@sekiban/create-dcb 0.0.0-stage → 0.1.1

package/template/migrations/d1/g32/0003_g58_safe_lane_health.sql

@@ -0,0 +1,12 @@
+-- SDT-G58 safe-lane operational health. This is intentionally an additive
+-- pipeline-D1 migration: the runtime never performs DDL, and the row records
+-- the last *scheduled* coverage decision rather than inferring it from a
+-- request-time read.
+CREATE TABLE serialized_dcb_safe_lane_health (
+  service_id TEXT PRIMARY KEY,
+  coverage_kind TEXT NOT NULL CHECK (coverage_kind IN ('SETTLED', 'BLOCK/UNSETTLED')),
+  coverage_reason TEXT,
+  coverage_partition_tag TEXT COLLATE BINARY,
+  settled_frontier_suid TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  observed_at INTEGER NOT NULL
+);

package/template/migrations/d1/g32/0004_g58_live_poll_health.sql

@@ -0,0 +1,18 @@
+-- SDT-G58 AC5 live-poll lifecycle diagnostics.  This is additive and
+-- observation-only: projection checkpoints and all SafeWindow/fence decisions
+-- remain in their existing tables and transactions.
+CREATE TABLE serialized_dcb_live_poll_health (
+  service_id TEXT NOT NULL,
+  projector_id TEXT NOT NULL,
+  attempted_at INTEGER NOT NULL,
+  outcome TEXT NOT NULL CHECK (outcome IN (
+    'never-invoked',
+    'invoked-and-threw',
+    'invoked-but-no-work',
+    'explicitly-gated',
+    'advanced'
+  )),
+  reason TEXT,
+  advanced_source_events INTEGER NOT NULL DEFAULT 0 CHECK (advanced_source_events >= 0),
+  PRIMARY KEY (service_id, projector_id)
+);

package/template/migrations/d1/g32/0005_g58_safe_lane_history.sql

@@ -0,0 +1,18 @@
+-- SDT-G58 AC1 scheduled safe-lane history.  This is append-only evidence of
+-- the coverage decision made by each cron tick.  An empty frontier is an
+-- explicit record of a tick for which no proven FULL frontier existed; the
+-- health guard treats that value as red rather than substituting an MV head.
+CREATE TABLE serialized_dcb_safe_lane_history (
+  service_id TEXT NOT NULL,
+  tick_id TEXT NOT NULL COLLATE BINARY,
+  coverage_kind TEXT NOT NULL CHECK (coverage_kind IN ('SETTLED', 'BLOCK/UNSETTLED')),
+  coverage_reason TEXT,
+  coverage_partition_tag TEXT COLLATE BINARY,
+  settled_frontier_suid TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  observed_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, tick_id),
+  UNIQUE (service_id, observed_at)
+);
+
+CREATE INDEX serialized_dcb_safe_lane_history_service_observed
+  ON serialized_dcb_safe_lane_history (service_id, observed_at ASC, tick_id COLLATE BINARY ASC);

package/template/migrations/d1/g32/0006_g60_durable_hop_measurements.sql

@@ -0,0 +1,31 @@
+-- SDT-G60 AC1 operational hop ledger.
+--
+-- This table is intentionally outside the logical event record and has no
+-- foreign key to dcb_events: command receipt is captured before downstream
+-- delivery creates the global event row. Stable EventId/SUID/attempt identity
+-- is retained in every stage row; no protocol or public response reads it.
+CREATE TABLE serialized_dcb_hop_measurements (
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  stage TEXT NOT NULL CHECK (stage IN (
+    'command-receipt',
+    'tag-append-committed',
+    'outbox-obligation-written',
+    'queue-send-returned',
+    'consumer-invocation-started',
+    'record-delivery-batch-committed',
+    'first-unsafe-visible-read'
+  )),
+  partition_tag TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  view_id TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  transport TEXT NOT NULL CHECK (transport IN ('', 'queue', 'fast', 'import', 'public-read')),
+  observed_at INTEGER NOT NULL CHECK (observed_at >= 0),
+  PRIMARY KEY (service_id, event_id, stage, partition_tag, view_id, transport)
+);
+
+CREATE INDEX serialized_dcb_hop_measurements_service_event_idx
+  ON serialized_dcb_hop_measurements (service_id, event_id COLLATE BINARY, observed_at ASC);
+CREATE INDEX serialized_dcb_hop_measurements_service_time_idx
+  ON serialized_dcb_hop_measurements (service_id, observed_at ASC, stage COLLATE BINARY);

