toolroll 0.9.104 → 0.9.105

package/dist/storage-sweep.d.ts

@@ -1,77 +0,0 @@
-import { type Located } from "./orphan-sweep.js";
-import { type ProcessRow } from "./run-closeout.js";
-import { type Store } from "./store.js";
-import { type WorktreePool } from "./worktree.js";
-import { type SweepCompletion, type SweepExecutor } from "./storage-sweep-process.js";
-export declare const SWEEP_CURSOR = "storage-sweep";
-export declare const SWEEP_EVERY_MS = 86400000;
-/** A sweep that failed somewhere, or left work for later, runs again this soon. */
-export declare const RETRY_MS: number;
-export type SweepKind = "test temp" | "orphans" | "checkouts" | "runtimes" | "dependencies" | "check history";
-export type SweepPart = {
-    kind: SweepKind;
-    count: number;
-    bytes: number;
-    failed: number;
-    more?: boolean;
-    problem?: string;
-    items: string[];
-};
-export type SweepRecord = {
-    at: string;
-    source: "automatic" | "manual";
-    actor: string;
-    parts: SweepPart[];
-};
-export type SweepDeps = {
-    databaseFile: string;
-    pool: WorktreePool | null;
-    tempRoots: readonly string[];
-    actor?: string;
-    /** Parent lifecycle only; never sent to the child. */
-    owner?: object;
-    census?: () => ProcessRow[];
-    locate?: (pids: readonly number[]) => Map<number, Located>;
-    inUse?: () => string[];
-    scripts?: (pids: readonly number[]) => string[];
-    graceMs?: number;
-    /** Which processes run from inside each path. */
-    cwds?: (paths: readonly string[]) => Map<string, number[]>;
-};
-export declare function storageSweepOff(env?: NodeJS.ProcessEnv): boolean;
-export declare function sweepFailure(at: string, actor: string, withPool: boolean, reason: Exclude<SweepCompletion, {
-    ok: true;
-}>["reason"]): SweepRecord;
-/**
- * What live work uses now. Live work: an open run, a current (unexpired, unreleased) lease, or a checkout leased, held
- * by a process or whose task has either. It uses its checkouts, the shared install each links, and every folder its
- * open runs' processes (with their groups and what they started) run from. `where` says where the given processes run
- * from, or null when that can't be read: then `blind`, and everything stays. With nothing live, nothing is read from the OS.
- */
-export type LiveWork = {
-    live: boolean;
-    paths: string[];
-    blind: boolean;
-};
-export declare function liveWork(store: Store, depsRoot: string, now: Date, where: (pids: readonly number[]) => string[] | null): LiveWork;
-/**
- * Whether live work uses `path`, asked again at every call, including process children. A cached process look
- * cannot protect a child launched between the pre-rename and post-rename guards. All this work is in the child.
- */
-export declare function liveUse(store: Store, deps: SweepDeps, now: () => Date): (path: string) => boolean;
-/** Parent side: no filesystem/process scans here. The executor seam is for deterministic unit tests only. */
-export declare function sweepStorage(store: Store, deps: SweepDeps, now: () => Date, execute?: SweepExecutor): Promise<SweepRecord>;
-export declare function sweepKinds(withPool: boolean): SweepKind[];
-/** Child side (also a focused unit-test seam): every scan and removal, without saving the parent's result. */
-export declare function executeSweep(store: Store, deps: SweepDeps, now: () => Date): Promise<SweepRecord>;
-/** Save what a sweep or a clean-up by hand did (the latest few are kept), with one ledger entry saying it. */
-export declare function saveSweep(store: Store, record: SweepRecord): SweepRecord;
-/** The latest sweep (of `source`, or either), or null when there has been none. */
-export declare function lastSweep(store: Store, source?: SweepRecord["source"]): SweepRecord | null;
-/** When the next automatic sweep is due, or null when it is off. */
-export declare function nextSweepAt(store: Store): string | null;
-export declare function partWords(one: Pick<SweepPart, "kind" | "count">): string;
-/** "Removed 120 test temp folders and 2 task folders, about 1.2 GB. Stopped 1 leftover process. 3 couldn't be removed." */
-export declare function sweepWords(parts: readonly SweepPart[]): string;
-/** The details a disclosure shows: each part's paths, problems and what's left for later, one line each. */
-export declare function sweepDetails(parts: readonly SweepPart[]): string[];

package/dist/storage-ui.d.ts

@@ -1,23 +0,0 @@
-import { type Html } from "./html.js";
-import { type CheckoutPlan } from "./checkout-cleanup.js";
-import { type SweepRecord } from "./storage-sweep.js";
-import { type SweepSchedule } from "./storage-sweep-schedule.js";
-import type { LandedSummary } from "./landed-cleanup.js";
-/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
-export declare const STORAGE_CSS = "";
-export type StorageView = {
-    plan: CheckoutPlan;
-    csrf: string;
-    sweep?: {
-        last: SweepRecord | null;
-        off: boolean;
-        schedule?: SweepSchedule;
-    };
-    landed?: LandedSummary;
-    /** When the checkouts were last measured, and its Check now (docs/plans/get-side-effects.md). */
-    measured?: Html;
-};
-export declare function storageHtml(view: StorageView, said: {
-    said?: string | null;
-    problem?: string | null;
-}): Html;

package/dist/storage.d.ts

@@ -1,68 +0,0 @@
-import type { Store } from "./store.js";
-import { type CheckoutCleanup, type CheckoutIdle } from "./contracts/storage.js";
-/** Settings → Storage: when a finished task's clean checkout is removed. One row, or none (the default). */
-export declare const CHECKOUT_CLEANUP_SCHEMA = "\nCREATE TABLE IF NOT EXISTS checkout_cleanup_setting (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  cleanup    TEXT NOT NULL CHECK (cleanup IN ('finished', '2d', '7d', 'never')),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n";
-/**
- * Landed work's teardown (landed-cleanup.ts): the intent is written first, with the completion it follows, and each
- * checkout and local branch it names is one item, finished at the next reconcile when a crash cut it short. A missing
- * resource finishes its item. New tables only (v121).
- */
-export declare const LANDED_CLEANUP_SCHEMA = "\nCREATE TABLE IF NOT EXISTS landed_cleanup (\n  id          INTEGER PRIMARY KEY,\n  repo        TEXT NOT NULL,\n  task_id     TEXT,\n  run_id      INTEGER,\n  receipt     TEXT,\n  head        TEXT NOT NULL,\n  how         TEXT NOT NULL CHECK (how IN ('merged', 'in-main', 'content-in-main')),\n  reason      TEXT NOT NULL,\n  completed   INTEGER NOT NULL DEFAULT 0 CHECK (completed IN (0, 1)),\n  actor       TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  finished_at TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS landed_cleanup_result ON landed_cleanup(run_id) WHERE run_id IS NOT NULL;\nCREATE TABLE IF NOT EXISTS landed_cleanup_item (\n  id      INTEGER PRIMARY KEY,\n  cleanup INTEGER NOT NULL REFERENCES landed_cleanup(id) ON DELETE CASCADE,\n  kind    TEXT NOT NULL CHECK (kind IN ('checkout', 'branch')),\n  repo    TEXT NOT NULL,\n  target  TEXT NOT NULL,\n  expect  TEXT NOT NULL,\n  state   TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending', 'done', 'kept')),\n  why     TEXT,\n  done_at TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS landed_cleanup_pending ON landed_cleanup_item(kind, repo, target) WHERE state = 'pending';\nCREATE INDEX IF NOT EXISTS landed_cleanup_item_of ON landed_cleanup_item(cleanup, state);\n";
-/** What each storage sweep or clean-up by hand did (storage-sweep.ts): the latest few. */
-export declare const STORAGE_SWEEP_SCHEMA = "\nCREATE TABLE IF NOT EXISTS storage_sweep (\n  id     INTEGER PRIMARY KEY,\n  at     TEXT NOT NULL,\n  source TEXT NOT NULL CHECK (source IN ('automatic', 'manual')),\n  actor  TEXT NOT NULL,\n  result TEXT NOT NULL\n);\n";
-export type { CheckoutCleanup, CheckoutIdle } from "./contracts/storage.js";
-export declare const DEFAULT_CLEANUP: CheckoutCleanup;
-export declare const CLEANUP_CHOICES: readonly {
-    value: CheckoutCleanup;
-    label: string;
-    days: number | null;
-}[];
-/** `finished` (or complete, cancelled), `2d`, `7d` (or week, 1w), `never` (or off); undefined when it's none of those. */
-export declare function parseCleanup(text: string): CheckoutCleanup | undefined;
-export declare function cleanupWords(cleanup: CheckoutCleanup): string;
-/**
- * v151: how long a task stays idle (no run, no person's act, no open lease) before its clean folder goes, even with its
- * result waiting for review or the task unfinished (checkout-cleanup.ts). Saved rows read NULL: the default.
- */
-export declare const V151_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
-    definition: string;
-    saved: string;
-}>>>>;
-export declare const DEFAULT_IDLE: CheckoutIdle;
-export declare const IDLE_CHOICES: readonly {
-    value: CheckoutIdle;
-    label: string;
-    days: number | null;
-}[];
-/** `7`, `14d`, `30 days`, `never` (or off); undefined when it's none of those. */
-export declare function parseIdle(text: string): CheckoutIdle | undefined;
-/** After "A task's clean folder is removed ". */
-export declare function idleWords(idle: CheckoutIdle): string;
-/** What the next sweep's idle cleanup takes, for `toolroll storage` and Settings → Storage. The sweep's own line says when. */
-export declare function idleCleanupWords(plan: {
-    cleanup: CheckoutCleanup;
-    idle: CheckoutIdle;
-    idleCount: number;
-    idleBytes: number;
-}): string;
-/** Bytes each path holds on disk: one `du` for them all (fast on a 300 MB checkout), a walk where it can't answer. */
-export declare function diskBytes(paths: readonly string[]): Map<string, number>;
-export type StorageLine = {
-    what: string;
-    bytes: number;
-    count?: number;
-    note?: string;
-};
-/** Bytes a tree holds on disk (allocated blocks; links not followed). */
-export declare function treeBytes(path: string): number;
-export declare function storageReport(store: Store, databaseFile: string, checkoutNote?: string): {
-    folder: string;
-    total: number;
-    lines: StorageLine[];
-};
-export declare function bytesWords(bytes: number): string;
-/** diskBytes without holding the event loop: the same one `du` per 200 paths and the same bounds, awaited. A console
- * measuring its checkouts (tens of GB) used to stall every page for as long as `du` took. */
-export declare function diskBytesAsync(paths: readonly string[], run?: typeof duOnce): Promise<Map<string, number>>;
-/** `du -sk` over a batch, its output whatever it managed (a slow disk or a failure answers what it has, or nothing). */
-declare function duOnce(batch: readonly string[]): Promise<string>;

package/dist/store-baseline.d.ts

@@ -1,19 +0,0 @@
-import type { Database } from "./store.js";
-/**
- * Schema v107: the database Toolroll 0.5.0, the first npm release, made for a
- * new installation — every table, index and trigger exactly as that release
- * wrote it (sqlite_master order and text), and the rows it seeded. A new
- * database starts here and takes the same numbered steps up to the current
- * schema that an installation from 0.5.0 takes; an older schema is refused
- * (update through 0.9.x first).
- *
- * Captured from a database 0.5.0 created, never edited by hand: its shape
- * digest below must match one this text creates (store-baseline.slow.test.ts), and
- * the upgrade path compares it with the published 0.5.0 package itself.
- */
-export declare const BASELINE_SCHEMA_VERSION = 107;
-/** The sha256 of `schemaShape` over a database 0.5.0 created (and over one BASELINE_SCHEMA creates). */
-export declare const BASELINE_SHAPE_SHA256 = "a8c5a0dad9ef6d73f7e2696203dd3618812d7a3975ca4a1b79c7550e315716ca";
-/** Every schema object, as SQLite keeps it (type, name, table and text), in one deterministic order, hashed. */
-export declare function schemaShape(db: Database): string;
-export declare const BASELINE_SCHEMA = "\nCREATE TABLE schema_version (\n  version INTEGER NOT NULL\n);\nCREATE TABLE service_cursor (\n  key TEXT PRIMARY KEY,\n  value INTEGER NOT NULL CHECK (value >= 0),\n  updated_at TEXT NOT NULL\n);\nCREATE TABLE task (\n  id         TEXT PRIMARY KEY,\n  title      TEXT NOT NULL,\n  state      TEXT NOT NULL CHECK (state IN ('queued','running','done','failed','cancelled')),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  priority   INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE queue_state (\n  id       INTEGER PRIMARY KEY CHECK (id = 1),\n  revision INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE task_edge (\n  blocked TEXT NOT NULL REFERENCES task(id) ON DELETE CASCADE,\n  blocker TEXT NOT NULL REFERENCES task(id) ON DELETE CASCADE,\n  PRIMARY KEY (blocked, blocker),\n  CHECK (blocked <> blocker)\n);\nCREATE TABLE task_ref (\n  id                      INTEGER PRIMARY KEY AUTOINCREMENT,\n  backend                 TEXT NOT NULL,\n  external_id             TEXT NOT NULL,\n  -- Which repository the work belongs to, when that is known. Capabilities\n  -- are repo-scoped, so a gap can only count the tasks it blocks if tasks\n  -- say where they live. NULL is honest for a task nobody has placed yet \u2014\n  -- it dispatches anywhere, and no gap claims it.\n  repo                    TEXT,\n  -- The worker this task is reserved for (v19); NULL = any free worker.\n  assigned_runner         TEXT,\n  zones                   TEXT NOT NULL DEFAULT '[]',\n  capability_requirements TEXT NOT NULL DEFAULT '[]',\n  park_rate               REAL NOT NULL DEFAULT 0,\n  origin                  TEXT NOT NULL DEFAULT 'theirs',\n  -- Planning mode (v7): 'requested' dispatches a planner before any scope\n  -- is approved; 'drafted' means a proposed scope + plan document await the\n  -- operator. NULL is the ordinary task that never asked for a plan.\n  plan                    TEXT CHECK (plan IN ('requested','drafted')),\n  -- Planning failures count separately from build strikes: a planner that\n  -- cannot finish must never spend the builder's three attempts.\n  plan_strikes            INTEGER NOT NULL DEFAULT 0,\n  -- The standing order this task is an instance of, when it is one (v8).\n  -- Ordinary one-off work carries NULL; the board uses this to keep\n  -- instances in their track row instead of the main lanes.\n  routine_id              INTEGER REFERENCES routine(id),\n  -- The pinned agent (v9): which provider/model this task's builds run on,\n  -- stamped by the routine fire transaction (digest-authoritative) \u2014 a\n  -- runtime flag never overrides a pin. NULL = resolve from config.\n  agent_provider          TEXT,\n  agent_model             TEXT,\n  -- Per-task unattended permission override (v37). NULL inherits the\n  -- installation default when a scope is next filed; approvals bind the\n  -- resulting concrete profile, never this mutable preference.\n  permission_mode         TEXT CHECK (permission_mode IN ('auto','bypassPermissions')),\n  -- Per-task quality override (v41). NULL inherits the installation\n  -- default when the next scope is filed; the scope stores the concrete\n  -- signed choice.\n  quality_mode            TEXT CHECK (quality_mode IN ('default','strict')),\n  -- Per-task declared risk (v47, phase routing). NULL reads as routine\n  -- when the next scope is filed; the scope stores the signed level.\n  risk_level              TEXT CHECK (risk_level IN ('routine','elevated','high')),\n  -- An approver's explicit per-phase route overrides (v47): a JSON list of\n  -- {phase, provider, model, by, at}, at most one per phase. Read when the\n  -- next scope is filed; the sealed route records what applied.\n  route_overrides_json    TEXT,\n  -- A revision task (M6.8): which task's reviewed run it revises, and the\n  -- immutable brief artifact carrying the exact comment batch. Every\n  -- revision requires its own approval; nothing is inherited.\n  revision_of             TEXT,\n  revision_brief_artifact INTEGER REFERENCES artifact(id),\n  -- Immutable provenance (v12): which door filed this work \u2014 'cli',\n  -- 'console', 'intake', 'template:<name>', 'revision'. Stamped once at\n  -- filing, never updated; NULL is history from before the column existed.\n  filed_via               TEXT,\n  -- The coordinator that filed this task (v31, MCP gateway): the\n  -- AUTHORITATIVE linkage \u2014 written only by the branded coordinator door,\n  -- joined by exact cid, never parsed out of filed_via (which stays\n  -- display-only). NULL is every other filer.\n  coordinator_cid         TEXT REFERENCES coordinator_credential(cid),\n  -- The deliverable (v34, scout tasks): 'branch' is every task until now;\n  -- 'report' dispatches a scout \u2014 a read-only session whose whole output\n  -- is one report artifact. Stamped at filing, never rewritten.