+    FROM workers producer
+    WHERE producer.id = NEW.producer_worker_id
+      AND producer.workspace_id = NEW.workspace_id
+      AND (
+          NEW.target_parent_worker_id IS NULL
+          OR NEW.target_parent_worker_id = producer.parent_worker_id
+      )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'ambient event audience must be the producer direct parent in the same workspace');
+END;
+
+-- A worker begins after the history that predates its existence. This trigger
+-- runs in the worker INSERT statement, so an occurrence is either in the
+-- baseline or after it. Fork INSERTs supply their own cursor/boundary and skip
+-- this ordinary-worker baseline. {§env-delta-log-pull}
+CREATE TRIGGER IF NOT EXISTS workers_capture_ambient_baseline
+AFTER INSERT ON workers
+WHEN NEW.ambient_event_cursor IS NULL
+BEGIN
+    UPDATE workers
+    SET ambient_event_cursor = COALESCE((
+        SELECT MAX(ae.id) FROM ambient_events ae WHERE ae.workspace_id = NEW.workspace_id
+    ), 0)
+    WHERE id = NEW.id;
+END;
 
 -- loops
 -- flags: per-loop runtime flags (auto, noProposals, noWeb, noInteraction,
@@ -128,9 +235,15 @@ CREATE TABLE IF NOT EXISTS loops (
     sequence INTEGER NOT NULL             CHECK (sequence >= 1),
     status   INTEGER NOT NULL DEFAULT 102 CHECK (status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)),
     prompt   TEXT    NOT NULL,
+    -- {§prompt-causal-source}: canonical actor address for the initial prompt;
+    -- NULL means the owning worker itself.
+    prompt_source TEXT CHECK (prompt_source IS NULL OR length(prompt_source) > 0),
     flags    TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(flags)),
-    provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(provider_spec)),
-    child_provider_spec TEXT NOT NULL DEFAULT 'null' CHECK (json_valid(child_provider_spec)),
+    -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
+    -- effective spawn route (was provider_spec/child_provider_spec JSON).
+    model_route_id       INTEGER          REFERENCES model_routes(id),
+    spawn_model_route_id INTEGER          REFERENCES model_routes(id),
+    reasoning_policy TEXT CHECK (reasoning_policy IS NULL OR reasoning_policy IN ('off', 'adaptive', 'low', 'medium', 'high')),
     max_turns INTEGER NOT NULL DEFAULT 50 CHECK (max_turns >= -1),
     -- {§methods-loop-run-open-paths}: the initial prompt frame's selected paths,
     -- held here until turn 1 materializes that frame (string[] JSON).
@@ -145,6 +258,9 @@ CREATE TABLE IF NOT EXISTS loops (
     -- {§loop-terminal-authorship}: 'cancel' names an external loop.cancel;
     -- NULL covers model terminals and engine verdicts whose result carries the story.
     terminated_by    TEXT                      CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
+    CONSTRAINT loops_generation_policy_contract CHECK (
+        (model_route_id IS NULL) = (reasoning_policy IS NULL)
+    ),
     CONSTRAINT loops_terminal_result_contract CHECK (
         CASE
             WHEN status IN (100, 102, 202) THEN terminal_result IS NULL
@@ -191,7 +307,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS loops_worker_id_sequence ON loops (worker_id,
 CREATE UNIQUE INDEX IF NOT EXISTS loops_orphan_source_loop_id ON loops (orphan_source_loop_id);
 -- {§worker-scheme}: a loop crossing into a terminal status stamps terminated_at, so sibling
 -- workers pull the termination as a folded ambient delta — caught uniformly across every
--- death-path (SEND, grinder, max-turns, strike, KILL). The stamp updates terminated_at,
+-- death-path (SEND, overflow recovery, max-turns, strike, KILL). The stamp updates terminated_at,
 -- never status, so it cannot re-fire this trigger. Terminals: 200 done · 413 budget ·
 -- 429 turn-ceiling · 499 cancel · 500 fail · 504 wall-clock timeout · 508 runaway. (202 = parked/sleeping, NOT terminal.)
 CREATE TRIGGER IF NOT EXISTS loops_stamp_terminated_at
@@ -201,22 +317,33 @@ BEGIN
     UPDATE loops SET terminated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.id;
 END;
 
--- A terminal transition is an ambient occurrence in the same total order as a
--- shared EDIT. Directly inserted fork history never crosses this transition and
+-- A child terminal transition is an occurrence addressed only to its direct
+-- parent. Directly inserted fork history never crosses this transition and
 -- therefore cannot fabricate a new conclusion event.
 CREATE TRIGGER IF NOT EXISTS loops_append_ambient_event
 AFTER UPDATE OF status ON loops
 WHEN NEW.status IN (200, 413, 429, 499, 500, 504, 508) AND OLD.status NOT IN (200, 413, 429, 499, 500, 504, 508)
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, pathname, rx, status_rx, terminated_by
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, source,
+        op, delimiter, scheme, pathname,
+        tx, mimetype_tx, rx, mimetype_rx, status_rx, state, terminated_by
     )
-    SELECT w.workspace_id, NEW.worker_id, 'loop_termination', NEW.id, NULL,
-           'SEND', 'worker', '/' || w.name, NEW.terminal_result,
-           json_extract(NEW.terminal_result, '$.status'), NEW.terminated_by
+    SELECT w.workspace_id, NEW.worker_id, w.parent_worker_id,
+           0, 'loop_termination', NEW.id, NULL,
+           'SEND', '', 'worker', '/' || w.name,
+           '', 'text/plain', NEW.terminal_result, 'application/json',
+           json_extract(NEW.terminal_result, '$.status'), 'resolved', NEW.terminated_by
     FROM workers w
-    WHERE w.id = NEW.worker_id;
+    WHERE w.id = NEW.worker_id
+      AND w.parent_worker_id IS NOT NULL
+      AND EXISTS (
+          SELECT 1
+          FROM turns t
+          WHERE t.loop_id = NEW.id
+            AND NOT (t.producer = '_plurnk' AND t.kind = 'operation')
+      );
 END;
 
 -- turns
@@ -229,7 +356,15 @@ CREATE TABLE IF NOT EXISTS turns (
     loop_id          INTEGER NOT NULL,
     sequence         INTEGER NOT NULL           CHECK (sequence >= 1),
     timestamp        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    -- {§turn-record}: producer and purpose define the turn. Packet/provider
+    -- evidence below is an optional inference specialization.
+    producer         TEXT    NOT NULL           CHECK (producer IN ('model', 'client', '_plurnk', 'plugin')),
+    kind             TEXT    NOT NULL           CHECK (kind IN ('inference', 'initialization', 'overflow', 'operation', 'maintenance')),
     status           INTEGER NOT NULL           CHECK (status BETWEEN 100 AND 599),
+    -- NULL while the producer still owns this turn. Status 102 is both the
+    -- provisional running value and the exact completed continue disposition;
+    -- completed_at distinguishes those states without inventing another status.
+    completed_at     TEXT DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
     -- Provider-derived curation calibration for this turn; NULL when input
     -- capacity is unknown. {§tokenomics-client-gauge}
     usage_curation_budget INTEGER                CHECK (usage_curation_budget IS NULL OR usage_curation_budget >= 1),
@@ -264,16 +399,59 @@ CREATE TABLE IF NOT EXISTS turns (
         END
     ),
     finish_reason    TEXT,
-    model            TEXT    NOT NULL DEFAULT 'unknown' CHECK (length(model) >= 1),
-    -- Opaque provider→client metadata plus engine rail keys; JSON-valid but
-    -- otherwise unenforced. {§meta-passthrough}, {§rail-truth-engine-verdict}
-    meta             TEXT    NOT NULL DEFAULT '{}'     CHECK (json_valid(meta)),
+    model            TEXT                       CHECK (model IS NULL OR length(model) >= 1),
+    -- Opaque provider→client metadata plus engine rail keys; absent outside
+    -- recorded inference evidence. {§meta-passthrough}, {§rail-truth-engine-verdict}
+    meta             TEXT                       CHECK (meta IS NULL OR json_valid(meta)),
+    CHECK (completed_at IS NOT NULL OR status = 102),
+    CHECK ((producer = 'model') = (kind = 'inference')),
+    CHECK (kind NOT IN ('initialization', 'overflow') OR producer = '_plurnk'),
+    CHECK (
+        kind = 'inference'
+        OR (
+            usage_curation_budget IS NULL
+            AND packet IS NULL
+            AND finish_reason IS NULL
+            AND model IS NULL
+            AND meta IS NULL
+        )
+    ),
     FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE
 ) STRICT;
 