package/template/migrations/d1/g32/0007_g60_post_admission_decomposition.sql

@@ -0,0 +1,30 @@
+-- SDT-G60 post-admission decomposition observations.
+--
+-- This is a separate append-only operational ledger so the original seven-hop
+-- table and its deployed schema remain unchanged. Every row retains the exact
+-- event/SUID/attempt identity; no protocol path reads this table.
+CREATE TABLE serialized_dcb_hop_submeasurements (
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  stage TEXT NOT NULL CHECK (stage IN (
+    'post-record-delivery-global-receipt-readback',
+    'source-tag-acknowledgement',
+    'completeness-coverage',
+    'detector',
+    'unsafe-view-apply'
+  )),
+  boundary TEXT NOT NULL CHECK (boundary IN ('start', 'end')),
+  outcome TEXT NOT NULL CHECK (length(outcome) > 0),
+  partition_tag TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  view_id TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  transport TEXT NOT NULL CHECK (transport IN ('', 'queue', 'fast', 'import', 'public-read')),
+  observed_at INTEGER NOT NULL CHECK (observed_at >= 0),
+  PRIMARY KEY (service_id, event_id, stage, boundary, partition_tag, view_id, transport)
+);
+
+CREATE INDEX serialized_dcb_hop_submeasurements_service_event_idx
+  ON serialized_dcb_hop_submeasurements (service_id, event_id COLLATE BINARY, observed_at ASC);
+CREATE INDEX serialized_dcb_hop_submeasurements_service_time_idx
+  ON serialized_dcb_hop_submeasurements (service_id, observed_at ASC, stage COLLATE BINARY, boundary COLLATE BINARY);

package/template/migrations/d1/g32/0008_g60_unsafe_writer_boundaries.sql

@@ -0,0 +1,24 @@
+-- SDT-G60 concrete unsafe-row writer boundaries.
+--
+-- This is observation-only. It has no foreign keys and is never read by
+-- admission, Queue acknowledgement, projection fencing, or public reads.
+-- Each row retains the exact event/SUID/attempt/view identity and names the
+-- concrete path at the unsafe apply boundary.
+CREATE TABLE serialized_dcb_unsafe_writer_boundaries (
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  writer_path TEXT NOT NULL CHECK (writer_path IN ('inline-delivery', 'scheduled-drain')),
+  boundary TEXT NOT NULL CHECK (boundary IN ('start', 'end')),
+  outcome TEXT NOT NULL CHECK (length(outcome) > 0),
+  view_id TEXT NOT NULL COLLATE BINARY,
+  transport TEXT NOT NULL CHECK (transport IN ('', 'queue', 'fast', 'import', 'scheduled')),
+  observed_at INTEGER NOT NULL CHECK (observed_at >= 0),
+  PRIMARY KEY (service_id, event_id, writer_path, view_id, boundary, transport)
+);
+
+CREATE INDEX serialized_dcb_unsafe_writer_boundaries_service_event_idx
+  ON serialized_dcb_unsafe_writer_boundaries (service_id, event_id COLLATE BINARY, observed_at ASC);
+CREATE INDEX serialized_dcb_unsafe_writer_boundaries_service_time_idx
+  ON serialized_dcb_unsafe_writer_boundaries (service_id, observed_at ASC, writer_path COLLATE BINARY, view_id COLLATE BINARY);

package/template/migrations/d1/g32/0009_g65_admission_attempts.sql

@@ -0,0 +1,23 @@
+-- SDT-G65 admission timing and outcome observations.
+--
+-- This is an operational ledger only.  No admission, Queue, projection, or
+-- public response path reads it.  The clock is the Worker wall clock captured
+-- at the boundary (`Date.now()`, epoch milliseconds); it is intentionally not
+-- confused with an authored event timestamp or D1's received_at value.
+CREATE TABLE serialized_dcb_g65_admission_attempts (
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  partition_tag TEXT NOT NULL COLLATE BINARY,
+  delivery_source TEXT NOT NULL CHECK (delivery_source IN ('fast')),
+  admission_started_at INTEGER NOT NULL CHECK (admission_started_at >= 0),
+  admission_finished_at INTEGER NOT NULL CHECK (admission_finished_at >= admission_started_at),
+  outcome TEXT NOT NULL CHECK (outcome IN ('admitted', 'not-admitted', 'unknown')),
+  global_completion_observed_at INTEGER,
+  clock_origin TEXT NOT NULL CHECK (clock_origin = 'Date.now epoch ms'),
+  PRIMARY KEY (service_id, event_id, attempt_id, delivery_source, admission_started_at)
+);
+
+CREATE INDEX serialized_dcb_g65_admission_attempts_service_time_idx
+  ON serialized_dcb_g65_admission_attempts (service_id, admission_started_at ASC, event_id COLLATE BINARY);

