@plurnk/plurnk-service 1.8.0 → 1.9.0

package/migrations/001_schema.sql

@@ -19,17 +19,6 @@ CREATE TABLE IF NOT EXISTS workspaces (
 
 CREATE INDEX IF NOT EXISTS workspaces_created_at ON workspaces (created_at);
 
--- {§module-workspace-state}: one opaque, provider-validated JSON snapshot per
--- module owner and workspace. Core owns isolation and lifecycle only.
-CREATE TABLE IF NOT EXISTS workspace_module_state (
-    workspace_id       INTEGER NOT NULL,
-    namespace_owner    TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
-    state              TEXT    NOT NULL CHECK (json_valid(state)),
-    updated_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    PRIMARY KEY (workspace_id, namespace_owner),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
-) STRICT;
-
 -- model_routes — the immutable resolved model route ({§worker-model-selection}). One row per
 -- complete resolved tuple; append-only. Alias is provenance plus a tuning scope,
 -- not route identity, and is absent on a direct provider/model selection.
@@ -77,8 +66,11 @@ CREATE TABLE IF NOT EXISTS workers (
     -- never persist).
     settings TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(settings)),
     -- {§env-delta-log-pull}: monotonic observation progress, not a private world snapshot.
-    -- NULL means the worker has not established its first-turn baseline yet.
+    -- Creation captures the workspace high-water; a fork instead copies its
+    -- parent's cursor and records the closed event boundary of its snapshot.
     ambient_event_cursor INTEGER      CHECK (ambient_event_cursor IS NULL OR ambient_event_cursor >= 0),
+    fork_event_boundary INTEGER       CHECK (fork_event_boundary IS NULL OR fork_event_boundary >= 0),
+    CHECK (fork_event_boundary IS NULL OR parent_worker_id IS NOT NULL),
     CHECK (default_conversation = 0 OR (origin = 'model' AND parent_worker_id IS NULL)),
     CHECK ((model_route_id IS NULL) = (reasoning_policy IS NULL)),
     FOREIGN KEY (workspace_id)    REFERENCES workspaces(id) ON DELETE CASCADE,
@@ -103,48 +95,133 @@ BEGIN
     SELECT RAISE(ABORT, 'workers.provider_identity is immutable');
 END;
 