 CREATE UNIQUE INDEX IF NOT EXISTS turns_loop_id_sequence ON turns (loop_id, sequence);
 CREATE        INDEX IF NOT EXISTS turns_timestamp        ON turns (timestamp);
 
+-- Producer and purpose are immutable except for the single pre-inference
+-- diversion into overflow recovery. The transition is allowed only before any
+-- model or non-kernel evidence exists.
+CREATE TRIGGER IF NOT EXISTS turns_identity_forward_only
+BEFORE UPDATE OF producer, kind ON turns
+WHEN NOT (
+    OLD.producer = NEW.producer
+    AND OLD.kind = NEW.kind
+)
+AND NOT (
+    OLD.producer = 'model'
+    AND OLD.kind = 'inference'
+    AND NEW.producer = '_plurnk'
+    AND NEW.kind = 'overflow'
+    AND OLD.completed_at IS NULL
+    AND OLD.packet IS NULL
+    AND OLD.usage_curation_budget IS NULL
+    AND OLD.finish_reason IS NULL
+    AND OLD.model IS NULL
+    AND OLD.meta IS NULL
+    AND NOT EXISTS (SELECT 1 FROM model_calls WHERE turn_id = OLD.id)
+    AND NOT EXISTS (
+        SELECT 1 FROM log_entries
+        WHERE turn_id = OLD.id AND origin != '_plurnk'
+    )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'turn producer and kind are immutable outside pre-inference overflow diversion');
+END;
+
 -- One logical provider.generate call. Emission attempts and BARE inferences
 -- share response/failure evidence and cardinal physical request accounting;
 -- operation-specific semantics live in their specializing relations.
@@ -321,6 +499,17 @@ CREATE TABLE IF NOT EXISTS model_calls (
 
 CREATE INDEX IF NOT EXISTS model_calls_turn_id ON model_calls (turn_id, sequence);
 
+CREATE TRIGGER IF NOT EXISTS model_calls_inference_turn_only
+BEFORE INSERT ON model_calls
+WHEN COALESCE((
+    SELECT producer = 'model' AND kind = 'inference'
+    FROM turns
+    WHERE id = NEW.turn_id
+), 0) != 1
+BEGIN
+    SELECT RAISE(ABORT, 'model call requires a model inference turn');
+END;
+
 CREATE TRIGGER IF NOT EXISTS model_calls_request_identity_immutable
 BEFORE UPDATE OF turn_id, sequence, kind, attributions, timestamp ON model_calls
 BEGIN
@@ -532,9 +721,9 @@ BEGIN
 END;
 
 -- derivations
--- Content-addressed deep projections. Entries point at a COMPLETE artifact by
--- deep_hash; graph, FTS, and vectors are stored once regardless of how many
--- workspace/worktree paths carry identical content under the same reader/config.
+-- Content-addressed deep projections. Entry channels and log projections point
+-- at a COMPLETE artifact by deep_hash; graph, FTS, and vectors are stored once
+-- regardless of how many addresses carry identical content under the same reader/config.
 -- A building row is unattached and safely replaceable after interruption.
 CREATE TABLE IF NOT EXISTS derivations (
     id          INTEGER NOT NULL PRIMARY KEY,
@@ -543,19 +732,30 @@ CREATE TABLE IF NOT EXISTS derivations (
     disposition TEXT    CHECK (disposition IN ('vector', 'lexical', 'excluded', 'nonsemantic', 'failed')),
     reason      TEXT,
     parse_issues INTEGER CHECK (parse_issues IS NULL OR parse_issues > 0),
+    summary     TEXT    CHECK (
+        summary IS NULL OR (
+            length(summary) > 0
+            AND summary = trim(summary)
+            AND instr(summary, char(10)) = 0
+            AND instr(summary, char(13)) = 0
+        )
+    ),
     CHECK ((state = 'building' AND disposition IS NULL) OR (state = 'complete' AND disposition IS NOT NULL))
 ) STRICT;
 
 -- entries
--- The canonical addressable store. (workspace, owner, scheme, pathname) is the identity
+-- The canonical addressable store. (owner, scheme, authority, pathname) is the identity
 -- tuple, and NO component may be NULL: NULLs are distinct under SQL UNIQUE, so a nullable
 -- component voids the identity index. Bare/file paths persist under the reserved `file`
 -- scheme; they still render as bare paths. {§entry-identity-no-null}
 CREATE TABLE IF NOT EXISTS entries (
     id         INTEGER NOT NULL PRIMARY KEY,
     version    INTEGER NOT NULL DEFAULT 0   CHECK (version >= 0),
-    workspace_id INTEGER,
     scheme     TEXT    NOT NULL             CHECK (length(scheme) > 0),
+    -- Canonical RFC authority for resource-addressed schemes. Namespace schemes
+    -- fold authored authority into pathname; owner-addressed schemes consume it
+    -- into owner_id. Empty is therefore the canonical no-resource-authority value.
+    authority  TEXT    NOT NULL DEFAULT '',
     pathname   TEXT    NOT NULL,
     -- {§entry-owner} — every entry is owned by a worker: the spawning worker for capability
     -- streams, the workspace's reserved 'commons' worker for shared content. A real row, never
@@ -569,14 +769,9 @@ CREATE TABLE IF NOT EXISTS entries (
     -- SPEC {§membership} — how a file member entered the curated surface. 'git' rows are
     -- reconciled against the repo's members each turn — tracked ls-files PLUS untracked-
     -- but-not-ignored files ({§membership-auto-add}) — registered + un-registered so entries
-    -- == members; 'client'/'constraint' (model-created, add-glob) are not git's to reclaim.
+    -- == members; 'constraint' rows are reconciled from ordinary pick policy.
     -- NULL = not a file member (other schemes don't carry origin).
-    membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'client', 'constraint')),
-    -- {§membership-change-gated-sync}: hash of the body content at the last
-    -- deep-channel derivation. The manifest-add pass re-derives symbols/refs (and
-    -- embeddings, later) ONLY when this differs from the current body hash — an
-    -- unchanged entry is skipped, never re-metadatafied every turn.
-    deep_hash TEXT,
+    membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'constraint')),
     -- SPEC {§membership-change-gated-sync} — the per-member sync stat-detect:
     -- "<mtimeMs>:<size>" of the disk file at its last materialization, or `absent`
     -- after an observed deletion. The pre-turn
@@ -584,20 +779,19 @@ CREATE TABLE IF NOT EXISTS entries (
     -- signature changed; an unchanged member is a no-op. NULL = never synced.
     synced_sig TEXT,
     -- User Note 5 — manifest cache-friendliness. Last-modified stamp, bumped on every
-    -- channel write by entries_touch_on_channel_write; engine_list_workspace_entries orders
-    -- the catalog by it ASC so dormant entries hold the stable prompt-cache prefix.
+    -- addressable representation change; engine_list_workspace_entries orders the catalog
+    -- by it ASC so dormant entries hold the stable prompt-cache prefix. Private derivation
+    -- attachment does not make an entry recently touched.
     updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    CHECK (workspace_id IS NOT NULL),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE,
-    FOREIGN KEY (deep_hash)    REFERENCES derivations(deep_hash)
+    FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE
 ) STRICT;
 