package/template/migrations/d1/g32/0010_g65_direct_rings.sql

@@ -0,0 +1,26 @@
+-- SDT-G65 AC0 receiver ring/apply ledger.
+--
+-- The ring is the only receiver work awaited by the Tag Durable Object.  The
+-- message bytes are retained before the RPC returns; the receiver then reads
+-- this durable row from its own execution context and performs the existing
+-- idempotent D1 delivery/apply.  This table is diagnostic/transport state, not
+-- an event or admission authority.
+CREATE TABLE serialized_dcb_g65_direct_rings (
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  partition_tag TEXT NOT NULL COLLATE BINARY,
+  message_json TEXT NOT NULL,
+  ring_started_at INTEGER NOT NULL CHECK (ring_started_at >= 0),
+  ring_finished_at INTEGER NOT NULL CHECK (ring_finished_at >= ring_started_at),
+  ring_outcome TEXT NOT NULL CHECK (ring_outcome IN ('rung', 'duplicate')),
+  apply_started_at INTEGER,
+  apply_finished_at INTEGER,
+  apply_outcome TEXT,
+  apply_error TEXT,
+  PRIMARY KEY (service_id, event_id, attempt_id)
+);
+
+CREATE INDEX serialized_dcb_g65_direct_rings_service_time_idx
+  ON serialized_dcb_g65_direct_rings (service_id, ring_finished_at ASC, event_id COLLATE BINARY);

package/template/migrations/d1/g32/0011_g67_safe_lane_passes.sql

@@ -0,0 +1,25 @@
+-- SDT-G67 AC1/AC6 event-driven safe-lane pass provenance.
+-- This is observation-only: no safe frontier or Queue decision reads this
+-- table.  A row is created before a kick is started and then updated through
+-- the pass lifecycle so a missing kick, coalesced request, or failed pass is
+-- distinguishable from a completed pass.
+CREATE TABLE serialized_dcb_safe_lane_passes (
+  service_id TEXT NOT NULL,
+  pass_id TEXT NOT NULL COLLATE BINARY,
+  trigger TEXT NOT NULL CHECK (trigger IN ('kick', 'cron')),
+  status TEXT NOT NULL CHECK (status IN ('scheduled', 'running', 'completed', 'failed', 'coalesced')),
+  scheduled_at INTEGER NOT NULL,
+  started_at INTEGER,
+  completed_at INTEGER,
+  coverage_kind TEXT CHECK (coverage_kind IS NULL OR coverage_kind IN ('SETTLED', 'BLOCK/UNSETTLED')),
+  coverage_reason TEXT,
+  coverage_partition_tag TEXT COLLATE BINARY,
+  settled_frontier_suid TEXT COLLATE BINARY,
+  safe_heads_before_json TEXT,
+  safe_heads_after_json TEXT,
+  error TEXT,
+  PRIMARY KEY (service_id, pass_id)
+);
+
+CREATE INDEX serialized_dcb_safe_lane_passes_service_scheduled
+  ON serialized_dcb_safe_lane_passes (service_id, scheduled_at ASC, pass_id COLLATE BINARY ASC);

package/template/migrations/d1/g32/0012_g67_safe_lane_pass_ownership.sql

@@ -0,0 +1,20 @@
+-- SDT-G67 AC4 durable ownership and effective catch-up attribution.
+-- These columns are observation-only.  The G44 frontier and Queue
+-- disposition never read this table.
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN delivery_event_id TEXT COLLATE BINARY;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN delivery_attempt_id TEXT COLLATE BINARY;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN delivery_partition_tag TEXT COLLATE BINARY;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN delivery_obligation_sequence INTEGER;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN catch_up_started_at INTEGER;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN catch_up_completed_at INTEGER;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN catch_up_outcome TEXT;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN catch_up_error TEXT;
+
+CREATE INDEX serialized_dcb_safe_lane_passes_delivery_identity
+  ON serialized_dcb_safe_lane_passes (
+    service_id,
+    delivery_partition_tag COLLATE BINARY,
+    delivery_obligation_sequence,
+    scheduled_at ASC,
+    pass_id COLLATE BINARY ASC
+  );

