borgmcp-server 0.1.1 → 0.1.5

package/src/store.ts

@@ -1,16 +1,19 @@
-import { randomUUID } from "node:crypto";
+import { randomUUID, timingSafeEqual } from "node:crypto";
 import { statfsSync, statSync } from "node:fs";
 import { chmod, lstat, mkdir, open } from "node:fs/promises";
 import { dirname, join, parse, relative, resolve, sep } from "node:path";
 import { DatabaseSync } from "node:sqlite";
+import type { MessageTaxonomy } from "borgmcp-shared/domain";
 
-import { applyMigrations } from "./migrations.js";
+import { applyMigrations, assertMigrationsCurrent } from "./migrations.js";
 import { operatorErrors } from "./operator-error.js";
 import {
   assertCanonicalUuid,
   assertServerDerivedPrincipal,
   type Principal,
 } from "./principal.js";
+import { patchRoleSectionText, type RoleSectionPatchOp } from "./role-section.js";
+import { validateMessageTaxonomy } from "./message-taxonomy.js";
 
 export type CubeAccess = "read" | "write" | "manage";
 
@@ -19,6 +22,7 @@ export interface CubeRecord {
   readonly ownerId: string;
   readonly name: string;
   readonly directive: string;
+  readonly messageTaxonomy: MessageTaxonomy | null;
   readonly createdAt: string;
   readonly updatedAt: string;
 }
@@ -50,6 +54,22 @@ export interface EnrichedActivityRecord {
   readonly recipient_drone_ids: string[];
 }
 
+export type ActivityNotificationRecord = EnrichedActivityRecord & (
+  | {
+    readonly kind: "ack" | "claim";
+    readonly log_entry_id: string;
+    readonly ack_kind: "ack" | "claim";
+    readonly ack_at: string;
+    readonly entry_preview: string;
+    readonly author_drone_id?: string;
+    readonly claimant_drone_id?: string;
+    readonly claimant_role?: string | null;
+  }
+  | { readonly kind: "heartbeat_ping" }
+);
+
+export type ActivityStreamRecord = EnrichedActivityRecord | ActivityNotificationRecord;
+
 export interface ClaimRecord {
   readonly log_entry_id: string;
   readonly claimant_drone_id: string;
@@ -84,8 +104,12 @@ export interface RoleRecord {
   readonly cube_id: string;
   readonly name: string;
   readonly short_description: string;
+  readonly detailed_description: string;
   readonly is_default: boolean;
+  readonly is_mandatory: boolean;
   readonly is_human_seat: boolean;
+  readonly can_broadcast: boolean;
+  readonly receives_all_direct: boolean;
   readonly role_class: "queen" | "worker";
   readonly created_at: string;
 }
@@ -97,7 +121,10 @@ export interface DroneRecord {
   readonly label: string;
   readonly last_seen: string;
   readonly hostname: string | null;
+  readonly posture: "observer" | "participant";
   readonly created_at: string;
+  readonly last_log_post_at?: string | null;
+  readonly seen_since?: boolean;
 }
 
 export interface StoreDiagnostics {
@@ -113,6 +140,7 @@ export interface OpenStoreOptions {
   readonly capacityProbe?: () => StorageCapacity;
   readonly cubeLimits?: CubeLimits;
   readonly mutationHook?: (phase: string) => void;
+  readonly migrationMode?: "apply" | "require-current";
 }
 
 export interface CubeLimits {
@@ -146,10 +174,19 @@ export interface StoreRuntime {
   readonly forPrincipal: (principal: Principal) => ScopedStore;
   readonly maintenance: MaintenanceStore;
   readonly credentials: CredentialStore;
+  readonly liveness: LivenessStore;
   readonly diagnostics: () => StoreDiagnostics;
   readonly close: () => void;
 }
 
+export interface LivenessStore {
+  readonly scan: (options?: {
+    readonly silentMs?: number;
+    readonly cooldownMs?: number;
+    readonly limit?: number;
+  }) => ActivityNotificationRecord[];
+}
+
 export interface DigestPair {
   readonly lookup: Buffer;
   readonly verifier: Buffer;
@@ -166,6 +203,25 @@ export interface StoredSecretDigest extends DigestPair {
 export interface StoredInvitationDigest extends StoredSecretDigest {
   readonly purpose: "owner" | "client";
   readonly ownerEpoch: number | null;
+  readonly cubeId: string | null;
+  readonly access: CubeAccess | null;
+}
+
+export interface InvitationCubeScope {
+  readonly cubeId: string;
+  readonly cubeName: string;
+  readonly access: CubeAccess;
+}
+
+export class InvitationCubeNotFoundError extends Error {}
+
+export class InvitationCubeAmbiguousError extends Error {
+  readonly candidateIds: readonly string[];
+
+  constructor(candidateIds: readonly string[]) {
+    super("Cube name is ambiguous.");
+    this.candidateIds = Object.freeze([...candidateIds]);
+  }
 }
 
 export interface EnrollmentClaimResult {
@@ -180,6 +236,7 @@ export interface StoredDroneSessionDigest extends StoredSecretDigest {
   readonly cubeId: string;
   readonly droneId: string;
   readonly expiresAt: string;
+  readonly evictedAt: string | null;
 }
 
 export interface CredentialStore {
@@ -190,7 +247,9 @@ export interface CredentialStore {
     readonly digest: DigestPair;
     readonly expiresAt: string;
     readonly purpose: "owner" | "client";
-  }) => void;
+    readonly cubeSelector?: { readonly kind: "id" | "name"; readonly value: string };
+    readonly access?: CubeAccess;
+  }) => InvitationCubeScope | null;
   readonly findInvitation: (lookup: Buffer) => StoredInvitationDigest | null;
   readonly claimInvitation: (input: {
     readonly invitationId: string;
@@ -204,6 +263,7 @@ export interface CredentialStore {
   readonly clientExists: (clientId: string) => boolean;
   readonly clientIsActive: (clientId: string) => boolean;
   readonly findDroneSessionCredential: (lookup: Buffer) => StoredDroneSessionDigest | null;
+  readonly findActiveDroneSessionExpiry: (sessionId: string) => string | null;
   readonly rotateClientCredential: (input: {
     readonly clientId: string;
     readonly credentialId: string;
@@ -216,11 +276,19 @@ export interface ScopedStore {
   readonly createCube: (input: CreateCubeInput) => CreateCubeRecord;
   readonly listCubes: () => CubeRecord[];
   readonly getCube: (cubeId: string) => CubeRecord | null;
+  readonly updateCube: (cubeId: string, input: UpdateCubeInput) => CubeRecord;
   readonly updateDirective: (cubeId: string, directive: string) => void;
   readonly appendActivity: (cubeId: string, message: string) => ActivityRecord;
   readonly readActivity: (cubeId: string, limit: number) => ActivityRecord[];
   readonly listRoles: (cubeId: string) => RoleRecord[];
+  readonly createRole: (cubeId: string, input: CreateRoleInput) => RoleRecord;
+  readonly updateRole: (cubeId: string, roleId: string, input: UpdateRoleInput) => RoleRecord;
+  readonly patchRoleSection: (cubeId: string, roleId: string, input: RoleSectionPatchOp) => RoleRecord;
   readonly listDrones: (cubeId: string) => DroneRecord[];
+  readonly listDronesSince: (cubeId: string, since: string) => {
+    readonly drones: DroneRecord[];
+    readonly since: string;
+  };
   readonly appendLog: (cubeId: string, input: {
     readonly message: string;
     readonly visibility?: "broadcast" | "direct";
@@ -236,11 +304,40 @@ export interface ScopedStore {
   readonly listDecisions: (cubeId: string) => DecisionRecord[];
   readonly subscribeActivity: (
     cubeId: string,
-    listener: (entry: EnrichedActivityRecord) => void,
+    listener: (entry: ActivityStreamRecord) => void,
   ) => (() => void);
   readonly attachSeat: (input: SeatAttachInput) => SeatAttachRecord;
 }
 