 -- {§entry-owner} / {§stream-owner-scoped} — owner is the sole visibility and identity axis.
 -- Concurrent workers' capability streams share the loop-relative coordinate (every worker's first
 -- loop is seq 1), so identity keys on the owner and identical coordinates are distinct rows
 -- ({§stream-owner-scoped}).
-CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (workspace_id, owner_id, scheme, pathname);
+CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (owner_id, scheme, authority, pathname);
+CREATE UNIQUE INDEX IF NOT EXISTS entries_id_owner ON entries (id, owner_id);
 
 -- The ONE engine-imposed constraint (SPEC {§stream-constraints}, {§stream-constraints-engine-one-cap}): 100 MiB char-length cap
 -- per channel content body. All other limits are extrinsic.
@@ -610,6 +804,9 @@ CREATE TABLE IF NOT EXISTS entry_channels (
     -- Content identity: sha256 of content, stamped at static writes; streamed
     -- appends leave it NULL. Curation weight remains model-independent.
     content_hash TEXT,
+    -- Search derivation for this exact addressable channel representation.
+    -- Content or mimetype changes invalidate it at the owning channel row.
+    deep_hash TEXT,
     state    TEXT    NOT NULL DEFAULT 'static' CHECK (state IN ('static', 'active', 'closed', 'errored')),
     -- Exact terminal producer evidence for this representation channel. NULL is
     -- the ordinary implicit {status:200}; selection/projection metadata belongs
@@ -642,12 +839,26 @@ CREATE TABLE IF NOT EXISTS entry_channels (
         END
     ),
     PRIMARY KEY (entry_id, name),
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
+    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE,
+    FOREIGN KEY (deep_hash) REFERENCES derivations(deep_hash)
 ) STRICT, WITHOUT ROWID;
 
--- User Note 5 — bump the entry's updated_at on any channel write so the catalog
--- (ordered by updated_at ASC) keeps recently-touched entries at the tail and holds
--- the prompt-cache prefix stable across turns.
+-- A changed channel representation cannot retain search evidence derived from
+-- its predecessor. This trigger is the one invalidation owner for every write
+-- path, including model EDIT, plugin channel capabilities, and streams.
+CREATE TRIGGER IF NOT EXISTS entry_channels_invalidate_derivation
+AFTER UPDATE OF content, mimetype ON entry_channels
+WHEN OLD.content IS NOT NEW.content OR OLD.mimetype IS NOT NEW.mimetype
+BEGIN
+    UPDATE entry_channels
+    SET deep_hash = NULL
+    WHERE entry_id = NEW.entry_id AND name = NEW.name AND deep_hash IS NOT NULL;
+END;
+
+-- User Note 5 — bump the entry's updated_at on addressable representation or
+-- lifecycle writes so the catalog (ordered by updated_at ASC) keeps recently-
+-- touched entries at the tail and holds the prompt-cache prefix stable across
+-- turns. Content hashes and search attachments are private metadata, not touches.
 CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_write
 AFTER INSERT ON entry_channels
 BEGIN
@@ -655,7 +866,7 @@ BEGIN
 END;
 
 CREATE TRIGGER IF NOT EXISTS entries_touch_on_channel_update
-AFTER UPDATE ON entry_channels
+AFTER UPDATE OF content, mimetype, weight, state, producer_result ON entry_channels
 BEGIN
     UPDATE entries SET updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.entry_id;
 END;
@@ -731,7 +942,8 @@ CREATE TABLE IF NOT EXISTS derivation_embeddings (
 -- status⊥state: status is the HTTP outcome, state is where in the
 -- lifecycle the entry sits. Most rows write 'resolved' directly;
 -- proposing schemes transition 'proposed' → resolved/failed/cancelled.
--- expanded: per-row visibility for OPEN/FOLD via the log:/// scheme.
+-- folded: canonical hidden log-body line intervals for OPEN/FOLD. [] is
+-- wholly open and [[1,-1]] is wholly folded.
 CREATE TABLE IF NOT EXISTS log_entries (
     id              INTEGER NOT NULL PRIMARY KEY,
     version         INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -741,30 +953,38 @@ CREATE TABLE IF NOT EXISTS log_entries (
     turn_id         INTEGER NOT NULL,
     sequence        INTEGER NOT NULL           CHECK (sequence >= 1),
     at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', 'plurnk', 'plugin')),
+    origin          TEXT    NOT NULL           CHECK (origin IN ('model', 'client', '_plurnk', 'plugin')),
     -- {§env-delta-attribution}: a worker:// name or stable subsystem token ('file');
     -- NULL = the owning worker itself, rendered without causal attribution.
     source          TEXT,
     -- Engine-owned occurrence identity. Source rows are stamped NULL→id by the
     -- journal trigger; observer and fork copies carry it at insertion.
     ambient_event_id INTEGER                  REFERENCES ambient_events(id),
+    -- Fork history is copied evidence, never new activity. Rows with no source
+    -- occurrence still need this structural guard against republication.
+    inherited_history INTEGER NOT NULL DEFAULT 0 CHECK (inherited_history IN (0, 1)),
     -- Search derivation attached to this durable log result, when available.
     deep_hash       TEXT                       REFERENCES derivations(deep_hash),
-    -- Exact logical provider call represented by a BARE result or model-emission
-    -- mirror. Other operation and ambient rows carry no model-call identity.
+    -- Exact logical provider call represented by a BARE result, admitted
+    -- model turnOps, or rejected emissionAttempt. Other operation and ambient
+    -- rows carry no model-call identity.
     model_call_id   INTEGER                    REFERENCES model_calls(id),
+    -- Engine-owned stream publication that produced this observation. The
+    -- publication cursor survives log curation; this relation is evidence,
+    -- never the acknowledgement itself. {§exec-stream}
+    subscription_publication_id INTEGER        REFERENCES subscription_publications(id) ON DELETE SET NULL,
 
     -- 'error' is an ACTIONLESS row ({§operation-results} — errors are log items): a parse failure that
     -- produced no op still records a log entry (op='error', status_rx≥400, no target) so the model
     -- can fold/kill/recall its own mistakes like any other log row — one budget surface, the log.
-    -- Actionless artifacts carry NULL here: kernel-authored worker initialization
-    -- ({§worker-initialization-entry}) or a model emission ({§model-entry}).
+    -- Exact producer source and rejected-attempt artifacts carry NULL here
+    -- ({§turn-ops-entry}, {§rejected-emission-entry}).
     -- No op enum here: the grammar op set is grammar's contract (PlurnkOp), and this column is written
     -- only by the PlurnkOp-typed engine (grammar ops), service row selectors, or NULL for no op.
     -- A SQL enum would be a hand-copy of grammar's op list that silently goes stale on every new verb
     -- (it did — FORK/WORK). Validity lives at the parse + type layer, not duplicated in DDL.
     op              TEXT,
-    suffix          TEXT    NOT NULL DEFAULT '',
+    delimiter          TEXT    NOT NULL DEFAULT '',
     signal          TEXT                       CHECK (signal IS NULL OR json_valid(signal)),
 
     scheme          TEXT                       CHECK (scheme IS NULL OR length(scheme) > 0),
@@ -795,11 +1015,16 @@ CREATE TABLE IF NOT EXISTS log_entries (
     outcome         TEXT,
     attrs           TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
 