package/template/migrations/d1/g32/0013_g67_safe_lane_catch_up_observations.sql

@@ -0,0 +1,6 @@
+-- SDT-G67 AC4 observation-only catch-up result attribution.
+-- These columns identify the exact Queue delivery SUID and the observed
+-- SafeWindow/MV result.  No safe-lane admission, frontier, or Queue decision
+-- reads them.
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN delivery_suid TEXT COLLATE BINARY;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN catch_up_result_json TEXT;

package/template/migrations/d1/g32/0014_g67_safe_lane_fence_expiry.sql

@@ -0,0 +1,6 @@
+-- SDT-G67 amended AC1 fence-expiry and coverage-retry provenance.
+-- These fields are observation-only. They never participate in G44
+-- certification, Queue disposition, MV advancement, or public reads.
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN trigger_kind TEXT CHECK (trigger_kind IS NULL OR trigger_kind IN ('delivery', 'fence-expiry', 'coverage-retry', 'cron', 'kick'));
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN stop_deadline_at INTEGER;
+ALTER TABLE serialized_dcb_safe_lane_passes ADD COLUMN stop_reason TEXT;

package/template/migrations/d1/g32/0015_g69_admission_attempts.sql

@@ -0,0 +1,33 @@
+-- SDT-G69 AC3 append-only per-recordDelivery admission-attempt evidence.
+-- This table is diagnostic only. No Queue, retry, G44, MV, or public-read
+-- path may use it as an authority.
+CREATE TABLE serialized_dcb_g69_admission_attempts (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  partition_tag TEXT NOT NULL COLLATE BINARY,
+  delivery_source TEXT NOT NULL CHECK (delivery_source IN ('queue', 'fast', 'import')),
+  queue_message_id TEXT NOT NULL COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  allocator_lineage_id TEXT NOT NULL COLLATE BINARY,
+  obligation_sequence INTEGER NOT NULL CHECK (obligation_sequence >= 1),
+  enqueued_at INTEGER NOT NULL,
+  observed_at INTEGER NOT NULL,
+  arrived_at INTEGER NOT NULL,
+  first_arrived_at_before INTEGER,
+  last_arrived_at_before INTEGER,
+  first_arrived_at_after INTEGER,
+  last_arrived_at_after INTEGER,
+  receipt_status TEXT NOT NULL CHECK (receipt_status IN ('stored', 'duplicate', 'suid-collision', 'lineage-mismatch', 'failed')),
+  retry_reason TEXT,
+  clock_origin TEXT NOT NULL CHECK (clock_origin = 'Date.now epoch ms')
+);
+
+CREATE INDEX serialized_dcb_g69_admission_attempts_identity_idx
+  ON serialized_dcb_g69_admission_attempts
+     (service_id, event_id COLLATE BINARY, sequence ASC);
+
+CREATE INDEX serialized_dcb_g69_admission_attempts_arrival_idx
+  ON serialized_dcb_g69_admission_attempts
+     (service_id, partition_tag COLLATE BINARY, observed_at ASC);

package/template/migrations/d1/g32/0016_g69_consultation003.sql

@@ -0,0 +1,12 @@
+-- SDT-G69 consultation-003: diagnostic observation is non-blocking and
+-- ordering detection trusts only normal delivery timestamps.
+-- Existing rows are deliberately marked unknown: imported/repaired history
+-- cannot be promoted to a safety witness after the fact.
+ALTER TABLE serialized_dcb_g69_admission_attempts ADD COLUMN before_observed_at INTEGER;
+ALTER TABLE serialized_dcb_g69_admission_attempts ADD COLUMN after_observed_at INTEGER;
+ALTER TABLE serialized_dcb_g69_admission_attempts ADD COLUMN observation_consistency TEXT NOT NULL DEFAULT 'unverified';
+ALTER TABLE dcb_event_ops ADD COLUMN FirstArrivedSource TEXT NOT NULL DEFAULT 'unknown';
+ALTER TABLE dcb_event_ops ADD COLUMN LastArrivedSource TEXT NOT NULL DEFAULT 'unknown';
+
+CREATE INDEX serialized_dcb_g69_admission_attempts_retention_idx
+  ON serialized_dcb_g69_admission_attempts (service_id, sequence DESC);

package/template/migrations/d1/g32/0017_g69_receipt_identity.sql

@@ -0,0 +1,61 @@
+-- SDT-G69 F5: keep the diagnostic Queue wrapper identity distinct from the
+-- envelope attempt identity. Direct delivery has no Queue wrapper, so its
+-- queue_message_id is intentionally nullable. This table remains diagnostic;
+-- no admission, retry, G44 or safe-lane path reads it.
+DROP INDEX IF EXISTS serialized_dcb_g69_admission_attempts_identity_idx;
+DROP INDEX IF EXISTS serialized_dcb_g69_admission_attempts_arrival_idx;
+DROP INDEX IF EXISTS serialized_dcb_g69_admission_attempts_retention_idx;
+ALTER TABLE serialized_dcb_g69_admission_attempts RENAME TO serialized_dcb_g69_admission_attempts_legacy;
+
+CREATE TABLE serialized_dcb_g69_admission_attempts (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  service_id TEXT NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  partition_tag TEXT NOT NULL COLLATE BINARY,
+  delivery_source TEXT NOT NULL CHECK (delivery_source IN ('queue', 'fast', 'import')),
+  queue_message_id TEXT COLLATE BINARY,
+  attempt_id TEXT NOT NULL COLLATE BINARY,
+  allocator_lineage_id TEXT NOT NULL COLLATE BINARY,
+  obligation_sequence INTEGER NOT NULL CHECK (obligation_sequence >= 1),
+  enqueued_at INTEGER NOT NULL,
+  observed_at INTEGER NOT NULL,
+  arrived_at INTEGER NOT NULL,
+  first_arrived_at_before INTEGER,
+  last_arrived_at_before INTEGER,
+  first_arrived_at_after INTEGER,
+  last_arrived_at_after INTEGER,
+  before_observed_at INTEGER,
+  after_observed_at INTEGER,
+  observation_consistency TEXT NOT NULL DEFAULT 'unverified',
+  receipt_status TEXT NOT NULL CHECK (receipt_status IN ('stored', 'duplicate', 'suid-collision', 'lineage-mismatch', 'failed')),
+  retry_reason TEXT,
+  clock_origin TEXT NOT NULL CHECK (clock_origin = 'Date.now epoch ms')
+);
+
+INSERT INTO serialized_dcb_g69_admission_attempts (
+  sequence, service_id, event_id, suid, partition_tag, delivery_source,
+  queue_message_id, attempt_id, allocator_lineage_id, obligation_sequence,
+  enqueued_at, observed_at, arrived_at, first_arrived_at_before,
+  last_arrived_at_before, first_arrived_at_after, last_arrived_at_after,
+  before_observed_at, after_observed_at, observation_consistency,
+  receipt_status, retry_reason, clock_origin
+)
+SELECT sequence, service_id, event_id, suid, partition_tag, delivery_source,
+       queue_message_id, attempt_id, allocator_lineage_id, obligation_sequence,
+       enqueued_at, observed_at, arrived_at, first_arrived_at_before,
+       last_arrived_at_before, first_arrived_at_after, last_arrived_at_after,
+       before_observed_at, after_observed_at, observation_consistency,
+       receipt_status, retry_reason, clock_origin
+  FROM serialized_dcb_g69_admission_attempts_legacy;
+
+DROP TABLE serialized_dcb_g69_admission_attempts_legacy;
+
+CREATE INDEX serialized_dcb_g69_admission_attempts_identity_idx
+  ON serialized_dcb_g69_admission_attempts
+     (service_id, event_id COLLATE BINARY, sequence ASC);
+CREATE INDEX serialized_dcb_g69_admission_attempts_arrival_idx
+  ON serialized_dcb_g69_admission_attempts
+     (service_id, partition_tag COLLATE BINARY, observed_at ASC);
+CREATE INDEX serialized_dcb_g69_admission_attempts_retention_idx
+  ON serialized_dcb_g69_admission_attempts (service_id, sequence DESC);

package/template/migrations/d1/g32/0018_g69_mutation_evidence.sql

@@ -0,0 +1,5 @@
+-- SDT-G69 F5: retain the mutation-owned first-admission witness separately
+-- from the diagnostic pre-read. The admission batch populates it atomically;
+-- a diagnostic receipt may never infer duplicate status from a late read.
+ALTER TABLE dcb_event_ops ADD COLUMN FirstAdmissionAttemptId TEXT;
+ALTER TABLE dcb_event_ops ADD COLUMN LastAdmissionAttemptId TEXT;

package/template/migrations/d1/g32/0019_g69_mutation_receipt_label.sql

@@ -0,0 +1,6 @@
+-- SDT-G69 F5: expose the mutation-owned classification on the append-only
+-- diagnostic receipt. A late/failed diagnostic read is never allowed to infer
+-- duplicate admission.
+ALTER TABLE serialized_dcb_g69_admission_attempts
+  ADD COLUMN mutation_evidence TEXT NOT NULL DEFAULT 'unverified'
+  CHECK (mutation_evidence IN ('first-admission', 'duplicate-admission', 'unverified'));

package/template/migrations/d1/g32/0020_g69_hotpath_costs.sql

@@ -0,0 +1,6 @@
+-- SDT-G69 W167: retain diagnostic cost without making diagnostic work part of
+-- the durable admission response. The value is the elapsed observation and
+-- receipt-preparation time before the append is issued, measured with the
+-- same Date.now epoch clock as the receipt. It is diagnostic only.
+ALTER TABLE serialized_dcb_g69_admission_attempts
+  ADD COLUMN diagnostic_duration_ms INTEGER;

package/template/migrations/mv/0001_materialized_views.sql

@@ -0,0 +1,87 @@
+-- SDT-G19 versioned MV schema. Runtime code never executes DDL.
+-- Pipeline D1 and MV D1 are separate bindings; checkpoints live beside rows.
+CREATE TABLE mv_instances (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active', 'candidate', 'retired')),
+  last_suid TEXT NOT NULL COLLATE BINARY,
+  definition_version INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id, generation)
+);
+
+CREATE UNIQUE INDEX mv_instances_active_idx
+  ON mv_instances (service_id, view_id, status)
+  WHERE status = 'active';
+
+CREATE TABLE mv_active_generations (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+);
+
+CREATE TABLE mv_rows (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  row_key TEXT NOT NULL COLLATE BINARY,
+  value_json TEXT NOT NULL,
+  row_version INTEGER NOT NULL,
+  source_suid TEXT NOT NULL COLLATE BINARY,
+  PRIMARY KEY (service_id, view_id, generation, row_key),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+    ON DELETE CASCADE
+);
+CREATE INDEX mv_rows_generation_idx
+  ON mv_rows (service_id, view_id, generation, row_key COLLATE BINARY);
+
+CREATE TABLE mv_index_entries (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  index_id TEXT NOT NULL COLLATE BINARY,
+  value_type TEXT NOT NULL CHECK (value_type IN ('text', 'integer', 'real')),
+  text_value TEXT COLLATE BINARY,
+  integer_value INTEGER,
+  real_value REAL,
+  row_key TEXT NOT NULL COLLATE BINARY,
+  PRIMARY KEY (service_id, view_id, generation, index_id, value_type,
+               text_value, integer_value, real_value, row_key),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+    ON DELETE CASCADE,
+  CHECK (
+    (value_type = 'text' AND text_value IS NOT NULL AND integer_value IS NULL AND real_value IS NULL)
+    OR (value_type = 'integer' AND text_value IS NULL AND integer_value IS NOT NULL AND real_value IS NULL)
+    OR (value_type = 'real' AND text_value IS NULL AND integer_value IS NULL AND real_value IS NOT NULL)
+  )
+);
+
+CREATE INDEX mv_index_entries_typed_idx
+  ON mv_index_entries (
+    service_id, view_id, generation, index_id, value_type,
+    text_value COLLATE BINARY, integer_value, real_value, row_key COLLATE BINARY
+  );
+
+-- SQLite permits NULLs in an ordinary composite primary key. This expression
+-- index makes the nullable typed columns behave as one typed value for
+-- idempotent index insertion while retaining the public typed columns above.
+CREATE UNIQUE INDEX mv_index_entries_unique_typed_idx
+  ON mv_index_entries (
+    service_id, view_id, generation, index_id, value_type,
+    COALESCE(text_value, CAST(integer_value AS TEXT), CAST(real_value AS TEXT)),
+    row_key COLLATE BINARY
+  );
+
+-- A NOT NULL guard row is inserted and deleted in each atomic batch.  A stale
+-- CAS selects NULL, causing the batch to abort before any mutation executes.
+CREATE TABLE mv_atomic_guards (
+  operation_id TEXT PRIMARY KEY COLLATE BINARY,
+  checkpoint_match INTEGER NOT NULL CHECK (checkpoint_match = 1)
+);