--- {§env-delta-log-pull}: one append-only occurrence journal gives every ambient
--- producer a shared monotonic order. It snapshots only what the observer row
--- needs; shared-world contents remain owned by entries/files, never copied here.
+CREATE TRIGGER IF NOT EXISTS workers_fork_event_boundary_immutable
+BEFORE UPDATE OF fork_event_boundary ON workers
+WHEN NEW.fork_event_boundary IS NOT OLD.fork_event_boundary
+BEGIN
+    SELECT RAISE(ABORT, 'workers.fork_event_boundary is immutable');
+END;
+
+-- {§module-worker-state}: one opaque, provider-validated JSON snapshot per
+-- module owner and Worker. Core owns isolation, inheritance, and lifecycle;
+-- the module owns its state schema and semantics.
+CREATE TABLE IF NOT EXISTS worker_module_state (
+    worker_id         INTEGER NOT NULL,
+    namespace_owner  TEXT    NOT NULL CHECK (length(namespace_owner) > 0),
+    state             TEXT    NOT NULL CHECK (json_valid(state)),
+    updated_at        TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    PRIMARY KEY (worker_id, namespace_owner),
+    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE
+) STRICT;
+
+-- A child snapshots every initialized module state at birth. Later parent
+-- mutations do not propagate; the child and parent are independent authorities.
+CREATE TRIGGER IF NOT EXISTS worker_module_state_inherit
+AFTER INSERT ON workers
+WHEN NEW.parent_worker_id IS NOT NULL
+BEGIN
+    INSERT INTO worker_module_state (worker_id, namespace_owner, state, updated_at)
+    SELECT NEW.id, namespace_owner, state, updated_at
+    FROM worker_module_state
+    WHERE worker_id = NEW.parent_worker_id;
+END;
+
+-- {§env-delta-log-pull}: one append-only occurrence journal gives every
+-- producer a shared monotonic order. Audience is structural: direct parent,
+-- explicit workspace broadcast, or their union. The event snapshots exactly
+-- what an observer row needs because source-log curation cannot erase history.
 -- source_record_id is forensic identity for the originating log/loop row, not a
 -- foreign key: model log curation must not erase an already-recorded occurrence.
 CREATE TABLE IF NOT EXISTS ambient_events (
-    id                 INTEGER NOT NULL PRIMARY KEY,
-    workspace_id       INTEGER NOT NULL,
-    producer_worker_id INTEGER NOT NULL,
-    kind               TEXT    NOT NULL CHECK (kind IN ('edit', 'loop_termination')),
-    source_record_id   INTEGER NOT NULL CHECK (source_record_id >= 1),
-    source             TEXT,
-    op                 TEXT    NOT NULL CHECK (op IN ('EDIT', 'SEND')),
-    scheme             TEXT,
-    hostname           TEXT,
-    pathname           TEXT,
-    rx                 TEXT,
-    attrs              TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
-    tags               TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(tags) AND json_type(tags) = 'array'),
-    status_rx          INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
-    terminated_by      TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
-    created_at         TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    id                      INTEGER NOT NULL PRIMARY KEY,
+    workspace_id            INTEGER NOT NULL,
+    producer_worker_id      INTEGER NOT NULL,
+    target_parent_worker_id INTEGER,
+    workspace_broadcast     INTEGER NOT NULL DEFAULT 0 CHECK (workspace_broadcast IN (0, 1)),
+    kind                    TEXT    NOT NULL CHECK (kind IN ('activity', 'loop_termination')),
+    source_record_id        INTEGER NOT NULL CHECK (source_record_id >= 1),
+    at                      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    source                  TEXT,
+    op                      TEXT    NOT NULL,
+    delimiter               TEXT    NOT NULL DEFAULT '',
+    signal                  TEXT             CHECK (signal IS NULL OR json_valid(signal)),
+    scheme                  TEXT,
+    username                TEXT,
+    password                TEXT,
+    hostname                TEXT,
+    port                    INTEGER          CHECK (port IS NULL OR (port BETWEEN 0 AND 65535)),
+    pathname                TEXT,
+    query                   TEXT,
+    fragment                TEXT,
+    line_marker             TEXT             CHECK (line_marker IS NULL OR json_valid(line_marker)),
+    tx                      TEXT    NOT NULL,
+    mimetype_tx             TEXT    NOT NULL CHECK (length(mimetype_tx) > 0),
+    rx                      TEXT    NOT NULL,
+    mimetype_rx             TEXT    NOT NULL CHECK (length(mimetype_rx) > 0),
+    status_rx               INTEGER NOT NULL CHECK (status_rx BETWEEN 100 AND 599),
+    state                   TEXT    NOT NULL CHECK (state IN ('resolved', 'failed', 'cancelled')),
+    outcome                 TEXT,
+    attrs                   TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(attrs)),
+    tags                    TEXT    NOT NULL DEFAULT '[]' CHECK (json_valid(tags) AND json_type(tags) = 'array'),
+    terminated_by           TEXT             CHECK (terminated_by IS NULL OR terminated_by = 'cancel'),
+    created_at              TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    CHECK (target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1),
     CHECK (
-        (kind = 'edit' AND op = 'EDIT' AND rx IS NOT NULL AND terminated_by IS NULL)
+        (kind = 'activity' AND terminated_by IS NULL)
         OR
         (kind = 'loop_termination'
             AND op = 'SEND'
             AND scheme = 'worker'
-            AND rx IS NOT NULL
             AND json_valid(rx)
             AND json_type(rx) = 'object'
             AND json_type(rx, '$.status') = 'integer'
             AND json_extract(rx, '$.status') = status_rx)
     ),
-    FOREIGN KEY (workspace_id)       REFERENCES workspaces(id) ON DELETE CASCADE,
-    FOREIGN KEY (producer_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
+    FOREIGN KEY (workspace_id)            REFERENCES workspaces(id) ON DELETE CASCADE,
+    FOREIGN KEY (producer_worker_id)      REFERENCES workers(id)    ON DELETE CASCADE,
+    FOREIGN KEY (target_parent_worker_id) REFERENCES workers(id)    ON DELETE CASCADE
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS ambient_events_workspace_id_id
     ON ambient_events (workspace_id, id);
 CREATE INDEX IF NOT EXISTS ambient_events_producer_kind_id
     ON ambient_events (producer_worker_id, kind, id);
+CREATE INDEX IF NOT EXISTS ambient_events_parent_id
+    ON ambient_events (target_parent_worker_id, id)
+    WHERE target_parent_worker_id IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS ambient_events_source_identity
+    ON ambient_events (producer_worker_id, kind, source_record_id);
+
+CREATE TRIGGER IF NOT EXISTS ambient_events_structural_audience
+BEFORE INSERT ON ambient_events
+WHEN NOT EXISTS (
+    SELECT 1
+    FROM workers producer
+    WHERE producer.id = NEW.producer_worker_id
+      AND producer.workspace_id = NEW.workspace_id
+      AND (
+          NEW.target_parent_worker_id IS NULL
+          OR NEW.target_parent_worker_id = producer.parent_worker_id
+      )
+)
+BEGIN
+    SELECT RAISE(ABORT, 'ambient event audience must be the producer direct parent in the same workspace');
+END;
+
+-- A worker begins after the history that predates its existence. This trigger
+-- runs in the worker INSERT statement, so an occurrence is either in the
+-- baseline or after it. Fork INSERTs supply their own cursor/boundary and skip
+-- this ordinary-worker baseline. {§env-delta-log-pull}
+CREATE TRIGGER IF NOT EXISTS workers_capture_ambient_baseline
+AFTER INSERT ON workers
+WHEN NEW.ambient_event_cursor IS NULL
+BEGIN
+    UPDATE workers
+    SET ambient_event_cursor = COALESCE((
+        SELECT MAX(ae.id) FROM ambient_events ae WHERE ae.workspace_id = NEW.workspace_id
+    ), 0)
+    WHERE id = NEW.id;
+END;
 