+export interface CreateRoleInput {
+  readonly name: string;
+  readonly shortDescription?: string;
+  readonly detailedDescription?: string;
+  readonly isDefault?: boolean;
+  readonly isMandatory?: boolean;
+  readonly isHumanSeat?: boolean;
+  readonly canBroadcast?: boolean;
+  readonly receivesAllDirect?: boolean;
+  readonly roleClass?: "queen" | "worker";
+}
+
+export interface UpdateRoleInput {
+  readonly name?: string;
+  readonly shortDescription?: string;
+  readonly detailedDescription?: string;
+  readonly isDefault?: boolean;
+  readonly isMandatory?: boolean;
+  readonly isHumanSeat?: boolean;
+  readonly canBroadcast?: boolean;
+  readonly receivesAllDirect?: boolean;
+  readonly roleClass?: "queen" | "worker";
+}
+
+export interface UpdateCubeInput {
+  readonly directive?: string;
+  readonly messageTaxonomy?: MessageTaxonomy | null;
+}
+
 export interface CreateCubeInput {
   readonly retryKey: string;
   readonly name: string;
@@ -257,7 +354,6 @@ export interface CreateCubeRecord {
 export interface SeatAttachInput {
   readonly cubeId: string;
   readonly roleId: string;
-  readonly retryKey: string;
   readonly priorDroneId?: string;
   readonly droneId: string;
   readonly sessionId: string;
@@ -283,9 +379,7 @@ export interface SeatAttachRecord {
   };
   readonly sessionId: string;
   readonly expiresAt: string;
-  readonly generation: number;
-  readonly reattached: boolean;
-  readonly revokedSessionIds: readonly string[];
+  readonly result: "created" | "reused";
 }
 
 export interface MaintenanceStore {
@@ -359,6 +453,33 @@ export class ScopedStoreError extends Error {
   }
 }
 
+export class RoleConflictError extends Error {
+  readonly code = "ROLE_ALREADY_EXISTS";
+
+  constructor() {
+    super("A role with that name already exists.");
+    this.name = "RoleConflictError";
+  }
+}
+
+export class DefaultRoleRequiredError extends Error {
+  readonly code = "DEFAULT_ROLE_REQUIRED";
+
+  constructor() {
+    super("A cube must retain one default role.");
+    this.name = "DefaultRoleRequiredError";
+  }
+}
+
+export class RoleSectionConflictError extends Error {
+  readonly code = "ROLE_SECTION_CONFLICT";
+
+  constructor() {
+    super("The role section patch conflicts with the current role text.");
+    this.name = "RoleSectionConflictError";
+  }
+}
+
 export class CursorExpiredError extends Error {
   readonly code = "CURSOR_EXPIRED";
 
@@ -368,12 +489,12 @@ export class CursorExpiredError extends Error {
   }
 }
 
-export class AttachConflictError extends Error {
-  readonly code = "ATTACH_CONFLICT";
+export class AttachSessionRejectedError extends Error {
+  readonly code = "SESSION_REJECTED";
 
   constructor() {
-    super("The attach request conflicts with an existing attachment.");
-    this.name = "AttachConflictError";
+    super("The saved session is not accepted for this seat.");
+    this.name = "AttachSessionRejectedError";
   }
 }
 
@@ -401,6 +522,7 @@ interface CubeRow {
   readonly owner_id: string;
   readonly name: string;
   readonly directive: string;
+  readonly message_taxonomy: string | null;
   readonly created_at: string;
   readonly updated_at: string;
 }
@@ -470,8 +592,13 @@ export async function openStore(options: OpenStoreOptions): Promise<StoreRuntime
   });
   const clock = options.clock ?? (() => new Date());
   try {
-    configureDatabase(database);
-    applyMigrations(database);
+    if (options.migrationMode === "require-current") {
+      configureExistingDatabase(database);
+      assertMigrationsCurrent(database);
+    } else {
+      configureDatabase(database);
+      applyMigrations(database);
+    }
   } catch (error) {
     database.close();
     throw error;
@@ -487,9 +614,10 @@ export async function openStore(options: OpenStoreOptions): Promise<StoreRuntime
     capacityProbe,
     requiredInteger(pageRow, "page_size"),
   );
+  const activityHub = new ActivityHub();
   const maintenance = new SqliteMaintenanceStore(database, clock);
+  const liveness = new SqliteLivenessStore(database, clock, activityHub, capacityGuard);
   const credentials = new SqliteCredentialStore(database, clock, capacityGuard, options.mutationHook);
-  const activityHub = new ActivityHub();
   return Object.freeze({
     forPrincipal: (principal: Principal) => {
       assertServerDerivedPrincipal(principal);
@@ -506,6 +634,7 @@ export async function openStore(options: OpenStoreOptions): Promise<StoreRuntime
     },
     maintenance,
     credentials,
+    liveness,
     diagnostics: () => diagnostics(database),
     close: () => database.close(),
   });
@@ -626,7 +755,8 @@ class SqliteScopedStore implements ScopedStore {
   listCubes(): CubeRecord[] {
     const scope = this.#scope("read");
     const rows = this.#database.prepare(`
-      SELECT c.id, c.owner_id, c.name, c.directive, c.created_at, c.updated_at
+      SELECT c.id, c.owner_id, c.name, c.directive, c.message_taxonomy,
+             c.created_at, c.updated_at
       FROM cubes AS c
       WHERE ${scope.sql}
       ORDER BY c.id
@@ -638,7 +768,8 @@ class SqliteScopedStore implements ScopedStore {
     assertCanonicalUuid(cubeId, "Cube id");
     const scope = this.#scope("read");
     const row = this.#database.prepare(`
-      SELECT c.id, c.owner_id, c.name, c.directive, c.created_at, c.updated_at
+      SELECT c.id, c.owner_id, c.name, c.directive, c.message_taxonomy,
+             c.created_at, c.updated_at
       FROM cubes AS c
       WHERE c.id = ? AND ${scope.sql}
     `).get(cubeId, ...scope.parameters);
@@ -646,17 +777,42 @@ class SqliteScopedStore implements ScopedStore {
   }
 
   updateDirective(cubeId: string, directive: string): void {
+    this.updateCube(cubeId, { directive });
+  }
+
+  updateCube(cubeId: string, input: UpdateCubeInput): CubeRecord {
     assertCanonicalUuid(cubeId, "Cube id");
-    validateDirective(directive);
+    if (input.directive === undefined && input.messageTaxonomy === undefined) {
+      throw new TypeError("At least one cube field is required.");
+    }
+    if (input.directive !== undefined) validateDirective(input.directive);
+    const taxonomy = input.messageTaxonomy === undefined
+      ? undefined
+      : validateMessageTaxonomy(input.messageTaxonomy);
+    const serializedTaxonomy = taxonomy === undefined ? undefined : serializeTaxonomy(taxonomy);
     const scope = this.#scope("manage");
     this.#requireCube(cubeId, "manage");
-    this.#capacityGuard.assertCanGrow(Buffer.byteLength(directive));
+    this.#capacityGuard.assertCanGrow(
+      Buffer.byteLength(input.directive ?? "") + Buffer.byteLength(serializedTaxonomy ?? ""),
+    );
     const result = this.#database.prepare(`
       UPDATE cubes AS c
-      SET directive = ?, updated_at = ?
+      SET directive = COALESCE(?, directive),
+          message_taxonomy = CASE WHEN ? = 1 THEN ? ELSE message_taxonomy END,
+          updated_at = ?
       WHERE c.id = ? AND ${scope.sql}
-    `).run(directive, this.#now(), cubeId, ...scope.parameters);
+    `).run(
+      input.directive ?? null,
+      serializedTaxonomy === undefined ? 0 : 1,
+      serializedTaxonomy ?? null,
+      this.#now(),
+      cubeId,
+      ...scope.parameters,
+    );
     if (result.changes !== 1) throw new ScopedStoreError();
+    const cube = this.getCube(cubeId);
+    if (cube === null) throw new ScopedStoreError();
+    return cube;
   }
 
   appendActivity(cubeId: string, message: string): ActivityRecord {
@@ -693,23 +849,282 @@ class SqliteScopedStore implements ScopedStore {
   listRoles(cubeId: string): RoleRecord[] {
     this.#requireCube(cubeId, "read");
     const rows = this.#database.prepare(`
-      SELECT id, cube_id, name, short_description, is_default, is_human_seat,
-             role_class, created_at
+      SELECT id, cube_id, name, short_description, detailed_description,
+             is_default, is_mandatory, is_human_seat, can_broadcast,
+             receives_all_direct, role_class, created_at
       FROM roles WHERE cube_id = ? ORDER BY name, id
     `).all(cubeId);
     return rows.map(roleRecord);
   }
 
+  createRole(cubeId: string, input: CreateRoleInput): RoleRecord {
+    assertCanonicalUuid(cubeId, "Cube id");
+    validateRoleName(input.name);
+    const shortDescription = input.shortDescription ?? "";
+    const detailedDescription = input.detailedDescription ?? "";
+    validateRoleShortDescription(shortDescription);
+    assertRoleTextWriteAllowed(detailedDescription);
+    for (const value of [
+      input.isDefault,
+      input.isMandatory,
+      input.isHumanSeat,
+      input.canBroadcast,
+      input.receivesAllDirect,
+    ]) {
+      if (value !== undefined && typeof value !== "boolean") throw new TypeError("Role flags must be boolean.");
+    }
+    validateRoleClass(input.roleClass);
+    const isDefault = input.isDefault ?? false;
+    const isMandatory = input.isMandatory ?? false;
+    const isHumanSeat = input.isHumanSeat ?? false;
+    const canBroadcast = input.canBroadcast ?? false;
+    const receivesAllDirect = input.receivesAllDirect ?? false;
+    this.#requireCube(cubeId, "manage");
+    this.#capacityGuard.assertCanGrow(
+      Buffer.byteLength(input.name) + Buffer.byteLength(shortDescription) +
+      Buffer.byteLength(detailedDescription) + 8_192,
+    );
+
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#requireCube(cubeId, "manage");
+      const duplicate = this.#database.prepare(
+        "SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ?",
+      ).get(cubeId, input.name);
+      if (duplicate !== undefined) throw new RoleConflictError();
+      if (isDefault) {
+        this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+          .run(cubeId);
+        this.#mutationHook?.("role.demote-default");
+      }
+      const id = randomUUID();
+      this.#database.prepare(`
+        INSERT INTO roles (
+          id, cube_id, name, short_description, detailed_description,
+          is_default, is_mandatory, is_human_seat, can_broadcast,
+          receives_all_direct, role_class, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        id, cubeId, input.name, shortDescription, detailedDescription,
+        booleanInteger(isDefault), booleanInteger(isMandatory), booleanInteger(isHumanSeat),
+        booleanInteger(canBroadcast), booleanInteger(receivesAllDirect), input.roleClass ?? "worker",
+        this.#now(),
+      );
+      this.#mutationHook?.("role.insert");
+      const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(id, cubeId);
+      if (row === undefined) throw new ScopedStoreError();
+      this.#database.exec("COMMIT");
+      this.#mutationHook?.("role.after-commit");
+      return roleRecord(row);
+    } catch (error) {
+      try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
+      throw error;
+    }
+  }
+
+  updateRole(cubeId: string, roleId: string, input: UpdateRoleInput): RoleRecord {
+    assertCanonicalUuid(cubeId, "Cube id");
+    assertCanonicalUuid(roleId, "Role id");
+    if (Object.values(input).every((value) => value === undefined)) {
+      throw new TypeError("At least one role field is required.");
+    }
+    if (input.name !== undefined) validateRoleName(input.name);
+    if (input.shortDescription !== undefined) validateRoleShortDescription(input.shortDescription);
+    if (input.detailedDescription !== undefined && typeof input.detailedDescription !== "string") {
+      throw new TypeError("Role detailed description must be text.");
+    }
+    for (const value of [
+      input.isDefault,
+      input.isMandatory,
+      input.isHumanSeat,
+      input.canBroadcast,
+      input.receivesAllDirect,
+    ]) {
+      if (value !== undefined && typeof value !== "boolean") throw new TypeError("Role flags must be boolean.");
+    }
+    validateRoleClass(input.roleClass);
+    this.#requireCube(cubeId, "manage");
+    this.#capacityGuard.assertCanGrow(
+      Buffer.byteLength(input.name ?? "") + Buffer.byteLength(input.shortDescription ?? "") +
+      Buffer.byteLength(input.detailedDescription ?? "") + 8_192,
+    );
+
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#requireCube(cubeId, "manage");
+      const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+      if (existingRow === undefined) throw new ScopedStoreError();
+      const existing = roleRecord(existingRow);
+      if (input.isDefault === false && existing.is_default) {
+        throw new DefaultRoleRequiredError();
+      }
+      if (input.name !== undefined && input.name !== existing.name) {
+        const duplicate = this.#database.prepare(
+          "SELECT 1 AS present FROM roles WHERE cube_id = ? AND name = ? AND id <> ?",
+        ).get(cubeId, input.name, roleId);
+        if (duplicate !== undefined) throw new RoleConflictError();
+      }
+      if (input.isDefault === true && !existing.is_default) {
+        this.#database.prepare("UPDATE roles SET is_default = 0 WHERE cube_id = ? AND is_default = 1")
+          .run(cubeId);
+        this.#mutationHook?.("role.demote-default");
+      }
+      const nextDetailedDescription = input.detailedDescription ?? existing.detailed_description;
+      assertRoleTextWriteAllowed(nextDetailedDescription, existing.detailed_description);
+      this.#database.prepare(`
+        UPDATE roles SET
+          name = ?, short_description = ?, detailed_description = ?, is_default = ?,
+          is_mandatory = ?, is_human_seat = ?, can_broadcast = ?, receives_all_direct = ?,
+          role_class = ?
+        WHERE id = ? AND cube_id = ?
+      `).run(
+        input.name ?? existing.name,
+        input.shortDescription ?? existing.short_description,
+        nextDetailedDescription,
+        booleanInteger(input.isDefault ?? existing.is_default),
+        booleanInteger(input.isMandatory ?? existing.is_mandatory),
+        booleanInteger(input.isHumanSeat ?? existing.is_human_seat),
+        booleanInteger(input.canBroadcast ?? existing.can_broadcast),
+        booleanInteger(input.receivesAllDirect ?? existing.receives_all_direct),
+        input.roleClass ?? existing.role_class,
+        roleId,
+        cubeId,
+      );
+      const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+      if (row === undefined) throw new ScopedStoreError();
+      this.#database.exec("COMMIT");
+      this.#mutationHook?.("role.after-commit");
+      return roleRecord(row);
+    } catch (error) {
+      try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
+      throw error;
+    }
+  }
+
+  patchRoleSection(cubeId: string, roleId: string, input: RoleSectionPatchOp): RoleRecord {
+    assertCanonicalUuid(cubeId, "Cube id");
+    assertCanonicalUuid(roleId, "Role id");
+    this.#requireCube(cubeId, "manage");
+    this.#capacityGuard.assertCanGrow(
+      Buffer.byteLength(input.heading) +
+      ("body" in input ? Buffer.byteLength(input.body) : 0) + 8_192,
+    );
+
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#requireCube(cubeId, "manage");
+      const existingRow = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+      if (existingRow === undefined) throw new ScopedStoreError();
+      const existing = roleRecord(existingRow);
+      let detailedDescription: string;
+      try {
+        detailedDescription = patchRoleSectionText(existing.detailed_description, input);
+      } catch (error) {
+        if (error instanceof TypeError) throw error;
+        throw new RoleSectionConflictError();
+      }
+      assertRoleTextWriteAllowed(detailedDescription, existing.detailed_description);
+      this.#database.prepare(
+        "UPDATE roles SET detailed_description = ? WHERE id = ? AND cube_id = ?",
+      ).run(detailedDescription, roleId, cubeId);
+      const row = this.#database.prepare(`
+        SELECT id, cube_id, name, short_description, detailed_description,
+               is_default, is_mandatory, is_human_seat, can_broadcast,
+               receives_all_direct, role_class, created_at
+        FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+      if (row === undefined) throw new ScopedStoreError();
+      this.#database.exec("COMMIT");
+      this.#mutationHook?.("role.after-commit");
+      return roleRecord(row);
+    } catch (error) {
+      try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
+      throw error;
+    }
+  }
+
   listDrones(cubeId: string): DroneRecord[] {
     this.#requireCube(cubeId, "read");
     const rows = this.#database.prepare(`
-      SELECT id, cube_id, role_id, label, COALESCE(last_seen, created_at) AS last_seen,
-             hostname, created_at
-      FROM drones WHERE cube_id = ? AND evicted_at IS NULL ORDER BY label, id
+      SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+             COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+             drone.hostname, drone.created_at,
+             CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+               THEN 'participant' ELSE 'observer' END AS posture
+      FROM drones AS drone
+      LEFT JOIN clients AS client ON client.id = drone.client_id
+      LEFT JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL
+      ORDER BY drone.label, drone.id
     `).all(cubeId);
     return rows.map(droneRecord);
   }
 
+  listDronesSince(cubeId: string, since: string): { drones: DroneRecord[]; since: string } {
+    this.#requireCube(cubeId, "read");
+    let createdAt: string;
+    let anchorId: string | null = null;
+    if (/^[0-9a-f]{8}-[0-9a-f-]{27}$/iu.test(since)) {
+      const anchor = this.#database.prepare(
+        "SELECT id, created_at FROM activity_log WHERE id = ? AND cube_id = ?",
+      ).get(since, cubeId);
+      if (anchor === undefined) throw new ScopedStoreError();
+      anchorId = requiredText(anchor, "id");
+      createdAt = requiredText(anchor, "created_at");
+    } else {
+      validateTimestamp(since);
+      createdAt = since;
+    }
+    const rows = this.#database.prepare(`
+      SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+             COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+             drone.hostname, drone.created_at,
+             CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+               THEN 'participant' ELSE 'observer' END AS posture,
+             (SELECT MAX(post.created_at) FROM activity_log AS post
+              WHERE post.cube_id = drone.cube_id AND post.drone_id = drone.id) AS last_log_post_at,
+             EXISTS (SELECT 1 FROM activity_log AS response
+              WHERE response.cube_id = drone.cube_id AND response.drone_id = drone.id
+                AND (response.created_at > ? OR
+                   (? IS NOT NULL AND response.created_at = ? AND response.id > ?))) AS seen_since
+      FROM drones AS drone
+      LEFT JOIN clients AS client ON client.id = drone.client_id
+      LEFT JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL
+      ORDER BY drone.label, drone.id
+    `).all(createdAt, anchorId, createdAt, anchorId, cubeId);
+    return {
+      since: createdAt,
+      drones: rows.map((row) => ({
+        ...droneRecord(row),
+        last_log_post_at: nullableText(row, "last_log_post_at"),
+        seen_since: requiredInteger(row, "seen_since") === 1,
+      })),
+    };
+  }
+
   appendLog(cubeId: string, input: {
     readonly message: string;
     readonly visibility?: "broadcast" | "direct";
@@ -756,11 +1171,24 @@ class SqliteScopedStore implements ScopedStore {
         createdAt, visibility, cubeId, ...scope.parameters,
       );
       if (inserted.changes !== 1) throw new ScopedStoreError();
+      if (droneId !== null) {
+        this.#database.prepare(`
+          UPDATE drones SET last_seen = ? WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
+        `).run(createdAt, droneId, cubeId);
+        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
+      }
       if (recipients.length > 0) {
         const valid = this.#database.prepare(`
-          SELECT COUNT(*) AS count FROM drones
-          WHERE cube_id = ? AND evicted_at IS NULL
-            AND id IN (${recipients.map(() => "?").join(", ")})
+          SELECT COUNT(*) AS count
+          FROM drones AS recipient
+          JOIN clients AS recipient_client ON recipient_client.id = recipient.client_id
+          JOIN client_cube_grants AS recipient_grant
+            ON recipient_grant.client_id = recipient.client_id
+            AND recipient_grant.cube_id = recipient.cube_id
+          WHERE recipient.cube_id = ? AND recipient.evicted_at IS NULL
+            AND recipient_client.revoked_at IS NULL
+            AND recipient_grant.access IN ('write', 'manage')
+            AND recipient.id IN (${recipients.map(() => "?").join(", ")})
         `).get(cubeId, ...recipients);
         if (valid === undefined) throw new Error("Recipient count query returned no row.");
         if (requiredInteger(valid, "count") !== recipients.length) throw new ScopedStoreError();
@@ -786,6 +1214,7 @@ class SqliteScopedStore implements ScopedStore {
       throw new Error("Activity read limit must be an integer from 1 to 500.");
     }
     this.#validateCursor(cubeId, cursor);
+    const broadcastOnly = !this.#allowsDirectedWork(cubeId);
     const cursorSql = cursor === null
       ? { sql: "1 = 1", parameters: [] as string[] }
       : {
@@ -796,6 +1225,7 @@ class SqliteScopedStore implements ScopedStore {
       SELECT l.id
       FROM activity_log AS l
       WHERE l.cube_id = ? AND ${cursorSql.sql}
+        AND (${broadcastOnly ? "l.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY l.created_at, l.id
       LIMIT ?
     `).all(cubeId, ...cursorSql.parameters, limit + 1);
@@ -804,13 +1234,15 @@ class SqliteScopedStore implements ScopedStore {
     const nextCursor = entries.length === 0
       ? cursor
       : { id: entries.at(-1)!.id, created_at: entries.at(-1)!.created_at };
-    const behind = nextCursor === null ? this.#countAfter(cubeId, null) : this.#countAfter(cubeId, nextCursor);
+    const behind = nextCursor === null
+      ? this.#countAfter(cubeId, null, broadcastOnly)
+      : this.#countAfter(cubeId, nextCursor, broadcastOnly);
     return {
       entries,
       cursor: nextCursor,
       behind_by: behind,
       has_more: behind > 0,
-      claims: this.#claims(cubeId),
+      claims: this.#claims(cubeId, broadcastOnly),
     };
   }
 
@@ -818,19 +1250,56 @@ class SqliteScopedStore implements ScopedStore {
     this.#requireCube(cubeId, "write");
     assertCanonicalUuid(entryId, "Activity entry id");
     if (kind !== "ack" && kind !== "claim") throw new Error("Unknown acknowledgement kind.");
-    const exists = this.#database.prepare(
-      "SELECT 1 AS present FROM activity_log WHERE id = ? AND cube_id = ?",
-    ).get(entryId, cubeId);
-    if (exists === undefined) throw new ScopedStoreError();
+    const original = this.#database.prepare(`
+      SELECT drone_id, message, visibility FROM activity_log WHERE id = ? AND cube_id = ?
+    `).get(entryId, cubeId);
+    if (original === undefined) throw new ScopedStoreError();
     this.#capacityGuard.assertCanGrow(512);
     const claimant = this.#principal.kind === "drone-session"
       ? this.#principal.droneId
       : this.#principal.id;
-    this.#database.prepare(`
+    const ackAt = this.#now();
+    const inserted = this.#database.prepare(`
       INSERT OR IGNORE INTO activity_acks (
         entry_id, principal_kind, principal_id, kind, created_at, claimant_drone_id
       ) VALUES (?, ?, ?, ?, ?, ?)
-    `).run(entryId, this.#principal.kind, this.#principal.id, kind, this.#now(), claimant);
+    `).run(entryId, this.#principal.kind, this.#principal.id, kind, ackAt, claimant);
+    if (inserted.changes !== 1 || this.#principal.kind !== "drone-session") return;
+    const claimantDroneId = this.#principal.droneId;
+
+    const actor = this.#database.prepare(`
+      SELECT drone.label, role.name AS role_name
+      FROM drones AS drone JOIN roles AS role ON role.id = drone.role_id
+      WHERE drone.id = ? AND drone.cube_id = ? AND drone.evicted_at IS NULL
+    `).get(claimantDroneId, cubeId);
+    const preview = activityPreview(requiredText(original, "message"));
+    const originalAuthor = nullableText(original, "drone_id");
+    const recipients = kind === "ack"
+      ? originalAuthor === null ? [] : [originalAuthor]
+      : this.#claimAudience(cubeId, entryId, requiredText(original, "visibility"))
+        .filter((droneId) => droneId !== claimantDroneId);
+    if (recipients.length === 0) return;
+    const roleName = actor === undefined ? null : requiredText(actor, "role_name");
+    const notification: ActivityNotificationRecord = {
+      kind,
+      id: randomUUID(),
+      cube_id: cubeId,
+      drone_id: claimantDroneId,
+      drone_label: actor === undefined ? null : requiredText(actor, "label"),
+      role_name: roleName,
+      message: `[${kind.toUpperCase()}] ${preview}`,
+      created_at: ackAt,
+      visibility: "direct",
+      recipient_drone_ids: recipients,
+      log_entry_id: entryId,
+      ack_kind: kind,
+      ack_at: ackAt,
+      entry_preview: preview,
+      ...(kind === "ack"
+        ? { author_drone_id: recipients[0]! }
+        : { claimant_drone_id: claimantDroneId, claimant_role: roleName }),
+    };
+    this.#activityHub.publish(cubeId, notification);
   }
 
   recordDecision(cubeId: string, input: {
@@ -887,7 +1356,6 @@ class SqliteScopedStore implements ScopedStore {
     if (this.#principal.kind !== "client") throw new ScopedStoreError();
     assertCanonicalUuid(input.cubeId, "Cube id");
     assertCanonicalUuid(input.roleId, "Role id");
-    assertCanonicalUuid(input.retryKey, "Retry key");
     if (input.priorDroneId !== undefined) assertCanonicalUuid(input.priorDroneId, "Prior drone id");
     assertCanonicalUuid(input.droneId, "Drone id");
     assertCanonicalUuid(input.sessionId, "Drone session id");
@@ -912,94 +1380,96 @@ class SqliteScopedStore implements ScopedStore {
         WHERE c.id = ? AND role.id = ? AND ${scope.sql}
       `).get(input.cubeId, input.roleId, ...scope.parameters);
       if (roleRow === undefined) throw new ScopedStoreError();
+      const bound = this.#database.prepare(`
+        SELECT credential.verifier_digest, credential.revoked_at AS credential_revoked_at,
+               session.id AS session_id, session.client_id, session.cube_id, session.drone_id,
+               session.expires_at, session.revoked_at AS session_revoked_at,
+               drone.role_id, drone.label, drone.evicted_at
+        FROM drone_session_credentials AS credential
+        JOIN drone_sessions AS session ON session.id = credential.session_id
+        JOIN drones AS drone ON drone.id = session.drone_id
+          AND drone.client_id = session.client_id AND drone.cube_id = session.cube_id
+        WHERE credential.lookup_digest = ?
+      `).get(input.credentialDigest.lookup);
+      if (bound !== undefined) {
+        const verifier = requiredBuffer(bound, "verifier_digest");
+        if (!timingSafeEqual(verifier, input.credentialDigest.verifier) ||
+            optionalText(bound, "credential_revoked_at") !== null ||
+            optionalText(bound, "session_revoked_at") !== null ||
+            optionalText(bound, "evicted_at") !== null ||
+            requiredText(bound, "expires_at") <= now ||
+            requiredText(bound, "client_id") !== this.#principal.id ||
+            requiredText(bound, "cube_id") !== input.cubeId ||
+            requiredText(bound, "role_id") !== input.roleId ||
+            (input.priorDroneId !== undefined &&
+              requiredText(bound, "drone_id") !== input.priorDroneId)) {
+          throw new AttachSessionRejectedError();
+        }
+        const droneId = requiredText(bound, "drone_id");
+        this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
+        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
+        const attachedRoleRow = this.#database.prepare(`
+          SELECT id AS role_id, name AS role_name, role_class, is_human_seat
+          FROM roles WHERE id = ? AND cube_id = ?
+        `).get(requiredText(bound, "role_id"), input.cubeId);
+        if (attachedRoleRow === undefined) throw new Error("Attached drone role is unavailable.");
+        const roleClass = requiredText(attachedRoleRow, "role_class");
+        if (roleClass !== "queen" && roleClass !== "worker") {
+          throw new Error("Database contains invalid role class.");
+        }
+        this.#database.exec("COMMIT");
+        return {
+          cube: {
+            id: requiredText(roleRow, "cube_id"),
+            name: requiredText(roleRow, "cube_name"),
+          },
+          role: {
+            id: requiredText(attachedRoleRow, "role_id"),
+            name: requiredText(attachedRoleRow, "role_name"),
+            role_class: roleClass,
+            is_human_seat: requiredInteger(attachedRoleRow, "is_human_seat") === 1,
+          },
+          drone: { id: droneId, label: requiredText(bound, "label") },
+          sessionId: requiredText(bound, "session_id"),
+          expiresAt: requiredText(bound, "expires_at"),
+          result: "reused",
+        };
+      }
 
-      const retryBinding = this.#database.prepare(`
-        SELECT binding.cube_id AS binding_cube_id,
-               binding.requested_role_id AS binding_requested_role_id,
-               binding.prior_drone_id, drone.id, drone.label,
-               drone.attach_generation, drone.evicted_at
-        FROM seat_attach_bindings AS binding
-        JOIN drones AS drone ON drone.id = binding.drone_id
-        WHERE binding.client_id = ? AND binding.retry_key = ?
-      `).get(this.#principal.id, input.retryKey);
+      const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
+        SELECT id, role_id, label FROM drones
+        WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
+      `).get(input.priorDroneId, this.#principal.id, input.cubeId);
       let droneId: string;
       let droneLabel: string;
-      let reattached: boolean;
-      let generation: number;
-      if (retryBinding !== undefined) {
-        if (optionalText(retryBinding, "evicted_at") != null) throw new ScopedStoreError();
-        if (requiredText(retryBinding, "binding_cube_id") !== input.cubeId ||
-            requiredText(retryBinding, "binding_requested_role_id") !== input.roleId ||
-            nullableText(retryBinding, "prior_drone_id") !== (input.priorDroneId ?? null)) {
-          throw new AttachConflictError();
+      if (priorSeat !== undefined) {
+        const priorSeatId = requiredText(priorSeat, "id");
+        if (requiredText(priorSeat, "role_id") !== input.roleId) {
+          throw new AttachSessionRejectedError();
         }
-        droneId = requiredText(retryBinding, "id");
-        droneLabel = requiredText(retryBinding, "label");
-        generation = requiredInteger(retryBinding, "attach_generation") + 1;
-        this.#database.prepare(`
-          UPDATE drones SET last_seen = ?, attach_generation = ? WHERE id = ?
-        `).run(now, generation, droneId);
-        reattached = true;
+        const occupied = this.#database.prepare(`
+          SELECT 1 FROM drone_sessions AS session
+          JOIN drone_session_credentials AS credential ON credential.session_id = session.id
+          WHERE session.drone_id = ? AND session.client_id = ? AND session.cube_id = ?
+            AND session.revoked_at IS NULL AND credential.revoked_at IS NULL
+            AND session.expires_at > ?
+        `).get(priorSeatId, this.#principal.id, input.cubeId, now);
+        if (occupied !== undefined) throw new AttachSessionRejectedError();
+        droneId = priorSeatId;
+        droneLabel = requiredText(priorSeat, "label");
+        this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
       } else {
-        const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
-          SELECT id, label, attach_generation
-          FROM drones
-          WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
-        `).get(input.priorDroneId, this.#principal.id, input.cubeId);
-        if (priorSeat !== undefined) {
-          droneId = requiredText(priorSeat, "id");
-          droneLabel = requiredText(priorSeat, "label");
-          generation = requiredInteger(priorSeat, "attach_generation") + 1;
-          this.#database.prepare(`
-            UPDATE drones SET last_seen = ?, attach_generation = ? WHERE id = ?
-          `).run(now, generation, droneId);
-          reattached = true;
-        } else {
-          droneId = input.droneId;
-          droneLabel = seatLabel(requiredText(roleRow, "role_name"), droneId);
-          this.#database.prepare(`
-            INSERT INTO drones (
-              id, cube_id, role_id, client_id, label, created_at, last_seen, retry_key,
-              attach_generation
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)
-          `).run(
-            droneId,
-            input.cubeId,
-            input.roleId,
-            this.#principal.id,
-            droneLabel,
-            now,
-            now,
-            input.retryKey,
-          );
-          reattached = false;
-          generation = 1;
-        }
+        droneId = input.droneId;
+        droneLabel = seatLabel(requiredText(roleRow, "role_name"), droneId);
         this.#database.prepare(`
-          INSERT INTO seat_attach_bindings (
-            client_id, retry_key, cube_id, requested_role_id, drone_id, prior_drone_id, created_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?)
+          INSERT INTO drones (id, cube_id, role_id, client_id, label, created_at, last_seen)
+          VALUES (?, ?, ?, ?, ?, ?, ?)
         `).run(
-          this.#principal.id, input.retryKey, input.cubeId, input.roleId,
-          droneId, input.priorDroneId ?? null, now,
+          droneId, input.cubeId, input.roleId, this.#principal.id, droneLabel, now, now,
         );
       }
+      this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
 
-      const oldSessions = this.#database.prepare(
-        "SELECT id FROM drone_sessions WHERE drone_id = ? AND client_id = ? AND cube_id = ?",
-      ).all(droneId, this.#principal.id, input.cubeId)
-        .map((row) => requiredText(row, "id"));
-      if (oldSessions.length > 0) {
-        const placeholders = oldSessions.map(() => "?").join(", ");
-        this.#database.prepare(`
-          UPDATE drone_session_credentials SET revoked_at = ?
-          WHERE session_id IN (${placeholders}) AND revoked_at IS NULL
-        `).run(now, ...oldSessions);
-        this.#database.prepare(`
-          UPDATE drone_sessions SET revoked_at = ?
-          WHERE id IN (${placeholders}) AND revoked_at IS NULL
-        `).run(now, ...oldSessions);
-      }
       this.#database.prepare(`
         INSERT INTO drone_sessions (
           id, client_id, cube_id, drone_id, created_at, expires_at
@@ -1047,9 +1517,7 @@ class SqliteScopedStore implements ScopedStore {
         drone: { id: droneId, label: droneLabel },
         sessionId: input.sessionId,
         expiresAt: input.expiresAt,
-        generation,
-        reattached,
-        revokedSessionIds: oldSessions,
+        result: "created",
       };
     } catch (error) {
       try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
@@ -1057,9 +1525,49 @@ class SqliteScopedStore implements ScopedStore {
     }
   }
 
-  subscribeActivity(cubeId: string, listener: (entry: EnrichedActivityRecord) => void): () => void {
+  subscribeActivity(cubeId: string, listener: (entry: ActivityStreamRecord) => void): () => void {
     this.#requireCube(cubeId, "read");
-    return this.#activityHub.subscribe(cubeId, listener);
+    return this.#activityHub.subscribe(cubeId, (entry) => {
+      if ("kind" in entry) {
+        if (this.#principal.kind === "drone-session" &&
+            entry.recipient_drone_ids.includes(this.#principal.droneId)) listener(entry);
+        return;
+      }
+      if (entry.visibility === "broadcast" || this.#allowsDirectedWork(cubeId)) listener(entry);
+    });
+  }
+
+  #claimAudience(cubeId: string, entryId: string, visibility: string): string[] {
+    if (visibility === "direct") {
+      return this.#database.prepare(`
+        SELECT recipient.drone_id
+        FROM activity_log_recipients AS recipient
+        JOIN drones AS drone ON drone.id = recipient.drone_id
+        JOIN clients AS client ON client.id = drone.client_id
+        JOIN client_cube_grants AS grant_row
+          ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+        WHERE recipient.entry_id = ? AND drone.cube_id = ? AND drone.evicted_at IS NULL
+          AND client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+        ORDER BY recipient.drone_id
+      `).all(entryId, cubeId).map((row) => requiredText(row, "drone_id"));
+    }
+    return this.#database.prepare(`
+      SELECT drone.id AS drone_id
+      FROM drones AS drone
+      JOIN clients AS client ON client.id = drone.client_id
+      JOIN client_cube_grants AS grant_row
+        ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+      WHERE drone.cube_id = ? AND drone.evicted_at IS NULL AND client.revoked_at IS NULL
+        AND grant_row.access IN ('write', 'manage')
+      ORDER BY drone.id
+    `).all(cubeId).map((row) => requiredText(row, "drone_id"));
+  }
+
+  #allowsDirectedWork(cubeId: string): boolean {
+    const scope = this.#scope("write");
+    return this.#database.prepare(`
+      SELECT 1 AS allowed FROM cubes AS c WHERE c.id = ? AND ${scope.sql}
+    `).get(cubeId, ...scope.parameters) !== undefined;
   }
 
   #requireCube(cubeId: string, access: CubeAccess): void {
@@ -1068,7 +1576,15 @@ class SqliteScopedStore implements ScopedStore {
     const row = this.#database.prepare(`
       SELECT 1 AS present FROM cubes AS c WHERE c.id = ? AND ${scope.sql}
     `).get(cubeId, ...scope.parameters);
-    if (row === undefined) throw new ScopedStoreError();
+    if (row !== undefined) return;
+    if (access === "manage") {
+      const visibleScope = this.#scope("read");
+      const visible = this.#database.prepare(`
+        SELECT 1 AS present FROM cubes AS c WHERE c.id = ? AND ${visibleScope.sql}
+      `).get(cubeId, ...visibleScope.parameters);
+      if (visible !== undefined) throw new AccessDeniedError();
+    }
+    throw new ScopedStoreError();
   }
 
   #nextActivityTimestamp(cubeId: string): string {
@@ -1123,14 +1639,16 @@ class SqliteScopedStore implements ScopedStore {
     if (valid === undefined) throw new ScopedStoreError();
   }
 
-  #countAfter(cubeId: string, cursor: LogCursor | null): number {
+  #countAfter(cubeId: string, cursor: LogCursor | null, broadcastOnly: boolean): number {
+    const visibility = broadcastOnly ? "AND visibility = 'broadcast'" : "";
     const row = cursor === null
       ? this.#database.prepare(
-          "SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ?",
+          `SELECT COUNT(*) AS count FROM activity_log WHERE cube_id = ? ${visibility}`,
         ).get(cubeId)
       : this.#database.prepare(`
           SELECT COUNT(*) AS count FROM activity_log
           WHERE cube_id = ? AND (created_at > ? OR (created_at = ? AND id > ?))
+            ${visibility}
         `).get(cubeId, cursor.created_at, cursor.created_at, cursor.id);
     if (row === undefined) throw new Error("Activity count query returned no row.");
     return requiredInteger(row, "count");
@@ -1152,7 +1670,7 @@ class SqliteScopedStore implements ScopedStore {
     return enrichedActivityRecord(row, recipientRows.map((recipient) => requiredText(recipient, "drone_id")));
   }
 
-  #claims(cubeId: string): ClaimRecord[] {
+  #claims(cubeId: string, broadcastOnly: boolean): ClaimRecord[] {
     return this.#database.prepare(`
       SELECT acknowledgement.entry_id AS log_entry_id,
              acknowledgement.claimant_drone_id,
@@ -1166,6 +1684,7 @@ class SqliteScopedStore implements ScopedStore {
       LEFT JOIN roles AS role ON role.id = drone.role_id AND role.cube_id = drone.cube_id
       WHERE entry.cube_id = ? AND acknowledgement.kind = 'claim'
         AND acknowledgement.claimant_drone_id IS NOT NULL
+        AND (${broadcastOnly ? "entry.visibility = 'broadcast'" : "1 = 1"})
       ORDER BY acknowledgement.created_at, acknowledgement.entry_id,
                acknowledgement.claimant_drone_id
     `).all(cubeId).map(claimRecord);
@@ -1323,7 +1842,7 @@ class SqliteMaintenanceStore implements MaintenanceStore {
       for (const table of [
         "cube_create_bindings", "activity_acks", "activity_log_recipients", "activity_log",
         "decisions", "expired_activity_cursors", "drone_session_credentials", "drone_sessions",
-        "seat_attach_bindings", "drones", "roles", "client_cube_grants", "cubes", "client_server_capabilities",
+        "drones", "roles", "client_cube_grants", "cubes", "client_server_capabilities",
         "enrollment_claims", "client_credentials", "owner_enrollment_state", "clients",
         "enrollment_invitations",
       ]) this.#database.exec(`DELETE FROM ${table}`);
@@ -1491,9 +2010,9 @@ class SqliteMaintenanceStore implements MaintenanceStore {
 }
 
 class ActivityHub {
-  readonly #listeners = new Map<string, Set<(entry: EnrichedActivityRecord) => void>>();
+  readonly #listeners = new Map<string, Set<(entry: ActivityStreamRecord) => void>>();
 
-  subscribe(cubeId: string, listener: (entry: EnrichedActivityRecord) => void): () => void {
+  subscribe(cubeId: string, listener: (entry: ActivityStreamRecord) => void): () => void {
     const listeners = this.#listeners.get(cubeId) ?? new Set();
     listeners.add(listener);
     this.#listeners.set(cubeId, listeners);
@@ -1503,7 +2022,7 @@ class ActivityHub {
     };
   }
 
-  publish(cubeId: string, entry: EnrichedActivityRecord): void {
+  publish(cubeId: string, entry: ActivityStreamRecord): void {
     for (const listener of this.#listeners.get(cubeId) ?? []) {
       try {
         listener(entry);
@@ -1514,6 +2033,64 @@ class ActivityHub {
   }
 }
 
+class SqliteLivenessStore implements LivenessStore {
+  constructor(
+    readonly database: DatabaseSync,
+    readonly clock: () => Date,
+    readonly hub: ActivityHub,
+    readonly capacityGuard: StorageCapacityGuard,
+  ) {}
+
+  scan(options: { silentMs?: number; cooldownMs?: number; limit?: number } = {}): ActivityNotificationRecord[] {
+    const now = this.clock();
+    const silentBefore = new Date(now.getTime() - (options.silentMs ?? 600_000)).toISOString();
+    const cooldownBefore = new Date(now.getTime() - (options.cooldownMs ?? 600_000)).toISOString();
+    const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 25), 25));
+    const candidates = this.database.prepare(`
+      SELECT drone.id AS drone_id, drone.cube_id, COALESCE(state.attempts, 0) AS attempts
+      FROM drones AS drone
+      JOIN clients AS client ON client.id = drone.client_id AND client.revoked_at IS NULL
+      JOIN client_cube_grants AS grant_row ON grant_row.client_id = drone.client_id
+        AND grant_row.cube_id = drone.cube_id AND grant_row.access IN ('write', 'manage')
+      LEFT JOIN silent_seat_ping_state AS state ON state.drone_id = drone.id
+      WHERE drone.evicted_at IS NULL AND COALESCE(drone.last_seen, drone.created_at) < ?
+        AND COALESCE(state.attempts, 0) < 3
+        AND (state.last_ping_at IS NULL OR state.last_ping_at < ?)
+        AND EXISTS (SELECT 1 FROM drone_sessions AS session
+          WHERE session.drone_id = drone.id AND session.revoked_at IS NULL AND session.expires_at > ?)
+      ORDER BY COALESCE(drone.last_seen, drone.created_at), drone.id LIMIT ?
+    `).all(silentBefore, cooldownBefore, now.toISOString(), limit);
+    const published: ActivityNotificationRecord[] = [];
+    for (const candidate of candidates) {
+      const droneId = requiredText(candidate, "drone_id");
+      const cubeId = requiredText(candidate, "cube_id");
+      const message = "[HEARTBEAT-PING] No recent activity; confirm this seat is responsive.";
+      this.capacityGuard.assertCanGrow(256);
+      const id = randomUUID();
+      const createdAt = now.toISOString();
+      this.database.exec("BEGIN IMMEDIATE");
+      try {
+        this.database.prepare(`INSERT INTO silent_seat_ping_state (drone_id, attempts, last_ping_at)
+          VALUES (?, 1, ?) ON CONFLICT(drone_id) DO UPDATE
+          SET attempts = attempts + 1, last_ping_at = excluded.last_ping_at
+        `).run(droneId, now.toISOString());
+        this.database.exec("COMMIT");
+      } catch (error) {
+        try { this.database.exec("ROLLBACK"); } catch { /* Preserve original failure. */ }
+        throw error;
+      }
+      const entry: ActivityNotificationRecord = {
+        kind: "heartbeat_ping",
+        id, cube_id: cubeId, drone_id: null, message, visibility: "direct", created_at: createdAt,
+        drone_label: null, role_name: null, recipient_drone_ids: [droneId],
+      };
+      this.hub.publish(cubeId, entry);
+      published.push(entry);
+    }
+    return published;
+  }
+}
+
 class SqliteCredentialStore implements CredentialStore {
   readonly #database: DatabaseSync;
   readonly #clock: () => Date;
@@ -1557,12 +2134,39 @@ class SqliteCredentialStore implements CredentialStore {
     readonly digest: DigestPair;
     readonly expiresAt: string;
     readonly purpose: "owner" | "client";
-  }): void {
+    readonly cubeSelector?: { readonly kind: "id" | "name"; readonly value: string };
+    readonly access?: CubeAccess;
+  }): InvitationCubeScope | null {
     assertCanonicalUuid(input.id, "Invitation id");
     validateDigest(input.digest);
     validateTimestamp(input.expiresAt);
     this.#database.exec("BEGIN IMMEDIATE");
     try {
+      let scope: InvitationCubeScope | null = null;
+      if (input.cubeSelector !== undefined) {
+        if (input.purpose !== "client" || input.access === undefined) {
+          throw new Error("Only client invitations may carry a complete cube scope.");
+        }
+        if (input.access !== "read" && input.access !== "write" && input.access !== "manage") {
+          throw new Error("Unknown cube access grant.");
+        }
+        const rows = input.cubeSelector.kind === "id"
+          ? this.#database.prepare("SELECT id, name FROM cubes WHERE id = ?").all(input.cubeSelector.value)
+          : this.#database.prepare("SELECT id, name FROM cubes WHERE name = ? ORDER BY id").all(input.cubeSelector.value);
+        if (rows.length === 0) throw new InvitationCubeNotFoundError();
+        if (rows.length > 1) {
+          throw new InvitationCubeAmbiguousError(rows.map((row) => requiredText(row, "id")));
+        }
+        const cubeId = requiredText(rows[0]!, "id");
+        assertCanonicalUuid(cubeId, "Resolved cube id");
+        scope = {
+          cubeId,
+          cubeName: requiredText(rows[0]!, "name"),
+          access: input.access,
+        };
+      } else if (input.access !== undefined) {
+        throw new Error("Invitation access requires a cube selector.");
+      }
       let ownerEpoch: number | null = null;
       if (input.purpose === "owner") {
         const state = this.#database.prepare(
@@ -1587,13 +2191,15 @@ class SqliteCredentialStore implements CredentialStore {
       }
       this.#database.prepare(`
         INSERT INTO enrollment_invitations (
-          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch
-        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+          id, lookup_digest, verifier_digest, expires_at, created_at, purpose, owner_epoch,
+          cube_id, access
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
       `).run(
         input.id, input.digest.lookup, input.digest.verifier, input.expiresAt,
-        this.#now(), input.purpose, ownerEpoch,
+        this.#now(), input.purpose, ownerEpoch, scope?.cubeId ?? null, scope?.access ?? null,
       );
       this.#database.exec("COMMIT");
+      return scope;
     } catch (error) {
       try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
       throw error;
@@ -1610,7 +2216,7 @@ class SqliteCredentialStore implements CredentialStore {
              COALESCE(invitation.expires_at, '') AS expires_at,
              invitation.consumed_at, invitation.revoked_at,
              COALESCE(invitation.purpose, 'client') AS purpose,
-             invitation.owner_epoch
+             invitation.owner_epoch, invitation.cube_id, invitation.access
       FROM (SELECT 1) AS seed
       LEFT JOIN enrollment_invitations AS invitation ON invitation.lookup_digest = ?
     `).get(lookup);
@@ -1641,7 +2247,8 @@ class SqliteCredentialStore implements CredentialStore {
                COALESCE(invitation.purpose, 'client') AS purpose,
                invitation.owner_epoch,
                COALESCE(invitation.expires_at, '') AS expires_at,
-               invitation.consumed_at, invitation.revoked_at
+               invitation.consumed_at, invitation.revoked_at,
+               invitation.cube_id, invitation.access
         FROM (SELECT 1) AS seed
         LEFT JOIN enrollment_invitations AS invitation ON invitation.id = ?
       `).get(input.invitationId);
@@ -1689,6 +2296,12 @@ class SqliteCredentialStore implements CredentialStore {
       const ownerEpoch = invitation["owner_epoch"] === null
         ? null
         : requiredInteger(invitation, "owner_epoch");
+      const cubeId = nullableText(invitation, "cube_id");
+      const accessValue = nullableText(invitation, "access");
+      const access = accessValue === null ? null : cubeAccess(accessValue);
+      if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+        throw new Error("Invalid invitation cube scope.");
+      }
       if (purpose === "owner") {
         const state = this.#database.prepare(`
           SELECT epoch, claimed_client_id FROM owner_enrollment_state WHERE singleton = 1
@@ -1699,6 +2312,10 @@ class SqliteCredentialStore implements CredentialStore {
           return null;
         }
       }
+      if (cubeId !== null && this.#database.prepare("SELECT 1 FROM cubes WHERE id = ?").get(cubeId) === undefined) {
+        this.#database.exec("ROLLBACK");
+        return null;
+      }
       this.#capacityGuard.assertCanGrow(Buffer.byteLength(input.requestedClientName ?? "") + 8_192);
       this.#database.prepare(
         "INSERT INTO clients (id, name, created_at) VALUES (?, ?, ?)",
@@ -1723,6 +2340,13 @@ class SqliteCredentialStore implements CredentialStore {
         `).run(input.clientId, now);
         this.#mutationHook?.("enrollment.insert-capability");
       }
+      if (cubeId !== null && access !== null) {
+        this.#database.prepare(`
+          INSERT INTO client_cube_grants (client_id, cube_id, access, created_at)
+          VALUES (?, ?, ?, ?)
+        `).run(input.clientId, cubeId, access, now);
+        this.#mutationHook?.("enrollment.insert-grant");
+      }
       this.#database.prepare(`
         INSERT INTO enrollment_claims (
           invitation_id, retry_key, client_id, requested_client_name,
@@ -1791,9 +2415,8 @@ class SqliteCredentialStore implements CredentialStore {
       SELECT credential.id, credential.lookup_digest, credential.verifier_digest,
              credential.session_id, session.client_id, session.cube_id, session.drone_id,
              session.expires_at,
-             COALESCE(
-               credential.revoked_at, session.revoked_at, client.revoked_at, drone.evicted_at
-             ) AS revoked_at
+             COALESCE(credential.revoked_at, session.revoked_at, client.revoked_at) AS revoked_at,
+             drone.evicted_at
       FROM drone_session_credentials AS credential
       JOIN drone_sessions AS session ON session.id = credential.session_id
       JOIN clients AS client ON client.id = session.client_id
@@ -1805,6 +2428,21 @@ class SqliteCredentialStore implements CredentialStore {
     return row === undefined ? null : storedDroneSessionDigest(row);
   }
 
+  findActiveDroneSessionExpiry(sessionId: string): string | null {
+    assertCanonicalUuid(sessionId, "Drone session id");
+    const row = this.#database.prepare(`
+      SELECT session.expires_at
+      FROM drone_sessions AS session
+      JOIN clients AS client ON client.id = session.client_id
+      JOIN drones AS drone ON drone.id = session.drone_id
+        AND drone.client_id = session.client_id
+        AND drone.cube_id = session.cube_id
+      WHERE session.id = ? AND session.revoked_at IS NULL
+        AND client.revoked_at IS NULL AND drone.evicted_at IS NULL
+    `).get(sessionId);
+    return row === undefined ? null : requiredText(row, "expires_at");
+  }
+
   rotateClientCredential(input: {
     readonly clientId: string;
     readonly credentialId: string;
@@ -1827,6 +2465,16 @@ class SqliteCredentialStore implements CredentialStore {
         UPDATE client_credentials SET revoked_at = ?
         WHERE client_id = ? AND revoked_at IS NULL
       `).run(now, input.clientId);
+      this.#database.prepare(`
+        UPDATE drone_session_credentials SET revoked_at = ?
+        WHERE revoked_at IS NULL AND session_id IN (
+          SELECT id FROM drone_sessions WHERE client_id = ?
+        )
+      `).run(now, input.clientId);
+      this.#database.prepare(`
+        UPDATE drone_sessions SET revoked_at = ?
+        WHERE client_id = ? AND revoked_at IS NULL
+      `).run(now, input.clientId);
       this.#database.prepare(`
         INSERT INTO client_credentials (
           id, client_id, lookup_digest, verifier_digest, created_at
@@ -1881,9 +2529,7 @@ class SqliteCredentialStore implements CredentialStore {
 async function prepareDatabasePath(path: string): Promise<string> {
   if (path === ":memory:") throw new Error("The server store requires a file-backed database.");
   const databasePath = resolve(path);
-  const directory = dirname(databasePath);
-  await ensureDirectoryTree(directory);
-  await chmod(directory, 0o700);
+  const directory = await preparePrivateDataDirectory(dirname(databasePath));
   try {
     const handle = await open(databasePath, "ax", 0o600);
     await handle.close();
@@ -1898,6 +2544,13 @@ async function prepareDatabasePath(path: string): Promise<string> {
   return databasePath;
 }
 
+export async function preparePrivateDataDirectory(path: string): Promise<string> {
+  const directory = resolve(path);
+  await ensureDirectoryTree(directory);
+  await chmod(directory, 0o700);
+  return directory;
+}
+
 async function ensureDirectoryTree(directory: string): Promise<void> {
   const { root } = parse(directory);
   let current = root;
@@ -1951,6 +2604,19 @@ function configureDatabase(database: DatabaseSync): void {
   }
 }
 
+function configureExistingDatabase(database: DatabaseSync): void {
+  database.exec(`
+    PRAGMA foreign_keys = ON;
+    PRAGMA synchronous = FULL;
+    PRAGMA trusted_schema = OFF;
+    PRAGMA secure_delete = ON;
+    PRAGMA busy_timeout = 5000;
+  `);
+  if (readPragma(database, "journal_mode") !== "wal") {
+    throw new Error("SQLite WAL mode is required.");
+  }
+}
+
 function diagnostics(database: DatabaseSync): StoreDiagnostics {
   const journalMode = readPragma(database, "journal_mode");
   const foreignKeys = readPragma(database, "foreign_keys");
@@ -1975,6 +2641,7 @@ function cubeRecord(row: CubeRow): CubeRecord {
     ownerId: row.owner_id,
     name: row.name,
     directive: row.directive,
+    messageTaxonomy: parseTaxonomy(row.message_taxonomy),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
   };
@@ -1998,6 +2665,7 @@ function cubeRow(row: Record<string, unknown>): CubeRow {
     owner_id: requiredText(row, "owner_id"),
     name: requiredText(row, "name"),
     directive: requiredText(row, "directive"),
+    message_taxonomy: nullableText(row, "message_taxonomy"),
     created_at: requiredText(row, "created_at"),
     updated_at: requiredText(row, "updated_at"),
   };
@@ -2083,8 +2751,12 @@ function roleRecord(row: Record<string, unknown>): RoleRecord {
     cube_id: requiredText(row, "cube_id"),
     name: requiredText(row, "name"),
     short_description: requiredText(row, "short_description"),
+    detailed_description: requiredText(row, "detailed_description"),
     is_default: requiredInteger(row, "is_default") === 1,
+    is_mandatory: requiredInteger(row, "is_mandatory") === 1,
     is_human_seat: requiredInteger(row, "is_human_seat") === 1,
+    can_broadcast: requiredInteger(row, "can_broadcast") === 1,
+    receives_all_direct: requiredInteger(row, "receives_all_direct") === 1,
     role_class: roleClass,
     created_at: requiredText(row, "created_at"),
   };
@@ -2100,6 +2772,10 @@ function createCubeRecord(row: Record<string, unknown>): CreateCubeRecord {
 }
 
 function droneRecord(row: Record<string, unknown>): DroneRecord {
+  const posture = requiredText(row, "posture");
+  if (posture !== "observer" && posture !== "participant") {
+    throw new Error("Database contains invalid drone posture.");
+  }
   return {
     id: requiredText(row, "id"),
     cube_id: requiredText(row, "cube_id"),
@@ -2107,6 +2783,7 @@ function droneRecord(row: Record<string, unknown>): DroneRecord {
     label: requiredText(row, "label"),
     last_seen: requiredText(row, "last_seen"),
     hostname: nullableText(row, "hostname"),
+    posture,
     created_at: requiredText(row, "created_at"),
   };
 }
@@ -2155,7 +2832,20 @@ function storedInvitationDigest(row: Record<string, unknown>): StoredInvitationD
   }
   const epochValue = row["owner_epoch"];
   const ownerEpoch = epochValue === null ? null : requiredInteger(row, "owner_epoch");
-  return { ...digest, purpose, ownerEpoch };
+  const cubeId = nullableText(row, "cube_id");
+  const accessValue = nullableText(row, "access");
+  const access = accessValue === null ? null : cubeAccess(accessValue);
+  if ((cubeId === null) !== (access === null) || (cubeId !== null && purpose !== "client")) {
+    throw new Error("Database contains invalid invitation cube scope.");
+  }
+  return { ...digest, purpose, ownerEpoch, cubeId, access };
+}
+
+function cubeAccess(value: string): CubeAccess {
+  if (value !== "read" && value !== "write" && value !== "manage") {
+    throw new Error("Database contains invalid cube access.");
+  }
+  return value;
 }
 
 function enrollmentClaimResult(
@@ -2203,6 +2893,7 @@ function storedDroneSessionDigest(row: Record<string, unknown>): StoredDroneSess
     cubeId: requiredText(row, "cube_id"),
     droneId: requiredText(row, "drone_id"),
     expiresAt: requiredText(row, "expires_at"),
+    evictedAt: nullableText(row, "evicted_at"),
   };
 }
 
@@ -2239,6 +2930,32 @@ function validatePresentationName(value: string): void {
   }
 }
 
+function validateRoleName(value: string): void {
+  if (typeof value !== "string" || value.length < 1 || value.length > 64) {
+    throw new Error("Role name must contain 1 to 64 characters.");
+  }
+}
+
+function validateRoleShortDescription(value: string): void {
+  if (typeof value !== "string" || value.length > 1_024) {
+    throw new Error("Role short description must contain at most 1024 characters.");
+  }
+}
+
+export const MAX_ROLE_DETAILED_DESCRIPTION_CHARS = 51_200;
+
+export function assertRoleTextWriteAllowed(value: string, previous?: string): void {
+  if (typeof value !== "string") throw new TypeError("Role detailed description must be text.");
+  if (value.length <= MAX_ROLE_DETAILED_DESCRIPTION_CHARS) return;
+  if (previous !== undefined && previous.length > MAX_ROLE_DETAILED_DESCRIPTION_CHARS &&
+      value.length < previous.length) return;
+  throw new RangeError("Role detailed description is too large.");
+}
+
+function booleanInteger(value: boolean): 0 | 1 {
+  return value ? 1 : 0;
+}
+
 function validateBoundedText(value: string, name: string, maxBytes: number): void {
   if (value.length === 0 || Buffer.byteLength(value) > maxBytes) {
     throw new Error(`${name} must contain 1 to ${maxBytes} bytes.`);
@@ -2262,6 +2979,34 @@ function validateDirective(value: string): void {
   }
 }
 
+function activityPreview(message: string): string {
+  return message.replace(/\s+/gu, " ").trim().slice(0, 200);
+}
+
+function validateRoleClass(value: unknown): void {
+  if (value !== undefined && value !== "queen" && value !== "worker") {
+    throw new TypeError("Role class must be queen or worker.");
+  }
+}
+
+function serializeTaxonomy(value: MessageTaxonomy | null): string | null {
+  if (value === null) return null;
+  const serialized = JSON.stringify(value);
+  if (Buffer.byteLength(serialized) > 100_000) {
+    throw new RangeError("Message taxonomy exceeds 100000 bytes.");
+  }
+  return serialized;
+}
+
+function parseTaxonomy(value: string | null): MessageTaxonomy | null {
+  if (value === null) return null;
+  try {
+    return validateMessageTaxonomy(JSON.parse(value));
+  } catch {
+    throw new Error("Database contains invalid message taxonomy.");
+  }
+}
+
 function validateDigest(digest: DigestPair): void {
   validateLookup(digest.lookup);
   if (digest.verifier.length !== 32) throw new Error("Verifier digest must contain 32 bytes.");