-    expanded         INTEGER NOT NULL DEFAULT 1 CHECK (expanded IN (0, 1)),
+    folded           TEXT    NOT NULL DEFAULT '[]'
+                    CHECK (json_valid(folded) AND json_type(folded) = 'array'),
 
-    CHECK ((op IS NULL) = COALESCE(json_extract(attrs, '$.kind') IN ('initialization', 'model_emission'), 0)),
-    CHECK (json_extract(attrs, '$.kind') != 'initialization' OR origin = 'plurnk'),
-    CHECK (json_extract(attrs, '$.kind') != 'model_emission' OR origin = 'model'),
+    CHECK (
+        (op IS NULL) = COALESCE(
+            json_extract(attrs, '$.kind') IN ('turnOps', 'emissionAttempt'),
+            0
+        )
+    ),
+    CHECK (json_extract(attrs, '$.kind') != 'emissionAttempt' OR origin = 'model'),
 
     FOREIGN KEY (worker_id)  REFERENCES workers(id)  ON DELETE CASCADE,
     FOREIGN KEY (loop_id) REFERENCES loops(id) ON DELETE CASCADE,
@@ -813,10 +1038,115 @@ CREATE        INDEX IF NOT EXISTS log_entries_at               ON log_entries (a
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_model_call_id
     ON log_entries (model_call_id)
     WHERE model_call_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS log_entries_subscription_publication_id
+    ON log_entries (subscription_publication_id)
+    WHERE subscription_publication_id IS NOT NULL;
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
     ON log_entries (worker_id, ambient_event_id)
     WHERE ambient_event_id IS NOT NULL;
 
+-- A log row belongs to one exact worker/loop/turn chain. Its writer is either
+-- that turn's producer or `_plurnk` observing the turn. Primitive absence,
+-- enum, and foreign-key failures remain owned by their column constraints.
+CREATE TRIGGER IF NOT EXISTS log_entries_turn_ownership
+BEFORE INSERT ON log_entries
+WHEN NEW.worker_id IS NOT NULL
+ AND NEW.loop_id IS NOT NULL
+ AND NEW.turn_id IS NOT NULL
+ AND NEW.origin IN ('model', 'client', '_plurnk', 'plugin')
+ AND EXISTS (SELECT 1 FROM workers WHERE id = NEW.worker_id)
+ AND EXISTS (SELECT 1 FROM loops WHERE id = NEW.loop_id)
+ AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
+ AND NOT EXISTS (
+    SELECT 1
+    FROM turns
+    JOIN loops ON loops.id = turns.loop_id
+    WHERE turns.id = NEW.turn_id
+      AND loops.id = NEW.loop_id
+      AND loops.worker_id = NEW.worker_id
+      AND (NEW.origin = turns.producer OR NEW.origin = '_plurnk')
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry must match its turn ownership and producer');
+END;
+
+-- {§turn-ops-entry} — exact admitted source is authored by the turn producer.
+-- `_plurnk` may observe another producer's turn through ordinary operation
+-- rows, but it cannot impersonate that producer's source program.
+CREATE TRIGGER IF NOT EXISTS log_entries_turn_ops_producer
+BEFORE INSERT ON log_entries
+WHEN NEW.op IS NULL
+ AND json_extract(NEW.attrs, '$.kind') = 'turnOps'
+ AND EXISTS (SELECT 1 FROM turns WHERE id = NEW.turn_id)
+ AND NOT EXISTS (
+    SELECT 1
+    FROM turns
+    WHERE turns.id = NEW.turn_id
+      AND turns.producer = NEW.origin
+ )
+BEGIN
+    SELECT RAISE(ABORT, 'actionless log entry does not match its turn producer');
+END;
+
+-- A folded interval is an inclusive [start,end] pair. Ranges are positive,
+-- sorted, disjoint, and non-adjacent; -1 is the final open-ended endpoint.
+-- Canonical intervals make visibility equality and curation effects exact.
+CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_insert
+BEFORE INSERT ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM json_each(NEW.folded) range
+    WHERE range.type != 'array'
+       OR json_array_length(range.value) != 2
+       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+       OR json_extract(range.value, '$[0]') < 1
+       OR (
+           json_extract(range.value, '$[1]') != -1
+           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+       )
+       OR EXISTS (
+           SELECT 1
+           FROM json_each(NEW.folded) previous
+           WHERE previous.key = range.key - 1
+             AND (
+                 json_extract(previous.value, '$[1]') = -1
+                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+             )
+       )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+END;
+
+CREATE TRIGGER IF NOT EXISTS log_entries_folded_valid_update
+BEFORE UPDATE OF folded ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM json_each(NEW.folded) range
+    WHERE range.type != 'array'
+       OR json_array_length(range.value) != 2
+       OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+       OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+       OR json_extract(range.value, '$[0]') < 1
+       OR (
+           json_extract(range.value, '$[1]') != -1
+           AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+       )
+       OR EXISTS (
+           SELECT 1
+           FROM json_each(NEW.folded) previous
+           WHERE previous.key = range.key - 1
+             AND (
+                 json_extract(previous.value, '$[1]') = -1
+                 OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+             )
+       )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'log entry folded ranges are invalid');
+END;
+
 CREATE TRIGGER IF NOT EXISTS log_entries_model_call_valid
 BEFORE INSERT ON log_entries
 WHEN NEW.model_call_id IS NOT NULL
@@ -831,7 +1161,7 @@ WHEN NEW.model_call_id IS NOT NULL
           OR (
               call.kind = 'emission'
               AND NEW.op IS NULL
-              AND json_extract(NEW.attrs, '$.kind') = 'model_emission'
+              AND json_extract(NEW.attrs, '$.kind') IN ('turnOps', 'emissionAttempt')
           )
       )
  )
@@ -930,19 +1260,93 @@ BEGIN
         SELECT json_group_array(tag)
         FROM (SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag)
     ), '[]')
-    WHERE kind = 'edit'
+    WHERE kind = 'activity'
+      AND producer_worker_id = NEW.worker_id
+      AND source_record_id = NEW.id;
+END;
+
+-- {§worker-initialization-entry} {§overflow-turn-script} — the turn identity
+-- classifies every row in a kernel-authored recovery/orientation turn. No
+-- caller can omit provenance from either its exact turnOps or its operation
+-- outcomes.
+CREATE TRIGGER IF NOT EXISTS log_entries_classify_plurnk_turn
+AFTER INSERT ON log_entries
+WHEN EXISTS (
+    SELECT 1
+    FROM turns
+    WHERE turns.id = NEW.turn_id
+      AND turns.producer = '_plurnk'
+      AND turns.kind IN ('initialization', 'overflow')
+)
+BEGIN
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    VALUES (NEW.id, '_plurnk');
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT NEW.id, CASE turns.kind
+        WHEN 'initialization' THEN 'init'
+        ELSE 'overflow'
+    END
+    FROM turns
+    WHERE turns.id = NEW.turn_id;
+
+    UPDATE ambient_events
+    SET tags = COALESCE((
+        SELECT json_group_array(tag)
+        FROM (SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag)
+    ), '[]')
+    WHERE kind = 'activity'
       AND producer_worker_id = NEW.worker_id
       AND source_record_id = NEW.id;
 END;
 