\n  deliverable             TEXT NOT NULL DEFAULT 'branch' CHECK (deliverable IN ('branch','report')), strikes INTEGER NOT NULL DEFAULT 0, plan_provider TEXT, plan_model TEXT, filed_by TEXT, filed_by_kind TEXT,\n  UNIQUE (backend, external_id)\n);\nCREATE TABLE coordinator_credential (\n  cid             TEXT PRIMARY KEY,\n  name            TEXT NOT NULL,\n  credential_hash TEXT NOT NULL,\n  repos           TEXT NOT NULL,\n  per_hour        INTEGER NOT NULL,\n  created_by      TEXT NOT NULL,\n  created_at      TEXT NOT NULL,\n  revoked_at      TEXT\n, expires_at TEXT);\nCREATE UNIQUE INDEX coordinator_live_name\n  ON coordinator_credential (name) WHERE revoked_at IS NULL;\nCREATE TABLE coordinator_event (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  cid        TEXT NOT NULL REFERENCES coordinator_credential(cid),\n  kind       TEXT NOT NULL CHECK (kind IN ('filed','dismissed','revoked')),\n  task_id    TEXT,\n  detail     TEXT,\n  created_at TEXT NOT NULL\n);\nCREATE TABLE mcp_idempotency (\n  cid            TEXT NOT NULL REFERENCES coordinator_credential(cid),\n  key            TEXT NOT NULL,\n  request_digest TEXT NOT NULL,\n  task_id        TEXT NOT NULL,\n  created_at     TEXT NOT NULL,\n  PRIMARY KEY (cid, key)\n);\nCREATE TABLE phase_config (\n  scope      TEXT NOT NULL,\n  phase      TEXT NOT NULL CHECK (phase IN ('plan','build','repair','review')),\n  provider   TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),\n  model      TEXT,\n  updated_at TEXT NOT NULL,\n  updated_by TEXT NOT NULL,\n  PRIMARY KEY (scope, phase)\n);\nCREATE TABLE fallback_config (\n  scope       TEXT NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('build')),\n  entries_json TEXT NOT NULL,\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL,\n  PRIMARY KEY (scope, phase)\n);\nCREATE TABLE phase_tier_config (\n  scope      TEXT NOT NULL,\n  phase      TEXT NOT NULL CHECK (phase IN ('plan','build','repair','review')),\n  tier       TEXT NOT NULL CHECK (tier IN ('strong')),\n  provider   TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),\n  model      TEXT,\n  updated_at TEXT NOT NULL,\n  updated_by TEXT NOT NULL,\n  PRIMARY KEY (scope, phase, tier)\n);\nCREATE TABLE provider_readiness (\n  runner      TEXT NOT NULL REFERENCES runner(name) ON DELETE CASCADE,\n  provider    TEXT NOT NULL CHECK (provider IN ('claude','codex','openrouter','gemini')),\n  state       TEXT NOT NULL CHECK (state IN ('ready','unavailable','unknown')),\n  reason      TEXT NOT NULL,\n  probe       TEXT NOT NULL,\n  observed_at TEXT NOT NULL,\n  PRIMARY KEY (runner, provider)\n);\nCREATE TABLE run_route (\n  run          INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  route_digest TEXT NOT NULL,\n  phase        TEXT NOT NULL CHECK (phase IN ('plan','build','repair','review')),\n  provider     TEXT NOT NULL,\n  model        TEXT,\n  chosen       TEXT NOT NULL CHECK (chosen IN ('recommended','override','pinned','legacy','fallback')),\n  stamped_at   TEXT NOT NULL\n);\nCREATE TABLE routine (\n  id               INTEGER PRIMARY KEY AUTOINCREMENT,\n  name             TEXT NOT NULL UNIQUE,\n  repo             TEXT NOT NULL,\n  goal             TEXT NOT NULL,\n  out_of_scope     TEXT,\n  touches          TEXT NOT NULL DEFAULT '[]',\n  requirements     TEXT NOT NULL DEFAULT '[]',\n  -- 'every:<minutes>', 'daily:<HH:MM>[@Zone]', or 'weekly:<0-6>:<HH:MM>[@Zone]' (UTC by default). Parsed, never guessed at.\n  schedule         TEXT NOT NULL,\n  single_flight    INTEGER NOT NULL DEFAULT 1,\n  -- Rolling 7-day ceiling in dollars. NULL is honestly \"no ceiling\";\n  -- enforcement FAILS CLOSED on unmeasured paid runs (finding 5).\n  cost_ceiling_usd REAL,\n  -- Per-INSTANCE dollar cap (v16): copied into each instance's scope as\n  -- its digest-bound budget term, enforced by the same native-cap\n  -- plumbing as any scope budget. NULL = only the global backstop.\n  budget_per_run_microusd INTEGER,\n  paused           INTEGER NOT NULL DEFAULT 0,\n  digest           TEXT NOT NULL,\n  approved_at      TEXT,\n  approved_by      TEXT,\n  approved_digest  TEXT,\n  -- v24: the routine's execution profile; firings stamp instances FROM\n  -- the APPROVED snapshot, never from fresh resolution.\n  profile_json          TEXT,\n  approved_profile_json TEXT,\n  digest_version        INTEGER NOT NULL DEFAULT 1,\n  profile_provenance    TEXT,\n  -- v48: the routine's four-role agent route, and the snapshot approval\n  -- sealed. Every firing copies the APPROVED route onto its instance, so a\n  -- configuration change after the yes can never re-route a firing.\n  route_json            TEXT,\n  approved_route_json   TEXT,\n  -- The next scheduled occurrence. NULL until approved; advanced by the\n  -- fire transaction and nothing else, aligned to cadence (finding 10).\n  next_fire_at     TEXT,\n  created_at       TEXT NOT NULL,\n  updated_at       TEXT NOT NULL,\n  -- Immutable provenance (v12), same contract as task_ref.filed_via.\n  filed_via        TEXT,\n  -- v39: the signed rubric every instance's scope copies forward. A\n  -- routine is validated mandatory-non-empty at creation/edit time\n  -- (validateRoutineTerms) -- by the time a firing reads this column it\n  -- is guaranteed present, so fireRoutine never re-checks it.\n  acceptance_json  TEXT\n, created_by TEXT);\nCREATE TABLE installation_fact (\n  key        TEXT PRIMARY KEY,\n  value      TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\nCREATE TABLE tournament_terms (\n  id                        INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref                  INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  generation                INTEGER NOT NULL,\n  active                    INTEGER NOT NULL DEFAULT 1,\n  -- v27: 'race' = dollar-capped tournament (money contract required);\n  -- 'comparison' = labeled cross-runtime comparison (no dollar terms\n  -- exist; each lane's sealed clock is its bound). The money CHECK is\n  -- kind-aware: races keep their positive budgets, comparisons pin 0.\n  kind                      TEXT NOT NULL DEFAULT 'race' CHECK (kind IN ('race','comparison')),\n  race_digest               TEXT NOT NULL,\n  -- The ordered agents, JSON: [{provider, model, repairModel}] \u2014 exact\n  -- model ids, resolved at filing, priced at price_version.\n  agents                    TEXT NOT NULL,\n  n                         INTEGER NOT NULL CHECK (n BETWEEN 2 AND 4),\n  per_agent_budget_microusd INTEGER NOT NULL,\n  overrun_reserve_microusd  INTEGER NOT NULL,\n  total_budget_microusd     INTEGER NOT NULL,\n  price_version             INTEGER NOT NULL,\n  retries                   INTEGER NOT NULL CHECK (retries = 0),\n  -- 'none', or the JSON of the publication grant constraints in force.\n  publication_policy        TEXT NOT NULL,\n  created_at                TEXT NOT NULL,\n  approved_at               TEXT,\n  approved_by               TEXT,\n  approved_digest           TEXT,\n  CHECK ((kind = 'race' AND per_agent_budget_microusd > 0 AND overrun_reserve_microusd > 0 AND total_budget_microusd > 0)\n      OR (kind = 'comparison' AND per_agent_budget_microusd = 0 AND overrun_reserve_microusd = 0 AND total_budget_microusd = 0))\n);\nCREATE UNIQUE INDEX tournament_terms_one_active\n  ON tournament_terms (task_ref) WHERE active = 1;\nCREATE TABLE contest (\n  id                 INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref           INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  terms              INTEGER NOT NULL REFERENCES tournament_terms(id),\n  generation         INTEGER NOT NULL DEFAULT 1,\n  state              TEXT NOT NULL CHECK (state IN\n    ('dispatching','racing','pick-wait','decision-wait','picked','abandoned','interrupted','exhausted')),\n  scope_digest       TEXT NOT NULL,\n  race_digest        TEXT NOT NULL,\n  base_sha           TEXT,\n  setup_digest       TEXT,\n  current_lease_id   TEXT,\n  runner             TEXT,\n  incarnation        TEXT,\n  created_at         TEXT NOT NULL,\n  picked_at          TEXT,\n  picked_by          TEXT,\n  winner_contestant  INTEGER,\n  overdue_paged      INTEGER NOT NULL DEFAULT 0,\n  -- v24: 1 = legacy race digest (provider/model/repair only) \u2014 admission\n  -- keeps byte-comparing the stored fingerprint; 2 = full-profile terms.\n  race_semantics     INTEGER NOT NULL DEFAULT 1,\n  -- v27: denormalized from the terms at admission, so screens, holds,\n  -- and recovery speak the right words without a join.\n  kind               TEXT NOT NULL DEFAULT 'race'\n);\nCREATE INDEX contest_by_task ON contest (task_ref, id DESC);\nCREATE TABLE contestant (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  contest             INTEGER NOT NULL REFERENCES contest(id) ON DELETE CASCADE,\n  ordinal             INTEGER NOT NULL,\n  provider            TEXT NOT NULL,\n  model               TEXT NOT NULL,\n  repair_model        TEXT NOT NULL,\n  -- v24: the contestant's full execution-profile snapshot (canonical JSON).\n  profile_json        TEXT,\n  branch              TEXT NOT NULL,\n  worktree            TEXT,\n  generation          INTEGER NOT NULL DEFAULT 1,\n  state               TEXT NOT NULL DEFAULT 'pending' CHECK (state IN\n    ('pending','ready','building','parked','built','failed','stopped')),\n  active_run          INTEGER REFERENCES run(id),\n  budget_microusd     INTEGER NOT NULL,\n  reserve_microusd    INTEGER NOT NULL,\n  measured_microusd   INTEGER NOT NULL DEFAULT 0,\n  accounted_microusd  INTEGER NOT NULL DEFAULT 0,\n  unknown_spend       INTEGER NOT NULL DEFAULT 0,\n  cleanup             TEXT CHECK (cleanup IN ('pending','done','attention')),\n  custody             TEXT,\n  UNIQUE (contest, ordinal)\n);\nCREATE TABLE execution_slot (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  runner        TEXT NOT NULL,\n  state         TEXT NOT NULL DEFAULT 'reserved' CHECK (state IN ('reserved','running','released')),\n  run           INTEGER REFERENCES run(id),\n  contestant    INTEGER REFERENCES contestant(id),\n  incarnation   TEXT,\n  process_group INTEGER,\n  reserved_at   TEXT NOT NULL,\n  running_at    TEXT,\n  released_at   TEXT\n);\nCREATE INDEX execution_slot_live ON execution_slot (runner, state);\nCREATE TABLE ceremony_nonce (\n  hash        TEXT PRIMARY KEY,\n  approver    TEXT NOT NULL,\n  subject     TEXT NOT NULL,\n  subject_id  INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX ceremony_nonce_expiry ON ceremony_nonce (expires_at);\nCREATE TABLE spend_defaults (\n  id                       INTEGER PRIMARY KEY CHECK (id = 1),\n  build_per_run_microusd   INTEGER,\n  race_per_agent_microusd  INTEGER,\n  race_total_microusd      INTEGER,\n  -- How many agents compete by default (v16, operator request). Applies\n  -- only where a filing names ONE agent and no explicit count \u2014 an\n  -- explicit list or count always wins, and the race digest binds the\n  -- actual lineup either way.\n  race_agents              INTEGER CHECK (race_agents BETWEEN 2 AND 4),\n  updated_at               TEXT NOT NULL,\n  updated_by               TEXT NOT NULL\n);\nCREATE TABLE permission_default (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  mode       TEXT NOT NULL CHECK (mode IN ('auto','bypassPermissions')),\n  updated_at TEXT,\n  updated_by TEXT\n);\nCREATE TABLE quality_default (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  mode       TEXT NOT NULL CHECK (mode IN ('default','strict')),\n  updated_at TEXT,\n  updated_by TEXT\n);\nCREATE TABLE chat_config (\n  id                      INTEGER PRIMARY KEY CHECK (id = 1),\n  provider                TEXT NOT NULL CHECK (provider IN ('anthropic-api','openrouter-api','claude-subscription','codex-subscription')),\n  model                   TEXT NOT NULL,\n  daily_turns             INTEGER NOT NULL DEFAULT 50,\n  -- The rolling 7-day spend ceiling, integer micro-dollars (change 4):\n  -- reservations count against it transactionally. Subscription-backed\n  -- chat stores zero: there is no truthful dollar meter on plan usage.\n  weekly_ceiling_microusd INTEGER NOT NULL,\n  -- The PINNED price (v13b): snapshotted from the provider's own catalog\n  -- (or the compiled table) at the authenticated save, integer\n  -- micro-dollars per token. Reservations and settlement use THESE, so an\n  -- upstream price change never silently moves the ledger math \u2014\n  -- re-saving re-pins. NULL only on rows written before the columns\n  -- existed; readers fall back to the compiled table then.\n  price_in_microusd       INTEGER,\n  price_out_microusd      INTEGER,\n  updated_at              TEXT NOT NULL,\n  updated_by              TEXT NOT NULL\n);\nCREATE TABLE chat_turn (\n  id                INTEGER PRIMARY KEY AUTOINCREMENT,\n  approver          TEXT NOT NULL,\n  -- Domain-separated sha256 over provider+key, full hex \u2014 a stable,\n  -- non-secret accounting identity (128+ bits per change 6).\n  credential_key    TEXT NOT NULL,\n  provider          TEXT NOT NULL CHECK (provider IN ('anthropic-api','openrouter-api','claude-subscription','codex-subscription')),\n  model             TEXT NOT NULL,\n  state             TEXT NOT NULL CHECK (state IN ('queued','running','answered','failed')),\n  -- Terminal transitions are generation-checked CAS: a late response\n  -- cannot resurrect a swept row (change 5).\n  generation        INTEGER NOT NULL DEFAULT 1,\n  created_at        TEXT NOT NULL,\n  started_at        TEXT,\n  deadline_at       TEXT,\n  finished_at       TEXT,\n  tokens_in         INTEGER,\n  tokens_out        INTEGER,\n  reserved_microusd INTEGER NOT NULL,\n  settled_microusd  INTEGER,\n  failure_reason    TEXT CHECK (failure_reason IN\n    ('provider-error','timeout','over-budget','malformed-reply','secret-refused','crashed','over-cap','unknown-spend')),\n  unknown_spend     INTEGER NOT NULL DEFAULT 0,\n  acknowledged_at   TEXT,\n  acknowledged_by   TEXT,\n  reply_bytes       INTEGER,\n  candidate_count   INTEGER,\n  kind              TEXT NOT NULL DEFAULT 'chat',\n  mate_turn         INTEGER\n);\nCREATE INDEX chat_turn_credential ON chat_turn (credential_key, created_at);\nCREATE INDEX chat_turn_approver ON chat_turn (approver, created_at);\nCREATE TABLE mate_session (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  approver            TEXT NOT NULL,\n  approver_generation INTEGER NOT NULL,\n  credential_key      TEXT NOT NULL,\n  ceiling_microusd    INTEGER NOT NULL,\n  spent_microusd      INTEGER NOT NULL DEFAULT 0,\n  ceiling_digest      TEXT NOT NULL,\n  terms_digest        TEXT NOT NULL,\n  minted_at           TEXT NOT NULL,\n  ended_at            TEXT,\n  ended_by            TEXT\n);\nCREATE INDEX mate_session_live ON mate_session (approver, ended_at);\nCREATE TABLE mate_thread (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  approver       TEXT NOT NULL,\n  ceiling_digest TEXT NOT NULL,\n  opened_at      TEXT NOT NULL,\n  last_turn_at   TEXT,\n  closed_at      TEXT,\n  scope_kind     TEXT NOT NULL DEFAULT 'lead' CHECK (scope_kind IN ('lead','project','task')),\n  scope_key      TEXT\n);\nCREATE INDEX mate_thread_live ON mate_thread (approver, closed_at);\nCREATE TABLE mate_message (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  thread     INTEGER NOT NULL REFERENCES mate_thread(id) ON DELETE CASCADE,\n  turn       INTEGER,\n  role       TEXT NOT NULL CHECK (role IN ('operator','assistant')),\n  text       TEXT NOT NULL,\n  activity   TEXT,\n  created_at TEXT NOT NULL\n);\nCREATE INDEX mate_message_thread ON mate_message (thread, id);\nCREATE TABLE chat_focus (\n  surface    TEXT NOT NULL,\n  binding    INTEGER NOT NULL,\n  task       TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  PRIMARY KEY (surface, binding)\n);\nCREATE TABLE flow (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo            TEXT NOT NULL,\n  name            TEXT NOT NULL,\n  definition_json TEXT NOT NULL,\n  revision        INTEGER NOT NULL DEFAULT 1,\n  state           TEXT NOT NULL CHECK (state IN ('active','archived')),\n  created_by      TEXT NOT NULL,\n  created_at      TEXT NOT NULL,\n  updated_by      TEXT NOT NULL,\n  updated_at      TEXT NOT NULL,\n  owner           TEXT\n);\nCREATE TABLE flow_card (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  flow         INTEGER NOT NULL REFERENCES flow(id),\n  title        TEXT NOT NULL,\n  description  TEXT,\n  stage        TEXT NOT NULL,\n  entry        INTEGER NOT NULL DEFAULT 1,\n  state        TEXT NOT NULL CHECK (state IN ('active','done','cancelled')),\n  task         TEXT,\n  primary_task TEXT,\n  note         TEXT,\n  waiting      TEXT,\n  outputs_json TEXT NOT NULL DEFAULT '{}',\n  created_by   TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  updated_at   TEXT NOT NULL,\n  source_json  TEXT,\n  owner        TEXT\n);\nCREATE INDEX flow_card_live ON flow_card (flow, state);\nCREATE TABLE flow_event (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  card       INTEGER NOT NULL REFERENCES flow_card(id),\n  from_stage TEXT,\n  to_stage   TEXT NOT NULL,\n  outcome    TEXT NOT NULL CHECK (outcome IN ('created','ok','fail','moved','approved','sent-back','cancelled')),\n  actor      TEXT NOT NULL,\n  note       TEXT,\n  at         TEXT NOT NULL\n);\nCREATE INDEX flow_event_card ON flow_event (card, id);\nCREATE TABLE flow_trigger (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  flow         INTEGER NOT NULL REFERENCES flow(id),\n  kind         TEXT NOT NULL CHECK (kind IN ('button','schedule','github','linear','flow','webhook','email','chat')),\n  config_json  TEXT NOT NULL,\n  state        TEXT NOT NULL CHECK (state IN ('active','paused','removed')),\n  hook_hash    TEXT UNIQUE,\n  cursor       TEXT,\n  next_at      TEXT,\n  last_at      TEXT,\n  last_outcome TEXT,\n  failures     INTEGER NOT NULL DEFAULT 0,\n  created_by   TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  updated_at   TEXT NOT NULL\n);\nCREATE INDEX flow_trigger_live ON flow_trigger (flow, state);\nCREATE TABLE flow_card_watcher (\n  card     INTEGER NOT NULL REFERENCES flow_card(id),\n  name     TEXT NOT NULL,\n  added_at TEXT NOT NULL,\n  PRIMARY KEY (card, name)\n);\nCREATE TABLE flow_comment (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  card          INTEGER NOT NULL REFERENCES flow_card(id),\n  kind          TEXT NOT NULL CHECK (kind IN ('comment','owner')),\n  author        TEXT NOT NULL,\n  body          TEXT NOT NULL,\n  mentions_json TEXT NOT NULL DEFAULT '[]',\n  at            TEXT NOT NULL\n);\nCREATE INDEX flow_comment_card ON flow_comment (card, id);\nCREATE TABLE flow_script (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo            TEXT NOT NULL,\n  name            TEXT NOT NULL,\n  about           TEXT NOT NULL,\n  body            TEXT NOT NULL,\n  timeout_minutes INTEGER NOT NULL,\n  version         INTEGER NOT NULL,\n  digest          TEXT NOT NULL,\n  saved_by        TEXT NOT NULL,\n  saved_at        TEXT NOT NULL,\n  state           TEXT NOT NULL CHECK (state IN ('active','removed')),\n  language        TEXT NOT NULL DEFAULT 'shell',\n  file            TEXT\n);\nCREATE UNIQUE INDEX flow_script_live ON flow_script (repo, name) WHERE state = 'active';\nCREATE TABLE flow_step_run (\n  card           INTEGER NOT NULL REFERENCES flow_card(id),\n  entry          INTEGER NOT NULL,\n  stage          TEXT NOT NULL,\n  kind           TEXT NOT NULL CHECK (kind IN ('check','update','sort','draft','request','email','tool','teammate')),\n  script         TEXT,\n  script_version INTEGER,\n  state          TEXT NOT NULL CHECK (state IN ('running','passed','failed','waiting')),\n  attempts       INTEGER NOT NULL DEFAULT 0,\n  next_at        TEXT,\n  started_at     TEXT NOT NULL,\n  finished_at    TEXT,\n  duration_ms    INTEGER,\n  exit_code      INTEGER,\n  result         TEXT,\n  log            TEXT,\n  decision_json  TEXT,\n  PRIMARY KEY (card, entry)\n);\nCREATE INDEX flow_step_run_recent ON flow_step_run (started_at);\nCREATE TABLE flow_trigger_event (\n  trigger    INTEGER NOT NULL REFERENCES flow_trigger(id),\n  key        TEXT NOT NULL,\n  card       INTEGER REFERENCES flow_card(id),\n  note       TEXT,\n  at         TEXT NOT NULL,\n  PRIMARY KEY (trigger, key)\n);\nCREATE TABLE flow_mail (\n  message_id TEXT PRIMARY KEY,\n  card       INTEGER NOT NULL REFERENCES flow_card(id),\n  direction  TEXT NOT NULL CHECK (direction IN ('sent','received')),\n  address    TEXT NOT NULL,\n  at         TEXT NOT NULL\n);\nCREATE INDEX flow_mail_card ON flow_mail (card, at);\nCREATE TABLE teammate (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo         TEXT NOT NULL,\n  handle       TEXT NOT NULL,\n  state        TEXT NOT NULL CHECK (state IN ('active','paused','removed')),\n  version      INTEGER NOT NULL,\n  soul         TEXT NOT NULL,\n  model        TEXT,\n  daily_turns  INTEGER NOT NULL DEFAULT 200,\n  manager      TEXT NOT NULL,\n  created_by   TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  updated_by   TEXT NOT NULL,\n  updated_at   TEXT NOT NULL,\n  summary_at   TEXT,\n  desk_flow    INTEGER REFERENCES flow(id),\n  weekly_at    TEXT\n);\nCREATE UNIQUE INDEX teammate_live ON teammate (repo, handle) WHERE state <> 'removed';\nCREATE TABLE teammate_version (\n  teammate   INTEGER NOT NULL REFERENCES teammate(id),\n  version    INTEGER NOT NULL,\n  soul       TEXT NOT NULL,\n  saved_by   TEXT NOT NULL,\n  saved_at   TEXT NOT NULL,\n  PRIMARY KEY (teammate, version)\n);\nCREATE TABLE teammate_event (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate    INTEGER NOT NULL REFERENCES teammate(id),\n  card        INTEGER REFERENCES flow_card(id),\n  entry       INTEGER,\n  kind        TEXT NOT NULL CHECK (kind IN ('decided','handled','handed','asked','answered','note','paused','resumed','summary','failed')),\n  said        TEXT NOT NULL,\n  detail_json TEXT,\n  by          TEXT,\n  at          TEXT NOT NULL\n);\nCREATE INDEX teammate_event_recent ON teammate_event (teammate, id);\nCREATE TABLE teammate_question (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate      INTEGER NOT NULL REFERENCES teammate(id),\n  card          INTEGER NOT NULL REFERENCES flow_card(id),\n  entry         INTEGER NOT NULL,\n  question      TEXT NOT NULL,\n  options_json  TEXT NOT NULL,\n  asked_of      TEXT NOT NULL,\n  state         TEXT NOT NULL CHECK (state IN ('open','answered','dropped')),\n  choice        TEXT,\n  answer        TEXT,\n  answered_by   TEXT,\n  answered_via  TEXT,\n  answered_at   TEXT,\n  created_at    TEXT NOT NULL,\n  tool_call     INTEGER REFERENCES teammate_call(id),\n  suggestion    INTEGER REFERENCES teammate_suggestion(id)\n);\nCREATE TABLE teammate_tool (\n  teammate     INTEGER NOT NULL REFERENCES teammate(id),\n  tool         TEXT NOT NULL,\n  actions_json TEXT NOT NULL,\n  rules_json   TEXT NOT NULL,\n  listed_at    TEXT,\n  updated_by   TEXT NOT NULL,\n  updated_at   TEXT NOT NULL,\n  PRIMARY KEY (teammate, tool)\n);\nCREATE TABLE teammate_call (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate    INTEGER NOT NULL REFERENCES teammate(id),\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  tool        TEXT NOT NULL,\n  action      TEXT NOT NULL,\n  input_json  TEXT NOT NULL,\n  rule        TEXT NOT NULL CHECK (rule IN ('free','ask','never')),\n  why         TEXT NOT NULL,\n  state       TEXT NOT NULL CHECK (state IN ('asked','approved','denied','refused','running','done','failed')),\n  result      TEXT,\n  decided_by  TEXT,\n  decided_at  TEXT,\n  created_at  TEXT NOT NULL,\n  done_at     TEXT,\n  undo_of     INTEGER REFERENCES teammate_call(id),\n  undone_by   TEXT,\n  undone_at   TEXT\n);\nCREATE INDEX teammate_call_card ON teammate_call (card, entry, id);\nCREATE TABLE teammate_turn (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate    INTEGER NOT NULL REFERENCES teammate(id),\n  card        INTEGER REFERENCES flow_card(id),\n  model       TEXT NOT NULL,\n  ok          INTEGER NOT NULL,\n  ms          INTEGER NOT NULL,\n  cost_usd    REAL,\n  tokens_in   INTEGER,\n  tokens_out  INTEGER,\n  at          TEXT NOT NULL\n, billing TEXT);\nCREATE INDEX teammate_turn_recent ON teammate_turn (teammate, at);\nCREATE INDEX teammate_call_recent ON teammate_call (teammate, id);\nCREATE TABLE teammate_memory (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate    INTEGER NOT NULL REFERENCES teammate(id),\n  text        TEXT NOT NULL,\n  source      TEXT NOT NULL CHECK (source IN ('teammate','person')),\n  card        INTEGER REFERENCES flow_card(id),\n  state       TEXT NOT NULL CHECK (state IN ('active','forgotten')),\n  created_by  TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL,\n  updated_at  TEXT NOT NULL,\n  used_at     TEXT\n);\nCREATE INDEX teammate_memory_live ON teammate_memory (teammate, state, id);\nCREATE TABLE teammate_suggestion (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  teammate      INTEGER NOT NULL REFERENCES teammate(id),\n  tool          TEXT NOT NULL,\n  action        TEXT NOT NULL,\n  rule_json     TEXT NOT NULL,\n  was_json      TEXT NOT NULL,\n  evidence_json TEXT NOT NULL,\n  said          TEXT NOT NULL,\n  state         TEXT NOT NULL CHECK (state IN ('open','accepted','dismissed','stale')),\n  decided_by    TEXT,\n  decided_at    TEXT,\n  created_at    TEXT NOT NULL\n);\nCREATE INDEX teammate_suggestion_action ON teammate_suggestion (teammate, tool, action, id);\nCREATE TABLE flow_mail_watch (\n  id           INTEGER PRIMARY KEY CHECK (id = 1),\n  cursor       TEXT,\n  next_at      TEXT,\n  failures     INTEGER NOT NULL DEFAULT 0,\n  last_outcome TEXT,\n  updated_at   TEXT\n);\nCREATE TABLE project_tool (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo           TEXT NOT NULL,\n  name           TEXT NOT NULL,\n  spec_json      TEXT NOT NULL,\n  digest         TEXT NOT NULL,\n  source         TEXT NOT NULL,\n  state          TEXT NOT NULL CHECK (state IN ('active','removed')),\n  created_at     TEXT NOT NULL,\n  created_by     TEXT NOT NULL,\n  removed_at     TEXT,\n  removed_by     TEXT,\n  last_test_json TEXT\n);\nCREATE UNIQUE INDEX project_tool_live ON project_tool (repo, name) WHERE state = 'active';\nCREATE TABLE tool_seal (\n  task            TEXT NOT NULL,\n  approved_digest TEXT NOT NULL,\n  tools_json      TEXT NOT NULL,\n  sealed_at       TEXT NOT NULL,\n  PRIMARY KEY (task, approved_digest)\n);\nCREATE TABLE run_tool (\n  run        INTEGER PRIMARY KEY,\n  tools_json TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\nCREATE TABLE telegram_task_message (\n  binding    INTEGER NOT NULL,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  task_id    TEXT NOT NULL,\n  source_run INTEGER,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\nCREATE TABLE mate_proposal (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  thread         INTEGER NOT NULL REFERENCES mate_thread(id) ON DELETE CASCADE,\n  turn           INTEGER NOT NULL,\n  kind           TEXT NOT NULL CHECK (kind IN ('task','next','reserve','hold','unhold','steer','scope','cancel','answer','repair','agents','review','control','task_action','action')),\n  payload_json   TEXT NOT NULL,\n  ceiling_digest TEXT NOT NULL,\n  state          TEXT NOT NULL CHECK (state IN ('drafting','pending','confirming','confirmed','refused','dismissed','expired')),\n  created_at     TEXT NOT NULL,\n  resolved_at    TEXT,\n  resolved_by    TEXT,\n  outcome_json   TEXT\n);\nCREATE INDEX mate_proposal_thread ON mate_proposal (thread, state);\nCREATE TABLE coordinator_proposal (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  cid          TEXT NOT NULL REFERENCES coordinator_credential(cid),\n  name         TEXT NOT NULL,\n  repo         TEXT NOT NULL,\n  kind         TEXT NOT NULL CHECK (kind IN ('next','reserve','hold','unhold','scope','cancel','answer')),\n  payload_json TEXT NOT NULL,\n  state        TEXT NOT NULL CHECK (state IN ('pending','confirming','confirmed','refused','dismissed','expired')),\n  created_at   TEXT NOT NULL,\n  resolved_at  TEXT,\n  resolved_by  TEXT,\n  outcome_json TEXT\n);\nCREATE INDEX coordinator_proposal_state ON coordinator_proposal (state, repo);\nCREATE TABLE mate_turn (\n  id                INTEGER PRIMARY KEY AUTOINCREMENT,\n  approver          TEXT NOT NULL,\n  session           INTEGER NOT NULL REFERENCES mate_session(id),\n  thread            INTEGER NOT NULL REFERENCES mate_thread(id),\n  credential_key    TEXT NOT NULL,\n  state             TEXT NOT NULL CHECK (state IN ('queued','running','answered','failed')),\n  generation        INTEGER NOT NULL DEFAULT 1,\n  created_at        TEXT NOT NULL,\n  deadline_at       TEXT NOT NULL,\n  finished_at       TEXT,\n  reserved_microusd INTEGER NOT NULL,\n  settled_microusd  INTEGER,\n  steps             INTEGER NOT NULL DEFAULT 0,\n  tokens_in         INTEGER,\n  tokens_out        INTEGER,\n  failure_reason    TEXT\n);\nCREATE INDEX mate_turn_live ON mate_turn (approver, state);\nCREATE TABLE routine_fire (\n  id                INTEGER PRIMARY KEY AUTOINCREMENT,\n  routine_id        INTEGER NOT NULL REFERENCES routine(id) ON DELETE CASCADE,\n  scheduled_for     TEXT NOT NULL,\n  outcome           TEXT NOT NULL CHECK (outcome IN ('fired','skipped')),\n  reason            TEXT,\n  instance_task_ref INTEGER REFERENCES task_ref(id),\n  created_at        TEXT NOT NULL,\n  UNIQUE (routine_id, scheduled_for)\n);\nCREATE INDEX routine_fire_recent ON routine_fire (routine_id, id DESC);\nCREATE TABLE hold (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref   INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  owner_kind TEXT NOT NULL CHECK (owner_kind IN ('operator','decision','incident','backoff','contest','revision','stop')),\n  owner_id   TEXT NOT NULL,\n  reason     TEXT NOT NULL,\n  until      TEXT,\n  held_at    TEXT NOT NULL,\n  UNIQUE (owner_kind, owner_id)\n);\nCREATE TABLE claim (\n  lease_id         TEXT PRIMARY KEY,\n  task_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  lease_generation INTEGER NOT NULL,\n  runner           TEXT NOT NULL,\n  acquired_at      TEXT NOT NULL,\n  expires_at       TEXT NOT NULL,\n  heartbeat_at     TEXT NOT NULL,\n  released_at      TEXT,\n  -- Who let go, because \"released\" alone conflates four different events:\n  -- the runner handing it back ('released'), a completion being accepted\n  -- ('completed'), expiry reap ('reaped'), and dead-runner recovery\n  -- ('recovered'). A retry that finds its lease released must know which:\n  -- answering \"duplicate\" to a runner whose lease was in fact reclaimed\n  -- would accept work the reclaim already disowned.\n  released_by      TEXT, incarnation TEXT,\n  UNIQUE (task_ref, lease_generation)\n);\nCREATE TABLE capability (\n  repo             TEXT NOT NULL,\n  kind             TEXT NOT NULL CHECK (kind IN ('env','cli','mcp','ci','other')),\n  name             TEXT NOT NULL,\n  probe            TEXT,\n  status           TEXT NOT NULL DEFAULT 'unprobed' CHECK (status IN ('unprobed','verified','failed')),\n  added_by         TEXT NOT NULL,\n  created_at       TEXT NOT NULL,\n  last_verified_at TEXT,\n  -- Who ran the probe that produced this status. Verification is a claim\n  -- about one environment: the machine whose shell answered. Another runner\n  -- trusts it only by re-proving it where it stands, which is what tick does.\n  verified_by      TEXT,\n  -- The probe's own words when it said no \u2014 \"exit 1\", \"timed out\", \"sh not\n  -- found\". Collapsing those into one bit would discard exactly the detail\n  -- that tells an operator whether to paste a key or fix a PATH.\n  last_result      TEXT,\n  expires_at       TEXT,\n  PRIMARY KEY (repo, kind, name)\n);\nCREATE TABLE run (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  lease_id      TEXT NOT NULL,\n  runner        TEXT NOT NULL,\n  -- v24 dispatch stamps: the digests this invocation was PROVED against\n  -- (warm resume matches on both), and the provider CLI version as\n  -- provenance \u2014 never authority.\n  scope_digest     TEXT,\n  profile_digest   TEXT,\n  provider_version TEXT,\n  -- 'repair' is a resumed session mending its own malformed park payload.\n  -- Deliberately NOT 'driver': the design's driver is the event-woken gate\n  -- role that first exists at M4, and recording repair under that name now\n  -- would make the two indistinguishable in every cost report afterwards.\n  -- 'scout' (v34) reads a repository and delivers a report \u2014 its own word\n  -- so scouting spend never hides under planning or building.\n  role          TEXT NOT NULL DEFAULT 'builder' CHECK (role IN ('builder','repair','planner','reviewer','scout')),\n  -- Which provider harness this attempt ran on (v9). The default is a\n  -- truthful backfill for history: every run before v9 passed through the\n  -- fixed claude gateway. New dispatches always supply it explicitly.\n  provider      TEXT NOT NULL DEFAULT 'claude',\n  parent_run    INTEGER REFERENCES run(id),\n  -- The agent session, kept so a malformed park can be repaired by resuming\n  -- the conversation that produced it instead of paying for a fresh one.\n  session_id    TEXT,\n  -- HEAD before the agent spent anything. Evidence is a diff against this,\n  -- not against whatever the index looked like when the agent stopped: an\n  -- agent that staged or committed before parking would otherwise show a\n  -- clean diff over material changes.\n  base_revision TEXT,\n  branch        TEXT,\n  worktree      TEXT,\n  model         TEXT,\n  phase         TEXT,\n  contestant    INTEGER REFERENCES contestant(id),\n  -- 'interrupted' (v25) is a held attended session cut down mid-flight \u2014\n  -- fence, expiry, crash custody, or shutdown. A real word, never a\n  -- synthesized park; the one-shot road keeps writing failed/interrupted\n  -- as outcome+reason exactly as before.\n  outcome       TEXT CHECK (outcome IN ('built','failed','refused','parked','no-change','interrupted')),\n  reason        TEXT,\n  committed     INTEGER,\n  -- The attended authorization this run consumed (v25) \u2014 the ruling-12\n  -- attempt identity, stamped in the same transaction that consumes the\n  -- one attempt. NULL = ordinary approved/tournament dispatch.\n  attended_authorization TEXT REFERENCES attended_authorization(id),\n  started_at    TEXT NOT NULL,\n  finished_at   TEXT,\n  -- Stamped by the invocation gateway the instant before the provider\n  -- process spawns. A run without it never paid anything; the zero-token\n  -- invariant is \"provider spawns == runs carrying this stamp\".