 -- loops
 -- flags: per-loop runtime flags (auto, noProposals, noWeb, noInteraction,
@@ -158,6 +235,9 @@ CREATE TABLE IF NOT EXISTS loops (
     sequence INTEGER NOT NULL             CHECK (sequence >= 1),
     status   INTEGER NOT NULL DEFAULT 102 CHECK (status IN (100, 102, 200, 202, 413, 429, 499, 500, 504, 508)),
     prompt   TEXT    NOT NULL,
+    -- {§prompt-causal-source}: canonical actor address for the initial prompt;
+    -- NULL means the owning worker itself.
+    prompt_source TEXT CHECK (prompt_source IS NULL OR length(prompt_source) > 0),
     flags    TEXT    NOT NULL DEFAULT '{}' CHECK (json_valid(flags)),
     -- {§worker-model-selection}: immutable loop snapshots of the resolved model route and the
     -- effective spawn route (was provider_spec/child_provider_spec JSON).
@@ -237,22 +317,33 @@ BEGIN
     UPDATE loops SET terminated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = NEW.id;
 END;
 
--- A terminal transition is an ambient occurrence in the same total order as a
--- shared EDIT. Directly inserted fork history never crosses this transition and
+-- A child terminal transition is an occurrence addressed only to its direct
+-- parent. Directly inserted fork history never crosses this transition and
 -- therefore cannot fabricate a new conclusion event.
 CREATE TRIGGER IF NOT EXISTS loops_append_ambient_event
 AFTER UPDATE OF status ON loops
 WHEN NEW.status IN (200, 413, 429, 499, 500, 504, 508) AND OLD.status NOT IN (200, 413, 429, 499, 500, 504, 508)
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, pathname, rx, status_rx, terminated_by
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, source,
+        op, delimiter, scheme, pathname,
+        tx, mimetype_tx, rx, mimetype_rx, status_rx, state, terminated_by
     )
-    SELECT w.workspace_id, NEW.worker_id, 'loop_termination', NEW.id, NULL,
-           'SEND', 'worker', '/' || w.name, NEW.terminal_result,
-           json_extract(NEW.terminal_result, '$.status'), NEW.terminated_by
+    SELECT w.workspace_id, NEW.worker_id, w.parent_worker_id,
+           0, 'loop_termination', NEW.id, NULL,
+           'SEND', '', 'worker', '/' || w.name,
+           '', 'text/plain', NEW.terminal_result, 'application/json',
+           json_extract(NEW.terminal_result, '$.status'), 'resolved', NEW.terminated_by
     FROM workers w
-    WHERE w.id = NEW.worker_id;
+    WHERE w.id = NEW.worker_id
+      AND w.parent_worker_id IS NOT NULL
+      AND EXISTS (
+          SELECT 1
+          FROM turns t
+          WHERE t.loop_id = NEW.id
+            AND NOT (t.producer = '_plurnk' AND t.kind = 'operation')
+      );
 END;
 
 -- turns
@@ -268,7 +359,7 @@ CREATE TABLE IF NOT EXISTS turns (
     -- {§turn-record}: producer and purpose define the turn. Packet/provider
     -- evidence below is an optional inference specialization.
     producer         TEXT    NOT NULL           CHECK (producer IN ('model', 'client', '_plurnk', 'plugin')),
-    kind             TEXT    NOT NULL           CHECK (kind IN ('inference', 'initialization', 'overflow', 'operation')),
+    kind             TEXT    NOT NULL           CHECK (kind IN ('inference', 'initialization', 'overflow', 'operation', 'maintenance')),
     status           INTEGER NOT NULL           CHECK (status BETWEEN 100 AND 599),
     -- NULL while the producer still owns this turn. Status 102 is both the
     -- provisional running value and the exact completed continue disposition;
@@ -653,15 +744,18 @@ CREATE TABLE IF NOT EXISTS derivations (
 ) STRICT;
 
 -- entries
--- The canonical addressable store. (workspace, owner, scheme, pathname) is the identity
+-- The canonical addressable store. (owner, scheme, authority, pathname) is the identity
 -- tuple, and NO component may be NULL: NULLs are distinct under SQL UNIQUE, so a nullable
 -- component voids the identity index. Bare/file paths persist under the reserved `file`
 -- scheme; they still render as bare paths. {§entry-identity-no-null}
 CREATE TABLE IF NOT EXISTS entries (
     id         INTEGER NOT NULL PRIMARY KEY,
     version    INTEGER NOT NULL DEFAULT 0   CHECK (version >= 0),
-    workspace_id INTEGER,
     scheme     TEXT    NOT NULL             CHECK (length(scheme) > 0),
+    -- Canonical RFC authority for resource-addressed schemes. Namespace schemes
+    -- fold authored authority into pathname; owner-addressed schemes consume it
+    -- into owner_id. Empty is therefore the canonical no-resource-authority value.
+    authority  TEXT    NOT NULL DEFAULT '',
     pathname   TEXT    NOT NULL,
     -- {§entry-owner} — every entry is owned by a worker: the spawning worker for capability
     -- streams, the workspace's reserved 'commons' worker for shared content. A real row, never
@@ -675,9 +769,9 @@ CREATE TABLE IF NOT EXISTS entries (
     -- SPEC {§membership} — how a file member entered the curated surface. 'git' rows are
     -- reconciled against the repo's members each turn — tracked ls-files PLUS untracked-
     -- but-not-ignored files ({§membership-auto-add}) — registered + un-registered so entries
-    -- == members; 'client'/'constraint' (model-created, add-glob) are not git's to reclaim.
+    -- == members; 'constraint' rows are reconciled from ordinary pick policy.
     -- NULL = not a file member (other schemes don't carry origin).
-    membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'client', 'constraint')),
+    membership_origin TEXT                   CHECK (membership_origin IS NULL OR membership_origin IN ('git', 'constraint')),
     -- SPEC {§membership-change-gated-sync} — the per-member sync stat-detect:
     -- "<mtimeMs>:<size>" of the disk file at its last materialization, or `absent`
     -- after an observed deletion. The pre-turn
@@ -689,8 +783,6 @@ CREATE TABLE IF NOT EXISTS entries (
     -- by it ASC so dormant entries hold the stable prompt-cache prefix. Private derivation
     -- attachment does not make an entry recently touched.
     updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
-    CHECK (workspace_id IS NOT NULL),
-    FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
     FOREIGN KEY (owner_id)     REFERENCES workers(id)    ON DELETE CASCADE
 ) STRICT;
 