+-- Overflow admission reclassifies a would-be inference turn only after its
+-- pre-model rows exist. Apply the same turn-owned classification to those
+-- rows; later rows are covered by log_entries_classify_plurnk_turn above.
+CREATE TRIGGER IF NOT EXISTS turns_classify_existing_plurnk_rows
+AFTER UPDATE OF producer, kind ON turns
+WHEN NEW.producer = '_plurnk'
+ AND NEW.kind IN ('initialization', 'overflow')
+BEGIN
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT id, '_plurnk' FROM log_entries WHERE turn_id = NEW.id;
+    INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
+    SELECT id, CASE NEW.kind
+        WHEN 'initialization' THEN 'init'
+        ELSE 'overflow'
+    END
+    FROM log_entries
+    WHERE turn_id = NEW.id;
+
+    UPDATE ambient_events
+    SET tags = COALESCE((
+        SELECT json_group_array(tag)
+        FROM (
+            SELECT lt.tag
+            FROM log_tags lt
+            WHERE lt.log_entry_id = ambient_events.source_record_id
+            ORDER BY lt.tag
+        )
+    ), '[]')
+    WHERE kind = 'activity'
+      AND producer_worker_id = (
+          SELECT l.worker_id FROM loops l WHERE l.id = NEW.loop_id
+      )
+      AND source_record_id IN (
+          SELECT id FROM log_entries WHERE turn_id = NEW.id
+      );
+END;
+
 -- Successful OPEN/FOLD rows are durable curation events even though their
 -- ordinary packet projection is suppressed ({§fold-open-meta-operations}).
--- Preserve the exact selected set and each target's pre-event visibility so a
+-- Preserve the exact selected set and each target's before/after visibility so a
 -- broad selector never collapses into the lossy fact `matched: N`.
 CREATE TABLE IF NOT EXISTS log_curation_effects (
     operation_log_entry_id INTEGER NOT NULL,
     target_log_entry_id    INTEGER NOT NULL,
-    expanded_before        INTEGER NOT NULL CHECK (expanded_before IN (0, 1)),
+    folded_before          TEXT    NOT NULL
+                                  CHECK (json_valid(folded_before) AND json_type(folded_before) = 'array'),
+    folded_after           TEXT    NOT NULL
+                                  CHECK (json_valid(folded_after) AND json_type(folded_after) = 'array'),
     tags_added             TEXT    NOT NULL DEFAULT '[]'
                                   CHECK (json_valid(tags_added) AND json_type(tags_added) = 'array'),
     tags_removed           TEXT    NOT NULL DEFAULT '[]'
@@ -972,6 +1376,39 @@ BEGIN
               AND operation.status_rx < 400
               AND operation.worker_id = target.worker_id
         )
+        OR EXISTS (
+            SELECT 1
+            FROM (
+                SELECT 'before' AS side, key, value, type FROM json_each(NEW.folded_before)
+                UNION ALL
+                SELECT 'after' AS side, key, value, type FROM json_each(NEW.folded_after)
+            ) range
+            WHERE range.type != 'array'
+               OR json_array_length(range.value) != 2
+               OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+               OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+               OR json_extract(range.value, '$[0]') < 1
+               OR (
+                   json_extract(range.value, '$[1]') != -1
+                   AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+               )
+               OR EXISTS (
+                   SELECT 1
+                   FROM (
+                       SELECT key, value FROM json_each(
+                           CASE range.side
+                               WHEN 'before' THEN NEW.folded_before
+                               ELSE NEW.folded_after
+                           END
+                       )
+                   ) previous
+                   WHERE previous.key = range.key - 1
+                     AND (
+                         json_extract(previous.value, '$[1]') = -1
+                         OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+                     )
+               )
+        )
         OR EXISTS (
             SELECT 1
             FROM (
@@ -1027,7 +1464,7 @@ BEGIN
 END;
 
 -- One outer INSERT owns the whole landed curation event: exact selected rows,
--- their pre-event visibility and tag deltas, the requested visibility, and the
+-- their before/after visibility and tag deltas, and the
 -- resulting classifications. Trigger failure rolls the operation row and all
 -- effects back together. The private plan is erased before INSERT returns.
 CREATE TRIGGER IF NOT EXISTS log_entries_apply_curation
@@ -1037,26 +1474,70 @@ WHEN NEW.op IN ('OPEN', 'FOLD')
  AND json_type(NEW.attrs, '$.__plurnk_curation') = 'object'
 BEGIN
     SELECT CASE WHEN
-        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.ids'), '') != 'array'
+        COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.targets'), '') != 'array'
         OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.add'), '') != 'array'
         OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.remove'), '') != 'array'
-        OR COALESCE(json_type(NEW.attrs, '$.__plurnk_curation.expanded'), '') != 'integer'
-        OR json_extract(NEW.attrs, '$.__plurnk_curation.expanded') NOT IN (0, 1)
-        OR json_array_length(NEW.attrs, '$.__plurnk_curation.ids') = 0
+        OR json_array_length(NEW.attrs, '$.__plurnk_curation.targets') = 0
         OR EXISTS (
-            SELECT 1 FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
-            WHERE type != 'integer' OR value <= 0
+            SELECT 1
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+            WHERE selected.type != 'object'
+               OR COALESCE(json_type(selected.value, '$.id'), '') != 'integer'
+               OR json_extract(selected.value, '$.id') <= 0
+               OR COALESCE(json_type(selected.value, '$.before'), '') != 'array'
+               OR COALESCE(json_type(selected.value, '$.after'), '') != 'array'
+               OR EXISTS (
+                   SELECT 1 FROM json_each(selected.value) field
+                   WHERE field.key NOT IN ('id', 'before', 'after')
+               )
+               OR EXISTS (
+                   SELECT 1
+                   FROM (
+                       SELECT 'before' AS side, range.key, range.value, range.type
+                       FROM json_each(json_extract(selected.value, '$.before')) range
+                       UNION ALL
+                       SELECT 'after' AS side, range.key, range.value, range.type
+                       FROM json_each(json_extract(selected.value, '$.after')) range
+                   ) range
+                   WHERE range.type != 'array'
+                      OR json_array_length(range.value) != 2
+                      OR COALESCE(json_type(range.value, '$[0]'), '') != 'integer'
+                      OR COALESCE(json_type(range.value, '$[1]'), '') != 'integer'
+                      OR json_extract(range.value, '$[0]') < 1
+                      OR (
+                          json_extract(range.value, '$[1]') != -1
+                          AND json_extract(range.value, '$[1]') < json_extract(range.value, '$[0]')
+                      )
+                      OR EXISTS (
+                          SELECT 1
+                          FROM json_each(
+                              CASE range.side
+                                  WHEN 'before' THEN json_extract(selected.value, '$.before')
+                                  ELSE json_extract(selected.value, '$.after')
+                              END
+                          ) previous
+                          WHERE previous.key = range.key - 1
+                            AND (
+                                json_extract(previous.value, '$[1]') = -1
+                                OR json_extract(range.value, '$[0]') <= json_extract(previous.value, '$[1]') + 1
+                            )
+                      )
+               )
         )
         OR (
-            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+            SELECT COUNT(*) FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
         ) != (
-            SELECT COUNT(DISTINCT value) FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+            SELECT COUNT(DISTINCT json_extract(value, '$.id'))
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
         )
         OR EXISTS (
             SELECT 1
-            FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
-            LEFT JOIN log_entries target ON target.id = selected.value
-            WHERE target.id IS NULL OR target.worker_id != NEW.worker_id OR target.id = NEW.id
+            FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+            LEFT JOIN log_entries target ON target.id = json_extract(selected.value, '$.id')
+            WHERE target.id IS NULL
+               OR target.worker_id != NEW.worker_id
+               OR target.id = NEW.id
+               OR json(target.folded) != json(json_extract(selected.value, '$.before'))
         )
         OR EXISTS (
             SELECT 1
@@ -1107,14 +1588,16 @@ BEGIN
     INSERT INTO log_curation_effects (
         operation_log_entry_id,
         target_log_entry_id,
-        expanded_before,
+        folded_before,
+        folded_after,
         tags_added,
         tags_removed
     )
     SELECT
         NEW.id,
         target.id,
-        target.expanded,
+        json_extract(selected.value, '$.before'),
+        json_extract(selected.value, '$.after'),
         COALESCE((
             SELECT json_group_array(ordered.tag)
             FROM (
@@ -1139,26 +1622,32 @@ BEGIN
                 ORDER BY removal.value
             ) ordered
         ), '[]')
-    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
-    JOIN log_entries target ON target.id = selected.value;
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+    JOIN log_entries target ON target.id = json_extract(selected.value, '$.id');
 