\n  provider_started_at TEXT,\n  tokens_in     INTEGER,\n  tokens_out    INTEGER,\n  cost_usd      REAL,\n  -- The provider's own usage object, bounded, for when the parsed columns\n  -- above turn out to have missed something. NULL = unmeasured, and the\n  -- brief says so rather than summing a lie.\n  usage_json    TEXT,\n  -- HEAD after the agent, as accepted. The builder owns commits; an agent\n  -- that moved HEAD itself is refused, so this names the exact commit any\n  -- publication may push.\n  head_revision TEXT,\n  -- The validated terminal handoff's conclusion \u2014 bounded, typed at\n  -- ingestion, and the only agent prose a PR body may quote.\n  handoff       TEXT,\n  -- The fallback-chain and credential stamps (v30), inline since v34 \u2014\n  -- the same columns ALTER appended on older files; the v34 rebuild\n  -- recognizes both placements as one shape.\n  chain_cycle INTEGER REFERENCES fallback_cycle(id), chain_index INTEGER, entry_digest TEXT, auth_mode TEXT, terminal_class TEXT, quality_mode TEXT NOT NULL DEFAULT 'default' CHECK (quality_mode IN ('default','strict')), plan_revision INTEGER REFERENCES plan_revision(id), authority_digest TEXT, watch_incarnation TEXT, review_attempt INTEGER,\n  -- v29 (the reviewer role): artifact-only runs carry NO workspace,\n  -- honestly \u2014 every other role requires both (exclusive, no sentinels).\n  CHECK ((role = 'reviewer' AND branch IS NULL AND worktree IS NULL)\n      OR (role <> 'reviewer' AND branch IS NOT NULL AND worktree IS NOT NULL))\n);\nCREATE TABLE artifact (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  run            INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  kind           TEXT NOT NULL CHECK (kind IN ('diff','status','park-payload','plan','terminal-diff','diff-stat','handoff','revision-brief','base-tree','report','proof','check-log','screenshot','structured-output','plan-contract','review-context')),\n  key            TEXT NOT NULL,\n  bytes_original INTEGER NOT NULL,\n  bytes_stored   INTEGER NOT NULL,\n  truncated      INTEGER NOT NULL DEFAULT 0,\n  sha256         TEXT NOT NULL,\n  capture        TEXT NOT NULL,\n  created_at     TEXT NOT NULL,\n  redacted       INTEGER NOT NULL DEFAULT 0,\n  -- Typed capture verdict (v14, finding 20): authority never parses the\n  -- prose capture description again. NULL = recorded before v14.\n  capture_status TEXT CHECK (capture_status IN ('ok','failed'))\n);\nCREATE TABLE decision_artifact (\n  decision INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  artifact INTEGER NOT NULL REFERENCES artifact(id) ON DELETE CASCADE,\n  PRIMARY KEY (decision, artifact)\n);\nCREATE TABLE run_decision (\n  run      INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  decision INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  choice   TEXT NOT NULL,\n  note     TEXT,\n  PRIMARY KEY (run, decision)\n);\nCREATE TABLE incident (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  run         INTEGER NOT NULL UNIQUE REFERENCES run(id) ON DELETE CASCADE,\n  kind        TEXT NOT NULL CHECK (kind IN ('malformed-decision','attempts-exhausted','commit-failure','malformed-plan','plan-attempts-exhausted','malformed-report','malformed-proof')),\n  created_at  TEXT NOT NULL,\n  resolved_at TEXT,\n  resolved_by TEXT\n);\nCREATE TABLE notification (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  dedupe_key      TEXT NOT NULL UNIQUE,\n  kind            TEXT NOT NULL,\n  subject         TEXT NOT NULL,\n  body            TEXT NOT NULL,\n  created_at      TEXT NOT NULL,\n  attempts        INTEGER NOT NULL DEFAULT 0,\n  last_attempt_at TEXT,\n  last_error      TEXT,\n  delivered_at    TEXT,\n  -- What the delivery command said on success \u2014 the closest thing to a\n  -- provider receipt a shell command can hand back.\n  receipt         TEXT,\n  -- The push surface (arc 3, v23): a CLOSED attention class and a\n  -- machine-minted console link, stamped by producers at enqueue.\n  -- Unstamped kinds never reach a phone; subject/body never do either.\n  push_class      TEXT CHECK (push_class IN ('decision','pick','merge','attention')),\n  link            TEXT\n, resolved_at TEXT, claim_owner TEXT, claim_expires_at TEXT, provenance_scope TEXT NOT NULL DEFAULT 'unknown' CHECK (provenance_scope IN ('unknown','installation','project','task')), project TEXT, task_ref INTEGER REFERENCES task_ref(id), task_id TEXT, source_run INTEGER REFERENCES run(id), recipient TEXT);\nCREATE TABLE telegram_digest (\n  id           INTEGER PRIMARY KEY CHECK (id = 1),\n  every_ms     INTEGER,\n  set_by       TEXT,\n  set_at       TEXT,\n  last_sent_at TEXT\n);\nCREATE TABLE backend_grant (\n  repo             TEXT NOT NULL,\n  backend          TEXT NOT NULL,\n  paths            TEXT NOT NULL DEFAULT '[]',\n  mutations        TEXT NOT NULL DEFAULT '[]',\n  selector         TEXT NOT NULL,\n  credential_scope TEXT,\n  observed_by_git  INTEGER NOT NULL,\n  granted_at       TEXT NOT NULL,\n  granted_by       TEXT NOT NULL,\n  -- External dispatch (v20): a SEPARATE authority from tracker writes \u2014\n  -- \"this plane will BUILD what this tracker nominates\". Never granted\n  -- by default; dispatch=1 requires remote_repo and plane_id (enforced\n  -- in saveGrant \u2014 ALTER ADD COLUMN cannot carry cross-column CHECKs).\n  dispatch                INTEGER NOT NULL DEFAULT 0 CHECK (dispatch IN (0, 1)),\n  remote_repo             TEXT,\n  plane_id                TEXT,\n  dispatch_blocked        TEXT CHECK (dispatch_blocked IN ('pending-marker','unreachable','foreign','missing','multiple-or-malformed')),\n  dispatch_blocked_at     TEXT,\n  dispatch_blocked_detail TEXT,\n  PRIMARY KEY (repo, backend)\n);\nCREATE TABLE external_mirror (\n  local_task_id   TEXT PRIMARY KEY REFERENCES task(id) ON DELETE CASCADE,\n  backend         TEXT NOT NULL,\n  remote_repo     TEXT NOT NULL,\n  remote_id       TEXT NOT NULL,\n  provenance      TEXT NOT NULL CHECK (provenance IN ('local-create','intake','granted-all')),\n  intake_grant    INTEGER,\n  established_by  TEXT NOT NULL,\n  established_at  TEXT NOT NULL,\n  remote_state    TEXT NOT NULL CHECK (remote_state IN ('open','closed','missing')),\n  close_generation INTEGER,\n  sync_generation INTEGER NOT NULL DEFAULT 0,\n  dispatch_ok     INTEGER NOT NULL DEFAULT 0 CHECK (dispatch_ok IN (0, 1)),\n  reopened_by     TEXT,\n  reopened_at     TEXT,\n  CHECK ((provenance = 'intake') = (intake_grant IS NOT NULL)),\n  UNIQUE (backend, remote_repo, remote_id)\n);\nCREATE TRIGGER external_mirror_immutable\nBEFORE UPDATE ON external_mirror\nWHEN OLD.backend IS NOT NEW.backend OR OLD.remote_repo IS NOT NEW.remote_repo\n  OR OLD.remote_id IS NOT NEW.remote_id OR OLD.provenance IS NOT NEW.provenance\n  OR OLD.intake_grant IS NOT NEW.intake_grant\n  OR OLD.established_by IS NOT NEW.established_by OR OLD.established_at IS NOT NEW.established_at\nBEGIN\n  SELECT RAISE(ABORT, 'external mirror identity is immutable');\nEND;\nCREATE TABLE sync_ledger (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  backend     TEXT NOT NULL,\n  remote_repo TEXT NOT NULL,\n  generation  INTEGER NOT NULL,\n  started_at  TEXT NOT NULL,\n  finished_at TEXT,\n  outcome     TEXT CHECK (outcome IN ('complete','capped','failed')),\n  candidates  INTEGER NOT NULL DEFAULT 0,\n  mirrored    INTEGER NOT NULL DEFAULT 0,\n  detail      TEXT,\n  UNIQUE (backend, remote_repo, generation)\n);\nCREATE TABLE external_intent (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  mirror       TEXT NOT NULL REFERENCES external_mirror(local_task_id),\n  kind         TEXT NOT NULL CHECK (kind IN ('comment','transition','close')),\n  body         TEXT,\n  state        TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','delivered','refused')),\n  attempts     INTEGER NOT NULL DEFAULT 0,\n  last_error   TEXT,\n  created_at   TEXT NOT NULL,\n  delivered_at TEXT\n);\nCREATE TABLE ci_observation (\n  github_repo TEXT NOT NULL,\n  pr_number   INTEGER NOT NULL,\n  head_sha    TEXT NOT NULL,\n  state       TEXT NOT NULL CHECK (state IN ('passing','failing','running','none')),\n  generation  INTEGER NOT NULL,\n  observed_at TEXT NOT NULL,\n  PRIMARY KEY (github_repo, pr_number)\n);\nCREATE TABLE merge_intent (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  publication   INTEGER NOT NULL UNIQUE REFERENCES publication(id),\n  grant_terms_hash TEXT NOT NULL,\n  head_sha      TEXT NOT NULL,\n  method        TEXT NOT NULL CHECK (method IN ('squash','merge','rebase')),\n  delete_branch INTEGER NOT NULL DEFAULT 0 CHECK (delete_branch IN (0, 1)),\n  state         TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','claimed','waiting-human','firing','merged','refused','superseded')),\n  claimed_by    TEXT,\n  claimed_until TEXT,\n  -- v29 (modes): WHOSE signature this intent fires under, bound at\n  -- creation and re-proved in the firing CAS \u2014 'grant' = the grant\n  -- ceremony's own unattended-merge signature; 'mode' = a live automerge\n  -- mode; 'human' = the per-merge password ceremony.\n  authority_basis TEXT NOT NULL DEFAULT 'grant' CHECK (authority_basis IN ('grant','mode','human')),\n  mode_digest   TEXT,\n  -- v29: the durable one-winner linearization point \u2014 the CAS into\n  -- 'firing' stamps both; staleness is firing_deadline passing, never a\n  -- guess.\n  firing_at     TEXT,\n  firing_deadline TEXT,\n  generation    INTEGER NOT NULL DEFAULT 0,\n  attempts      INTEGER NOT NULL DEFAULT 0,\n  last_error    TEXT,\n  receipt       TEXT,\n  created_at    TEXT NOT NULL,\n  settled_at    TEXT,\n  CHECK (state <> 'claimed' OR (claimed_by IS NOT NULL AND claimed_until IS NOT NULL)),\n  CHECK (state <> 'firing' OR (firing_at IS NOT NULL AND firing_deadline IS NOT NULL))\n);\nCREATE TABLE merge_blocker (\n  publication INTEGER NOT NULL REFERENCES publication(id),\n  reason      TEXT NOT NULL CHECK (reason IN ('repair-open')),\n  task_id     TEXT,\n  created_at  TEXT NOT NULL,\n  -- v29: lifting is a stamp, not a DELETE \u2014 who unblocked, and when, is\n  -- an audit answer the People screen promises. One LIVE blocker per\n  -- publication (partial unique in the post-migration block); lifted\n  -- rows are history and never block a new block.\n  lifted_at   TEXT,\n  lifted_by   TEXT\n);\nCREATE TABLE operating_mode (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo            TEXT NOT NULL,\n  name            TEXT NOT NULL CHECK (name IN ('standard','hands-off')),\n  terms_json      TEXT NOT NULL,\n  digest          TEXT NOT NULL,\n  signed_by       TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  signed_at       TEXT NOT NULL,\n  absolute_expiry TEXT NOT NULL,\n  revoked_at      TEXT,\n  revoked_by      TEXT,\n  revoke_reason   TEXT\n);\nCREATE UNIQUE INDEX one_live_mode_per_repo\n  ON operating_mode (repo) WHERE revoked_at IS NULL;\nCREATE TABLE operating_mode_event (\n  id       INTEGER PRIMARY KEY AUTOINCREMENT,\n  mode     INTEGER NOT NULL REFERENCES operating_mode(id),\n  kind     TEXT NOT NULL CHECK (kind IN ('signed','renewed','revoked','expired-closed','signer-revoked')),\n  actor    TEXT NOT NULL,\n  at       TEXT NOT NULL\n);\nCREATE TABLE invite (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  token_hash  TEXT NOT NULL UNIQUE,\n  role        TEXT NOT NULL CHECK (role IN ('approver','viewer')),\n  minted_by   TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  minted_at   TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  attempts    INTEGER NOT NULL DEFAULT 0,\n  consumed_by TEXT,\n  consumed_at TEXT,\n  revoked_at  TEXT\n, projects_json TEXT);\nCREATE TABLE mode_rail (\n  repo            TEXT NOT NULL,\n  utc_day         TEXT NOT NULL,\n  reserved_starts INTEGER NOT NULL DEFAULT 0,\n  PRIMARY KEY (repo, utc_day)\n);\nCREATE TABLE task_scope (\n  task_id         TEXT PRIMARY KEY REFERENCES task(id) ON DELETE CASCADE,\n  goal            TEXT NOT NULL,\n  out_of_scope    TEXT,\n  touches         TEXT NOT NULL DEFAULT '[]',\n  proposed_at     TEXT NOT NULL,\n  digest          TEXT NOT NULL,\n  -- The dollar cap per build attempt, integer micro-dollars (v15):\n  -- approved spend, digest-bound, enforced by the provider's own stop.\n  budget_microusd INTEGER,\n  approved_at     TEXT,\n  approved_by     TEXT,\n  approved_digest TEXT,\n  -- The execution profile (v24, Parity II foundations): WHAT RUNS, bound\n  -- into what the operator signs. profile_json = the working profile;\n  -- approved_profile_json = the immutable snapshot the approval act took;\n  -- digest_version 1 = legacy fields-only digest (grandfathered), 2 =\n  -- profile-bearing. profile_state 'unresolved' blocks dispatch AND\n  -- approval, with its reason in words. Provenance (resolvedFrom,\n  -- grandfathered, provider version) lives in profile_provenance and\n  -- NEVER enters a digest.\n  profile_json          TEXT,\n  profile_state         TEXT NOT NULL DEFAULT 'resolved' CHECK (profile_state IN ('resolved','unresolved')),\n  unresolved_reason     TEXT,\n  approved_profile_json TEXT,\n  digest_version        INTEGER NOT NULL DEFAULT 1,\n  profile_provenance    TEXT,\n  -- The EXPLICIT fallback chain (v30, fallback chains). proposed_chain_json\n  -- is the WORKING snapshot saveScope binds the digest to when the repo has\n  -- configured fallbacks (mirrors profile_json); approved_chain_json is the\n  -- immutable snapshot the approval COPIED from it (mirrors\n  -- approved_profile_json = profile_json), so what is sealed is exactly what\n  -- the signed digest bound \u2014 never re-resolved. Both NULL = a legacy\n  -- single-profile (or no-profile) scope, untouched. approval_kind names\n  -- which the approval sealed: 'profile' (legacy) or 'chain'.\n  proposed_chain_json   TEXT,\n  approved_chain_json   TEXT,\n  -- The signed acceptance rubric (v39, Acceptance Contract v2): the SAME\n  -- additive shape as every digest-bound field before it. NULL/absent\n  -- reads back as [] and digests exactly as a rubric-less scope always\n  -- has -- grandfathering is this column simply not existing on a row\n  -- nobody has rewritten since. What makes a rubric MANDATORY going\n  -- forward is enforced by the authoring roads (proposeGuarded,\n  -- createConsoleTask, routine firing, the planner), never by this\n  -- schema or by saveScope itself.\n  acceptance_json       TEXT,\n  -- The concrete quality policy (v41), folded into digest only when strict\n  -- so every historical/default approval remains byte-identical.\n  quality_mode          TEXT NOT NULL DEFAULT 'default' CHECK (quality_mode IN ('default','strict')),\n  approval_kind         TEXT NOT NULL DEFAULT 'profile' CHECK (approval_kind IN ('profile','chain')),\n  -- The phase route (v47, explainable risk-aware routing). risk_level is\n  -- the signed risk; proposed_route_json is the WORKING canonical route\n  -- saveScope computed from risk, quality, evidence, publication, the\n  -- configured candidate tiers, and the task's overrides; EVERY route\n  -- filed since v47 folds its digest into the scope digest, routine-shaped\n  -- ones included. approved_route_json is the immutable snapshot the seal\n  -- COPIED, exactly as approved_profile_json mirrors profile_json \u2014\n  -- dispatch re-proves against it and mutable configuration can never\n  -- rewrite it. route_era is the DURABLE marker: NULL only on a row proven\n  -- to predate v47 (legacy \u2014 its sealed profile alone governs the build);\n  -- the route version on every row saveScope has written since. A row with\n  -- an era and a missing or unreadable route is corrupt and FAILS CLOSED\n  -- at approval, dispatch, review, and repair alike.\n  risk_level            TEXT NOT NULL DEFAULT 'routine' CHECK (risk_level IN ('routine','elevated','high')),\n  proposed_route_json   TEXT,\n  approved_route_json   TEXT,\n  route_era             INTEGER\n, proposed_via TEXT, approval_basis TEXT, mode_digest TEXT, candidate TEXT);\nCREATE TABLE approver (\n  name            TEXT PRIMARY KEY,\n  credential_hash TEXT NOT NULL,\n  added_at        TEXT NOT NULL,\n  -- v29 (multi-user): 'viewer' authenticates and reads; every\n  -- consequential act requires ACTIVE role 'approver'. Revocation is a\n  -- stamp \u2014 history stays attributable forever.\n  role            TEXT NOT NULL DEFAULT 'approver' CHECK (role IN ('approver','viewer')),\n  revoked_at      TEXT,\n  revoked_by      TEXT,\n  -- Bumped whenever the credential is replaced. Anything that derives\n  -- authority from an approver \u2014 a paired Telegram chat, an outstanding\n  -- pairing code \u2014 records the generation it was granted under, and a\n  -- rotation strands every grant from the old one.\n  generation      INTEGER NOT NULL DEFAULT 1\n, projects_json TEXT);\nCREATE TABLE telegram_binding (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  paired_at           TEXT NOT NULL,\n  paired_by           TEXT NOT NULL,\n  pair_update_id      INTEGER,\n  revoked_at          TEXT,\n  revoked_by          TEXT\n);\nCREATE UNIQUE INDEX telegram_binding_live_user\n  ON telegram_binding (bot_id, user_id) WHERE revoked_at IS NULL;\nCREATE TABLE telegram_team_chat (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id       TEXT NOT NULL,\n  chat_id      TEXT NOT NULL,\n  binding      INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  kind         TEXT NOT NULL CHECK (kind IN ('group','private')),\n  conversation TEXT NOT NULL REFERENCES team_conversation(id) ON DELETE RESTRICT,\n  bound_by     TEXT NOT NULL,\n  bound_at     TEXT NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  revoked_at   TEXT,\n  revoked_by   TEXT\n);\nCREATE UNIQUE INDEX telegram_team_chat_live\n  ON telegram_team_chat (bot_id, chat_id) WHERE revoked_at IS NULL;\nCREATE UNIQUE INDEX telegram_team_chat_group\n  ON telegram_team_chat (conversation) WHERE revoked_at IS NULL AND kind = 'group';\nCREATE TABLE notification_delivery (\n  notification INTEGER NOT NULL REFERENCES notification(id) ON DELETE RESTRICT,\n  destination TEXT NOT NULL,\n  claim_owner TEXT,\n  claim_generation INTEGER NOT NULL DEFAULT 0,\n  claim_expires_at TEXT,\n  attempts INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at TEXT,\n  last_attempt_at TEXT,\n  last_error TEXT,\n  delivered_at TEXT,\n  receipt TEXT,\n  PRIMARY KEY (notification, destination)\n);\nCREATE TABLE telegram_outbound_message (\n  binding INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id TEXT NOT NULL,\n  chat_id TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  notification INTEGER NOT NULL REFERENCES notification(id) ON DELETE RESTRICT,\n  destination TEXT NOT NULL,\n  project TEXT,\n  task_ref INTEGER REFERENCES task_ref(id),\n  task_id TEXT,\n  source_run INTEGER REFERENCES run(id),\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id, notification)\n);\nCREATE TABLE telegram_retry (\n  bot_id TEXT PRIMARY KEY,\n  next_attempt_at TEXT NOT NULL\n);\nCREATE TABLE telegram_pairing (\n  code_hash       TEXT PRIMARY KEY,\n  approver        TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  created_at      TEXT NOT NULL,\n  created_by      TEXT NOT NULL,\n  expires_at      TEXT NOT NULL,\n  consumed_at     TEXT,\n  consumed_chat   TEXT,\n  consumed_user   TEXT,\n  consumed_update INTEGER\n);\nCREATE TABLE telegram_update (\n  update_id  INTEGER PRIMARY KEY,\n  applied_at TEXT NOT NULL,\n  result     TEXT NOT NULL\n);\nCREATE TABLE telegram_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  decision    INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  option_id   TEXT NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('choose','confirm','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n, note_digest TEXT);\nCREATE INDEX telegram_action_by_decision ON telegram_action (decision);\nCREATE TABLE telegram_flow_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  action      TEXT NOT NULL CHECK (action IN ('approve','edit','send-back')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX telegram_flow_action_visit ON telegram_flow_action (card, entry);\nCREATE TABLE telegram_question_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  choice      TEXT,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE TABLE telegram_question_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\nCREATE TABLE telegram_flow_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  mode        TEXT NOT NULL CHECK (mode IN ('edit','send-back')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\nCREATE TABLE telegram_decision_message (\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\nCREATE TABLE telegram_note_draft (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  update_id  INTEGER NOT NULL,\n  message_id TEXT NOT NULL,\n  reply_to   TEXT NOT NULL,\n  note       TEXT NOT NULL,\n  state      TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','armed','superseded','consumed','discarded')),\n  created_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX telegram_note_draft_live\n  ON telegram_note_draft (binding, decision) WHERE state IN ('pending','armed');\nCREATE TABLE telegram_conversation (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding             INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL,\n  approver_generation INTEGER NOT NULL,\n  update_id           INTEGER NOT NULL UNIQUE,\n  message_id          TEXT NOT NULL,\n  reply_to            TEXT,\n  request             TEXT NOT NULL UNIQUE,\n  text                TEXT NOT NULL,\n  context             TEXT,\n  task_id             TEXT,\n  source_run          INTEGER,\n  state               TEXT NOT NULL CHECK (state IN ('queued','running','done','failed')),\n  claim_owner         TEXT,\n  claim_expires_at    TEXT,\n  attempts            INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at     TEXT,\n  session             INTEGER,\n  turn                INTEGER,\n  outcome             TEXT,\n  reply_message_id    TEXT,\n  created_at          TEXT NOT NULL,\n  started_at          TEXT,\n  finished_at         TEXT\n);\nCREATE INDEX telegram_conversation_queue ON telegram_conversation (bot_id, state, id);\nCREATE TABLE telegram_proposal_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  proposal    INTEGER NOT NULL REFERENCES mate_proposal(id) ON DELETE CASCADE,\n  phase       TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX telegram_proposal_action_by_proposal ON telegram_proposal_action (proposal);\nCREATE TABLE telegram_conversation_part (\n  conversation    INTEGER NOT NULL REFERENCES telegram_conversation(id) ON DELETE CASCADE,\n  ordinal         INTEGER NOT NULL,\n  kind            TEXT NOT NULL CHECK (kind IN ('reply','card','image')),\n  text            TEXT NOT NULL,\n  reply_to        TEXT,\n  proposal        INTEGER REFERENCES mate_proposal(id) ON DELETE SET NULL,\n  keyboard_json   TEXT,\n  state           TEXT NOT NULL CHECK (state IN ('pending','sent','dropped')),\n  message_id      TEXT,\n  attempts        INTEGER NOT NULL DEFAULT 0,\n  uncertain       INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at TEXT,\n  last_error      TEXT,\n  created_at      TEXT NOT NULL,\n  sent_at         TEXT,\n  task_id         TEXT,\n  source_run      INTEGER REFERENCES run(id),\n  artifact        INTEGER,\n  sha256          TEXT,\n  PRIMARY KEY (conversation, ordinal),\n  CHECK ((state = 'sent') = (message_id IS NOT NULL)),\n  CHECK ((state = 'sent') = (sent_at IS NOT NULL)),\n  CHECK ((kind = 'image') = (task_id IS NOT NULL AND source_run IS NOT NULL AND artifact IS NOT NULL AND sha256 IS NOT NULL))\n);\nCREATE TABLE mate_turn_evidence (\n  turn       INTEGER NOT NULL REFERENCES mate_turn(id) ON DELETE CASCADE,\n  ordinal    INTEGER NOT NULL,\n  task_id    TEXT NOT NULL,\n  task_ref   INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  run        INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  artifact   INTEGER NOT NULL REFERENCES artifact(id) ON DELETE CASCADE,\n  sha256     TEXT NOT NULL,\n  format     TEXT NOT NULL CHECK (format IN ('png','jpeg')),\n  bytes      INTEGER NOT NULL,\n  caption    TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (turn, ordinal),\n  UNIQUE (turn, artifact)\n);\nCREATE TABLE bridge_lease (\n  bot_id       TEXT PRIMARY KEY,\n  owner        TEXT NOT NULL,\n  generation   INTEGER NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  expires_at   TEXT NOT NULL,\n  heartbeat_at TEXT NOT NULL,\n  push_url     TEXT,\n  push_at      TEXT,\n  push_problem TEXT\n);\nCREATE TABLE telegram_inbox (\n  update_id    INTEGER PRIMARY KEY,\n  bot_id       TEXT NOT NULL,\n  payload      TEXT NOT NULL,\n  received_at  TEXT NOT NULL\n);\nCREATE TABLE wake (\n  id  INTEGER PRIMARY KEY CHECK (id = 1),\n  seq INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE watch_lease (\n  runner       TEXT NOT NULL,\n  repo         TEXT NOT NULL,\n  owner        TEXT NOT NULL,\n  generation   INTEGER NOT NULL,\n  started_at   TEXT NOT NULL,\n  expires_at   TEXT NOT NULL,\n  heartbeat_at TEXT NOT NULL,\n  PRIMARY KEY (runner, repo)\n);\nCREATE TABLE quota (\n  runner      TEXT NOT NULL,\n  provider    TEXT NOT NULL,\n  scope       TEXT NOT NULL DEFAULT '',\n  -- v30 (fallback chains): quota identity must distinguish a subscription\n  -- from an API key, else exhausting a claude subscription would wrongly\n  -- block a claude api-key fallback. auth_mode + a stable NON-SECRET\n  -- credential fingerprint join the key. Defaults keep every pre-v30 row\n  -- identical (mode 'subscription', empty fp) since that is what they were.\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription','api-key')),\n  credential_fp TEXT NOT NULL DEFAULT '',\n  state       TEXT NOT NULL CHECK (state IN ('exhausted','half-open')),\n  reason      TEXT NOT NULL,\n  observed_at TEXT NOT NULL,\n  reset_at    TEXT,\n  PRIMARY KEY (runner, provider, scope, auth_mode, credential_fp)\n);\nCREATE TABLE fallback_cycle (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  -- The approved chain this cycle walks; the cycle is void if the approval\n  -- moves (the CAS re-proves it).\n  chain_digest  TEXT NOT NULL,\n  cursor        INTEGER NOT NULL DEFAULT 0,\n  state         TEXT NOT NULL CHECK (state IN ('open','sanitizing','awaiting-release','pending-admission','incident','closed')),\n  transition_generation INTEGER NOT NULL DEFAULT 0,\n  -- The current tail run (the entry running, or the predecessor being\n  -- sanitized). NULL only transiently at pending-admission before the next\n  -- run opens.\n  tail_run      INTEGER REFERENCES run(id),\n  created_at    TEXT NOT NULL,\n  updated_at    TEXT NOT NULL,\n  closed_reason TEXT\n);\nCREATE TABLE fallback_transition (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  cycle         INTEGER NOT NULL REFERENCES fallback_cycle(id) ON DELETE CASCADE,\n  kind          TEXT NOT NULL CHECK (kind IN ('exhaustion','quota-skip')),\n  from_index    INTEGER NOT NULL,\n  to_index      INTEGER NOT NULL,\n  -- The predecessor run whose exhaustion (or whose skip evidence) earned\n  -- this step; NULL for a fresh cycle's index-0 (there is no transition\n  -- into index 0 \u2014 a cycle starts there).\n  predecessor_run INTEGER REFERENCES run(id),\n  -- The gateway-stamped terminal class + proven evidence identity that\n  -- authorized an 'exhaustion' step (NULL for quota-skip, which cites\n  -- durable quota evidence instead).\n  terminal_class  TEXT,\n  evidence_provider TEXT,\n  evidence_version  TEXT,\n  evidence_auth_mode TEXT,\n  evidence_fp     TEXT,\n  created_at    TEXT NOT NULL,\n  -- The run that consumed this transition's authority (single-use). NULL\n  -- until admission; set once, in the same txn that opens the next run.\n  consumed_by   INTEGER REFERENCES run(id)\n);\nCREATE TABLE watch_episode (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo        TEXT NOT NULL,\n  runner      TEXT NOT NULL,\n  incarnation TEXT NOT NULL UNIQUE,\n  started_at  TEXT NOT NULL,\n  ended_at    TEXT,\n  ticks       INTEGER NOT NULL DEFAULT 0,\n  built       INTEGER NOT NULL DEFAULT 0,\n  broke       INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE project (\n  path           TEXT PRIMARY KEY,\n  name           TEXT NOT NULL,\n  added_at       TEXT NOT NULL,\n  last_opened_at TEXT NOT NULL\n);\nCREATE INDEX project_recent ON project (last_opened_at);\nCREATE TABLE publication_grant (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo         TEXT NOT NULL,\n  github_repo  TEXT NOT NULL,\n  remote       TEXT NOT NULL,\n  head_prefix  TEXT NOT NULL,\n  base         TEXT NOT NULL,\n  capabilities TEXT NOT NULL,\n  selector     TEXT NOT NULL CHECK (selector IN ('ours','all')),\n  draft        INTEGER NOT NULL DEFAULT 1,\n  granted_by   TEXT NOT NULL,\n  granted_at   TEXT NOT NULL,\n  revoked_by   TEXT,\n  revoked_at   TEXT\n, merge INTEGER NOT NULL DEFAULT 0 CHECK (merge IN (0, 1)), merge_method TEXT CHECK (merge_method IN ('squash','merge','rebase')), merge_delete_branch INTEGER NOT NULL DEFAULT 0 CHECK (merge_delete_branch IN (0, 1)));\nCREATE UNIQUE INDEX publication_grant_live\n  ON publication_grant (repo) WHERE revoked_at IS NULL;\nCREATE TABLE publication (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  run         INTEGER NOT NULL UNIQUE REFERENCES run(id) ON DELETE CASCADE,\n  task_ref    INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  github_repo TEXT NOT NULL,\n  remote      TEXT NOT NULL,\n  base        TEXT NOT NULL,\n  head        TEXT NOT NULL,\n  head_sha    TEXT NOT NULL,\n  body_hash   TEXT NOT NULL,\n  draft       INTEGER NOT NULL,\n  state       TEXT NOT NULL CHECK (state IN ('intended','pushed','opened','failed')),\n  pr_number   INTEGER,\n  pr_url      TEXT,\n  attempts    INTEGER NOT NULL DEFAULT 0,\n  last_error  TEXT,\n  created_at  TEXT NOT NULL,\n  updated_at  TEXT NOT NULL,\n  -- The remote's own verdict, observed (M8 audit C-6): MERGED/CLOSED ends\n  -- the watch without widening the local state CHECK.\n  remote_state TEXT,\n  -- What CI was last SEEN doing, and when (audit SD-4): the review queue\n  -- ranks observed-passing first and never upgrades silence to green.\n  last_check_state TEXT,\n  last_check_at    TEXT\n);\nCREATE TABLE runner (\n  name            TEXT PRIMARY KEY,\n  host            TEXT NOT NULL,\n  credential_hash TEXT NOT NULL,\n  capacity        INTEGER NOT NULL,\n  -- What capacity bounds (v14, finding 26): 'tasks' is the original\n  -- contract (live claims) and stays the default; 'processes' counts\n  -- worker processes via execution_slot and is an explicit opt-in \u2014\n  -- an upgrade never silently changes what an operator's number means.\n  capacity_mode   TEXT NOT NULL DEFAULT 'tasks' CHECK (capacity_mode IN ('tasks','processes')),\n  repos           TEXT NOT NULL DEFAULT '[]',\n  agents          TEXT NOT NULL DEFAULT '[]',\n  registered_at   TEXT NOT NULL,\n  heartbeat_at    TEXT NOT NULL,\n  retired_at      TEXT,\n  -- The queue column's theme note (v19) \u2014 operator prose, display only.\n  queue_note      TEXT\n);\nCREATE TABLE worktree (\n  path          TEXT PRIMARY KEY,\n  repo          TEXT NOT NULL,\n  branch        TEXT NOT NULL,\n  runner        TEXT REFERENCES runner(name) ON DELETE SET NULL,\n  task_ref      INTEGER REFERENCES task_ref(id) ON DELETE SET NULL,\n  created_at    TEXT NOT NULL,\n  leased_at     TEXT,\n  released_at   TEXT,\n  -- Reconstructed state is trusted only after it has been checked; see\n  -- treehouse's rule about state you did not watch being created.\n  verified      INTEGER NOT NULL DEFAULT 0,\n  -- Per-occupancy epoch (live-peek findings 16/28): a fresh random value\n  -- written ATOMICALLY with every lease and rotated on release, so it can\n  -- never repeat across release/forget/adopt/recreation. An observation\n  -- proved against one epoch is DISCARDED if the epoch moved before it\n  -- rendered \u2014 the fence that keeps a successor occupant's files out of a\n  -- predecessor's page.\n  lease_epoch   TEXT,\n  -- The approved setup this checkout last ran to completion (M5.7):\n  -- matching the live setup's digest is the cache hit; anything else runs\n  -- it again before an agent may spawn here.\n  setup_digest  TEXT\n);\nCREATE TABLE worktree_setup (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo        TEXT NOT NULL,\n  command     TEXT NOT NULL,\n  timeout_ms  INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  approved_by TEXT NOT NULL,\n  approved_at TEXT NOT NULL,\n  revoked_at  TEXT,\n  revoked_by  TEXT\n);\nCREATE UNIQUE INDEX worktree_setup_live\n  ON worktree_setup (repo) WHERE revoked_at IS NULL;\nCREATE TABLE verify_command (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo        TEXT NOT NULL,\n  command     TEXT NOT NULL,\n  timeout_ms  INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  -- v45: opt-in authority for exactly one post-commit replay of this\n  -- setup digest when the verification command cannot start because a\n  -- required project executable is unavailable. NULL preserves every older grant.\n  recovery_setup_digest TEXT,\n  approved_by TEXT NOT NULL,\n  approved_at TEXT NOT NULL,\n  revoked_at  TEXT,\n  revoked_by  TEXT\n);\nCREATE UNIQUE INDEX verify_command_live\n  ON verify_command (repo) WHERE revoked_at IS NULL;\nCREATE TABLE proof_verdict (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  verdict     TEXT NOT NULL CHECK (verdict IN ('verified','attested','short','refuted')),\n  reasons_json TEXT NOT NULL,\n  decided_at  TEXT NOT NULL,\n  -- v39: the criterion-to-evidence matrix adjudicate() computed alongside\n  -- the verdict -- one shared render, never re-derived. NULL for every\n  -- verdict decided before this migration, and for any run whose scope\n  -- signed no rubric (adjudicate returns [] and this column stores NULL,\n  -- not \"[]\", so a surface can tell \"no matrix\" from \"an empty one\" --\n  -- not that the two currently read any differently).\n  matrix_json TEXT,\n  -- v40 (evidence-review-v1): the verdict adjudicate() computed, BEFORE an\n  -- independent reviewer's judgements were folded in \u2014 NULL means \"no\n  -- review folded\", reading back exactly as today. Never overwritten once\n  -- set: one SUCCESSFUL review per source run, ever (v50's\n  -- one_successful_root_review_per_source), so this is written at most\n  -- once, by the same transaction that folds it.\n  machine_verdict TEXT CHECK (machine_verdict IS NULL OR machine_verdict IN ('verified','attested','short','refuted'))\n);\nCREATE TABLE criterion_review (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  reviewer_run  INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  source_run    INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  criterion_id  TEXT NOT NULL,\n  judgement     TEXT NOT NULL CHECK (judgement IN ('upholds','contradicts','cannot-tell')),\n  note          TEXT NOT NULL,\n  artifact      INTEGER NOT NULL REFERENCES artifact(id) ON DELETE CASCADE,\n  artifact_sha  TEXT NOT NULL,\n  author        TEXT NOT NULL,\n  created_at    TEXT NOT NULL,\n  -- Audit hardening (still evidence-review-v1, unreleased): every input the\n  -- reviewer was actually shown, hash-bound and RE-VALIDATED against the\n  -- live store at ingest time by ingestReview() -- never trusted from the\n  -- caller's say-so. NULL exactly when that input never existed for this\n  -- run (no verify command configured, no screenshots claimed): an\n  -- omission, recorded as one, never confused with a mismatch.\n  scope_digest       TEXT,\n  head_sha           TEXT,\n  proof_artifact     INTEGER,\n  proof_sha          TEXT,\n  check_log_artifact INTEGER,\n  check_log_sha      TEXT,\n  screenshots_json   TEXT NOT NULL DEFAULT '[]',\n  -- v51 (inherited review context): the sealed context inventory the\n  -- reviewer was shown, hash-bound and re-validated at ingest exactly like\n  -- the proof. NULL exactly when the run captured no inventory (every run\n  -- that is not a revision, and every run before v51).\n  context_artifact   INTEGER,\n  context_sha        TEXT\n);\nCREATE TABLE repair_chain (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  root_task       TEXT NOT NULL,\n  source_run      INTEGER NOT NULL UNIQUE REFERENCES run(id) ON DELETE CASCADE,\n  attempt         INTEGER NOT NULL,\n  draft_task      TEXT,\n  basis           TEXT NOT NULL CHECK (basis IN ('human','mode')),\n  mode_digest     TEXT,\n  unresolved_json TEXT NOT NULL,\n  outcome         TEXT NOT NULL DEFAULT 'drafted'\n                    CHECK (outcome IN ('drafted','attempts-spent','no-progress','integrity-refused','resolved')),\n  created_at      TEXT NOT NULL,\n  settled_at      TEXT\n);\nCREATE INDEX repair_chain_root ON repair_chain (root_task, attempt);\nCREATE TABLE proof_acceptance (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  approver    TEXT NOT NULL,\n  note        TEXT,\n  accepted_at TEXT NOT NULL\n);\nCREATE TABLE run_note (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  run        INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  author     TEXT NOT NULL,\n  note       TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\nCREATE TABLE intake_grant (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo        TEXT NOT NULL,\n  github      TEXT NOT NULL,\n  label       TEXT NOT NULL,\n  reviewers   TEXT,\n  approved_by TEXT NOT NULL,\n  approved_at TEXT NOT NULL,\n  revoked_at  TEXT,\n  revoked_by  TEXT\n);\nCREATE UNIQUE INDEX intake_grant_live\n  ON intake_grant (repo) WHERE revoked_at IS NULL;\nCREATE TABLE diff_comment (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  artifact      INTEGER NOT NULL REFERENCES artifact(id) ON DELETE CASCADE,\n  artifact_sha  TEXT NOT NULL,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  path          TEXT,\n  line          INTEGER,\n  note          TEXT NOT NULL,\n  author        TEXT NOT NULL,\n  created_at    TEXT NOT NULL,\n  superseded_by INTEGER REFERENCES diff_comment(id),\n  consumed_by   TEXT,\n  -- Where an ingested comment came from (M8.17): gh:<owner/name>:<id>.\n  -- The GitHub comment id is the idempotency key \u2014 one ingest, ever.\n  -- Its unique index is created AFTER migration (see openStore): a\n  -- database whose diff_comment predates the column would die on an\n  -- index statement inside this schema block before addColumn could run.\n  source_key    TEXT\n, reviewer_run INTEGER REFERENCES run(id), severity TEXT CHECK (severity IN ('note','question','problem')));\nCREATE TABLE review_request (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  run             INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  -- Who asked, as words for the page. AUTHORITY lives in basis/mode_digest\n  -- below, never in this string (Codex reviewer round 1, finding 4: an\n  -- operator who NAMES themselves 'mode:\u2026' must not be misclassified).\n  requested_by    TEXT NOT NULL,\n  -- 'human' = an operator's credentialed ask, always dispatchable.\n  -- 'mode' = a reviewAuto mode queued it; dispatch re-proves the EXACT\n  -- digest below is still the active mode \u2014 a renewal is a new signature\n  -- and does not inherit its predecessor's queued asks.\n  basis           TEXT NOT NULL DEFAULT 'human' CHECK (basis IN ('human','mode')),\n  mode_digest     TEXT,\n  -- v47: the approved route digest the request was queued under. Admission\n  -- re-proves the task's sealed route still carries it \u2014 a re-approved\n  -- task with a different route spends the request unrun, in words.\n  route_digest    TEXT,\n  requested_at    TEXT NOT NULL,\n  consumed_at     TEXT,\n  consumed_reason TEXT,\n  -- v50: the ROOT reviewer run this request was spent on \u2014 written by the\n  -- very admission that consumed it, so a request and its attempt are one\n  -- durable fact. NULL on a request spent without a run (route-changed,\n  -- mode-ended, already-reviewed, \u2026) and on any v49 row the migration\n  -- could not bind to exactly one root.\n  reviewer_run    INTEGER REFERENCES run(id),\n  -- v50 (explicit-only retries): how the ask was PRODUCED, apart from\n  -- whose authority it carries. 'operator' = a fresh credentialed act\n  -- (task review, the Retry review button). 'automatic' = a build\n  -- disposition's producer (a reviewAuto mode, a Strict / release scope)\n  -- \u2014 one-shot per source run: it queues the first attempt only, and a\n  -- replayed disposition (crash recovery, a re-dispose) can neither queue\n  -- nor admit a retry. Request and admission both refuse on it BEFORE\n  -- any rail or run exists; a mode-basis row is automatic whatever this\n  -- column says.\n  origin          TEXT NOT NULL DEFAULT 'operator' CHECK (origin IN ('operator','automatic'))\n);\nCREATE TABLE task_steer (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  author        TEXT NOT NULL,\n  note          TEXT NOT NULL,\n  created_at    TEXT NOT NULL,\n  attached_run  INTEGER REFERENCES run(id),\n  attached_at   TEXT,\n  delivered_at  TEXT,\n  superseded_at TEXT,\n  -- v24 (ruling 11): authorship is a VERIFIED principal or it is history.\n  -- The default is the legacy label so any road that forgets to say\n  -- otherwise fails closed into \"unverified\".\n  authorship_state  TEXT NOT NULL DEFAULT 'unverified-legacy' CHECK (authorship_state IN ('verified','unverified-legacy')),\n  superseded_reason TEXT,\n  CHECK ((attached_run IS NULL) = (attached_at IS NULL)),\n  CHECK (delivered_at IS NULL OR attached_run IS NOT NULL)\n);\nCREATE TABLE plan_revision (\n  id               INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref         INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  revision         INTEGER NOT NULL,\n  artifact         INTEGER NOT NULL REFERENCES artifact(id),\n  parent_hash      TEXT,\n  reason           TEXT NOT NULL,\n  evidence_link    TEXT,\n  author           TEXT NOT NULL,\n  origin_run       INTEGER REFERENCES run(id),\n  kind             TEXT NOT NULL CHECK (kind IN ('initial', 'operator-edit', 'builder-proposal')),\n  authority_kind   TEXT NOT NULL CHECK (authority_kind IN ('plan-only', 'authority-change')),\n  authority_digest TEXT NOT NULL,\n  changed_fields   TEXT,\n  status           TEXT NOT NULL CHECK (status IN ('applied', 'blocked', 'rejected')),\n  created_at       TEXT NOT NULL,\n  resolved_at      TEXT,\n  resolved_by      TEXT,\n  UNIQUE (task_ref, revision)\n);\nCREATE TABLE run_checkpoint (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  plan_revision INTEGER NOT NULL REFERENCES plan_revision(id),\n  snapshot_json TEXT NOT NULL,\n  created_at    TEXT NOT NULL\n);\nCREATE TABLE push_subscription (\n  id                        INTEGER PRIMARY KEY AUTOINCREMENT,\n  endpoint                  TEXT NOT NULL,\n  p256dh                    TEXT NOT NULL,\n  auth                      TEXT NOT NULL,\n  approver                  TEXT NOT NULL,\n  approver_generation       INTEGER NOT NULL,\n  ua_words                  TEXT NOT NULL,\n  vapid_fingerprint         TEXT NOT NULL,\n  starts_after_notification INTEGER NOT NULL,\n  created_at                TEXT NOT NULL,\n  last_ok_at                TEXT,\n  consecutive_failures      INTEGER NOT NULL DEFAULT 0,\n  retired_at                TEXT,\n  retired_reason            TEXT\n);\nCREATE UNIQUE INDEX push_subscription_live\n  ON push_subscription (endpoint) WHERE retired_at IS NULL;\nCREATE TABLE push_delivery (\n  id               INTEGER PRIMARY KEY AUTOINCREMENT,\n  notification     INTEGER NOT NULL REFERENCES notification(id) ON DELETE CASCADE,\n  subscription     INTEGER NOT NULL REFERENCES push_subscription(id) ON DELETE CASCADE,\n  state            TEXT NOT NULL DEFAULT 'pending'\n                     CHECK (state IN ('pending','claimed','accepted','rejected','undeliverable','retired')),\n  claim_owner      TEXT,\n  claim_expires_at TEXT,\n  claim_generation INTEGER NOT NULL DEFAULT 0,\n  attempts         INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at  TEXT,\n  last_error       TEXT,\n  created_at       TEXT NOT NULL,\n  accepted_at      TEXT,\n  UNIQUE (notification, subscription),\n  CHECK (state <> 'claimed' OR (claim_owner IS NOT NULL AND claim_expires_at IS NOT NULL))\n);\nCREATE INDEX push_delivery_due\n  ON push_delivery (state, next_attempt_at) WHERE state IN ('pending','claimed');\nCREATE TABLE mutation (\n  idempotency_key TEXT PRIMARY KEY,\n  operation       TEXT NOT NULL,\n  result          TEXT NOT NULL,\n  actor           TEXT NOT NULL,\n  created_at      TEXT NOT NULL\n);\nCREATE TABLE attended_authorization (\n  id                TEXT PRIMARY KEY,\n  task_ref          INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  approver          TEXT NOT NULL,\n  runner            TEXT NOT NULL,\n  runner_generation INTEGER NOT NULL,\n  composite_digest  TEXT NOT NULL,\n  terms_json        TEXT NOT NULL,\n  max_session_turns INTEGER NOT NULL,\n  budget_microusd   INTEGER NOT NULL,\n  -- Continuation (A4): the finished parent attempt this authorization\n  -- continues, and the follow-up text \u2014 BOTH also inside the signed\n  -- terms_json; these columns exist so admission can join without parsing.\n  parent_run        INTEGER REFERENCES run(id),\n  followup          TEXT,\n  created_at        TEXT NOT NULL,\n  absolute_expiry   TEXT NOT NULL,\n  last_beat_at      TEXT,\n  attempt_run       INTEGER UNIQUE REFERENCES run(id),\n  consumed_at       TEXT,\n  closed_at         TEXT,\n  end_reason        TEXT\n, authority_basis TEXT NOT NULL DEFAULT 'password' CHECK (authority_basis IN ('password','mode')), mode_digest TEXT);\nCREATE TABLE session_turn (\n  id                 INTEGER PRIMARY KEY AUTOINCREMENT,\n  run                INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  seq                INTEGER NOT NULL,\n  source_kind        TEXT NOT NULL CHECK (source_kind IN ('brief','answer','operator','repair')),\n  source_id          INTEGER,\n  -- Verified operator name for source_kind 'operator' ONLY; brief and\n  -- repair turns are machine-authored and say so with NULL.\n  author             TEXT,\n  text               TEXT NOT NULL,\n  reserved_microusd  INTEGER NOT NULL,\n  accounted_microusd INTEGER,\n  accounted_at       TEXT,\n  recorded_at        TEXT NOT NULL,\n  written_at         TEXT,\n  accepted_at        TEXT,\n  settled_at         TEXT,\n  measured_microusd  INTEGER,\n  output_tokens      INTEGER,\n  state              TEXT NOT NULL DEFAULT 'recorded'\n                       CHECK (state IN ('recorded','written','accepted','settled','uncertain','cancelled')),\n  UNIQUE (run, seq)\n);\nCREATE TABLE held_session (\n  run                   INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  authorization_id      TEXT NOT NULL REFERENCES attended_authorization(id),\n  runner                TEXT NOT NULL,\n  lease_id              TEXT NOT NULL,\n  up_incarnation        TEXT NOT NULL,\n  cookie                TEXT NOT NULL,\n  socket_path           TEXT NOT NULL,\n  supervisor_pid        INTEGER,\n  agent_pgid            INTEGER,\n  cumulative_microusd   INTEGER NOT NULL DEFAULT 0,\n  cumulative_tokens_out INTEGER NOT NULL DEFAULT 0,\n  state                 TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open','fencing')),\n  fencer                TEXT,\n  fencing_deadline      TEXT,\n  started_at            TEXT NOT NULL,\n  ended_at              TEXT,\n  end_reason            TEXT\n);\nCREATE TABLE run_process (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  run INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  pid INTEGER CHECK (pid > 0),\n  host TEXT NOT NULL,\n  process_group INTEGER NOT NULL CHECK (process_group IN (0,1)),\n  observed_at TEXT NOT NULL,\n  exited_at TEXT,\n  boot_id TEXT,\n  containment TEXT,\n  container TEXT,\n  container_empty_at TEXT,\n  container_identity TEXT\n);\nCREATE INDEX run_process_by_run ON run_process(run, exited_at);\nCREATE INDEX task_by_state ON task (state);\nCREATE INDEX edge_by_blocker ON task_edge (blocker);\nCREATE INDEX claim_by_task ON claim (task_ref, lease_generation DESC);\nCREATE INDEX hold_by_task ON hold (task_ref);\nCREATE TABLE learning_capture (\n source INTEGER PRIMARY KEY REFERENCES run(id), reviewer INTEGER NOT NULL REFERENCES run(id),\n repo TEXT NOT NULL, identity TEXT NOT NULL, environment TEXT NOT NULL, payload TEXT NOT NULL, catalog TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE TABLE learning_policy (\n repo TEXT PRIMARY KEY, identity TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 0 CHECK(enabled IN (0,1)),\n revision INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE project_lesson (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, identity TEXT NOT NULL, source INTEGER NOT NULL REFERENCES run(id),\n reviewer INTEGER NOT NULL REFERENCES run(id), finding TEXT NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL,\n status TEXT NOT NULL CHECK(status IN ('proposed','adopted','disabled')), version INTEGER NOT NULL DEFAULT 1,\n adopted_by TEXT, UNIQUE(source, finding)\n);\nCREATE TABLE learning_event (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, actor TEXT NOT NULL, at TEXT NOT NULL,\n action TEXT NOT NULL, before_state TEXT NOT NULL, after_state TEXT NOT NULL, reason TEXT NOT NULL,\n lesson INTEGER REFERENCES project_lesson(id), run INTEGER REFERENCES run(id), evidence TEXT NOT NULL,\n dedupe TEXT UNIQUE\n);\nCREATE INDEX learning_event_project ON learning_event(repo,id);\nCREATE TABLE learning_snapshot (\n run INTEGER PRIMARY KEY REFERENCES run(id), repo TEXT NOT NULL, identity TEXT NOT NULL,\n payload TEXT NOT NULL, sha TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE TRIGGER learning_event_no_update BEFORE UPDATE ON learning_event BEGIN SELECT RAISE(ABORT,'learning history is append-only'); END;\nCREATE TRIGGER learning_event_no_delete BEFORE DELETE ON learning_event BEGIN SELECT RAISE(ABORT,'learning history is append-only'); END;\nCREATE TRIGGER learning_snapshot_no_update BEFORE UPDATE ON learning_snapshot BEGIN SELECT RAISE(ABORT,'learning snapshots are immutable'); END;\nCREATE TRIGGER learning_snapshot_no_delete BEFORE DELETE ON learning_snapshot BEGIN SELECT RAISE(ABORT,'learning snapshots are immutable'); END;\nCREATE TRIGGER project_lesson_content_immutable BEFORE UPDATE OF repo,identity,source,reviewer,finding,payload,sha ON project_lesson BEGIN SELECT RAISE(ABORT,'learning sources are immutable'); END;\nCREATE TRIGGER learning_capture_no_update BEFORE UPDATE ON learning_capture BEGIN SELECT RAISE(ABORT,'learning sources are immutable'); END;\nCREATE TRIGGER learning_capture_no_delete BEFORE DELETE ON learning_capture BEGIN SELECT RAISE(ABORT,'learning sources are immutable'); END;\nCREATE TABLE project_knowledge (\n repo TEXT PRIMARY KEY, identity TEXT NOT NULL, revision INTEGER NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL\n);\nCREATE TABLE knowledge_change (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, identity TEXT NOT NULL, revision INTEGER NOT NULL,\n actor TEXT NOT NULL, at TEXT NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL,\n UNIQUE(repo,identity,revision)\n);\nCREATE TABLE knowledge_snapshot (\n run INTEGER PRIMARY KEY REFERENCES run(id), repo TEXT NOT NULL, identity TEXT NOT NULL,\n payload TEXT NOT NULL, sha TEXT NOT NULL\n);\nCREATE TRIGGER knowledge_change_no_update BEFORE UPDATE ON knowledge_change BEGIN SELECT RAISE(ABORT,'Knowledge history is immutable'); END;\nCREATE TRIGGER knowledge_change_no_delete BEFORE DELETE ON knowledge_change BEGIN SELECT RAISE(ABORT,'Knowledge history is immutable'); END;\nCREATE TRIGGER knowledge_snapshot_no_update BEFORE UPDATE ON knowledge_snapshot BEGIN SELECT