@@ -698,7 +790,8 @@ CREATE TABLE IF NOT EXISTS entries (
 -- Concurrent workers' capability streams share the loop-relative coordinate (every worker's first
 -- loop is seq 1), so identity keys on the owner and identical coordinates are distinct rows
 -- ({§stream-owner-scoped}).
-CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (workspace_id, owner_id, scheme, pathname);
+CREATE UNIQUE INDEX IF NOT EXISTS entries_identity ON entries (owner_id, scheme, authority, pathname);
+CREATE UNIQUE INDEX IF NOT EXISTS entries_id_owner ON entries (id, owner_id);
 
 -- The ONE engine-imposed constraint (SPEC {§stream-constraints}, {§stream-constraints-engine-one-cap}): 100 MiB char-length cap
 -- per channel content body. All other limits are extrinsic.
@@ -867,12 +960,19 @@ CREATE TABLE IF NOT EXISTS log_entries (
     -- Engine-owned occurrence identity. Source rows are stamped NULL→id by the
     -- journal trigger; observer and fork copies carry it at insertion.
     ambient_event_id INTEGER                  REFERENCES ambient_events(id),
+    -- Fork history is copied evidence, never new activity. Rows with no source
+    -- occurrence still need this structural guard against republication.
+    inherited_history INTEGER NOT NULL DEFAULT 0 CHECK (inherited_history IN (0, 1)),
     -- Search derivation attached to this durable log result, when available.
     deep_hash       TEXT                       REFERENCES derivations(deep_hash),
     -- Exact logical provider call represented by a BARE result, admitted
     -- model turnOps, or rejected emissionAttempt. Other operation and ambient
     -- rows carry no model-call identity.
     model_call_id   INTEGER                    REFERENCES model_calls(id),
+    -- Engine-owned stream publication that produced this observation. The
+    -- publication cursor survives log curation; this relation is evidence,
+    -- never the acknowledgement itself. {§exec-stream}
+    subscription_publication_id INTEGER        REFERENCES subscription_publications(id) ON DELETE SET NULL,
 
     -- 'error' is an ACTIONLESS row ({§operation-results} — errors are log items): a parse failure that
     -- produced no op still records a log entry (op='error', status_rx≥400, no target) so the model
@@ -938,6 +1038,9 @@ CREATE        INDEX IF NOT EXISTS log_entries_at               ON log_entries (a
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_model_call_id
     ON log_entries (model_call_id)
     WHERE model_call_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS log_entries_subscription_publication_id
+    ON log_entries (subscription_publication_id)
+    WHERE subscription_publication_id IS NOT NULL;
 CREATE UNIQUE INDEX IF NOT EXISTS log_entries_worker_ambient_event
     ON log_entries (worker_id, ambient_event_id)
     WHERE ambient_event_id IS NOT NULL;
@@ -1157,7 +1260,7 @@ BEGIN
         SELECT json_group_array(tag)
         FROM (SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag)
     ), '[]')
-    WHERE kind = 'edit'
+    WHERE kind = 'activity'
       AND producer_worker_id = NEW.worker_id
       AND source_record_id = NEW.id;
 END;
@@ -1185,6 +1288,15 @@ BEGIN
     END
     FROM turns
     WHERE turns.id = NEW.turn_id;
+
+    UPDATE ambient_events
+    SET tags = COALESCE((
+        SELECT json_group_array(tag)
+        FROM (SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag)
+    ), '[]')
+    WHERE kind = 'activity'
+      AND producer_worker_id = NEW.worker_id
+      AND source_record_id = NEW.id;
 END;
 
 -- Overflow admission reclassifies a would-be inference turn only after its
@@ -1204,6 +1316,24 @@ BEGIN
     END
     FROM log_entries
     WHERE turn_id = NEW.id;
+
+    UPDATE ambient_events
+    SET tags = COALESCE((
+        SELECT json_group_array(tag)
+        FROM (
+            SELECT lt.tag
+            FROM log_tags lt
+            WHERE lt.log_entry_id = ambient_events.source_record_id
+            ORDER BY lt.tag
+        )
+    ), '[]')
+    WHERE kind = 'activity'
+      AND producer_worker_id = (
+          SELECT l.worker_id FROM loops l WHERE l.id = NEW.loop_id
+      )
+      AND source_record_id IN (
+          SELECT id FROM log_entries WHERE turn_id = NEW.id
+      );
 END;
 