     UPDATE log_entries
-    SET expanded = json_extract(NEW.attrs, '$.__plurnk_curation.expanded')
+    SET folded = (
+        SELECT json_extract(selected.value, '$.after')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
+        WHERE json_extract(selected.value, '$.id') = log_entries.id
+    )
     WHERE id IN (
-        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        SELECT json_extract(value, '$.id')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
     );
 
     DELETE FROM log_tags
     WHERE log_entry_id IN (
-        SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.ids')
+        SELECT json_extract(value, '$.id')
+        FROM json_each(NEW.attrs, '$.__plurnk_curation.targets')
     )
       AND tag IN (
         SELECT value FROM json_each(NEW.attrs, '$.__plurnk_curation.remove')
     );
 
     INSERT OR IGNORE INTO log_tags (log_entry_id, tag)
-    SELECT selected.value, addition.value
-    FROM json_each(NEW.attrs, '$.__plurnk_curation.ids') selected
+    SELECT json_extract(selected.value, '$.id'), addition.value
+    FROM json_each(NEW.attrs, '$.__plurnk_curation.targets') selected
     CROSS JOIN json_each(NEW.attrs, '$.__plurnk_curation.add') addition;
 
     UPDATE log_entries
@@ -1168,18 +1657,18 @@ END;
 
 -- Column-scoped immutability: the original action's identity and target never
 -- change; the proposal lifecycle is allowed to mutate state, outcome,
--- status_rx, rx, expanded. Keep attrs separate so the curation trigger's one
+-- status_rx, rx, folded. Keep attrs separate so the curation trigger's one
 -- private-payload removal cannot exempt changes to any other core column.
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
 BEFORE UPDATE OF
-    worker_id, loop_id, turn_id, sequence, at, origin, source, model_call_id,
-    op, suffix, signal,
+    worker_id, loop_id, turn_id, sequence, at, origin, source, inherited_history, model_call_id,
+    op, delimiter, signal,
     scheme, username, password, hostname,
     port, pathname, query, fragment,
     lineMarker, tx, mimetype_tx, mimetype_rx
 ON log_entries
 BEGIN
-    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/expanded may change');
+    SELECT RAISE(ABORT, 'log_entries core fields are immutable; only state/outcome/status_rx/rx/folded may change');
 END;
 
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_attrs
@@ -1201,72 +1690,168 @@ BEGIN
     SELECT RAISE(ABORT, 'log_entries ambient event identity may only be assigned once');
 END;
 
--- Immediate successful shared EDITs append their occurrence in the same SQL
--- statement that persists the receipt. Rows already carrying an event id are
--- observer/fork history and can never republish themselves.
+-- One relational projection owns activity eligibility, audience, and snapshot
+-- shape for both immediately-final and proposal-settlement paths.
+CREATE VIEW IF NOT EXISTS ambient_activity_candidates AS
+SELECT *
+FROM (
+    SELECT w.workspace_id,
+           le.worker_id AS producer_worker_id,
+           CASE
+               WHEN t.producer = '_plurnk' AND t.kind = 'operation' THEN NULL
+               ELSE w.parent_worker_id
+           END AS target_parent_worker_id,
+           CASE
+               WHEN le.state = 'resolved'
+                AND le.status_rx BETWEEN 200 AND 399
+                AND le.status_rx != 304
+                AND (
+                    (
+                        (
+                            le.op IN ('EDIT', 'KILL')
+                            OR (
+                                le.op = 'SEND'
+                                AND json_valid(le.signal)
+                                AND json_extract(le.signal, '$') = 410
+                            )
+                        )
+                        AND le.scheme = 'worker'
+                        AND le.hostname IS NULL
+                        AND le.pathname IS NOT NULL
+                    )
+                    OR (
+                        le.op IN ('COPY', 'MOVE')
+                        AND json_valid(le.rx)
+                        AND EXISTS (
+                            SELECT 1 FROM json_each(le.rx, '$.effects') effect
+                            WHERE json_type(effect.value) = 'object'
+                              AND substr(CAST(json_extract(effect.value, '$.target') AS TEXT), 1, 10) = 'worker:///'
+                        )
+                    )
+                )
+               THEN 1 ELSE 0
+           END AS workspace_broadcast,
+           le.id AS source_record_id,
+           le.at,
+           le.source,
+           le.op,
+           le.delimiter,
+           le.signal,
+           le.scheme,
+           le.username,
+           le.password,
+           le.hostname,
+           le.port,
+           le.pathname,
+           le.query,
+           le.fragment,
+           le.lineMarker AS line_marker,
+           le.tx,
+           le.mimetype_tx,
+           le.rx,
+           le.mimetype_rx,
+           le.status_rx,
+           le.state,
+           le.outcome,
+           json_remove(le.attrs, '$.__plurnk_curation') AS attrs,
+           COALESCE((
+               SELECT json_group_array(ordered.tag)
+               FROM (
+                   SELECT tag FROM log_tags WHERE log_entry_id = le.id ORDER BY tag
+               ) ordered
+           ), '[]') AS tags
+    FROM log_entries le
+    JOIN workers w ON w.id = le.worker_id
+    JOIN loops l ON l.id = le.loop_id
+    JOIN turns t ON t.id = le.turn_id
+    WHERE le.ambient_event_id IS NULL
+      AND le.inherited_history = 0
+      AND le.op IS NOT NULL
+      AND le.state != 'proposed'
+      AND NOT (
+          le.op = 'SEND'
+          AND le.scheme IS NULL
+          AND l.status IN (200, 413, 429, 499, 500, 504, 508)
+      )
+) candidate
+WHERE target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1;
+
+-- Every final op-bearing child row is parent activity. A successful operation
+-- whose landed effects touch worker:/// additionally acquires the workspace
+-- audience. Observer rows and copied fork history cannot republish themselves.
 CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_insert
 AFTER INSERT ON log_entries
-WHEN NEW.ambient_event_id IS NULL
- AND NEW.op = 'EDIT'
- AND NEW.state = 'resolved'
- AND NEW.status_rx IN (200, 201)
- AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
- AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
- AND (
-     NEW.origin != 'plurnk'
-     OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
- )
+WHEN NEW.state != 'proposed'
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, at, source,
+        op, delimiter, signal,
+        scheme, username, password, hostname, port, pathname, query, fragment,
+        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+        state, outcome, attrs, tags
     )
-    SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
-           COALESCE((
-               SELECT json_group_array(ordered.tag)
-               FROM (
-                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
-               ) ordered
-           ), '[]'),
-           NEW.status_rx
-    FROM workers w
-    WHERE w.id = NEW.worker_id;
-    UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
+    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
+           workspace_broadcast, 'activity', source_record_id, at, source,
+           op, delimiter, signal,
+           scheme, username, password, hostname, port, pathname, query, fragment,
+           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+           state, outcome, attrs, tags
+    FROM ambient_activity_candidates
+    WHERE source_record_id = NEW.id;
+
+    UPDATE log_entries
+    SET ambient_event_id = (
+        SELECT id FROM ambient_events
+        WHERE producer_worker_id = NEW.worker_id
+          AND kind = 'activity'
+          AND source_record_id = NEW.id
+    )
+    WHERE id = NEW.id
+      AND EXISTS (
+          SELECT 1 FROM ambient_events
+          WHERE producer_worker_id = NEW.worker_id
+            AND kind = 'activity'
+            AND source_record_id = NEW.id
+      );
 END;
 