RAISE(ABORT,'Knowledge context is immutable'); END;\nCREATE TRIGGER knowledge_snapshot_no_delete BEFORE DELETE ON knowledge_snapshot BEGIN SELECT RAISE(ABORT,'Knowledge context is immutable'); END;\nCREATE TABLE project_decision (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, identity TEXT NOT NULL, revision INTEGER NOT NULL DEFAULT 1,\n claim TEXT NOT NULL, why TEXT NOT NULL,\n status TEXT NOT NULL CHECK(status IN ('active','superseded','retired')),\n supersedes INTEGER REFERENCES project_decision(id),\n decided_by TEXT NOT NULL, decided_at TEXT NOT NULL,\n source_kind TEXT NOT NULL CHECK(source_kind IN ('conversation','task','result','manual','backward-pass')),\n source_ref TEXT, recorded_by TEXT NOT NULL, sha TEXT NOT NULL\n);\nCREATE INDEX project_decision_repo ON project_decision(repo, status, id);\nCREATE TABLE decision_change (\n id INTEGER PRIMARY KEY, decision INTEGER NOT NULL REFERENCES project_decision(id), revision INTEGER NOT NULL,\n actor TEXT NOT NULL, at TEXT NOT NULL, action TEXT NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL,\n UNIQUE(decision, revision)\n);\nCREATE TRIGGER decision_change_no_update BEFORE UPDATE ON decision_change BEGIN SELECT RAISE(ABORT,'Decision history is immutable'); END;\nCREATE TRIGGER decision_change_no_delete BEFORE DELETE ON decision_change BEGIN SELECT RAISE(ABORT,'Decision history is immutable'); END;\nCREATE TRIGGER project_decision_no_delete BEFORE DELETE ON project_decision BEGIN SELECT RAISE(ABORT,'Decisions are retired, never deleted'); END;\nCREATE VIRTUAL TABLE memory_search USING fts5(kind UNINDEXED, ref UNINDEXED, repo UNINDEXED, scope UNINDEXED, title, body, tokenize='unicode61');\nCREATE TABLE memory_session (\n id TEXT PRIMARY KEY, repo TEXT NOT NULL, kind TEXT NOT NULL CHECK(kind IN ('claude','codex','lead','crew')),\n source TEXT NOT NULL, seen_at TEXT NOT NULL, surface TEXT NOT NULL, trace_sha TEXT NOT NULL,\n analyzed_at TEXT, verdict TEXT, problem TEXT\n);\nCREATE INDEX memory_session_repo ON memory_session(repo, seen_at);\nCREATE TABLE memory_gap (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, key TEXT NOT NULL, mistake TEXT NOT NULL, proposed TEXT NOT NULL,\n domain TEXT NOT NULL CHECK(domain IN ('project','orchestration')), first_seen TEXT NOT NULL, last_seen TEXT NOT NULL,\n retired_at TEXT, retired_reason TEXT, UNIQUE(repo, key)\n);\nCREATE TABLE memory_sighting (\n gap INTEGER NOT NULL REFERENCES memory_gap(id), session TEXT NOT NULL REFERENCES memory_session(id),\n at TEXT NOT NULL, quote TEXT NOT NULL, PRIMARY KEY(gap, session)\n);\nCREATE TABLE memory_proposal (\n id INTEGER PRIMARY KEY, repo TEXT NOT NULL, kind TEXT NOT NULL CHECK(kind IN ('instruction-add','instruction-remove','decision-add')),\n fingerprint TEXT NOT NULL, title TEXT NOT NULL, rationale TEXT NOT NULL, before_text TEXT, after_text TEXT NOT NULL,\n evidence TEXT NOT NULL, sessions INTEGER NOT NULL, status TEXT NOT NULL CHECK(status IN ('pending','accepted','rejected','stale')),\n created_at TEXT NOT NULL, decided_by TEXT, decided_at TEXT, surface TEXT NOT NULL\n);\nCREATE INDEX memory_proposal_pending ON memory_proposal(repo, status, fingerprint);\nCREATE TABLE memory_rejection (\n repo TEXT NOT NULL, fingerprint TEXT NOT NULL, rejected_at TEXT NOT NULL, rejected_by TEXT NOT NULL, sessions INTEGER NOT NULL, PRIMARY KEY(repo, fingerprint)\n);\nCREATE TABLE model_seen (\n  source        TEXT NOT NULL CHECK (source IN ('claude','codex','gemini','openrouter')),\n  id            TEXT NOT NULL,\n  name          TEXT NOT NULL,\n  input_usd     REAL,\n  output_usd    REAL,\n  context       INTEGER,\n  tools         INTEGER NOT NULL DEFAULT 0,\n  released_at   TEXT,\n  first_seen_at TEXT NOT NULL,\n  last_seen_at  TEXT NOT NULL,\n  PRIMARY KEY (source, id)\n);\nCREATE TABLE runtime_check (\n  tool           TEXT PRIMARY KEY CHECK (tool IN ('claude','codex','gemini')),\n  installed      TEXT,\n  latest         TEXT,\n  update_command TEXT,\n  problem        TEXT,\n  checked_at     TEXT NOT NULL,\n  updated_at     TEXT,\n  updated_by     TEXT\n);\nCREATE TABLE model_watch (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  enabled    INTEGER NOT NULL DEFAULT 0,\n  checked_at TEXT,\n  problem    TEXT,\n  changed_by TEXT,\n  changed_at TEXT\n);\nCREATE TABLE skill_package (sha TEXT PRIMARY KEY, payload TEXT NOT NULL);\nCREATE TABLE skill_owner (sha TEXT NOT NULL REFERENCES skill_package(sha), actor TEXT NOT NULL, at TEXT NOT NULL, PRIMARY KEY(sha,actor));\nCREATE TABLE project_skill_change (repo TEXT NOT NULL, identity TEXT NOT NULL, revision INTEGER NOT NULL, actor TEXT NOT NULL, at TEXT NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL, PRIMARY KEY(repo,revision));\nCREATE TABLE skill_snapshot (run INTEGER PRIMARY KEY REFERENCES run(id), repo TEXT NOT NULL, payload TEXT NOT NULL, sha TEXT NOT NULL);\nCREATE TABLE skill_test (task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id), package TEXT NOT NULL REFERENCES skill_package(sha), actor TEXT NOT NULL, request_sha TEXT NOT NULL, sample TEXT NOT NULL, source_run INTEGER REFERENCES run(id), feedback TEXT, identity TEXT NOT NULL);\nCREATE TRIGGER skill_package_no_update BEFORE UPDATE ON skill_package BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_package_no_delete BEFORE DELETE ON skill_package BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_owner_no_update BEFORE UPDATE ON skill_owner BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_owner_no_delete BEFORE DELETE ON skill_owner BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER project_skill_change_no_update BEFORE UPDATE ON project_skill_change BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER project_skill_change_no_delete BEFORE DELETE ON project_skill_change BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_snapshot_no_update BEFORE UPDATE ON skill_snapshot BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_snapshot_no_delete BEFORE DELETE ON skill_snapshot BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_test_no_update BEFORE UPDATE ON skill_test BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TRIGGER skill_test_no_delete BEFORE DELETE ON skill_test BEGIN SELECT RAISE(ABORT,'Skill history is immutable'); END;\nCREATE TABLE slack_binding (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL,\n team TEXT NOT NULL, app TEXT NOT NULL, member TEXT NOT NULL, channel TEXT NOT NULL,\n approver TEXT NOT NULL, generation INTEGER NOT NULL, created TEXT NOT NULL, revoked TEXT\n);\nCREATE UNIQUE INDEX slack_one_binding_member ON slack_binding(installation, member) WHERE revoked IS NULL;\nCREATE TABLE slack_pair (\n hash TEXT PRIMARY KEY, installation TEXT NOT NULL, approver TEXT NOT NULL,\n generation INTEGER NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE slack_event (\n id TEXT PRIMARY KEY, installation TEXT NOT NULL, binding INTEGER REFERENCES slack_binding(id),\n kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),\n channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,\n payload TEXT NOT NULL, created TEXT NOT NULL,\n session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),\n next_at TEXT, problem TEXT\n);\nCREATE INDEX slack_pending_event ON slack_event(installation,state,next_at);\nCREATE TABLE slack_part (\n id INTEGER PRIMARY KEY AUTOINCREMENT, event TEXT NOT NULL REFERENCES slack_event(id), ordinal INTEGER NOT NULL,\n payload TEXT NOT NULL, state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','sent','dropped')),\n message TEXT, file TEXT, uploaded INTEGER NOT NULL DEFAULT 0, attempts INTEGER NOT NULL DEFAULT 0,\n uncertain INTEGER NOT NULL DEFAULT 0, next_at TEXT, problem TEXT, created TEXT NOT NULL,\n UNIQUE(event,ordinal)\n);\nCREATE TABLE slack_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES slack_part(id),\n proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),\n expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE slack_progress (\n binding INTEGER NOT NULL REFERENCES slack_binding(id), run INTEGER NOT NULL REFERENCES run(id),\n part INTEGER NOT NULL REFERENCES slack_part(id), digest TEXT NOT NULL,\n PRIMARY KEY(binding,run)\n);\nCREATE TABLE slack_runtime (\n installation TEXT PRIMARY KEY, owner TEXT, lease_until TEXT, connected TEXT,\n problem TEXT, retry_at TEXT, notification INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE slack_room (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL, chat TEXT NOT NULL,\n kind TEXT NOT NULL CHECK(kind IN ('group','private')), conversation TEXT NOT NULL,\n binding INTEGER NOT NULL REFERENCES slack_binding(id),\n bound_by TEXT NOT NULL, bound TEXT NOT NULL, cursor INTEGER NOT NULL DEFAULT 0,\n revoked TEXT, revoked_by TEXT\n);\nCREATE UNIQUE INDEX slack_room_live ON slack_room(installation, chat) WHERE revoked IS NULL;\nCREATE UNIQUE INDEX slack_room_group ON slack_room(conversation) WHERE revoked IS NULL AND kind='group';\nCREATE TABLE slack_meta (\n installation TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, updated TEXT NOT NULL,\n PRIMARY KEY(installation, key)\n);\nCREATE TABLE slack_flow_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES slack_part(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n action TEXT NOT NULL CHECK(action IN ('approve','edit','send-back')), expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX slack_flow_action_visit ON slack_flow_action(card, entry);\nCREATE TABLE slack_flow_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES slack_binding(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n mode TEXT NOT NULL CHECK(mode IN ('edit','send-back')), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX slack_flow_prompt_open ON slack_flow_prompt(binding, consumed);\nCREATE TABLE slack_question_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES slack_part(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX slack_question_action_question ON slack_question_action(question);\nCREATE TABLE slack_question_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES slack_binding(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX slack_question_prompt_open ON slack_question_prompt(binding, consumed);\nCREATE TABLE discord_binding (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL,\n team TEXT NOT NULL, app TEXT NOT NULL, member TEXT NOT NULL, channel TEXT NOT NULL,\n approver TEXT NOT NULL, generation INTEGER NOT NULL, created TEXT NOT NULL, revoked TEXT\n);\nCREATE UNIQUE INDEX discord_one_binding_member ON discord_binding(installation, member) WHERE revoked IS NULL;\nCREATE TABLE discord_pair (\n hash TEXT PRIMARY KEY, installation TEXT NOT NULL, approver TEXT NOT NULL,\n generation INTEGER NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE discord_event (\n id TEXT PRIMARY KEY, installation TEXT NOT NULL, binding INTEGER REFERENCES discord_binding(id),\n kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),\n channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,\n payload TEXT NOT NULL, created TEXT NOT NULL,\n session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),\n next_at TEXT, problem TEXT\n);\nCREATE INDEX discord_pending_event ON discord_event(installation,state,next_at);\nCREATE TABLE discord_part (\n id INTEGER PRIMARY KEY AUTOINCREMENT, event TEXT NOT NULL REFERENCES discord_event(id), ordinal INTEGER NOT NULL,\n payload TEXT NOT NULL, state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','sent','dropped')),\n message TEXT, file TEXT, uploaded INTEGER NOT NULL DEFAULT 0, attempts INTEGER NOT NULL DEFAULT 0,\n uncertain INTEGER NOT NULL DEFAULT 0, next_at TEXT, problem TEXT, created TEXT NOT NULL,\n UNIQUE(event,ordinal)\n);\nCREATE TABLE discord_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES discord_part(id),\n proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),\n expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE discord_progress (\n binding INTEGER NOT NULL REFERENCES discord_binding(id), run INTEGER NOT NULL REFERENCES run(id),\n part INTEGER NOT NULL REFERENCES discord_part(id), digest TEXT NOT NULL,\n PRIMARY KEY(binding,run)\n);\nCREATE TABLE discord_runtime (\n installation TEXT PRIMARY KEY, owner TEXT, lease_until TEXT, connected TEXT,\n problem TEXT, retry_at TEXT, notification INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE discord_room (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL, chat TEXT NOT NULL,\n kind TEXT NOT NULL CHECK(kind IN ('group','private')), conversation TEXT NOT NULL,\n binding INTEGER NOT NULL REFERENCES discord_binding(id),\n bound_by TEXT NOT NULL, bound TEXT NOT NULL, cursor INTEGER NOT NULL DEFAULT 0,\n revoked TEXT, revoked_by TEXT\n);\nCREATE UNIQUE INDEX discord_room_live ON discord_room(installation, chat) WHERE revoked IS NULL;\nCREATE UNIQUE INDEX discord_room_group ON discord_room(conversation) WHERE revoked IS NULL AND kind='group';\nCREATE TABLE discord_meta (\n installation TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, updated TEXT NOT NULL,\n PRIMARY KEY(installation, key)\n);\nCREATE TABLE discord_flow_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES discord_part(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n action TEXT NOT NULL CHECK(action IN ('approve','edit','send-back')), expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX discord_flow_action_visit ON discord_flow_action(card, entry);\nCREATE TABLE discord_flow_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES discord_binding(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n mode TEXT NOT NULL CHECK(mode IN ('edit','send-back')), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX discord_flow_prompt_open ON discord_flow_prompt(binding, consumed);\nCREATE TABLE discord_question_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES discord_part(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX discord_question_action_question ON discord_question_action(question);\nCREATE TABLE discord_question_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES discord_binding(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX discord_question_prompt_open ON discord_question_prompt(binding, consumed);\nCREATE TABLE teams_binding (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL,\n team TEXT NOT NULL, app TEXT NOT NULL, member TEXT NOT NULL, channel TEXT NOT NULL,\n approver TEXT NOT NULL, generation INTEGER NOT NULL, created TEXT NOT NULL, revoked TEXT\n);\nCREATE UNIQUE INDEX teams_one_binding_member ON teams_binding(installation, member) WHERE revoked IS NULL;\nCREATE TABLE teams_pair (\n hash TEXT PRIMARY KEY, installation TEXT NOT NULL, approver TEXT NOT NULL,\n generation INTEGER NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE teams_event (\n id TEXT PRIMARY KEY, installation TEXT NOT NULL, binding INTEGER REFERENCES teams_binding(id),\n kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),\n channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,\n payload TEXT NOT NULL, created TEXT NOT NULL,\n session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),\n next_at TEXT, problem TEXT\n);\nCREATE INDEX teams_pending_event ON teams_event(installation,state,next_at);\nCREATE TABLE teams_part (\n id INTEGER PRIMARY KEY AUTOINCREMENT, event TEXT NOT NULL REFERENCES teams_event(id), ordinal INTEGER NOT NULL,\n payload TEXT NOT NULL, state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','sent','dropped')),\n message TEXT, file TEXT, uploaded INTEGER NOT NULL DEFAULT 0, attempts INTEGER NOT NULL DEFAULT 0,\n uncertain INTEGER NOT NULL DEFAULT 0, next_at TEXT, problem TEXT, created TEXT NOT NULL,\n UNIQUE(event,ordinal)\n);\nCREATE TABLE teams_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES teams_part(id),\n proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),\n expires TEXT NOT NULL, consumed TEXT\n);\nCREATE TABLE teams_progress (\n binding INTEGER NOT NULL REFERENCES teams_binding(id), run INTEGER NOT NULL REFERENCES run(id),\n part INTEGER NOT NULL REFERENCES teams_part(id), digest TEXT NOT NULL,\n PRIMARY KEY(binding,run)\n);\nCREATE TABLE teams_runtime (\n installation TEXT PRIMARY KEY, owner TEXT, lease_until TEXT, connected TEXT,\n problem TEXT, retry_at TEXT, notification INTEGER NOT NULL DEFAULT 0\n);\nCREATE TABLE teams_room (\n id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL, chat TEXT NOT NULL,\n kind TEXT NOT NULL CHECK(kind IN ('group','private')), conversation TEXT NOT NULL,\n binding INTEGER NOT NULL REFERENCES teams_binding(id),\n bound_by TEXT NOT NULL, bound TEXT NOT NULL, cursor INTEGER NOT NULL DEFAULT 0,\n revoked TEXT, revoked_by TEXT\n);\nCREATE UNIQUE INDEX teams_room_live ON teams_room(installation, chat) WHERE revoked IS NULL;\nCREATE UNIQUE INDEX teams_room_group ON teams_room(conversation) WHERE revoked IS NULL AND kind='group';\nCREATE TABLE teams_meta (\n installation TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, updated TEXT NOT NULL,\n PRIMARY KEY(installation, key)\n);\nCREATE TABLE teams_flow_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES teams_part(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n action TEXT NOT NULL CHECK(action