 -- Successful OPEN/FOLD rows are durable curation events even though their
@@ -1531,7 +1661,7 @@ END;
 -- private-payload removal cannot exempt changes to any other core column.
 CREATE TRIGGER IF NOT EXISTS log_entries_immutable_core
 BEFORE UPDATE OF
-    worker_id, loop_id, turn_id, sequence, at, origin, source, model_call_id,
+    worker_id, loop_id, turn_id, sequence, at, origin, source, inherited_history, model_call_id,
     op, delimiter, signal,
     scheme, username, password, hostname,
     port, pathname, query, fragment,
@@ -1560,72 +1690,168 @@ BEGIN
     SELECT RAISE(ABORT, 'log_entries ambient event identity may only be assigned once');
 END;
 
--- Immediate successful shared EDITs append their occurrence in the same SQL
--- statement that persists the receipt. Rows already carrying an event id are
--- observer/fork history and can never republish themselves.
+-- One relational projection owns activity eligibility, audience, and snapshot
+-- shape for both immediately-final and proposal-settlement paths.
+CREATE VIEW IF NOT EXISTS ambient_activity_candidates AS
+SELECT *
+FROM (
+    SELECT w.workspace_id,
+           le.worker_id AS producer_worker_id,
+           CASE
+               WHEN t.producer = '_plurnk' AND t.kind = 'operation' THEN NULL
+               ELSE w.parent_worker_id
+           END AS target_parent_worker_id,
+           CASE
+               WHEN le.state = 'resolved'
+                AND le.status_rx BETWEEN 200 AND 399
+                AND le.status_rx != 304
+                AND (
+                    (
+                        (
+                            le.op IN ('EDIT', 'KILL')
+                            OR (
+                                le.op = 'SEND'
+                                AND json_valid(le.signal)
+                                AND json_extract(le.signal, '$') = 410
+                            )
+                        )
+                        AND le.scheme = 'worker'
+                        AND le.hostname IS NULL
+                        AND le.pathname IS NOT NULL
+                    )
+                    OR (
+                        le.op IN ('COPY', 'MOVE')
+                        AND json_valid(le.rx)
+                        AND EXISTS (
+                            SELECT 1 FROM json_each(le.rx, '$.effects') effect
+                            WHERE json_type(effect.value) = 'object'
+                              AND substr(CAST(json_extract(effect.value, '$.target') AS TEXT), 1, 10) = 'worker:///'
+                        )
+                    )
+                )
+               THEN 1 ELSE 0
+           END AS workspace_broadcast,
+           le.id AS source_record_id,
+           le.at,
+           le.source,
+           le.op,
+           le.delimiter,
+           le.signal,
+           le.scheme,
+           le.username,
+           le.password,
+           le.hostname,
+           le.port,
+           le.pathname,
+           le.query,
+           le.fragment,
+           le.lineMarker AS line_marker,
+           le.tx,
+           le.mimetype_tx,
+           le.rx,
+           le.mimetype_rx,
+           le.status_rx,
+           le.state,
+           le.outcome,
+           json_remove(le.attrs, '$.__plurnk_curation') AS attrs,
+           COALESCE((
+               SELECT json_group_array(ordered.tag)
+               FROM (
+                   SELECT tag FROM log_tags WHERE log_entry_id = le.id ORDER BY tag
+               ) ordered
+           ), '[]') AS tags
+    FROM log_entries le
+    JOIN workers w ON w.id = le.worker_id
+    JOIN loops l ON l.id = le.loop_id
+    JOIN turns t ON t.id = le.turn_id
+    WHERE le.ambient_event_id IS NULL
+      AND le.inherited_history = 0
+      AND le.op IS NOT NULL
+      AND le.state != 'proposed'
+      AND NOT (
+          le.op = 'SEND'
+          AND le.scheme IS NULL
+          AND l.status IN (200, 413, 429, 499, 500, 504, 508)
+      )
+) candidate
+WHERE target_parent_worker_id IS NOT NULL OR workspace_broadcast = 1;
+
+-- Every final op-bearing child row is parent activity. A successful operation
+-- whose landed effects touch worker:/// additionally acquires the workspace
+-- audience. Observer rows and copied fork history cannot republish themselves.
 CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_insert
 AFTER INSERT ON log_entries
-WHEN NEW.ambient_event_id IS NULL
- AND NEW.op = 'EDIT'
- AND NEW.state = 'resolved'
- AND NEW.status_rx IN (200, 201)
- AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
- AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
- AND (
-     NEW.origin != '_plurnk'
-     OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
- )
+WHEN NEW.state != 'proposed'
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, at, source,
+        op, delimiter, signal,
+        scheme, username, password, hostname, port, pathname, query, fragment,
+        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+        state, outcome, attrs, tags
     )
-    SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
-           COALESCE((
-               SELECT json_group_array(ordered.tag)
-               FROM (
-                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
-               ) ordered
-           ), '[]'),
-           NEW.status_rx
-    FROM workers w
-    WHERE w.id = NEW.worker_id;
-    UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
+    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
+           workspace_broadcast, 'activity', source_record_id, at, source,
+           op, delimiter, signal,
+           scheme, username, password, hostname, port, pathname, query, fragment,
+           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+           state, outcome, attrs, tags
+    FROM ambient_activity_candidates
+    WHERE source_record_id = NEW.id;
+
+    UPDATE log_entries
+    SET ambient_event_id = (
+        SELECT id FROM ambient_events
+        WHERE producer_worker_id = NEW.worker_id
+          AND kind = 'activity'
+          AND source_record_id = NEW.id
+    )
+    WHERE id = NEW.id
+      AND EXISTS (
+          SELECT 1 FROM ambient_events
+          WHERE producer_worker_id = NEW.worker_id
+            AND kind = 'activity'
+            AND source_record_id = NEW.id
+      );
 END;
 
--- A proposed EDIT becomes an occurrence only when its one lifecycle transition
--- resolves successfully. Rejection, cancellation, and failed application publish nothing.
+-- A proposed operation becomes activity only when its lifecycle settles.
 CREATE TRIGGER IF NOT EXISTS log_entries_append_ambient_event_resolve
-AFTER UPDATE OF state, status_rx ON log_entries
-WHEN OLD.state = 'proposed'
- AND NEW.state = 'resolved'
- AND NEW.ambient_event_id IS NULL
- AND NEW.op = 'EDIT'
- AND NEW.status_rx IN (200, 201)
- AND (NEW.scheme IS NULL OR NEW.scheme != 'plurnk')
- AND (NEW.scheme IS NULL OR NEW.scheme != 'worker' OR NEW.hostname IS NULL OR NEW.hostname = 'plurnk')
- AND (
-     NEW.origin != '_plurnk'
-     OR EXISTS (SELECT 1 FROM workers w WHERE w.id = NEW.worker_id AND w.name = 'plurnk')
- )
+AFTER UPDATE OF state, status_rx, rx, outcome ON log_entries
+WHEN OLD.state = 'proposed' AND NEW.state != 'proposed'
 BEGIN
     INSERT INTO ambient_events (
-        workspace_id, producer_worker_id, kind, source_record_id, source,
-        op, scheme, hostname, pathname, rx, attrs, tags, status_rx
+        workspace_id, producer_worker_id, target_parent_worker_id,
+        workspace_broadcast, kind, source_record_id, at, source,
+        op, delimiter, signal,
+        scheme, username, password, hostname, port, pathname, query, fragment,
+        line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+        state, outcome, attrs, tags
     )
-    SELECT w.workspace_id, NEW.worker_id, 'edit', NEW.id, NEW.source,
-           'EDIT', NEW.scheme, NEW.hostname, NEW.pathname, NEW.rx, NEW.attrs,
-           COALESCE((
-               SELECT json_group_array(ordered.tag)
-               FROM (
-                   SELECT tag FROM log_tags WHERE log_entry_id = NEW.id ORDER BY tag
-               ) ordered
-           ), '[]'),
-           NEW.status_rx
-    FROM workers w
-    WHERE w.id = NEW.worker_id;
-    UPDATE log_entries SET ambient_event_id = last_insert_rowid() WHERE id = NEW.id;
+    SELECT workspace_id, producer_worker_id, target_parent_worker_id,
+           workspace_broadcast, 'activity', source_record_id, at, source,
+           op, delimiter, signal,
+           scheme, username, password, hostname, port, pathname, query, fragment,
+           line_marker, tx, mimetype_tx, rx, mimetype_rx, status_rx,
+           state, outcome, attrs, tags
+    FROM ambient_activity_candidates
+    WHERE source_record_id = NEW.id;
+
+    UPDATE log_entries
+    SET ambient_event_id = (
+        SELECT id FROM ambient_events
+        WHERE producer_worker_id = NEW.worker_id
+          AND kind = 'activity'
+          AND source_record_id = NEW.id
+    )
+    WHERE id = NEW.id
+      AND EXISTS (
+          SELECT 1 FROM ambient_events
+          WHERE producer_worker_id = NEW.worker_id
+            AND kind = 'activity'
+            AND source_record_id = NEW.id
+      );
 END;
 
 -- {§client-interactions}: the durable discoverable half of a client-owned
@@ -1652,7 +1878,8 @@ CREATE INDEX IF NOT EXISTS client_interactions_worker_id_id
 -- Durable subscription lifecycle per SPEC {§subscriptions}. The row records what
 -- the worker holds and routes cancellation to a separate process-local callable;
 -- it never serializes that callable. Closed rows persist for forensics; partial
--- unique index enforces one active subscription per (worker, entry).
+-- unique index enforces one active subscription per entry. The composite
+-- foreign key makes that entry part of the subscribing Worker's own space.
 CREATE TABLE IF NOT EXISTS subscriptions (
     id           INTEGER NOT NULL PRIMARY KEY,
     version      INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
@@ -1671,14 +1898,15 @@ CREATE TABLE IF NOT EXISTS subscriptions (
     closed_at    TEXT,
     close_status INTEGER          CHECK (close_status IS NULL OR (close_status BETWEEN 100 AND 599)),
     close_result TEXT             CHECK (close_result IS NULL OR json_valid(close_result)),
-    CHECK ((closed_at IS NULL AND close_status IS NULL)
-        OR (closed_at IS NOT NULL AND close_status IS NOT NULL)),
-    FOREIGN KEY (worker_id)   REFERENCES workers(id)    ON DELETE CASCADE,
-    FOREIGN KEY (entry_id) REFERENCES entries(id) ON DELETE CASCADE
+    channel_results TEXT          CHECK (channel_results IS NULL OR json_valid(channel_results)),
+    CHECK ((closed_at IS NULL AND close_status IS NULL AND close_result IS NULL AND channel_results IS NULL)
+        OR (closed_at IS NOT NULL AND close_status IS NOT NULL AND close_result IS NOT NULL AND channel_results IS NOT NULL)),
+    FOREIGN KEY (worker_id) REFERENCES workers(id) ON DELETE CASCADE,
+    FOREIGN KEY (entry_id, worker_id) REFERENCES entries(id, owner_id) ON DELETE CASCADE
 ) STRICT;
 
 CREATE UNIQUE INDEX IF NOT EXISTS subscriptions_active_one_per_entry
-    ON subscriptions (worker_id, entry_id)
+    ON subscriptions (entry_id)
     WHERE closed_at IS NULL;
 
 CREATE INDEX IF NOT EXISTS subscriptions_scheme_active
@@ -1689,13 +1917,26 @@ CREATE INDEX IF NOT EXISTS subscriptions_opened_at ON subscriptions (opened_at);
 
 CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_insert
 BEFORE INSERT ON subscriptions
+WHEN NEW.closed_at IS NOT NULL
+  OR NEW.close_status IS NOT NULL
+  OR NEW.close_result IS NOT NULL
+  OR NEW.channel_results IS NOT NULL
+BEGIN
+    SELECT RAISE(ABORT, 'subscription must open before it can settle');
+END;
+
+CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_update
+BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
 WHEN NOT (
-    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL)
+    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL AND NEW.channel_results IS NULL)
     OR (
         NEW.closed_at IS NOT NULL
         AND NEW.close_status IS NOT NULL
         AND NEW.close_result IS NOT NULL
+        AND NEW.channel_results IS NOT NULL
         AND json_valid(NEW.close_result)
+        AND json_valid(NEW.channel_results)
+        AND json_type(NEW.channel_results) = 'object'
         AND json_type(NEW.close_result, '$.status') = 'integer'
         AND json_extract(NEW.close_result, '$.status') = NEW.close_status
         AND (
@@ -1712,35 +1953,142 @@ BEGIN
     SELECT RAISE(ABORT, 'subscription terminal result violates the operation-result contract');
 END;
 
-CREATE TRIGGER IF NOT EXISTS subscriptions_result_contract_update
-BEFORE UPDATE OF closed_at, close_status, close_result ON subscriptions
-WHEN NOT (
-    (NEW.closed_at IS NULL AND NEW.close_status IS NULL AND NEW.close_result IS NULL)
-    OR (
-        NEW.closed_at IS NOT NULL
-        AND NEW.close_status IS NOT NULL
-        AND NEW.close_result IS NOT NULL
-        AND json_valid(NEW.close_result)
-        AND json_type(NEW.close_result, '$.status') = 'integer'
-        AND json_extract(NEW.close_result, '$.status') = NEW.close_status
-        AND (
-            (NEW.close_status < 400 AND json_type(NEW.close_result, '$.problem') IS NULL)
-            OR (
-                NEW.close_status >= 400
-                AND json_type(NEW.close_result, '$.problem') = 'object'
-                AND json_extract(NEW.close_result, '$.problem.status') = NEW.close_status
-            )
-        )
+-- A settlement may override the universal result for exact named channels.
+-- Unknown channels and malformed results fail before the subscription or any
+-- representation changes. The JS boundary additionally rejects projection
+-- fields that are structurally unavailable in ChannelProducerResult.
+CREATE TRIGGER IF NOT EXISTS subscriptions_channel_results_contract
+BEFORE UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
+WHEN NEW.closed_at IS NOT NULL AND (
+    EXISTS (
+        SELECT 1
+        FROM json_each(NEW.channel_results) AS channel_result
+        LEFT JOIN entry_channels ec
+          ON ec.entry_id = NEW.entry_id AND ec.name = channel_result.key
+        WHERE ec.name IS NULL
+           OR json_type(channel_result.value) != 'object'
+           OR json_type(channel_result.value, '$.status') != 'integer'
+           OR json_extract(channel_result.value, '$.status') NOT BETWEEN 200 AND 599
+           OR json_extract(channel_result.value, '$.status') = 202
+           OR (
+                json_extract(channel_result.value, '$.status') < 400
+                AND json_type(channel_result.value, '$.problem') IS NOT NULL
+           )
+           OR (
+                json_extract(channel_result.value, '$.status') >= 400
+                AND (
+                    json_type(channel_result.value, '$.problem') != 'object'
+                    OR json_extract(channel_result.value, '$.problem.status')
+                        != json_extract(channel_result.value, '$.status')
+                )
+           )
     )
 )
 BEGIN
-    SELECT RAISE(ABORT, 'subscription terminal result violates the operation-result contract');
+    SELECT RAISE(ABORT, 'subscription channel result violates the channel producer contract');
+END;
+
+-- Subscription settlement is the single atomic transition that closes the
+-- lifecycle and installs current terminal producer evidence on every channel.
+-- Overrides are exact; all other channels inherit the universal result.
+CREATE TRIGGER IF NOT EXISTS subscriptions_settle_channels
+AFTER UPDATE OF closed_at, close_status, close_result, channel_results ON subscriptions
+WHEN OLD.closed_at IS NULL AND NEW.closed_at IS NOT NULL
+BEGIN
+    UPDATE entry_channels
+    SET producer_result = COALESCE(
+            (
+                SELECT json(channel_result.value)
+                FROM json_each(NEW.channel_results) AS channel_result
+                WHERE channel_result.key = entry_channels.name
+            ),
+            NEW.close_result
+        ),
+        state = CASE WHEN json_extract(
+            COALESCE(
+                (
+                    SELECT json(channel_result.value)
+                    FROM json_each(NEW.channel_results) AS channel_result
+                    WHERE channel_result.key = entry_channels.name
+                ),
+                NEW.close_result
+            ),
+            '$.status'
+        ) >= 400 THEN 'errored' ELSE 'closed' END
+    WHERE entry_id = NEW.entry_id;
+END;
+
+-- One durable publication cursor per selected subscription channel. Log rows
+-- are curated model context and therefore cannot own this lifecycle fact.
+-- The row survives KILLing any generated observation and disappears only with
+-- its subscription. {§exec-stream}
+CREATE TABLE IF NOT EXISTS subscription_publications (
+    id                 INTEGER NOT NULL PRIMARY KEY,
+    version            INTEGER NOT NULL DEFAULT 0 CHECK (version >= 0),
+    subscription_id    INTEGER NOT NULL,
+    channel            TEXT    NOT NULL CHECK (length(channel) > 0),
+    published_end      INTEGER NOT NULL DEFAULT 0 CHECK (published_end >= 0),
+    terminal_published INTEGER NOT NULL DEFAULT 0 CHECK (terminal_published IN (0, 1)),
+    UNIQUE (subscription_id, channel),
+    FOREIGN KEY (subscription_id) REFERENCES subscriptions(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS subscription_publications_pending
+    ON subscription_publications (subscription_id, terminal_published);
+
+CREATE TRIGGER IF NOT EXISTS subscriptions_seed_publications
+AFTER INSERT ON subscriptions
+BEGIN
+    INSERT INTO subscription_publications (subscription_id, channel)
+    SELECT NEW.id, ec.name
+    FROM entry_channels ec
+    WHERE ec.entry_id = NEW.entry_id
+      AND (NEW.published_channel IS NULL OR ec.name = NEW.published_channel);
+
+    SELECT CASE WHEN NOT EXISTS (
+        SELECT 1 FROM subscription_publications WHERE subscription_id = NEW.id
+    ) THEN RAISE(ABORT, 'subscription has no publishable channel') END;
+END;
+
+-- The generated READ and its cursor transition are one SQLite statement. A
+-- later log KILL removes evidence from active context without rewinding the
+-- subscription/channel publication state. {§exec-stream}
+CREATE TRIGGER IF NOT EXISTS log_entries_advance_subscription_publication
+AFTER INSERT ON log_entries
+WHEN NEW.subscription_publication_id IS NOT NULL
+BEGIN
+    SELECT CASE WHEN
+        NEW.origin != '_plurnk'
+        OR NEW.op != 'READ'
+        OR json_type(NEW.attrs, '$.streamEnd') != 'integer'
+        OR json_extract(NEW.attrs, '$.streamEnd') < 0
+        OR json_type(NEW.attrs, '$.terminal') NOT IN ('true', 'false')
+    THEN RAISE(ABORT, 'subscription publication requires one canonical stream observation') END;
+
+    UPDATE subscription_publications
+    SET published_end = json_extract(NEW.attrs, '$.streamEnd'),
+        terminal_published = json_extract(NEW.attrs, '$.terminal'),
+        version = version + 1
+    WHERE id = NEW.subscription_publication_id
+      AND terminal_published = 0
+      AND (
+          (json_extract(NEW.attrs, '$.terminal') = 0
+              AND json_extract(NEW.attrs, '$.streamEnd') > published_end)
+          OR
+          (json_extract(NEW.attrs, '$.terminal') = 1
+              AND json_extract(NEW.attrs, '$.streamEnd') >= published_end)
+      );
+
+    SELECT CASE WHEN changes() != 1
+        THEN RAISE(ABORT, 'subscription publication transition is stale or already terminal')
+    END;
 END;
 
 -- (worker_watermarks removed — {§env-delta} is now pull-from-log, no per-worker snapshot.)
 
 -- workspace_constraints
--- SPEC {§membership} constraint overlay — the client's supersede over git membership.
+-- SPEC {§membership} constraint overlay — explicit policy and the inspectable
+-- exact pick produced by accepted file creation share one representation.
 -- Per (workspace, effect, glob/target): `pick` (members git misses, resolved by a
 -- targeted client-dictated scan), `hide` (drop git-tracked matches), `view` (member
 -- for read; File.edit rejects the write). git-absent, `pick` rows are the sole substrate
@@ -1749,6 +2097,8 @@ CREATE TABLE IF NOT EXISTS workspace_constraints (
     workspace_id INTEGER NOT NULL,
     effect     TEXT    NOT NULL CHECK (effect IN ('pick', 'hide', 'view')),
     glob       TEXT    NOT NULL,
+    source     TEXT    NOT NULL CHECK (source IN ('explicit', 'create')),
+    CHECK (source = 'explicit' OR effect = 'pick'),
     PRIMARY KEY (workspace_id, effect, glob),
     FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
 ) STRICT, WITHOUT ROWID;