package/template/migrations/mv/0002_unsafe_window_materialized_views.sql

@@ -0,0 +1,58 @@
+-- SDT-G23 unsafe-window layer.  This is deliberately a new migration: 0001
+-- is already applied to deployed G19/G20 MV databases and Wrangler keys its
+-- migration ledger by filename.
+CREATE TABLE mv_unsafe_rows (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  row_key TEXT NOT NULL COLLATE BINARY,
+  value_json TEXT NOT NULL,
+  row_version INTEGER NOT NULL,
+  source_suid TEXT NOT NULL COLLATE BINARY,
+  tombstone INTEGER NOT NULL DEFAULT 0 CHECK (tombstone IN (0, 1)),
+  PRIMARY KEY (service_id, view_id, generation, row_key),
+  FOREIGN KEY (service_id, view_id, generation) REFERENCES mv_instances (service_id, view_id, generation) ON DELETE CASCADE
+);
+CREATE INDEX mv_unsafe_rows_generation_idx ON mv_unsafe_rows (service_id, view_id, generation, row_key COLLATE BINARY);
+
+CREATE TABLE mv_unsafe_index_entries (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  index_id TEXT NOT NULL COLLATE BINARY,
+  value_type TEXT NOT NULL CHECK (value_type IN ('text', 'integer', 'real')),
+  text_value TEXT COLLATE BINARY,
+  integer_value INTEGER,
+  real_value REAL,
+  row_key TEXT NOT NULL COLLATE BINARY,
+  PRIMARY KEY (service_id, view_id, generation, index_id, value_type, text_value, integer_value, real_value, row_key),
+  FOREIGN KEY (service_id, view_id, generation) REFERENCES mv_instances (service_id, view_id, generation) ON DELETE CASCADE,
+  CHECK ((value_type = 'text' AND text_value IS NOT NULL AND integer_value IS NULL AND real_value IS NULL) OR (value_type = 'integer' AND text_value IS NULL AND integer_value IS NOT NULL AND real_value IS NULL) OR (value_type = 'real' AND text_value IS NULL AND integer_value IS NULL AND real_value IS NOT NULL))
+);
+CREATE INDEX mv_unsafe_index_entries_typed_idx ON mv_unsafe_index_entries (service_id, view_id, generation, index_id, value_type, text_value COLLATE BINARY, integer_value, real_value, row_key COLLATE BINARY);
+
+CREATE TABLE mv_unsafe_receipts (
+  service_id TEXT NOT NULL, view_id TEXT NOT NULL COLLATE BINARY,
+  event_id TEXT NOT NULL COLLATE BINARY, suid TEXT NOT NULL COLLATE BINARY,
+  outcome TEXT NOT NULL CHECK (outcome IN ('applied', 'older', 'patch-not-found', 'delete-without-row', 'no-change')),
+  observed_at INTEGER NOT NULL, PRIMARY KEY (service_id, view_id, event_id, suid)
+);
+CREATE TABLE mv_unsafe_markers (
+  service_id TEXT NOT NULL, view_id TEXT NOT NULL COLLATE BINARY, generation INTEGER NOT NULL,
+  row_key TEXT NOT NULL COLLATE BINARY, event_id TEXT NOT NULL COLLATE BINARY, suid TEXT NOT NULL COLLATE BINARY,
+  reason TEXT NOT NULL CHECK (reason IN ('patch-not-found', 'delete-without-row', 'no-change', 'older')),
+  PRIMARY KEY (service_id, view_id, generation, row_key, event_id, suid, reason)
+);
+CREATE TABLE mv_unsafe_arrivals (
+  service_id TEXT NOT NULL, view_id TEXT NOT NULL COLLATE BINARY, generation INTEGER NOT NULL,
+  safe_head TEXT NOT NULL COLLATE BINARY DEFAULT '', arrival_watermark TEXT NOT NULL COLLATE BINARY DEFAULT '',
+  behind_frontier_event_id TEXT COLLATE BINARY, behind_frontier_suid TEXT COLLATE BINARY,
+  rebuild_required INTEGER NOT NULL DEFAULT 0 CHECK (rebuild_required IN (0, 1)),
+  PRIMARY KEY (service_id, view_id, generation)
+);
+CREATE TABLE mv_unsafe_kicks (
+  service_id TEXT NOT NULL, view_id TEXT NOT NULL COLLATE BINARY,
+  target_suid TEXT NOT NULL COLLATE BINARY DEFAULT '', lease_owner TEXT COLLATE BINARY,
+  lease_until INTEGER NOT NULL DEFAULT 0, dirty INTEGER NOT NULL DEFAULT 0 CHECK (dirty IN (0, 1)),
+  PRIMARY KEY (service_id, view_id)
+);

package/template/migrations/mv/0003_checkpoint_ahead_hardening.sql

@@ -0,0 +1,14 @@
+-- SDT-G24 checkpoint-ahead hardening. A finding is scoped to the affected
+-- generation, so the only recovery path is the existing rebuild/promote flow.
+CREATE TABLE mv_checkpoint_ahead_findings (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  checkpoint_suid TEXT NOT NULL COLLATE BINARY,
+  store_max_suid TEXT NOT NULL COLLATE BINARY,
+  observed_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id, generation),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+    ON DELETE CASCADE
+);

package/template/migrations/mv/0004_unsafe_window_failure_findings.sql

@@ -0,0 +1,12 @@
+-- SDT-G25: an unsafe apply failure is an idempotent operational finding.
+-- The source event is already durable; this records that the exceptional
+-- immediate projection write requires Queue retry or DLQ attention.
+CREATE TABLE mv_unsafe_failure_findings (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  classification TEXT NOT NULL CHECK (classification IN ('UNSAFE_APPLY_RETRY')),
+  observed_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id, event_id, suid, classification)
+);

package/template/migrations/mv/0005_g31_wait_receipts.sql

@@ -0,0 +1,25 @@
+-- SDT-G31: a wait receipt is an active-generation/definition observation.
+-- It is intentionally separate from mv_unsafe_receipts, whose historical
+-- identity is cross-generation and remains the G23/G26 delivery oracle.
+CREATE TABLE mv_wait_receipts (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  definition_version INTEGER NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  observed_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id, generation, event_id, suid),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+    ON DELETE CASCADE
+);
+CREATE INDEX mv_wait_receipts_active_target_idx
+  ON mv_wait_receipts (
+    service_id,
+    view_id,
+    generation,
+    definition_version,
+    event_id COLLATE BINARY,
+    suid COLLATE BINARY
+  );

package/template/migrations/mv/0006_g31_wait_target_poison.sql

@@ -0,0 +1,48 @@
+-- SDT-G31: poison is a target fact for one active generation/definition, not
+-- a global view switch. This lets the wait loop use the same bounded active
+-- generation point-read shape for receipt, checkpoint, rebuild, and poison.
+CREATE TABLE mv_wait_target_poison (
+  service_id TEXT NOT NULL,
+  view_id TEXT NOT NULL COLLATE BINARY,
+  generation INTEGER NOT NULL,
+  definition_version INTEGER NOT NULL,
+  event_id TEXT NOT NULL COLLATE BINARY,
+  suid TEXT NOT NULL COLLATE BINARY,
+  classification TEXT NOT NULL CHECK (classification IN ('UNSAFE_APPLY_RETRY')),
+  observed_at INTEGER NOT NULL,
+  PRIMARY KEY (service_id, view_id, generation, event_id, suid, classification),
+  FOREIGN KEY (service_id, view_id, generation)
+    REFERENCES mv_instances (service_id, view_id, generation)
+    ON DELETE CASCADE
+);
+CREATE INDEX mv_wait_target_poison_active_target_idx
+  ON mv_wait_target_poison (
+    service_id,
+    view_id,
+    generation,
+    definition_version,
+    event_id COLLATE BINARY,
+    suid COLLATE BINARY
+  );
+
+-- Preserve historical pre-G31 poison as a finding on the generation that was
+-- active while this migration ran. A later generation is deliberately free to
+-- rebuild and prove its own state without inheriting an old receipt/failure.
+INSERT OR IGNORE INTO mv_wait_target_poison
+  (service_id, view_id, generation, definition_version, event_id, suid, classification, observed_at)
+SELECT finding.service_id,
+       finding.view_id,
+       instance.generation,
+       instance.definition_version,
+       finding.event_id,
+       finding.suid,
+       finding.classification,
+       finding.observed_at
+  FROM mv_unsafe_failure_findings finding
+  JOIN mv_active_generations active
+    ON active.service_id = finding.service_id
+   AND active.view_id = finding.view_id
+  JOIN mv_instances instance
+    ON instance.service_id = active.service_id
+   AND instance.view_id = active.view_id
+   AND instance.generation = active.generation;