--- A proposed EDIT becomes an occurrence only when its one lifecycle transition
--- resolves successfully. Rejection, cancellation, and failed application publish nothing.
+-- A proposed operation becomes activity only when its lifecycle settles.
 CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_resolve
-AFTER UPDATE OF state, status_rx ON log_entries
-WHEN OLD.state = 'proposed'
- AND NEW.state = 'resolved'
- AND NEW.ambient_event_id IS NULL
- AND NEW.op = 'EDIT'
- AND NEW.status_rx IN (200, 201)
- AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
- AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
- AND (
-     NEW.origin != 'plurnk'
-     OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
- )
+AFTER UPDATE OF state, status_rx, rx, outcome ON log_entries
+WHEN OLD.state = 'proposed' AND NEW.state != 'proposed'
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, at, source,
+        op, delimiter, signal,
+        scheme, username, password, hostname, port, pathname, query, fragment,
+        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+        state, outcome, attrs, tags
     )
-    SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
-           COALESCE((
-               SELECT json_group_array(ordered.tag)
-               FROM (
-                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
-               ) ordered
-           ), '[]'),
-           NEW.status_rx
-    FROM workers w
-    WHERE w.id = NEW.worker_id;
-    UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
+    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
+           workspace_broadcast, 'activity', source_record_id, at, source,
+           op, delimiter, signal,
+           scheme, username, password, hostname, port, pathname, query, fragment,
+           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+           state, outcome, attrs, tags
+    FROM ambient_activity_candidates
+    WHERE source_record_id = NEW.id;
+
+    UPDATE log_entries
+    SET ambient_event_id = (
+        SELECT id FROM ambient_events
+        WHERE producer_worker_id = NEW.worker_id
+          AND kind = 'activity'
+          AND source_record_id = NEW.id
+    )
+    WHERE id = NEW.id
+      AND EXISTS (
+          SELECT 1 FROM ambient_events
+          WHERE producer_worker_id = NEW.worker_id
+            AND kind = 'activity'
+            AND source_record_id = NEW.id
+      );
 END;
 
 -- {§client-interactions}: the durable discoverable half of a client-owned
@@ -1293,7 +1878,8 @@ CREATE INDEX IF NOT EXISTS client_interactions_worker_id_id
 -- Durable subscription lifecycle per SPEC {§subscriptions}. The row records what
 -- the worker holds and routes cancellation to a separate process-local callable;
 -- it never serializes that callable. Closed rows persist for forensics; partial
--- unique index enforces one active subscription per (worker, entry).
+-- unique index enforces one active subscription per entry. The composite
+-- foreign key makes that entry part of the subscribing Worker's own space.
 CREATE TABLE IF NOT EXISTS subscriptions (
     id           INTEGER NOT NULL PRIMARY KEY,
     version      INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -1312,14 +1898,15 @@ CREATE TABLE IF NOT EXISTS subscriptions (
     closed_at    TEXT,
     close_status INTEGER          CHECK (close_status IS NULL OR (close_status BETWEEN 100 AND 599)),
     close_result TEXT             CHECK (close_result IS NULL OR json_valid(close_result)),
-    CHECK ((closed_at IS NULL AND close_status IS NULL)
-        OR (closed_at IS NOT NULL AND close_status IS NOT NULL)),
-    FOREIGN KEY (worker_id)   REFERENCES workers(id)    ON DELETE CASCADE,
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
+    channel_results TEXT          CHECK (channel_results IS NULL OR json_valid(channel_results)),
+    CHECK ((closed_at IS NULL AND close_status IS NULL AND close_result IS NULL AND channel_results IS NULL)
+        OR (closed_at IS NOT NULL AND close_status IS NOT NULL AND close_result IS NOT NULL AND channel_results IS NOT NULL)),
+    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
+    FOREIGN KEY (entry_id, worker_id) REFERENCES entries(id, owner_id) ON DELETE CASCADE
 ) STRICT;
 
 CREATE UNIQUE INDEX IF NOT EXISTS subscriptions_active_one_per_entry
-    ON subscriptions (worker_id, entry_id)
+    ON subscriptions (entry_id)
     WHERE closed_at IS NULL;
 
 CREATE INDEX IF NOT EXISTS subscriptions_scheme_active
@@ -1330,13 +1917,26 @@ CREATE INDEX IF NOT EXISTS subscriptions_opened_at ON subscriptions (opened_at);
 
 CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_insert
 BEFORE INSERT ON subscriptions
+WHEN NEW.closed_at IS NOT NULL
+  OR NEW.close_status IS NOT NULL
+  OR NEW.close_result IS NOT NULL
+  OR NEW.channel_results IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'subscription must open before it can settle');
+END;
+
+CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_update
+BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
 WHEN NOT (
-    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL)
+    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL AND NEW.channel_results IS NULL)
     OR (
         NEW.closed_at IS NOT NULL
         AND NEW.close_status IS NOT NULL
         AND NEW.close_result IS NOT NULL
+        AND NEW.channel_results IS NOT NULL
         AND json_valid(NEW.close_result)
+        AND json_valid(NEW.channel_results)
+        AND json_type(NEW.channel_results) = 'object'
         AND json_type(NEW.close_result, '$.status') = 'integer'
         AND json_extract(NEW.close_result, '$.status') = NEW.close_status
         AND (
@@ -1353,35 +1953,142 @@ BEGIN
     SELECT RAISE(ABORT, 'subscription terminal result violates the operation-result contract');
 END;
 
-CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_update
-BEFORE UPDATE OF closed_at, close_status, close_result ON subscriptions
-WHEN NOT (
-    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL)
-    OR (
-        NEW.closed_at IS NOT NULL
-        AND NEW.close_status IS NOT NULL
-        AND NEW.close_result IS NOT NULL
-        AND json_valid(NEW.close_result)
-        AND json_type(NEW.close_result, '$.status') = 'integer'
-        AND json_extract(NEW.close_result, '$.status') = NEW.close_status
-        AND (
-            (NEW.close_status < 400 AND json_type(NEW.close_result, '$.problem') IS NULL)
-            OR (
-                NEW.close_status >= 400
-                AND json_type(NEW.close_result, '$.problem') = 'object'
-                AND json_extract(NEW.close_result, '$.problem.status') = NEW.close_status
-            )
-        )
+-- A settlement may override the universal result for exact named channels.
+-- Unknown channels and malformed results fail before the subscription or any
+-- representation changes. The JS boundary additionally rejects projection
+-- fields that are structurally unavailable in ChannelProducerResult.
+CREATE TRIGGER IF NOT EXISTS subscriptions_channel_results_contract
+BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
+WHEN NEW.closed_at IS NOT NULL AND (
+    EXISTS (
+        SELECT 1
+        FROM json_each(NEW.channel_results) AS channel_result
+        LEFT JOIN entry_channels ec
+          ON ec.entry_id = NEW.entry_id AND ec.name = channel_result.key
+        WHERE ec.name IS NULL
+           OR json_type(channel_result.value) != 'object'
+           OR json_type(channel_result.value, '$.status') != 'integer'
+           OR json_extract(channel_result.value, '$.status') NOT BETWEEN 200 AND 599
+           OR json_extract(channel_result.value, '$.status') = 202
+           OR (
+                json_extract(channel_result.value, '$.status') < 400
+                AND json_type(channel_result.value, '$.problem') IS NOT NULL
+           )
+           OR (
+                json_extract(channel_result.value, '$.status') >= 400
+                AND (
+                    json_type(channel_result.value, '$.problem') != 'object'
+                    OR json_extract(channel_result.value, '$.problem.status')
+                        != json_extract(channel_result.value, '$.status')
+                )
+           )
     )
 )
 BEGIN
-    SELECT RAISE(ABORT, 'subscription terminal result violates the operation-result contract');
+    SELECT RAISE(ABORT, 'subscription channel result violates the channel producer contract');
+END;
+
+-- Subscription settlement is the single atomic transition that closes the
+-- lifecycle and installs current terminal producer evidence on every channel.
+-- Overrides are exact; all other channels inherit the universal result.
+CREATE TRIGGER IF NOT EXISTS subscriptions_settle_channels
+AFTER UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
+WHEN OLD.closed_at IS NULL AND NEW.closed_at IS NOT NULL
+BEGIN
+    UPDATE entry_channels
+    SET producer_result = COALESCE(
+            (
+                SELECT json(channel_result.value)
+                FROM json_each(NEW.channel_results) AS channel_result
+                WHERE channel_result.key = entry_channels.name
+            ),
+            NEW.close_result
+        ),
+        state = CASE WHEN json_extract(
+            COALESCE(
+                (
+                    SELECT json(channel_result.value)
+                    FROM json_each(NEW.channel_results) AS channel_result
+                    WHERE channel_result.key = entry_channels.name
+                ),
+                NEW.close_result
+            ),
+            '$.status'
+        ) >= 400 THEN 'errored' ELSE 'closed' END
+    WHERE entry_id = NEW.entry_id;
+END;
+
+-- One durable publication cursor per selected subscription channel. Log rows
+-- are curated model context and therefore cannot own this lifecycle fact.
+-- The row survives KILLing any generated observation and disappears only with
+-- its subscription. {§exec-stream}
+CREATE TABLE IF NOT EXISTS subscription_publications (
+    id                 INTEGER NOT NULL PRIMARY KEY,
+    version            INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
+    subscription_id    INTEGER NOT NULL,
+    channel            TEXT    NOT NULL CHECK (length(channel) > 0),
+    published_end      INTEGER NOT NULL DEFAULT 0 CHECK (published_end >= 0),
+    terminal_published INTEGER NOT NULL DEFAULT 0 CHECK (terminal_published IN (0, 1)),
+    UNIQUE (subscription_id, channel),
+    FOREIGN KEY (subscription_id) REFERENCES subscriptions(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS subscription_publications_pending
+    ON subscription_publications (subscription_id, terminal_published);
+
+CREATE TRIGGER IF NOT EXISTS subscriptions_seed_publications
+AFTER INSERT ON subscriptions
+BEGIN
+    INSERT INTO subscription_publications (subscription_id, channel)
+    SELECT NEW.id, ec.name
+    FROM entry_channels ec
+    WHERE ec.entry_id = NEW.entry_id
+      AND (NEW.published_channel IS NULL OR ec.name = NEW.published_channel);
+
+    SELECT CASE WHEN NOT EXISTS (
+        SELECT 1 FROM subscription_publications WHERE subscription_id = NEW.id
+    ) THEN RAISE(ABORT, 'subscription has no publishable channel') END;
+END;
+
+-- The generated READ and its cursor transition are one SQLite statement. A
+-- later log KILL removes evidence from active context without rewinding the
+-- subscription/channel publication state. {§exec-stream}
+CREATE TRIGGER IF NOT EXISTS log_entries_advance_subscription_publication
+AFTER INSERT ON log_entries
+WHEN NEW.subscription_publication_id IS NOT NULL
+BEGIN
+    SELECT CASE WHEN
+        NEW.origin != '_plurnk'
+        OR NEW.op != 'READ'
+        OR json_type(NEW.attrs, '$.streamEnd') != 'integer'
+        OR json_extract(NEW.attrs, '$.streamEnd') < 0
+        OR json_type(NEW.attrs, '$.terminal') NOT IN ('true', 'false')
+    THEN RAISE(ABORT, 'subscription publication requires one canonical stream observation') END;
+
+    UPDATE subscription_publications
+    SET published_end = json_extract(NEW.attrs, '$.streamEnd'),
+        terminal_published = json_extract(NEW.attrs, '$.terminal'),
+        version = version + 1
+    WHERE id = NEW.subscription_publication_id
+      AND terminal_published = 0
+      AND (
+          (json_extract(NEW.attrs, '$.terminal') = 0
+              AND json_extract(NEW.attrs, '$.streamEnd') > published_end)
+          OR
+          (json_extract(NEW.attrs, '$.terminal') = 1
+              AND json_extract(NEW.attrs, '$.streamEnd') >= published_end)
+      );
+
+    SELECT CASE WHEN changes() != 1
+        THEN RAISE(ABORT, 'subscription publication transition is stale or already terminal')
+    END;
 END;
 
 -- (worker_watermarks removed — {§env-delta} is now pull-from-log, no per-worker snapshot.)
 
 -- workspace_constraints
--- SPEC {§membership} constraint overlay — the client's supersede over git membership.
+-- SPEC {§membership} constraint overlay — explicit policy and the inspectable
+-- exact pick produced by accepted file creation share one representation.
 -- Per (workspace, effect, glob/target): `pick` (members git misses, resolved by a
 -- targeted client-dictated scan), `hide` (drop git-tracked matches), `view` (member
 -- for read; File.edit rejects the write). git-absent, `pick` rows are the sole substrate
@@ -1390,6 +2097,8 @@ CREATE TABLE IF NOT EXISTS workspace_constraints (
     workspace_id INTEGER NOT NULL,
     effect     TEXT    NOT NULL CHECK (effect IN ('pick', 'hide', 'view')),
     glob       TEXT    NOT NULL,
+    source     TEXT    NOT NULL CHECK (source IN ('explicit', 'create')),
+    CHECK (source = 'explicit' OR effect = 'pick'),
     PRIMARY KEY (workspace_id, effect, glob),
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID;