@starci/hfs 1.0.1 → 2.0.1

package/runtime/engine/migrations/machine/0001-init.sql

@@ -0,0 +1,887 @@
+-- ############################################################################################################
+-- PHẦN B — machine.sqlite (mỗi máy) → engine/migrations/machine/0001-init.sql
+-- Gộp: machine.sqlite cũ, reconciler.sqlite, ledger Supervisor, journal.sqlite (mồ côi), mọi JSON state và log văn bản.
+-- ############################################################################################################
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B0. Danh tính, từ vựng, registry, catalog, archive
+-- ---------------------------------------------------------------------------------------------------------
+-- machine_meta: host_id, schema='starci/machine@1', created_at, blob_root, runtime_rev, sqlite_version, node_version.
+CREATE TABLE IF NOT EXISTS machine_meta(key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS schema_migrations(
+  version INTEGER PRIMARY KEY, name TEXT NOT NULL, runtime_rev TEXT, sql_sha256 TEXT NOT NULL,
+  backup_path TEXT, backup_sha256 TEXT, started_at INTEGER NOT NULL, finished_at INTEGER,
+  status TEXT NOT NULL CHECK(status IN ('running','done','failed'))) STRICT;
+
+CREATE TABLE IF NOT EXISTS ui_states(
+  ui TEXT PRIMARY KEY CHECK(ui IN ('bad','warn','running','waiting','ok','done','unknown')),
+  rank INTEGER NOT NULL, label_vi TEXT NOT NULL) STRICT;
+INSERT OR IGNORE INTO ui_states VALUES
+  ('bad',0,'Hỏng / Kẹt'),('warn',1,'Chậm / Cảnh báo'),('running',2,'Đang chạy'),('waiting',3,'Chờ'),
+  ('ok',4,'Ổn'),('done',5,'Xong'),('unknown',6,'Chưa rõ');
+CREATE TABLE IF NOT EXISTS ui_state_map(
+  entity TEXT NOT NULL, native TEXT NOT NULL, ui TEXT NOT NULL REFERENCES ui_states(ui), PRIMARY KEY(entity,native)) STRICT;
+INSERT OR IGNORE INTO ui_state_map VALUES
+  ('service','healthy','ok'),('service','ok','ok'),('service','live','ok'),('service','down','bad'),('service','dead','bad'),
+  ('service','quarantined','bad'),('service','stale','bad'),('service','restarting','warn'),('service','booting','running'),
+  ('seat','empty','waiting'),('seat','parked','done'),('seat','booting','running'),('seat','live','ok'),('seat','busy','running'),
+  ('seat','stale','bad'),('seat','dead','bad'),('seat','replacing','warn'),('seat','quarantined','bad'),('service','degraded','warn'),
+  ('engine-action','fenced','warn'),('push','failed','bad'),
+  ('sla','running','waiting'),('sla','violated','warn'),('sla','violated-critical','bad'),('sla','cleared','done'),
+  ('engine-action','intent','running'),('engine-action','running','running'),('engine-action','done','done'),
+  ('engine-action','failed','bad'),('engine-action','unknown','bad'),
+  ('land','queued','waiting'),('land','running','running'),('land','passed','done'),('land','failed','bad'),
+  ('land','conflict','bad'),('land','refused','bad'),('land','cancelled','done'),
+  ('push','pushed','done'),('push','skipped','waiting'),('push','refused','bad'),
+  ('lane','open','running'),('lane','landing','running'),('lane','landed','done'),('lane','abandoned','done'),('lane','removed','done'),
+  ('provider','healthy','ok'),('provider','recovered','ok'),('provider','striking','warn'),('provider','unavailable','bad'),
+  ('throttle','normal','ok'),('throttle','heavy','warn'),('throttle','critical','bad'),
+  ('sup-job','queued','waiting'),('sup-job','spawning','running'),('sup-job','running','running'),('sup-job','reported','running'),
+  ('sup-job','landing','running'),('sup-job','succeeded','done'),('sup-job','failed','bad'),('sup-job','cancelled','done'),
+  ('decision','open','waiting'),('decision','claimed','running'),('decision','escalated','warn'),('decision','expired','warn'),
+  ('decision','resolved','done'),('decision','superseded','done'),
+  ('owed','open','waiting'),('owed','acked','running'),('owed','closed','done'),
+  ('gc-run','running','running'),('gc-run','done','done'),('gc-run','errors','warn'),
+  ('env-server','starting','running'),('env-server','ready','ok'),('env-server','failed','bad'),('env-server','stopped','done'),
+  ('ask','open','waiting'),('ask','answered','done'),('ask','retired','done'),('ask','expired','warn');
+
+CREATE TABLE IF NOT EXISTS blob_ref_columns(
+  table_name TEXT NOT NULL, column_name TEXT NOT NULL, PRIMARY KEY(table_name,column_name)) STRICT;
+INSERT OR IGNORE INTO blob_ref_columns VALUES
+  ('lanes','report_sha'),('land_runs','stdout_sha'),('land_runs','stderr_sha'),
+  ('engine_actions','result_sha'),('engine_actions','stdout_sha'),('engine_actions','stderr_sha'),
+  ('metrics_snapshots','data_sha'),('sup_reports','report_sha'),('sup_attempts','prompt_sha'),('sup_attempts','transcript_sha'),
+  ('env_servers','log_sha'),('notifications','media_sha'),('agent_sessions','transcript_sha'),('sup_events','payload_sha'),
+  ('seat_transcript_snapshots','sha256'),('pushes','stdout_sha'),('pushes','stderr_sha'),('gc_runs','report_sha');
+
+-- ledgers: sổ đăng ký DUY NHẤT mọi runtime.sqlite (reconciler, GC, harness đọc từ đây; bỏ config.yaml supervisor.repos).
+CREATE TABLE IF NOT EXISTS ledgers(
+  ledger_id      TEXT PRIMARY KEY,               -- = meta.ledger_id trong file (UUID)
+  name           TEXT NOT NULL UNIQUE,           -- 'nivo-backend'
+  product        TEXT,
+  repo_root      TEXT NOT NULL,
+  file           TEXT NOT NULL,
+  state          TEXT NOT NULL DEFAULT 'active' CHECK(state IN ('active','idle','retired')),
+  schema_version INTEGER,
+  registered_at  INTEGER NOT NULL,
+  seen_at        INTEGER NOT NULL,               -- lần engine mở được gần nhất (G16)
+  retired_at     INTEGER, retired_reason TEXT,
+  CHECK(state<>'retired' OR retired_at IS NOT NULL)) STRICT;
+
+CREATE TABLE IF NOT EXISTS repositories(
+  repo_root      TEXT PRIMARY KEY,
+  name           TEXT NOT NULL,
+  role           TEXT NOT NULL CHECK(role IN ('backend','frontend','service','runtime')),
+  ledger_id      TEXT REFERENCES ledgers(ledger_id),
+  default_branch TEXT, remote TEXT,
+  seen_at        INTEGER NOT NULL) STRICT;
+
+-- agents / models: HÌNH CHIẾU modules/models/*.yaml (YAML vẫn là hợp đồng), viết lại mỗi lần engine khởi động.
+CREATE TABLE IF NOT EXISTS agents(
+  agent      TEXT PRIMARY KEY CHECK(agent IN ('devin','codex','claude')),
+  provider   TEXT, spawn_card TEXT, cli_name TEXT,
+  source_rev TEXT NOT NULL, loaded_at INTEGER NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS models(
+  profile     TEXT PRIMARY KEY,
+  agent       TEXT REFERENCES agents(agent),
+  model       TEXT, pool TEXT, max_parallel INTEGER, share_pct REAL,
+  roles_json  TEXT CHECK(roles_json IS NULL OR json_valid(roles_json)),
+  cost_json   TEXT CHECK(cost_json IS NULL OR json_valid(cost_json)),
+  source_rev  TEXT NOT NULL, loaded_at INTEGER NOT NULL) STRICT;
+
+CREATE TABLE IF NOT EXISTS blobs(
+  sha256 TEXT PRIMARY KEY CHECK(length(sha256)=64), bytes INTEGER NOT NULL CHECK(bytes>=0), media_type TEXT NOT NULL,
+  encoding TEXT CHECK(encoding IS NULL OR encoding='gzip'), redaction TEXT CHECK(redaction IS NULL OR redaction IN ('v1','binary')),
+  file_uri TEXT NOT NULL, http_path TEXT GENERATED ALWAYS AS ('/api/blob/' || sha256) VIRTUAL,
+  created_at INTEGER NOT NULL, pinned INTEGER NOT NULL DEFAULT 0 CHECK(pinned IN (0,1)),
+  archived_at INTEGER, archive_ref TEXT) STRICT;
+
+-- archives: mọi zip/bản sao ở D:/starci-archive (purge, backup DB, retention blob, lane logs) đã kiểm chứng.
+CREATE TABLE IF NOT EXISTS archives(
+  archive_path    TEXT PRIMARY KEY,
+  kind            TEXT NOT NULL CHECK(kind IN ('workflow-purge','db-backup','blob-retention','lane-logs','agent-sessions')),
+  subject         TEXT,
+  bytes           INTEGER NOT NULL, sha256 TEXT NOT NULL, manifest_sha256 TEXT, entries INTEGER,
+  integrity       TEXT,                          -- 'ok' từ integrity_check (db-backup) / 'sha-verified' (zip)
+  created_at      INTEGER NOT NULL, verified_at INTEGER, expires_at INTEGER) STRICT;
+
+-- gc_marks: tập sha đang sống, GC mark theo TỪNG ledger (mở read-only lần lượt, đọc blob_ref_columns của ledger đó)
+-- rồi machine; sweep chỉ xoá file khi: không có trong gc_marks của lượt, pinned=0 ở mọi DB, archived_at IS NOT NULL,
+-- created_at < now-24h. Không ATTACH-UNION (giới hạn 10 DB).
+CREATE TABLE IF NOT EXISTS gc_marks(
+  run_id  INTEGER NOT NULL REFERENCES gc_runs(run_id) ON DELETE CASCADE,
+  sha256  TEXT NOT NULL,
+  source  TEXT NOT NULL,                         -- ledger name | 'machine'
+  pinned  INTEGER NOT NULL DEFAULT 0 CHECK(pinned IN (0,1)),
+  PRIMARY KEY(run_id,sha256,source)) STRICT, WITHOUT ROWID;
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B1. Supervisor (bảng riêng tiền tố sup_; ghế ở `seats`, log ở `machine_logs`, chi phí ở `llm_usage`)
+-- ---------------------------------------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS sup_jobs(
+  job_id       TEXT PRIMARY KEY,
+  trace_id     TEXT NOT NULL CHECK(length(trace_id)=32),
+  kind         TEXT NOT NULL,                    -- runtime.fix | runtime.review | ...
+  role         TEXT NOT NULL CHECK(role IN ('worker','supervisor')),
+  cluster      TEXT,
+  title        TEXT NOT NULL,
+  status       TEXT NOT NULL CHECK(status IN ('queued','spawning','running','reported','landing','succeeded','failed','cancelled')),
+  lane         TEXT,
+  files_json   TEXT CHECK(files_json IS NULL OR json_valid(files_json)),     -- đường .claude được phép sửa
+  brief        TEXT,
+  payload_json TEXT CHECK(payload_json IS NULL OR json_valid(payload_json)),
+  created_at   INTEGER NOT NULL, updated_at INTEGER NOT NULL) STRICT;
+CREATE INDEX IF NOT EXISTS ix_sup_jobs_status ON sup_jobs(status,created_at);
+
+CREATE TABLE IF NOT EXISTS sup_leases(
+  path        TEXT PRIMARY KEY,
+  job_id      TEXT NOT NULL REFERENCES sup_jobs(job_id) ON DELETE CASCADE,
+  acquired_at INTEGER NOT NULL, expires_at INTEGER NOT NULL) STRICT;
+
+-- sup_attempts: cùng nhóm cột với op_attempts (ai, ở đâu, khi nào, kết quả, tái lập) để không trôi lệch.
+CREATE TABLE IF NOT EXISTS sup_attempts(
+  attempt_id     INTEGER PRIMARY KEY AUTOINCREMENT,
+  job_id         TEXT NOT NULL REFERENCES sup_jobs(job_id) ON DELETE CASCADE,
+  dispatch_seq   INTEGER NOT NULL DEFAULT 1,
+  span_id        TEXT NOT NULL CHECK(length(span_id)=16), parent_span_id TEXT,
+  agent          TEXT CHECK(agent IS NULL OR agent IN ('devin','codex','claude')),
+  provider TEXT, model TEXT, effort TEXT, terminal_handle TEXT, worker_pid INTEGER,
+  runtime_rev TEXT, cli_name TEXT, cli_version TEXT,
+  prompt_sha     TEXT REFERENCES blobs(sha256), transcript_sha TEXT REFERENCES blobs(sha256),
+  worktree_path TEXT, branch TEXT, base_sha TEXT, head_sha TEXT, landed_sha TEXT,
+  spawned_at INTEGER, reported_at INTEGER, acked_at INTEGER, landed_at INTEGER, cancelled_at INTEGER, closed_at INTEGER,
+  report_outcome TEXT, verdict TEXT, failure_class TEXT,
+  tokens_in INTEGER, tokens_out INTEGER, cost_usd REAL,
+  UNIQUE(job_id,dispatch_seq)) STRICT;
+
+CREATE TABLE IF NOT EXISTS sup_reports(
+  report_id    INTEGER PRIMARY KEY AUTOINCREMENT,
+  attempt_id   INTEGER NOT NULL UNIQUE REFERENCES sup_attempts(attempt_id) ON DELETE CASCADE,
+  job_id       TEXT NOT NULL,
+  outcome      TEXT NOT NULL,
+  report_json  TEXT NOT NULL CHECK(json_valid(report_json)),
+  summary      TEXT GENERATED ALWAYS AS (json_extract(report_json,'$.summary')) VIRTUAL,
+  report_sha   TEXT REFERENCES blobs(sha256),    -- <lane>.REPORT.md
+  consumed_at  INTEGER, created_at INTEGER NOT NULL) STRICT;
+
+-- sup_events: nhật ký kiểm toán Supervisor; digest tính trong writer JS như events.
+CREATE TABLE IF NOT EXISTS sup_events(
+  seq          INTEGER PRIMARY KEY AUTOINCREMENT,
+  event_id     TEXT NOT NULL UNIQUE,
+  entity_type  TEXT NOT NULL, entity_id TEXT NOT NULL, kind TEXT NOT NULL, span_id TEXT,
+  payload_json TEXT CHECK(payload_json IS NULL OR (json_valid(payload_json) AND length(payload_json)<=16384)),
+  payload_sha  TEXT REFERENCES blobs(sha256),
+  prev_digest  TEXT, digest TEXT NOT NULL CHECK(length(digest)=64), created_at INTEGER NOT NULL) STRICT;
+CREATE INDEX IF NOT EXISTS ix_sup_events_kind   ON sup_events(kind,seq);
+CREATE INDEX IF NOT EXISTS ix_sup_events_entity ON sup_events(entity_type,entity_id,seq);
+CREATE TRIGGER IF NOT EXISTS sup_events_append_only BEFORE UPDATE ON sup_events BEGIN
+    SELECT RAISE(ABORT,'sup_events are append-only');
+  END;
+
+CREATE TABLE IF NOT EXISTS sup_decision_items(
+  di_id           TEXT PRIMARY KEY,
+  -- MB-07: '<kind>:<entity>:<chữ ký lỗi>:<head>' — không phần rỗng (push-refused thiếu head đã gộp 73 lần vào DI cũ).
+  idempotency_key TEXT NOT NULL UNIQUE CHECK(idempotency_key NOT LIKE '%::%' AND idempotency_key NOT LIKE '%:'
+                                              AND idempotency_key NOT LIKE ':%' AND length(idempotency_key)>=5),
+  key_parts_json  TEXT NOT NULL CHECK(json_valid(key_parts_json) AND json_type(key_parts_json)='object'),
+  superseded_by   TEXT REFERENCES sup_decision_items(di_id),
+  delivered_at    INTEGER,                       -- MB-02: đã báo tới ghế Supervisor chưa (chi tiết ở deliveries)
+  ledger_id       TEXT REFERENCES ledgers(ledger_id),
+  workflow_id     TEXT,
+  kind            TEXT NOT NULL,                 -- cap-starved | quota-exhausted | runtime-defect | cross-workflow | deadlock | ...
+  decider         TEXT NOT NULL CHECK(decider IN ('supervisor','owner')),
+  entity_type TEXT, entity_id TEXT,
+  summary         TEXT NOT NULL,
+  status          TEXT NOT NULL CHECK(status IN ('open','claimed','resolved','escalated','expired','superseded')),
+  opened_by       TEXT NOT NULL, opened_at INTEGER NOT NULL, due_at INTEGER,
+  escalate_to TEXT, escalations INTEGER NOT NULL DEFAULT 0,
+  claim_by TEXT, claim_at INTEGER, claim_ttl_ms INTEGER,
+  resolved_by TEXT, resolved_at INTEGER, resolution_verb TEXT, decision_id TEXT,
+  evidence_json TEXT CHECK(evidence_json IS NULL OR json_valid(evidence_json)),
+  options_json TEXT CHECK(options_json IS NULL OR json_valid(options_json)),
+  allowed_verbs_json TEXT CHECK(allowed_verbs_json IS NULL OR json_valid(allowed_verbs_json)),
+  payload_json TEXT NOT NULL CHECK(json_valid(payload_json))) STRICT;
+CREATE INDEX IF NOT EXISTS ix_sup_di_open ON sup_decision_items(status,due_at);
+
+CREATE TABLE IF NOT EXISTS sup_decisions(
+  decision_id TEXT PRIMARY KEY, di_id TEXT REFERENCES sup_decision_items(di_id), decider TEXT NOT NULL,
+  span_id TEXT NOT NULL CHECK(length(span_id)=16), parent_span_id TEXT,
+  ledger_id TEXT, workflow_id TEXT, subject_type TEXT, subject_id TEXT,
+  choice TEXT NOT NULL, rationale TEXT, result_json TEXT CHECK(result_json IS NULL OR json_valid(result_json)),
+  decided_at INTEGER NOT NULL) STRICT;
+
+CREATE TABLE IF NOT EXISTS sup_owed(
+  owed_id    TEXT PRIMARY KEY,
+  kind       TEXT NOT NULL, subject TEXT NOT NULL, cluster TEXT,
+  state      TEXT NOT NULL CHECK(state IN ('open','acked','closed')),
+  opened_at  INTEGER NOT NULL, due_at INTEGER, acked_at INTEGER, acked_by TEXT, closed_at INTEGER,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;
+CREATE INDEX IF NOT EXISTS ix_sup_owed_open ON sup_owed(state,due_at);
+
+CREATE TABLE IF NOT EXISTS sup_learning(
+  item_id     TEXT PRIMARY KEY,
+  kind        TEXT NOT NULL CHECK(kind IN ('lesson','hypothesis','experiment','experiment-result','proposal','owner-feedback','leftover')),
+  parent_id   TEXT REFERENCES sup_learning(item_id),
+  title       TEXT NOT NULL, state TEXT, source_ref TEXT, lane TEXT, landed_sha TEXT,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json)),
+  created_at  INTEGER NOT NULL, updated_at INTEGER NOT NULL) STRICT;
+
+CREATE TABLE IF NOT EXISTS sup_owner_rulings(
+  ruling_id TEXT PRIMARY KEY, said_at INTEGER NOT NULL, channel TEXT, verbatim TEXT NOT NULL, paraphrase TEXT,
+  applies_to TEXT, contract_ref TEXT, recorded_by TEXT, created_at INTEGER NOT NULL) STRICT;
+
+CREATE TABLE IF NOT EXISTS sup_bridges(
+  bridge_id TEXT PRIMARY KEY, ledger_id TEXT REFERENCES ledgers(ledger_id),
+  action TEXT NOT NULL CHECK(action IN ('bridge','transfer','rewire')),
+  state TEXT NOT NULL, approved_by TEXT, detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json)),
+  created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL) STRICT;
+
+CREATE TABLE IF NOT EXISTS sup_messages(
+  msg_id     TEXT PRIMARY KEY,
+  direction  TEXT NOT NULL CHECK(direction IN ('in','out')),
+  channel    TEXT NOT NULL CHECK(channel IN ('telegram','tell','ask-gateway')),
+  chat_id TEXT, message_id TEXT, from_ref TEXT, to_ref TEXT, via TEXT,
+  text       TEXT NOT NULL,
+  ok         INTEGER CHECK(ok IS NULL OR ok IN (0,1)),
+  read_at    INTEGER, at INTEGER NOT NULL) STRICT;
+CREATE INDEX IF NOT EXISTS ix_sup_messages_unread ON sup_messages(direction,read_at,at);
+
+CREATE TABLE IF NOT EXISTS sup_signals(
+  scope TEXT NOT NULL CHECK(scope IN ('supervisor-enabled','supervisor-busy')), key TEXT NOT NULL,
+  holder_pid INTEGER, token TEXT, value_json TEXT CHECK(value_json IS NULL OR json_valid(value_json)),
+  at INTEGER NOT NULL, expires_at INTEGER, PRIMARY KEY(scope,key)) STRICT;
+
+-- llm_usage (máy): chi phí của Supervisor và [Worker].
+CREATE TABLE IF NOT EXISTS llm_usage(
+  usage_id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  subject_type       TEXT NOT NULL CHECK(subject_type IN ('supervisor-turn','worker-attempt')),
+  sup_attempt_id     INTEGER REFERENCES sup_attempts(attempt_id) ON DELETE CASCADE,
+  turn_ref           TEXT, span_id TEXT,
+  provider           TEXT NOT NULL, request_model TEXT, response_model TEXT,
+  input_tokens INTEGER, output_tokens INTEGER, cache_read_tokens INTEGER, cache_write_tokens INTEGER, reasoning_tokens INTEGER,
+  cost_usd REAL, turns INTEGER, tool_calls INTEGER, tool_errors INTEGER,
+  source             TEXT NOT NULL CHECK(source IN ('cli-transcript','provider-report')),
+  at                 INTEGER NOT NULL,
+  CHECK((subject_type='worker-attempt' AND sup_attempt_id IS NOT NULL) OR (subject_type='supervisor-turn' AND turn_ref IS NOT NULL))) STRICT;
+CREATE INDEX IF NOT EXISTS ix_musage ON llm_usage(subject_type,at);
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B2. Engine reconciler (thay reconciler.sqlite, reconciler-starts.json, reconciler.heartbeat)
+-- Nguyên tắc (LOG-AUDIT-MACHINE §5): mọi thứ có thời lượng là lịch sử APPEND-ONLY; "trạng thái hiện tại" là view
+-- hoặc một dòng mỏng. Không DELETE, không ghi đè lịch sử. Mọi hành động có id; mọi hệ quả tham chiếu id đó.
+-- ---------------------------------------------------------------------------------------------------------
+-- process_runs (G1, MB-04): MỖI tiến trình dài của runtime (engine, harness, gateway, tunnel, telegram-bridge, settler,
+-- push-mains, land) một dòng: sinh ra vì sao, chết vì sao, ai giết, heartbeat cuối lúc chết.
+CREATE TABLE IF NOT EXISTS process_runs(
+  run_id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  role              TEXT NOT NULL CHECK(role IN ('engine','harness','gateway','tunnel','telegram-bridge','settler','push','land','boot','other')),
+  pid               INTEGER NOT NULL, host TEXT, rev TEXT, epoch INTEGER,
+  parent_action_id  TEXT,                          -- engine_actions.id đã sinh ra nó (nếu có)
+  start_reason      TEXT NOT NULL CHECK(start_reason IN ('boot','ensure-stale-heartbeat','self-reload','crash-restart','manual','scheduled','action')),
+  started_at        INTEGER NOT NULL,
+  last_heartbeat_at INTEGER,
+  draining_since    INTEGER,                       -- MB-04: đang bàn giao; ensure KHÔNG giết tiến trình đang drain
+  ended_at          INTEGER,
+  exit_code         INTEGER,
+  exit_reason       TEXT CHECK(exit_reason IS NULL OR exit_reason IN ('clean','reload-handover','crash','killed','lost-lease','stopped','unknown')),
+  killed_by         TEXT,                          -- 'boot-ensure' | 'supervisor' | 'owner' | pid:<n>
+  heartbeat_age_at_end_ms INTEGER,
+  CHECK(ended_at IS NULL OR exit_reason IS NOT NULL)) STRICT;
+CREATE INDEX IF NOT EXISTS ix_process_runs ON process_runs(role,started_at);
+-- Chỉ được điền các trường kết thúc một lần (append-only về ngữ nghĩa).
+CREATE TRIGGER IF NOT EXISTS process_runs_end_once BEFORE UPDATE OF ended_at, exit_reason, killed_by ON process_runs
+  WHEN OLD.ended_at IS NOT NULL BEGIN
+    SELECT RAISE(ABORT,'process run already ended');
+  END;
+CREATE TRIGGER IF NOT EXISTS process_runs_no_delete BEFORE DELETE ON process_runs
+  WHEN OLD.started_at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 7776000000 BEGIN   -- chỉ GC xoá dòng > 90 ngày
+    SELECT RAISE(ABORT,'process_runs are append-only (90-day retention)');
+  END;
+-- Tương thích UI-API (/api/reconciler starts24h): các lần engine khởi động = view.
+CREATE VIEW IF NOT EXISTS v_engine_starts AS
+SELECT run_id, started_at AS at, pid, rev, epoch, start_reason AS reason, ended_at, exit_reason, killed_by
+FROM process_runs WHERE role='engine';
+
+-- engine_leader: một dòng hiện tại (fence). Lịch sử ở leader_history.
+CREATE TABLE IF NOT EXISTS engine_leader(
+  name TEXT PRIMARY KEY, holder TEXT NOT NULL, pid INTEGER NOT NULL, epoch INTEGER NOT NULL,
+  process_run_id INTEGER REFERENCES process_runs(run_id),
+  heartbeat_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, rev TEXT,
+  draining INTEGER NOT NULL DEFAULT 0 CHECK(draining IN (0,1)),   -- MB-04: lease vẫn gia hạn bằng timer riêng khi drain
+  passes INTEGER, last_pass_ms INTEGER, last_error TEXT) STRICT;
+-- leader_history (G2): mỗi epoch một dòng; giữ lead bao lâu, nhả vì sao.
+CREATE TABLE IF NOT EXISTS leader_history(
+  epoch          INTEGER PRIMARY KEY,
+  holder TEXT NOT NULL, pid INTEGER NOT NULL, process_run_id INTEGER REFERENCES process_runs(run_id), rev TEXT,
+  acquired_at    INTEGER NOT NULL,
+  acquired_how   TEXT NOT NULL CHECK(acquired_how IN ('fresh','takeover-stale','handover')),
+  released_at    INTEGER,
+  release_reason TEXT CHECK(release_reason IS NULL OR release_reason IN ('reload','lost','killed','stop','crash'))) STRICT;
+CREATE TRIGGER IF NOT EXISTS leader_history_release_once BEFORE UPDATE ON leader_history
+  WHEN OLD.released_at IS NOT NULL OR NEW.epoch<>OLD.epoch OR NEW.acquired_at<>OLD.acquired_at BEGIN
+    SELECT RAISE(ABORT,'leader_history is append-only');
+  END;
+CREATE TRIGGER IF NOT EXISTS leader_history_no_delete BEFORE DELETE ON leader_history BEGIN
+    SELECT RAISE(ABORT,'leader_history is append-only');
+  END;
+
+CREATE TABLE IF NOT EXISTS engine_cursors(
+  ledger_id TEXT PRIMARY KEY REFERENCES ledgers(ledger_id), last_seq INTEGER NOT NULL, updated_at INTEGER NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS engine_queue(
+  controller TEXT NOT NULL, key TEXT NOT NULL, due_at INTEGER, reason TEXT, tries INTEGER NOT NULL DEFAULT 0,
+  last_error TEXT, PRIMARY KEY(controller,key)) STRICT;
+
+-- schedules (MB-01): lịch chạy của mọi nhiệm vụ định kỳ nằm trong DB, KHÔNG trong RAM — engine mới đọc lại, không
+-- "first run" lặp (housekeeping 1 lần/ngày từng chạy 32 lần trong 3,5 giờ).
+CREATE TABLE IF NOT EXISTS schedules(
+  controller       TEXT NOT NULL CHECK(controller IN ('job','workflow','resource','host','gc','fleet','learning','sla')),
+  duty             TEXT NOT NULL,                -- housekeeping, sweep, push, digest, backup, blob-sweep, transcripts, boot ...
+  interval_ms      INTEGER NOT NULL CHECK(interval_ms>0),
+  last_started_at  INTEGER, last_finished_at INTEGER,
+  last_result      TEXT CHECK(last_result IS NULL OR last_result IN ('done','failed','unknown','skipped')),
+  last_action_id   TEXT,                         -- engine_actions.id
+  last_result_digest TEXT,
+  next_due_at      INTEGER NOT NULL,
+  running_pid      INTEGER,                      -- một lượt đang chạy (không chồng lượt)
+  PRIMARY KEY(controller,duty)) STRICT;
+
+-- engine_actions (MB-03): kết quả KHÔNG bị cắt 4000 ký tự — result_json chỉ là tóm tắt nhỏ có cấu trúc; bản đầy đủ,
+-- stdout và stderr của verb con là blob. id TẤT ĐỊNH = sha(controller, key, verb, epoch, observed_generation).
+CREATE TABLE IF NOT EXISTS engine_actions(
+  id TEXT PRIMARY KEY,
+  controller TEXT NOT NULL CHECK(controller IN ('job','workflow','resource','host','gc','fleet','learning','sla')),
+  duty TEXT,                                     -- schedules.duty khi hành động là một lượt định kỳ
+  key TEXT, verb TEXT, argv_digest TEXT, epoch INTEGER, observed_generation INTEGER,
+  span_id TEXT CHECK(span_id IS NULL OR length(span_id)=16), trace_id TEXT,
+  state TEXT NOT NULL CHECK(state IN ('intent','running','done','failed','unknown','fenced')),
+  mode TEXT CHECK(mode IS NULL OR mode IN ('shadow','active')),
+  ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER,
+  request_id TEXT,                               -- api_requests.request_id của verb con
+  child_run_id INTEGER REFERENCES process_runs(run_id),
+  started_at INTEGER, finished_at INTEGER, exit_code INTEGER,
+  result_json TEXT CHECK(result_json IS NULL OR (json_valid(result_json) AND length(result_json)<=8192)),
+  result_sha TEXT REFERENCES blobs(sha256),      -- kết quả đầy đủ
+  stdout_sha TEXT REFERENCES blobs(sha256),
+  stderr_sha TEXT REFERENCES blobs(sha256),      -- stderr ĐẦY ĐỦ (hôm nay cắt 6 dòng)
+  error_signature TEXT) STRICT;                  -- chữ ký lỗi ổn định (không chứa HEAD) để gộp/so lặp
+CREATE INDEX IF NOT EXISTS ix_engine_actions_ctl    ON engine_actions(controller,started_at);
+CREATE INDEX IF NOT EXISTS ix_engine_actions_entity ON engine_actions(ledger_id,workflow_id,job_id);
+CREATE INDEX IF NOT EXISTS ix_engine_actions_sig    ON engine_actions(controller,error_signature);
+-- action_steps (G13): bước bên trong một hành động dài.
+CREATE TABLE IF NOT EXISTS action_steps(
+  action_id TEXT NOT NULL REFERENCES engine_actions(id) ON DELETE CASCADE,
+  step_no INTEGER NOT NULL, step TEXT NOT NULL, started_at INTEGER NOT NULL, ms INTEGER,
+  ok INTEGER CHECK(ok IS NULL OR ok IN (0,1)), detail TEXT,
+  PRIMARY KEY(action_id,step_no)) STRICT;
+
+-- controller_modes: mode hiện tại; mode_changes (G6): lịch sử append-only, ai đổi và vì sao.
+CREATE TABLE IF NOT EXISTS controller_modes(
+  controller TEXT PRIMARY KEY CHECK(controller IN ('job','workflow','resource','host','gc','fleet','learning')),
+  mode TEXT NOT NULL CHECK(mode IN ('off','shadow','active')), set_at INTEGER, set_by TEXT) STRICT;
+CREATE TABLE IF NOT EXISTS mode_changes(
+  change_id INTEGER PRIMARY KEY AUTOINCREMENT,
+  controller TEXT NOT NULL, from_mode TEXT, to_mode TEXT NOT NULL CHECK(to_mode IN ('off','shadow','active')),
+  by TEXT NOT NULL, reason TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
+CREATE TRIGGER IF NOT EXISTS mode_changes_append_only BEFORE UPDATE ON mode_changes BEGIN
+    SELECT RAISE(ABORT,'mode_changes are append-only');
+  END;
+CREATE TRIGGER IF NOT EXISTS controller_modes_recorded BEFORE UPDATE OF mode ON controller_modes
+  WHEN NEW.mode<>OLD.mode AND NOT EXISTS(SELECT 1 FROM mode_changes c WHERE c.controller=NEW.controller AND c.to_mode=NEW.mode
+         AND c.change_id=(SELECT max(change_id) FROM mode_changes WHERE controller=NEW.controller)) BEGIN
+    SELECT RAISE(ABORT,'mode change must be recorded in mode_changes first');
+  END;
+
+-- sla_episodes (G3): MỖI đợt đồng hồ SLA một dòng, APPEND-ONLY. Không DELETE, không ghi đè: chỉ điền violated_at,
+-- reported_at, cleared_at (+ clear_reason) đúng một lần. Đồng hồ đang mở = v_sla_open.
+CREATE TABLE IF NOT EXISTS sla_episodes(
+  episode_id   INTEGER PRIMARY KEY AUTOINCREMENT,
+  entity       TEXT NOT NULL, state TEXT NOT NULL, code TEXT NOT NULL,   -- READY_UNDISPATCHED, WORKER_SILENT, SEAT_DEAF, TRANSCRIPT_MISSING ...
+  severity     TEXT NOT NULL CHECK(severity IN ('warn','critical')),
+  ledger_id TEXT, workflow_id TEXT,
+  entered_at   INTEGER NOT NULL, sla_ms INTEGER NOT NULL,
+  violated_at  INTEGER, reported_at INTEGER, di_id TEXT,
+  cleared_at   INTEGER,
+  clear_reason TEXT CHECK(clear_reason IS NULL OR clear_reason IN ('resolved','superseded','entity-gone','workflow-stopped')),
+  CHECK(cleared_at IS NULL OR clear_reason IS NOT NULL)) STRICT;
+CREATE UNIQUE INDEX IF NOT EXISTS ux_sla_open ON sla_episodes(entity,state) WHERE cleared_at IS NULL;   -- một đợt mở / (entity,state)
+CREATE INDEX IF NOT EXISTS ix_sla_code ON sla_episodes(code,entered_at);
+CREATE TRIGGER IF NOT EXISTS sla_episodes_fill_once BEFORE UPDATE ON sla_episodes
+  WHEN NEW.entity<>OLD.entity OR NEW.state<>OLD.state OR NEW.code<>OLD.code OR NEW.entered_at<>OLD.entered_at
+    OR (OLD.violated_at IS NOT NULL AND NEW.violated_at IS NOT OLD.violated_at)
+    OR (OLD.reported_at IS NOT NULL AND NEW.reported_at IS NOT OLD.reported_at)
+    OR (OLD.cleared_at  IS NOT NULL AND NEW.cleared_at  IS NOT OLD.cleared_at) BEGIN
+    SELECT RAISE(ABORT,'sla_episodes are append-only: fields fill once');
+  END;
+CREATE TRIGGER IF NOT EXISTS sla_episodes_no_delete BEFORE DELETE ON sla_episodes BEGIN
+    SELECT RAISE(ABORT,'sla_episodes are append-only');
+  END;
+
+CREATE TABLE IF NOT EXISTS invariant_violations(
+  violation_id INTEGER PRIMARY KEY AUTOINCREMENT, code TEXT NOT NULL,
+  severity TEXT NOT NULL CHECK(severity IN ('warn','critical')),
+  entity TEXT NOT NULL, ledger_id TEXT, workflow_id TEXT, episode_id INTEGER REFERENCES sla_episodes(episode_id),
+  violated_at INTEGER NOT NULL, cleared_at INTEGER, di_id TEXT, lesson_id TEXT,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;
+CREATE INDEX IF NOT EXISTS ix_inv_open ON invariant_violations(cleared_at,code);
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B3. Máy: dịch vụ, ghế, terminal, giao nhận, lượt, khoá, claim, phiên agent, kiểm kê
+-- Luật chủ sở hữu (không có giao dịch liên DB): tài nguyên máy (terminal, worktree, khoá) do machine làm chủ;
+-- op_attempts chỉ TRỎ tới (terminal_handle, worktree_path). Resource ctrl/GC đối soát lệch hai phía.
+-- ---------------------------------------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS services(
+  name TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK(kind IN ('host-app','http','tunnel','connector','scheduled-task','ledger')),
+  state TEXT NOT NULL CHECK(state IN ('healthy','ok','degraded','down','quarantined','restarting','booting','stale')),
+  since INTEGER, pid INTEGER, port INTEGER, url TEXT,
+  last_probe_json TEXT CHECK(last_probe_json IS NULL OR json_valid(last_probe_json)),
+  quarantined_until INTEGER) STRICT;
+CREATE TABLE IF NOT EXISTS service_probes(
+  probe_id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL REFERENCES services(name) ON DELETE CASCADE,
+  at INTEGER NOT NULL, ok INTEGER NOT NULL CHECK(ok IN (0,1)), latency_ms INTEGER,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;   -- giữ 14 ngày
+CREATE INDEX IF NOT EXISTS ix_probes ON service_probes(name,at);
+-- service_events (G5): mọi chuyển trạng thái và mọi restart, append-only (thay services.restarts_json bị cửa sổ hoá).
+CREATE TABLE IF NOT EXISTS service_events(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL REFERENCES services(name) ON DELETE CASCADE,
+  at INTEGER NOT NULL, from_state TEXT, to_state TEXT NOT NULL,
+  probe_ms INTEGER, probe_error TEXT,
+  action TEXT CHECK(action IS NULL OR action IN ('restart','quarantine','release','none')), action_id TEXT) STRICT;
+CREATE INDEX IF NOT EXISTS ix_service_events ON service_events(name,at);
+CREATE TRIGGER IF NOT EXISTS service_events_append_only BEFORE UPDATE ON service_events BEGIN
+    SELECT RAISE(ABORT,'service_events are append-only');
+  END;
+
+-- seats: ghế LLM sống lâu — MỘT nơi. 'parked' = cố ý không có Kernel (workflow paused/stopped): controller KHÔNG
+-- "sửa" ghế parked (MB-08). Đếm lỗi nhập liên tiếp theo ghế (MB-05) → thay ghế sau K lần trong T phút (SLA SEAT_DEAF).
+CREATE TABLE IF NOT EXISTS seats(
+  seat_id TEXT PRIMARY KEY,                      -- 'kernel:<ledger name>:<wf>' | 'supervisor'
+  role TEXT NOT NULL CHECK(role IN ('kernel','supervisor')),
+  ledger_id TEXT REFERENCES ledgers(ledger_id), workflow_id TEXT,
+  state TEXT NOT NULL CHECK(state IN ('empty','parked','booting','live','busy','stale','dead','replacing','quarantined')),
+  parked_reason TEXT,
+  terminal_handle TEXT, agent TEXT, model TEXT, routed_by TEXT, pid INTEGER,
+  kernel_rev TEXT, acked_rev TEXT,
+  booted_at INTEGER, last_seen_at INTEGER, replaced_count INTEGER NOT NULL DEFAULT 0,
+  input_failures_consecutive INTEGER NOT NULL DEFAULT 0,   -- unwritable/exited/unavailable liên tiếp
+  input_failures_total INTEGER NOT NULL DEFAULT 0,
+  last_input_failure_at INTEGER, last_input_ok_at INTEGER,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json)),
+  CHECK(state<>'parked' OR parked_reason IS NOT NULL)) STRICT;
+
+-- deliveries (G11, MB-02): MỌI lần đưa thông điệp tới một ghế (DI, inbox, doorbell, wake, telegram) và kết quả.
+CREATE TABLE IF NOT EXISTS deliveries(
+  delivery_id  INTEGER PRIMARY KEY AUTOINCREMENT,
+  message_kind TEXT NOT NULL CHECK(message_kind IN ('decision','inbox','doorbell','wake','telegram','notice')),
+  message_ref  TEXT NOT NULL,                    -- di_id | inbox_id | msg_id
+  ledger_id TEXT, seat_id TEXT REFERENCES seats(seat_id), terminal_handle TEXT,
+  channel      TEXT NOT NULL,
+  attempted_at INTEGER NOT NULL,
+  outcome      TEXT NOT NULL CHECK(outcome IN ('delivered','busy-deferred','unwritable','exited','unavailable','failed')),
+  turn_id      INTEGER,                          -- seat_turns.turn_id mà lời nhắn mở ra
+  detail TEXT) STRICT;
+CREATE INDEX IF NOT EXISTS ix_deliveries_seat ON deliveries(seat_id,attempted_at);
+CREATE INDEX IF NOT EXISTS ix_deliveries_msg  ON deliveries(message_kind,message_ref);
+-- Đếm lỗi nhập theo ghế nằm trong DB, tự động theo từng giao nhận.
+CREATE TRIGGER IF NOT EXISTS deliveries_count_seat_failures AFTER INSERT ON deliveries WHEN NEW.seat_id IS NOT NULL BEGIN
+    UPDATE seats SET
+      input_failures_consecutive = CASE WHEN NEW.outcome IN ('unwritable','exited','unavailable','failed')
+                                        THEN input_failures_consecutive+1 ELSE 0 END,
+      input_failures_total = input_failures_total + (NEW.outcome IN ('unwritable','exited','unavailable','failed')),
+      last_input_failure_at = CASE WHEN NEW.outcome IN ('unwritable','exited','unavailable','failed') THEN NEW.attempted_at ELSE last_input_failure_at END,
+      last_input_ok_at = CASE WHEN NEW.outcome='delivered' THEN NEW.attempted_at ELSE last_input_ok_at END
+    WHERE seat_id=NEW.seat_id;
+  END;
+CREATE TRIGGER IF NOT EXISTS deliveries_append_only BEFORE UPDATE OF outcome, attempted_at, message_ref ON deliveries BEGIN
+    SELECT RAISE(ABORT,'deliveries are append-only');
+  END;
+
+-- seat_turns (G12): mỗi lượt làm việc của ghế: ai đánh thức, kéo dài bao lâu, kết thúc vì sao.
+CREATE TABLE IF NOT EXISTS seat_turns(
+  turn_id      INTEGER PRIMARY KEY AUTOINCREMENT,
+  seat_id      TEXT NOT NULL REFERENCES seats(seat_id),
+  woken_by_delivery INTEGER REFERENCES deliveries(delivery_id),
+  started_at   INTEGER NOT NULL, ended_at INTEGER,
+  end_reason   TEXT CHECK(end_reason IS NULL OR end_reason IN ('idle','budget','interrupted','replaced','crashed')),
+  actions_count INTEGER NOT NULL DEFAULT 0,
+  span_id      TEXT) STRICT;
+CREATE INDEX IF NOT EXISTS ix_seat_turns ON seat_turns(seat_id,started_at);
+
+-- seat_transcript_snapshots (UI-API §2.10): snapshot scrollback định kỳ của ghế Kernel/Supervisor, đã redact.
+CREATE TABLE IF NOT EXISTS seat_transcript_snapshots(
+  snapshot_id INTEGER PRIMARY KEY AUTOINCREMENT,
+  seat_id     TEXT NOT NULL REFERENCES seats(seat_id),
+  terminal_handle TEXT,
+  at INTEGER NOT NULL, lines INTEGER NOT NULL, bytes INTEGER NOT NULL,
+  sha256 TEXT NOT NULL REFERENCES blobs(sha256),
+  UNIQUE(seat_id,sha256)) STRICT;
+CREATE INDEX IF NOT EXISTS ix_seat_snap ON seat_transcript_snapshots(seat_id,at);
+
+CREATE TABLE IF NOT EXISTS terminals(
+  handle TEXT PRIMARY KEY, title TEXT,
+  role TEXT NOT NULL CHECK(role IN ('op','kernel','worker','supervisor','shell','other')),
+  ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER, sup_attempt_id INTEGER, seat_id TEXT, pid INTEGER,
+  owner_ref TEXT,                                -- MB-13: mọi terminal có chủ hoặc TTL
+  expires_at INTEGER,
+  opened_at INTEGER, closed_at INTEGER, close_verified_at INTEGER, closed_by TEXT, last_output_at INTEGER,
+  refused_count INTEGER NOT NULL DEFAULT 0) STRICT;   -- số lần GC từ chối đóng (MB-13: quá N → DI một lần)
+CREATE INDEX IF NOT EXISTS ix_terminals_open    ON terminals(closed_at,role);
+CREATE INDEX IF NOT EXISTS ix_terminals_attempt ON terminals(ledger_id,attempt_id);
+
+CREATE TABLE IF NOT EXISTS host_locks(
+  name TEXT PRIMARY KEY, holder_pid INTEGER NOT NULL, holder TEXT, process_run_id INTEGER REFERENCES process_runs(run_id),
+  started_at INTEGER NOT NULL, heartbeat_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+  handed_over_from INTEGER,
+  state TEXT NOT NULL DEFAULT 'held' CHECK(state IN ('starting','held','released'))) STRICT;
+
+-- claims (G14, MB-04, MB-17): tài nguyên tạm (thư mục, worktree tạm, file lock) được CLAIM trước khi tạo; GC xoá an toàn
+-- (safeRemoveTree, không đi theo junction) khi pid chủ đã chết.
+CREATE TABLE IF NOT EXISTS claims(
+  claim_id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  resource_path   TEXT NOT NULL,
+  kind            TEXT NOT NULL CHECK(kind IN ('temp-dir','worktree','lock-file','fixture','scratch')),
+  owner_action_id TEXT, owner_pid INTEGER NOT NULL, owner_run_id INTEGER REFERENCES process_runs(run_id),
+  has_junctions   INTEGER NOT NULL DEFAULT 0 CHECK(has_junctions IN (0,1)),
+  created_at      INTEGER NOT NULL, released_at INTEGER, swept_at INTEGER, sweep_error TEXT) STRICT;
+CREATE UNIQUE INDEX IF NOT EXISTS ux_claims_live ON claims(resource_path) WHERE released_at IS NULL AND swept_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS agent_sessions(
+  session_id      TEXT PRIMARY KEY,
+  agent           TEXT NOT NULL CHECK(agent IN ('devin','codex','claude')),
+  terminal_handle TEXT, ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER, sup_attempt_id INTEGER, seat_id TEXT,
+  started_at INTEGER, ended_at INTEGER,
+  transcript_sha  TEXT REFERENCES blobs(sha256), archive_ref TEXT, bytes INTEGER, archived_at INTEGER) STRICT;
+CREATE INDEX IF NOT EXISTS ix_agent_sessions_attempt ON agent_sessions(ledger_id,attempt_id);
+
+-- inventory_snapshots (G15): kiểm kê tiến trình/terminal/worktree/dir tạm mỗi N phút, giữ 7 ngày — thấy rò tăng dần.
+CREATE TABLE IF NOT EXISTS inventory_snapshots(
+  snap_at INTEGER NOT NULL,
+  kind    TEXT NOT NULL CHECK(kind IN ('process','terminal','worktree','temp-dir','lock')),
+  key     TEXT NOT NULL,                         -- pid:starttime | handle | path
+  owner   TEXT, rss_mb INTEGER, age_s INTEGER, detail TEXT,
+  PRIMARY KEY(snap_at,kind,key)) STRICT, WITHOUT ROWID;
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B4. Tài nguyên: RAM/CPU, pool, provider, quota, guard, lease máy, ngân sách
+-- ---------------------------------------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS throttle_state(       -- thay ram-throttle.json (một dòng hiện tại; mang rev người ghi — MB-15)
+  id INTEGER PRIMARY KEY CHECK(id=1),
+  mode TEXT NOT NULL CHECK(mode IN ('normal','heavy','critical')),
+  effective_cap INTEGER, heavy_cap INTEGER, running INTEGER,
+  free_ram_pct REAL, free_ram_mb INTEGER, cpu_pct REAL, cpu_hot INTEGER, since INTEGER, updated_at INTEGER NOT NULL,
+  reason TEXT, writer TEXT NOT NULL, writer_rev TEXT NOT NULL,
+  slot_targets_json TEXT CHECK(slot_targets_json IS NULL OR json_valid(slot_targets_json)),
+  priorities_json TEXT CHECK(priorities_json IS NULL OR json_valid(priorities_json))) STRICT;
+-- throttle_events (G7): MỌI chuyển mode, APPEND-ONLY (không ghi đè, không xoá).
+CREATE TABLE IF NOT EXISTS throttle_events(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL,
+  from_mode TEXT, to_mode TEXT NOT NULL CHECK(to_mode IN ('normal','heavy','critical')), reason TEXT,
+  free_ram_pct REAL, cpu_pct REAL, effective_cap INTEGER, running INTEGER, writer_rev TEXT,
+  sample_json TEXT CHECK(sample_json IS NULL OR json_valid(sample_json))) STRICT;
+CREATE TRIGGER IF NOT EXISTS throttle_events_no_update BEFORE UPDATE ON throttle_events BEGIN
+    SELECT RAISE(ABORT,'throttle_events are append-only');
+  END;
+CREATE TRIGGER IF NOT EXISTS throttle_events_no_delete BEFORE DELETE ON throttle_events BEGIN
+    SELECT RAISE(ABORT,'throttle_events are append-only');
+  END;
+-- Đổi mode trong throttle_state phải có throttle_events tương ứng ghi trước (không mất chuyển nào).
+CREATE TRIGGER IF NOT EXISTS throttle_state_recorded BEFORE UPDATE OF mode ON throttle_state
+  WHEN NEW.mode<>OLD.mode AND NOT EXISTS(SELECT 1 FROM throttle_events e WHERE e.seq=(SELECT max(seq) FROM throttle_events)
+         AND e.to_mode=NEW.mode AND e.from_mode IS OLD.mode) BEGIN
+    SELECT RAISE(ABORT,'throttle mode change must be recorded in throttle_events first');
+  END;
+-- throttle_decisions (G7): op nào bị hoãn vì throttle, bao lâu.
+CREATE TABLE IF NOT EXISTS throttle_decisions(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL, ledger_id TEXT, workflow_id TEXT, job_id TEXT,
+  reason TEXT NOT NULL, waited_ms INTEGER, released_at INTEGER) STRICT;
+
+CREATE TABLE IF NOT EXISTS host_samples(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('host','op-footprint','worker-footprint')),
+  ledger_id TEXT, workflow_id TEXT, attempt_id INTEGER, sup_attempt_id INTEGER, subject TEXT,
+  ram_mb INTEGER, cpu_pct REAL, free_ram_mb INTEGER, free_ram_pct REAL, free_disk_gb REAL,
+  mode TEXT, effective_cap INTEGER, running INTEGER,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;           -- giữ 14 ngày
+CREATE INDEX IF NOT EXISTS ix_host_samples ON host_samples(kind,at);
+CREATE TABLE IF NOT EXISTS provider_health(
+  provider TEXT PRIMARY KEY CHECK(provider IN ('devin','codex','claude')),
+  status TEXT NOT NULL CHECK(status IN ('healthy','striking','unavailable','recovered')),
+  failure_kind TEXT, strikes INTEGER NOT NULL DEFAULT 0, strike_limit INTEGER,
+  circuit_open_until INTEGER, recovered_at INTEGER, reason TEXT, updated_at INTEGER NOT NULL,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;
+CREATE TABLE IF NOT EXISTS provider_health_events(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, provider TEXT NOT NULL, at INTEGER NOT NULL, from_status TEXT, to_status TEXT,
+  failure_kind TEXT, ledger_id TEXT, attempt_id INTEGER,
+  detail_json TEXT CHECK(detail_json IS NULL OR json_valid(detail_json))) STRICT;
+CREATE TABLE IF NOT EXISTS pool_backoff(
+  pool TEXT PRIMARY KEY, until_at INTEGER, strikes INTEGER NOT NULL DEFAULT 0, reason TEXT, updated_at INTEGER NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS quotas(
+  provider TEXT NOT NULL, window TEXT NOT NULL, used REAL, limit_value REAL, reset_at INTEGER, source TEXT,
+  observed_at INTEGER NOT NULL, PRIMARY KEY(provider,window)) STRICT;
+CREATE TABLE IF NOT EXISTS guard_jobs(           -- thay .claude/runtime/guards/jobs/<job>.json (STARCI_GUARD_FILE)
+  job_id TEXT PRIMARY KEY, ledger_id TEXT, workflow_id TEXT, attempt_id INTEGER,
+  allow_json TEXT NOT NULL CHECK(json_valid(allow_json)),
+  hooks_json TEXT CHECK(hooks_json IS NULL OR json_valid(hooks_json)),
+  created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, released_at INTEGER) STRICT;
+CREATE TABLE IF NOT EXISTS guard_refusals(       -- thay .claude/runtime/guards/refusals.jsonl
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL, ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER,
+  tool TEXT, command TEXT, code TEXT, reason TEXT, remedy TEXT, cwd TEXT) STRICT;
+CREATE TABLE IF NOT EXISTS host_resources(resource_key TEXT PRIMARY KEY, capacity INTEGER NOT NULL CHECK(capacity>=0)) STRICT;
+CREATE TABLE IF NOT EXISTS host_leases(
+  resource_key TEXT NOT NULL, token TEXT NOT NULL, ledger_id TEXT NOT NULL REFERENCES ledgers(ledger_id),
+  workflow_id TEXT NOT NULL, job_id TEXT NOT NULL, attempt_id INTEGER, holder TEXT, units INTEGER NOT NULL CHECK(units>0),
+  acquired_at INTEGER NOT NULL, expires_at INTEGER NOT NULL CHECK(expires_at>acquired_at), PRIMARY KEY(resource_key,token)) STRICT;
+CREATE INDEX IF NOT EXISTS ix_host_leases_expiry ON host_leases(expires_at);
+CREATE TABLE IF NOT EXISTS budgets(
+  scope_key TEXT PRIMARY KEY, limit_value INTEGER NOT NULL, used_value INTEGER NOT NULL DEFAULT 0,
+  reserved_value INTEGER NOT NULL DEFAULT 0, window TEXT, updated_at INTEGER) STRICT;
+CREATE TABLE IF NOT EXISTS budget_reservations(
+  scope_key TEXT NOT NULL REFERENCES budgets(scope_key), ledger_id TEXT NOT NULL, job_id TEXT NOT NULL,
+  units INTEGER NOT NULL, at INTEGER, PRIMARY KEY(scope_key,ledger_id,job_id)) STRICT;
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B5. GC, land gate, push, lane, worktree, môi trường
+-- ---------------------------------------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS gc_runs(
+  run_id INTEGER PRIMARY KEY AUTOINCREMENT, action_id TEXT, started_at INTEGER NOT NULL, finished_at INTEGER,
+  trigger TEXT CHECK(trigger IS NULL OR trigger IN ('event','sweep','housekeeping','low-disk','low-ram','blob-sweep','manual')),
+  freed_bytes INTEGER,
+  collectors_json TEXT CHECK(collectors_json IS NULL OR json_valid(collectors_json)),
+  counts_json TEXT CHECK(counts_json IS NULL OR json_valid(counts_json)),
+  errors_json TEXT CHECK(errors_json IS NULL OR json_valid(errors_json)),
+  report_sha TEXT REFERENCES blobs(sha256)) STRICT;        -- báo cáo đầy đủ (G4: không cắt)
+-- gc_items (G4, MB-14): MỖI thứ GC chạm tới một dòng: thu/từ chối/giữ, bao nhiêu byte, thử lại mấy lần, kết cục CUỐI.
+CREATE TABLE IF NOT EXISTS gc_items(
+  item_id INTEGER PRIMARY KEY AUTOINCREMENT, run_id INTEGER REFERENCES gc_runs(run_id) ON DELETE CASCADE,
+  collector TEXT NOT NULL, kind TEXT NOT NULL, target TEXT NOT NULL, owner_ref TEXT, age_ms INTEGER,
+  action TEXT NOT NULL CHECK(action IN ('collect','refuse','keep','closed','killed','removed','archived','failed')),
+  reason TEXT, bytes INTEGER,
+  tries INTEGER NOT NULL DEFAULT 1, next_try_at INTEGER,   -- retry đặt vào grace - age + margin, không đúng bằng grace
+  last_error TEXT,
+  outcome TEXT CHECK(outcome IS NULL OR outcome IN ('done','dropped','gave-up')),   -- kết cục cuối, luôn được ghi
+  verified_gone_at INTEGER,
+  at INTEGER NOT NULL) STRICT;
+CREATE INDEX IF NOT EXISTS ix_gc_items_kind ON gc_items(collector,kind,at);
+CREATE INDEX IF NOT EXISTS ix_gc_items_open ON gc_items(outcome,next_try_at);
+CREATE TABLE IF NOT EXISTS gc_marks(
+  run_id  INTEGER NOT NULL REFERENCES gc_runs(run_id) ON DELETE CASCADE,
+  sha256  TEXT NOT NULL,
+  source  TEXT NOT NULL,                         -- ledger name | 'machine'
+  pinned  INTEGER NOT NULL DEFAULT 0 CHECK(pinned IN (0,1)),
+  PRIMARY KEY(run_id,sha256,source)) STRICT, WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS lanes(
+  name TEXT PRIMARY KEY, worktree_path TEXT NOT NULL, branch TEXT NOT NULL, base_sha TEXT, head_sha TEXT,
+  owner TEXT NOT NULL,                           -- 'supervisor' | 'owner-chat' | 'worker:<job>'
+  sup_job_id TEXT REFERENCES sup_jobs(job_id),
+  state TEXT NOT NULL CHECK(state IN ('open','landing','landed','abandoned','removed')),
+  created_at INTEGER NOT NULL, landed_at INTEGER, removed_at INTEGER,
+  report_sha TEXT REFERENCES blobs(sha256)) STRICT;
+-- land_queue (G9, MB-10): thời điểm vào gate và ai giữ gate khi bận.
+CREATE TABLE IF NOT EXISTS land_queue(
+  ticket_id TEXT PRIMARY KEY, lane TEXT REFERENCES lanes(name), commit_sha TEXT NOT NULL, commits INTEGER, requested_by TEXT,
+  state TEXT NOT NULL CHECK(state IN ('queued','running','passed','failed','cancelled')),
+  enqueued_at INTEGER NOT NULL, gate_at INTEGER, busy_holder TEXT, started_at INTEGER, finished_at INTEGER) STRICT;
+CREATE INDEX IF NOT EXISTS ix_land_queue_state ON land_queue(state,enqueued_at);
+CREATE TABLE IF NOT EXISTS land_runs(
+  run_id INTEGER PRIMARY KEY AUTOINCREMENT, ticket_id TEXT REFERENCES land_queue(ticket_id), lane TEXT,
+  span_id TEXT NOT NULL CHECK(length(span_id)=16), parent_span_id TEXT,
+  commit_sha TEXT NOT NULL, landed_sha TEXT,
+  commits_json TEXT CHECK(commits_json IS NULL OR (json_valid(commits_json) AND json_type(commits_json)='array')),   -- every picked commit, in order (a3-2)
+  result TEXT NOT NULL CHECK(result IN ('passed','failed','conflict','refused')), reason TEXT,
+  push_id INTEGER,                               -- MB-12: land 'passed' nối với kết quả push thật
+  specs_json TEXT CHECK(specs_json IS NULL OR json_valid(specs_json)),
+  stdout_sha TEXT REFERENCES blobs(sha256), stderr_sha TEXT REFERENCES blobs(sha256),
+  started_at INTEGER NOT NULL, finished_at INTEGER) STRICT;
+CREATE INDEX IF NOT EXISTS ix_land_runs_lane ON land_runs(lane,started_at);
+-- pushes (G8, MB-03): mỗi lần push một dòng, có chữ ký lỗi ổn định và log ĐẦY ĐỦ ở blob.
+CREATE TABLE IF NOT EXISTS pushes(
+  push_id INTEGER PRIMARY KEY AUTOINCREMENT, repo_root TEXT NOT NULL, branch TEXT, head TEXT NOT NULL, from_sha TEXT, to_sha TEXT,
+  result TEXT NOT NULL CHECK(result IN ('pushed','refused','skipped','failed')), reason TEXT,
+  failure_signature TEXT,                        -- secret-scan:<rule> | lint:<rule> | jest:<suite> ... (không chứa HEAD)
+  ms INTEGER, action_id TEXT,
+  scan_json TEXT CHECK(scan_json IS NULL OR json_valid(scan_json)),
+  stdout_sha TEXT REFERENCES blobs(sha256), stderr_sha TEXT REFERENCES blobs(sha256),
+  at INTEGER NOT NULL,
+  CHECK(result IN ('pushed','skipped') OR failure_signature IS NOT NULL)) STRICT;
+CREATE INDEX IF NOT EXISTS ix_pushes ON pushes(repo_root,at);
+
+CREATE TABLE IF NOT EXISTS worktrees(
+  path TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK(kind IN ('op','workflow','land-scratch','push-scratch','supervisor-staging','lane')),
+  repo_root TEXT NOT NULL, branch TEXT, base_sha TEXT, head_sha TEXT, port INTEGER,
+  ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER, lane TEXT, claim_id INTEGER REFERENCES claims(claim_id),
+  created_at INTEGER NOT NULL, removed_at INTEGER, archived_ref TEXT, remove_error TEXT) STRICT;
+CREATE INDEX IF NOT EXISTS ix_worktrees_live    ON worktrees(removed_at,kind);
+CREATE INDEX IF NOT EXISTS ix_worktrees_attempt ON worktrees(ledger_id,attempt_id);
+
+CREATE TABLE IF NOT EXISTS env_servers(
+  server_id TEXT PRIMARY KEY, env TEXT, service TEXT, repo_root TEXT,
+  ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER,
+  command TEXT, cwd TEXT, port INTEGER, pid INTEGER, url TEXT,
+  state TEXT NOT NULL CHECK(state IN ('starting','ready','failed','stopped')),
+  started_at INTEGER, stopped_at INTEGER, log_sha TEXT REFERENCES blobs(sha256)) STRICT;
+CREATE TABLE IF NOT EXISTS uat_slots(
+  slot_id TEXT PRIMARY KEY, ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER,
+  browser_profile TEXT, port INTEGER, acquired_at INTEGER, expires_at INTEGER, released_at INTEGER) STRICT;
+CREATE TABLE IF NOT EXISTS connectors(           -- KHÔNG chứa bí mật; bí mật ở .starcistacks + sops
+  name TEXT PRIMARY KEY, kind TEXT, state TEXT, pid INTEGER, port INTEGER, public_url TEXT,
+  config_json TEXT CHECK(config_json IS NULL OR json_valid(config_json)),
+  cursor_json TEXT CHECK(cursor_json IS NULL OR json_valid(cursor_json)),     -- vd telegram offset, route chats
+  updated_at INTEGER NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS ask_requests(
+  ask_id TEXT PRIMARY KEY, ledger_id TEXT, workflow_id TEXT, di_id TEXT, channel TEXT, question TEXT NOT NULL,
+  form_url TEXT,
+  state TEXT NOT NULL CHECK(state IN ('open','answered','retired','expired')),
+  asked_at INTEGER NOT NULL, answered_at INTEGER, answer_ref TEXT) STRICT;
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B6. Quan sát cấp máy
+-- ---------------------------------------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS machine_logs(
+  seq INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL,
+  actor TEXT NOT NULL CHECK(actor IN ('reconciler','supervisor','worker','gc','host','land','watchdog','connector','harness','runtime')),
+  controller TEXT, ledger_id TEXT, workflow_id TEXT, job_id TEXT, attempt_id INTEGER, action_id TEXT,
+  trace_id TEXT, span_id TEXT,
+  level TEXT NOT NULL CHECK(level IN ('debug','info','warn','error')),
+  kind TEXT NOT NULL, msg TEXT NOT NULL,
+  data_json TEXT CHECK(data_json IS NULL OR json_valid(data_json)),
+  refs_json TEXT CHECK(refs_json IS NULL OR json_valid(refs_json)),
+  src TEXT UNIQUE) STRICT;                       -- append-only; GC xoá theo retention (debug 14 ngày, còn lại 90 ngày)
+CREATE INDEX IF NOT EXISTS ix_mlogs_at   ON machine_logs(at);
+CREATE INDEX IF NOT EXISTS ix_mlogs_kind ON machine_logs(actor,kind,seq);
+CREATE INDEX IF NOT EXISTS ix_mlogs_ent  ON machine_logs(ledger_id,workflow_id,job_id,seq);
+CREATE TRIGGER IF NOT EXISTS machine_logs_append_only BEFORE UPDATE ON machine_logs BEGIN
+    SELECT RAISE(ABORT,'machine_logs are append-only');
+  END;
+CREATE VIRTUAL TABLE IF NOT EXISTS machine_logs_fts USING fts5(msg, kind, controller, content='machine_logs', content_rowid='seq',
+  tokenize='unicode61 remove_diacritics 2');
+CREATE TRIGGER IF NOT EXISTS machine_logs_fts_insert AFTER INSERT ON machine_logs BEGIN
+    INSERT INTO machine_logs_fts(rowid,msg,kind,controller) VALUES (NEW.seq,NEW.msg,NEW.kind,NEW.controller);
+  END;
+CREATE TRIGGER IF NOT EXISTS machine_logs_fts_delete AFTER DELETE ON machine_logs BEGIN
+    INSERT INTO machine_logs_fts(machine_logs_fts,rowid,msg,kind,controller) VALUES ('delete',OLD.seq,OLD.msg,OLD.kind,OLD.controller);
+  END;
+
+-- metrics_snapshots: controller ghi (progress, rca, frontier, coverage, verify ...) để harness KHÔNG phải chạy verb.
+CREATE TABLE IF NOT EXISTS metrics_snapshots(
+  snap_id INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('op-health','progress','rca','frontier','coverage','verify','model-scorecard','throughput','ram')),
+  ledger_id TEXT, workflow_id TEXT, window_ms INTEGER, subject TEXT,
+  data_json TEXT CHECK(data_json IS NULL OR json_valid(data_json)),
+  data_sha TEXT REFERENCES blobs(sha256)) STRICT;
+CREATE INDEX IF NOT EXISTS ix_metrics ON metrics_snapshots(kind,ledger_id,workflow_id,at);
+
+CREATE TABLE IF NOT EXISTS notifications(
+  notif_id INTEGER PRIMARY KEY AUTOINCREMENT, channel TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('digest','urgent','ask','ack','media')),
+  text TEXT NOT NULL, media_sha TEXT REFERENCES blobs(sha256), sent_at INTEGER, delivery TEXT, ref TEXT,
+  dedupe_key TEXT UNIQUE) STRICT;                -- thay telegram-sent.json / telegram-media-sent.json
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B7. View bền của machine.sqlite
+-- ---------------------------------------------------------------------------------------------------------
+CREATE VIEW IF NOT EXISTS v_services AS
+SELECT s.*, COALESCE(m.ui,'unknown') AS ui,
+       (SELECT count(*) FROM service_events e WHERE e.name=s.name AND e.action='restart'
+          AND e.at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 86400000) AS restarts_24h,
+       (SELECT count(*) FROM service_probes p WHERE p.name=s.name AND p.ok=0
+          AND p.at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 86400000) AS failed_probes_24h
+FROM services s LEFT JOIN ui_state_map m ON m.entity='service' AND m.native=s.state;
+
+CREATE VIEW IF NOT EXISTS v_seats AS
+SELECT s.*, COALESCE(m.ui,'unknown') AS ui, t.closed_at AS terminal_closed_at, t.last_output_at,
+       (SELECT max(at) FROM seat_transcript_snapshots x WHERE x.seat_id=s.seat_id) AS last_snapshot_at
+FROM seats s LEFT JOIN ui_state_map m ON m.entity='seat' AND m.native=s.state
+LEFT JOIN terminals t ON t.handle=s.terminal_handle;
+
+CREATE VIEW IF NOT EXISTS v_engine_actions AS
+SELECT a.*, COALESCE(m.ui,'unknown') AS ui FROM engine_actions a
+LEFT JOIN ui_state_map m ON m.entity='engine-action' AND m.native=a.state;
+
+-- Đồng hồ SLA đang mở (thay bảng sla_clocks cũ).
+CREATE VIEW IF NOT EXISTS v_sla_open AS
+SELECT e.*, e.entered_at + e.sla_ms AS due_at,
+       CASE WHEN e.violated_at IS NULL THEN 'waiting' WHEN e.severity='critical' THEN 'bad' ELSE 'warn' END AS ui
+FROM sla_episodes e WHERE e.cleared_at IS NULL;
+
+-- Nhiệm vụ định kỳ quá hạn hoặc chạy quá dày (MB-01).
+CREATE VIEW IF NOT EXISTS v_schedules AS
+SELECT s.*, (CAST(unixepoch('subsec')*1000 AS INTEGER) - s.next_due_at) AS overdue_ms,
+       (SELECT count(*) FROM engine_actions a WHERE a.controller=s.controller AND a.duty=s.duty
+          AND a.started_at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 86400000) AS runs_24h,
+       CASE WHEN (SELECT count(*) FROM engine_actions a WHERE a.controller=s.controller AND a.duty=s.duty
+                   AND a.started_at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 86400000) > 2 * (86400000 / s.interval_ms) + 1 THEN 'bad'
+            WHEN s.next_due_at < CAST(unixepoch('subsec')*1000 AS INTEGER) - s.interval_ms THEN 'warn' ELSE 'ok' END AS ui
+FROM schedules s;
+
+CREATE VIEW IF NOT EXISTS v_open_sup_decisions AS
+SELECT di_id, kind, summary, status, opened_at, due_at, escalations, delivered_at,
+       (CAST(unixepoch('subsec')*1000 AS INTEGER) - opened_at) AS age_ms,
+       CASE WHEN due_at IS NOT NULL AND due_at < CAST(unixepoch('subsec')*1000 AS INTEGER) THEN 'bad'
+            WHEN delivered_at IS NULL THEN 'warn'
+            WHEN status='claimed' THEN 'running' ELSE 'waiting' END AS ui
+FROM sup_decision_items WHERE status IN ('open','claimed','escalated');
+
+-- Ghế điếc (MB-05): lỗi nhập liên tiếp ≥ 3 → SLA SEAT_DEAF → thay ghế.
+CREATE VIEW IF NOT EXISTS v_deaf_seats AS
+SELECT seat_id, role, workflow_id, state, input_failures_consecutive, last_input_failure_at, last_input_ok_at
+FROM seats WHERE state NOT IN ('parked','empty') AND input_failures_consecutive >= 3;
+
+CREATE VIEW IF NOT EXISTS v_leaks AS
+SELECT 'worktree' AS kind, path AS target, ledger_id, job_id AS owner, created_at AS since FROM worktrees
+ WHERE removed_at IS NULL AND kind IN ('op','push-scratch','land-scratch')
+UNION ALL SELECT 'terminal', handle, ledger_id, COALESCE(owner_ref,job_id), opened_at FROM terminals
+ WHERE closed_at IS NULL AND (role IN ('op','worker') OR (owner_ref IS NULL AND expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER)))
+UNION ALL SELECT 'lease', resource_key, ledger_id, job_id, acquired_at FROM host_leases
+ WHERE expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER)
+UNION ALL SELECT 'lease', path, NULL, job_id, acquired_at FROM sup_leases WHERE expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER)
+UNION ALL SELECT 'guard', job_id, ledger_id, job_id, created_at FROM guard_jobs
+ WHERE released_at IS NULL AND expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER)
+UNION ALL SELECT 'claim', resource_path, NULL, owner_action_id, created_at FROM claims
+ WHERE released_at IS NULL AND swept_at IS NULL AND created_at < CAST(unixepoch('subsec')*1000 AS INTEGER) - 3600000
+UNION ALL SELECT 'lock', name, NULL, holder, started_at FROM host_locks
+ WHERE state<>'released' AND expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER);
+
+CREATE VIEW IF NOT EXISTS v_engine_health AS
+SELECT l.holder, l.pid, l.epoch, l.rev, l.heartbeat_at, l.draining, l.passes, l.last_pass_ms, l.last_error,
+       (CAST(unixepoch('subsec')*1000 AS INTEGER) - l.heartbeat_at) AS heartbeat_age_ms,
+       (SELECT count(*) FROM process_runs r WHERE r.role='engine' AND r.started_at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 3600000) AS starts_last_hour,
+       (SELECT count(*) FROM process_runs r WHERE r.role='engine' AND r.exit_reason IN ('crash','killed','lost-lease')
+          AND r.ended_at > CAST(unixepoch('subsec')*1000 AS INTEGER) - 86400000) AS bad_exits_24h,
+       (SELECT count(*) FROM engine_queue) AS queue_depth,
+       (SELECT count(*) FROM sla_episodes WHERE violated_at IS NOT NULL AND cleared_at IS NULL) AS open_violations,
+       CASE WHEN l.expires_at < CAST(unixepoch('subsec')*1000 AS INTEGER) THEN 'bad'
+            WHEN l.last_error IS NOT NULL OR l.draining=1 THEN 'warn' ELSE 'ok' END AS ui
+FROM engine_leader l;
+
+CREATE VIEW IF NOT EXISTS v_search_ids AS
+SELECT 'sup-decision' AS kind, di_id AS id, summary AS title FROM sup_decision_items
+UNION ALL SELECT 'sup-job', job_id, title FROM sup_jobs
+UNION ALL SELECT 'trace', trace_id, title FROM sup_jobs
+UNION ALL SELECT 'lane', name, branch FROM lanes
+UNION ALL SELECT 'land-ticket', ticket_id, commit_sha FROM land_queue
+UNION ALL SELECT 'commit', landed_sha, lane FROM land_runs WHERE landed_sha IS NOT NULL
+UNION ALL SELECT 'action', id, controller||' '||COALESCE(verb,'') FROM engine_actions
+UNION ALL SELECT 'terminal', handle, title FROM terminals
+UNION ALL SELECT 'seat', seat_id, state FROM seats
+UNION ALL SELECT 'service', name, state FROM services
+UNION ALL SELECT 'worktree', path, branch FROM worktrees
+UNION ALL SELECT 'ledger', name, repo_root FROM ledgers
+UNION ALL SELECT 'blob', sha256, media_type FROM blobs;
+
+CREATE VIEW IF NOT EXISTS v_live_marks AS
+SELECT 'machine_logs' AS topic, COALESCE(max(seq),0) AS mark FROM machine_logs
+UNION ALL SELECT 'engine_actions', COALESCE(max(COALESCE(finished_at,started_at)),0) FROM engine_actions
+UNION ALL SELECT 'violations', COALESCE(max(max(violation_id), max(COALESCE(cleared_at,0))),0) FROM invariant_violations
+UNION ALL SELECT 'services', COALESCE(max(seq),0) FROM service_events
+UNION ALL SELECT 'deliveries', COALESCE(max(delivery_id),0) FROM deliveries
+UNION ALL SELECT 'sup_decisions', COALESCE(max(max(opened_at), max(COALESCE(resolved_at,0))),0) FROM sup_decision_items;
+
+-- ---------------------------------------------------------------------------------------------------------
+-- B8. Truy vấn liên DB — KHÔNG có view bền (SQLite cấm view của main tham chiếu DB ATTACH).
+--   * Danh sách fleet (progress, op_history, media, open_work, blocking, settle_overdue, scorecard): engine/machine-db.mjs
+--     forEachLedger(fn) mở từng runtime.sqlite read-only, chạy view cùng tên, gắn cột ledger, gộp trong JS.
+--     attachFleet(batch ≤ 9) chỉ cho truy vấn tay.
+--   * Blob GC: mark theo TỪNG ledger vào gc_marks (theo blob_ref_columns của mỗi DB) rồi sweep — không ATTACH-UNION.
+-- ---------------------------------------------------------------------------------------------------------