IN ('approve','edit','send-back')), expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX teams_flow_action_visit ON teams_flow_action(card, entry);\nCREATE TABLE teams_flow_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES teams_binding(id),\n card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,\n mode TEXT NOT NULL CHECK(mode IN ('edit','send-back')), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX teams_flow_prompt_open ON teams_flow_prompt(binding, consumed);\nCREATE TABLE teams_question_action (\n token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES teams_part(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX teams_question_action_question ON teams_question_action(question);\nCREATE TABLE teams_question_prompt (\n id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES teams_binding(id),\n question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT\n);\nCREATE INDEX teams_question_prompt_open ON teams_question_prompt(binding, consumed);\nCREATE TABLE team_lead (\n id TEXT PRIMARY KEY, name TEXT NOT NULL, instructions TEXT NOT NULL, revision INTEGER NOT NULL DEFAULT 1,\n status TEXT NOT NULL CHECK(status IN ('active','paused')), created_by TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE TABLE team_lead_project (\n lead TEXT NOT NULL REFERENCES team_lead(id), project TEXT NOT NULL, PRIMARY KEY(lead,project)\n);\nCREATE TABLE team_lead_member (\n lead TEXT NOT NULL REFERENCES team_lead(id), account TEXT NOT NULL REFERENCES approver(name),\n role TEXT NOT NULL CHECK(role IN ('viewer','contributor','manager')), active INTEGER NOT NULL DEFAULT 1,\n revision INTEGER NOT NULL DEFAULT 1, PRIMARY KEY(lead,account)\n);\nCREATE TABLE team_conversation (\n id TEXT PRIMARY KEY, lead TEXT NOT NULL REFERENCES team_lead(id), title TEXT NOT NULL,\n visibility TEXT NOT NULL CHECK(visibility IN ('private','team')), projects_json TEXT NOT NULL,\n revision INTEGER NOT NULL DEFAULT 1, thread INTEGER NOT NULL UNIQUE REFERENCES mate_thread(id),\n created_by TEXT NOT NULL REFERENCES approver(name), created_at TEXT NOT NULL, last_claimed_at TEXT\n);\nCREATE TABLE team_participant (\n conversation TEXT NOT NULL REFERENCES team_conversation(id), account TEXT NOT NULL REFERENCES approver(name),\n role TEXT NOT NULL CHECK(role IN ('viewer','contributor','manager')), active INTEGER NOT NULL DEFAULT 1,\n revision INTEGER NOT NULL DEFAULT 1, PRIMARY KEY(conversation,account)\n);\nCREATE TABLE team_message (\n message INTEGER PRIMARY KEY REFERENCES mate_message(id), conversation TEXT NOT NULL REFERENCES team_conversation(id),\n author TEXT NOT NULL REFERENCES approver(name), author_generation INTEGER NOT NULL, lead_member_revision INTEGER NOT NULL, participant_revision INTEGER NOT NULL, request_id TEXT NOT NULL,\n payload_hash TEXT NOT NULL, status TEXT NOT NULL CHECK(status IN ('queued','running','answered','failed','cancelled','uncertain')),\n revision INTEGER NOT NULL DEFAULT 1, generation INTEGER NOT NULL DEFAULT 0, runner TEXT, claimed_at TEXT,\n turn_id INTEGER REFERENCES mate_turn(id), stop_requested INTEGER NOT NULL DEFAULT 0, error TEXT,\n UNIQUE(conversation,author,request_id)\n);\nCREATE INDEX team_message_queue ON team_message(status,message);\nCREATE INDEX team_message_conversation ON team_message(conversation,message);\nCREATE UNIQUE INDEX team_message_single_writer ON team_message(conversation) WHERE status='running';\nCREATE TABLE team_read (\n conversation TEXT NOT NULL REFERENCES team_conversation(id), account TEXT NOT NULL REFERENCES approver(name),\n message INTEGER NOT NULL, PRIMARY KEY(conversation,account)\n);\nCREATE TABLE team_follow (\n conversation TEXT NOT NULL REFERENCES team_conversation(id), account TEXT NOT NULL REFERENCES approver(name),\n generation INTEGER NOT NULL, lead_member_revision INTEGER NOT NULL, participant_revision INTEGER NOT NULL, enabled INTEGER NOT NULL, PRIMARY KEY(conversation,account)\n);\nCREATE TABLE team_mate_session (\n session INTEGER PRIMARY KEY REFERENCES mate_session(id), thread INTEGER NOT NULL REFERENCES mate_thread(id)\n);\nCREATE INDEX team_mate_session_thread ON team_mate_session(thread,session);\nCREATE TABLE team_task_owner (\n task_ref INTEGER PRIMARY KEY REFERENCES task_ref(id), lead TEXT NOT NULL REFERENCES team_lead(id), conversation TEXT REFERENCES team_conversation(id),\n revision INTEGER NOT NULL DEFAULT 1, changed_by TEXT NOT NULL, changed_at TEXT NOT NULL\n);\nCREATE TABLE team_event (\n id INTEGER PRIMARY KEY AUTOINCREMENT, lead TEXT NOT NULL REFERENCES team_lead(id),\n conversation TEXT REFERENCES team_conversation(id), kind TEXT NOT NULL, actor TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE INDEX team_event_conversation ON team_event(conversation,id);\nCREATE INDEX team_event_lead ON team_event(lead,id);\nCREATE INDEX team_lead_member_account ON team_lead_member(account,active,lead);\nCREATE INDEX team_participant_account ON team_participant(account,active,conversation);\nCREATE TABLE team_request (\n account TEXT NOT NULL, generation INTEGER NOT NULL, request_id TEXT NOT NULL, payload_hash TEXT NOT NULL,\n response_json TEXT NOT NULL, PRIMARY KEY(account,generation,request_id)\n);\nCREATE TABLE sso_identity (\n  issuer       TEXT NOT NULL,\n  subject      TEXT NOT NULL,\n  account      TEXT NOT NULL REFERENCES approver(name),\n  email        TEXT,\n  created_at   TEXT NOT NULL,\n  last_seen_at TEXT NOT NULL,\n  PRIMARY KEY (issuer, subject)\n);\nCREATE INDEX sso_identity_account ON sso_identity (account);\nCREATE TABLE api_token (\n  id           TEXT PRIMARY KEY,\n  account      TEXT NOT NULL REFERENCES approver(name),\n  name         TEXT NOT NULL,\n  secret_hash  TEXT NOT NULL,\n  access       TEXT NOT NULL CHECK (access IN ('read','act')),\n  created_at   TEXT NOT NULL,\n  created_by   TEXT NOT NULL,\n  expires_at   TEXT NOT NULL,\n  last_used_at TEXT,\n  revoked_at   TEXT,\n  revoked_by   TEXT\n);\nCREATE INDEX api_token_account ON api_token (account);\nCREATE TABLE web_session (\n  id_hash          TEXT PRIMARY KEY,\n  account          TEXT NOT NULL,\n  csrf             TEXT NOT NULL,\n  role             TEXT NOT NULL CHECK (role IN ('approver','viewer')),\n  generation       INTEGER NOT NULL,\n  created_at       INTEGER NOT NULL,\n  last_seen        INTEGER NOT NULL,\n  project          TEXT,\n  project_revision INTEGER NOT NULL,\n  sso_at           INTEGER,\n  agent            TEXT,\n  address          TEXT\n);\nCREATE INDEX web_session_account ON web_session (account);\nCREATE TABLE approval_policy (\n  repo            TEXT PRIMARY KEY,\n  not_requester   INTEGER NOT NULL DEFAULT 0 CHECK (not_requester IN (0,1)),\n  protect_project INTEGER NOT NULL DEFAULT 0 CHECK (protect_project IN (0,1)),\n  protected_paths TEXT NOT NULL DEFAULT '[]',\n  updated_by      TEXT NOT NULL,\n  updated_at      TEXT NOT NULL\n);\nCREATE TABLE scope_approval_vote (\n  task_id  TEXT NOT NULL,\n  digest   TEXT NOT NULL,\n  approver TEXT NOT NULL,\n  at       TEXT NOT NULL,\n  PRIMARY KEY (task_id, digest, approver)\n);\nCREATE TABLE scope_author (\n  task_id TEXT NOT NULL,\n  digest  TEXT NOT NULL,\n  author  TEXT NOT NULL,\n  at      TEXT NOT NULL,\n  PRIMARY KEY (task_id, digest, author)\n);\nCREATE TABLE ledger_seal (\n  id   INTEGER PRIMARY KEY,\n  prev TEXT NOT NULL,\n  hash TEXT NOT NULL\n);\nCREATE TRIGGER ledger_seal_no_update BEFORE UPDATE ON ledger_seal\nBEGIN SELECT RAISE(ABORT, 'the ledger chain is append-only'); END;\nCREATE TRIGGER ledger_seal_no_delete BEFORE DELETE ON ledger_seal\nBEGIN SELECT RAISE(ABORT, 'the ledger chain is append-only'); END;\nCREATE TABLE ledger_checkpoint (\n  id      INTEGER PRIMARY KEY AUTOINCREMENT,\n  through INTEGER NOT NULL,\n  hash    TEXT NOT NULL,\n  at      TEXT NOT NULL,\n  by      TEXT NOT NULL\n);\nCREATE TRIGGER ledger_checkpoint_no_update BEFORE UPDATE ON ledger_checkpoint\nBEGIN SELECT RAISE(ABORT, 'ledger checkpoints are append-only'); END;\nCREATE TRIGGER ledger_checkpoint_no_delete BEFORE DELETE ON ledger_checkpoint\nBEGIN SELECT RAISE(ABORT, 'ledger checkpoints are append-only'); END;\nCREATE TABLE monitoring_status (\n  sink        TEXT PRIMARY KEY,\n  target      TEXT,\n  through     INTEGER NOT NULL DEFAULT 0,\n  sent        INTEGER NOT NULL DEFAULT 0,\n  last_ok_at  TEXT,\n  last_error  TEXT,\n  last_error_at TEXT,\n  failures    INTEGER NOT NULL DEFAULT 0,\n  next_try_at TEXT,\n  holder      TEXT,\n  held_until  TEXT\n);\nCREATE TABLE run_spend (\n  run         INTEGER PRIMARY KEY,\n  microusd    INTEGER,\n  source      TEXT NOT NULL CHECK (source IN ('reported', 'estimated', 'unpriced', 'subscription')),\n  billing     TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),\n  -- 1 once the run's own evidence set it (a key it was given, what its CLI said); a later turn can only make it a key.\n  billing_fixed INTEGER NOT NULL DEFAULT 0,\n  price_model TEXT,\n  input_usd   REAL,\n  output_usd  REAL,\n  priced_at   TEXT NOT NULL\n);\nCREATE TABLE budget (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  scope_kind  TEXT NOT NULL CHECK (scope_kind IN ('installation', 'project', 'person', 'teammate')),\n  scope_key   TEXT NOT NULL,\n  limit_microusd INTEGER NOT NULL CHECK (limit_microusd > 0),\n  hard_stop   INTEGER NOT NULL DEFAULT 1,\n  created_by  TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL,\n  updated_at  TEXT NOT NULL,\n  removed_by  TEXT,\n  removed_at  TEXT\n);\nCREATE UNIQUE INDEX budget_live ON budget (scope_kind, scope_key) WHERE removed_at IS NULL;\nCREATE TABLE provider_limit (\n  provider       TEXT NOT NULL,\n  window         TEXT NOT NULL,\n  used_percent   REAL NOT NULL,\n  window_minutes INTEGER,\n  resets_at      TEXT,\n  reached        INTEGER NOT NULL DEFAULT 0,\n  plan           TEXT,\n  observed_at    TEXT NOT NULL,\n  PRIMARY KEY (provider, window)\n);\nCREATE TABLE side_spend (\n  id        INTEGER PRIMARY KEY AUTOINCREMENT,\n  kind      TEXT NOT NULL CHECK (kind IN ('draft')),\n  repo      TEXT,\n  provider  TEXT NOT NULL,\n  model     TEXT,\n  cost_usd  REAL,\n  billing   TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),\n  at        TEXT NOT NULL\n);\nCREATE INDEX side_spend_at ON side_spend (at);\nCREATE TABLE provider_account (\n  provider    TEXT PRIMARY KEY,\n  billing     TEXT NOT NULL CHECK (billing IN ('subscription', 'api-key')),\n  observed_at TEXT NOT NULL\n);\nCREATE INDEX chat_turn_created ON chat_turn (created_at);\nCREATE INDEX mate_turn_created ON mate_turn (created_at);\nCREATE INDEX teammate_turn_at ON teammate_turn (at);\nCREATE TABLE retention_setting (\n  kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),\n  -- NULL is forever; a row only exists once someone chose.\n  days       INTEGER CHECK (days IS NULL OR (days >= 7 AND days <= 3650)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\nCREATE TABLE backup_settings (\n  id          INTEGER PRIMARY KEY CHECK (id = 1),\n  enabled     INTEGER NOT NULL DEFAULT 1,\n  every_hours INTEGER NOT NULL DEFAULT 24,\n  keep        INTEGER NOT NULL DEFAULT 7,\n  folder      TEXT\n);\nCREATE TABLE backup_run (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  trigger        TEXT NOT NULL CHECK (trigger IN ('scheduled', 'manual')),\n  started_at     TEXT NOT NULL,\n  finished_at    TEXT,\n  ok             INTEGER,\n  file           TEXT,\n  bytes          INTEGER,\n  schema_version INTEGER,\n  removed        INTEGER NOT NULL DEFAULT 0,\n  error          TEXT\n);\nCREATE TABLE backup_lease (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  holder     TEXT,\n  held_until TEXT\n);\nCREATE TABLE org_policy (\n  id             INTEGER PRIMARY KEY CHECK (id = 1),\n  providers_json TEXT,\n  models_json    TEXT,\n  tools_json     TEXT,\n  ceiling        TEXT NOT NULL DEFAULT 'escalated' CHECK (ceiling IN ('safe', 'standard', 'escalated')),\n  updated_by     TEXT NOT NULL,\n  updated_at     TEXT NOT NULL\n);\nCREATE TABLE run_check (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  status      TEXT CHECK (status IS NULL OR status IN ('passed', 'failed', 'not-run')),\n  exit_code   INTEGER,\n  suites_json TEXT NOT NULL DEFAULT '[]',\n  release     INTEGER NOT NULL DEFAULT 0 CHECK (release IN (0, 1)),\n  recorded_at TEXT,\n  snapshot    TEXT,\n  line        TEXT,\n  final       INTEGER NOT NULL DEFAULT 0 CHECK (final IN (0, 1)),\n  updated_at  TEXT,\n  notified_at TEXT\n);\nCREATE INDEX run_check_release ON run_check (run DESC) WHERE release = 1;\nCREATE INDEX mate_thread_scope ON mate_thread (approver, scope_kind, scope_key, closed_at);\nCREATE TABLE \"decision\" (\n  id             INTEGER PRIMARY KEY AUTOINCREMENT,\n  run            INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  urgency        TEXT NOT NULL CHECK (urgency IN ('blocking')),\n  state          TEXT NOT NULL DEFAULT 'open' CHECK (state IN ('open','expired','answered')),\n  recap          TEXT NOT NULL,\n  question       TEXT NOT NULL,\n  options        TEXT NOT NULL,\n  recommendation TEXT NOT NULL,\n  assignee       TEXT,\n  -- Attention metadata only. A deadline is never a hold expiry: a blocking\n  -- decision that goes overdue becomes 'expired' and MORE visible, not a\n  -- task that quietly dispatches itself unanswered.\n  deadline       TEXT,\n  created_at     TEXT NOT NULL,\n  answered_at    TEXT,\n  answered_by    TEXT,\n  -- Which racing agent asked (v14); lets one-open-question-per-agent be a\n  -- real database rule instead of a hope (finding 28). NULL = ordinary.\n  contestant     INTEGER REFERENCES contestant(id),\n  -- Typed closure (v14): 'excluded' = the operator stopped the asking\n  -- agent instead of answering. Never a fake option.\n  closed_reason  TEXT CHECK (closed_reason IN ('excluded')),\n  answered_via   TEXT CHECK (answered_via IN ('cli','web','telegram','slack','discord','teams')),\n  choice         TEXT,\n  note           TEXT,\n  -- v25 held-session linkage. session_turn = the turn whose settlement\n  -- produced this park (causal, held runs only). delivered_turn = the\n  -- answer turn that claimed delivery into the live session \u2014 the\n  -- delivery-CAS target: set once (WHERE delivered_turn IS NULL), reverted\n  -- only when that turn terminally never reached acceptance.\n  session_turn   INTEGER REFERENCES session_turn(id),\n  delivered_turn INTEGER REFERENCES session_turn(id)\n);\nCREATE TABLE \"run_stop\" (\n  run           INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  requested_by  TEXT NOT NULL,\n  requested_via TEXT NOT NULL CHECK (requested_via IN ('cli','web','telegram','slack','discord','teams')),\n  requested_at  TEXT NOT NULL,\n  settled_at    TEXT,\n  settlement    TEXT CHECK (settlement IN ('interrupted','recovered','held','finished')),\n  resumed_at    TEXT,\n  resumed_by    TEXT,\n  resumed_via   TEXT CHECK (resumed_via IN ('cli','web','telegram','slack','discord','teams')),\n  CHECK ((settled_at IS NULL) = (settlement IS NULL)),\n  CHECK (resumed_at IS NULL OR settled_at IS NOT NULL),\n  CHECK ((resumed_at IS NULL) = (resumed_by IS NULL))\n);\nCREATE INDEX run_stop_by_task ON run_stop (task_ref, requested_at DESC);\nCREATE UNIQUE INDEX teammate_question_visit ON teammate_question (card, entry) WHERE tool_call IS NULL AND suggestion IS NULL;\nCREATE UNIQUE INDEX teammate_question_suggestion ON teammate_question (suggestion) WHERE suggestion IS NOT NULL;\nCREATE UNIQUE INDEX teammate_question_call ON teammate_question (tool_call) WHERE tool_call IS NOT NULL;\nCREATE INDEX teammate_question_open ON teammate_question (card, entry, state);\nCREATE TABLE action_ledger (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  at TEXT NOT NULL, actor TEXT NOT NULL, repo TEXT,\n  task_id TEXT, run_id INTEGER,\n  action TEXT NOT NULL, outcome TEXT NOT NULL,\n  source TEXT NOT NULL CHECK (source IN ('work','request','access','sign-in','policy')),\n  detail TEXT\n);\nCREATE INDEX action_ledger_project ON action_ledger(repo, id DESC);\nCREATE INDEX action_ledger_actor ON action_ledger(actor, id DESC);\nCREATE TRIGGER action_ledger_no_update BEFORE UPDATE ON action_ledger\nBEGIN SELECT RAISE(ABORT, 'action history is append-only'); END;\nCREATE TRIGGER action_ledger_no_delete BEFORE DELETE ON action_ledger\nBEGIN SELECT RAISE(ABORT, 'action history is append-only'); END;\nCREATE TABLE workflow_recipe (\n  id TEXT NOT NULL, revision INTEGER NOT NULL CHECK(revision > 0),\n  repo TEXT NOT NULL, document TEXT NOT NULL, digest TEXT NOT NULL,\n  author TEXT NOT NULL, created_at TEXT NOT NULL,\n  PRIMARY KEY(id, revision)\n);\nCREATE INDEX workflow_recipe_project ON workflow_recipe(repo, id, revision DESC);\nCREATE TRIGGER workflow_recipe_no_update BEFORE UPDATE ON workflow_recipe\nBEGIN SELECT RAISE(ABORT, 'recipe revisions are immutable'); END;\nCREATE TRIGGER workflow_recipe_no_delete BEFORE DELETE ON workflow_recipe\nBEGIN SELECT RAISE(ABORT, 'recipe revisions are immutable'); END;\nCREATE TABLE workflow_preview (\n  token TEXT PRIMARY KEY, actor TEXT NOT NULL, repo TEXT NOT NULL,\n  document TEXT NOT NULL, digest TEXT NOT NULL, source TEXT NOT NULL,\n  created_at TEXT NOT NULL, expires_at TEXT NOT NULL,\n  task_id TEXT REFERENCES task(id), routine_id INTEGER REFERENCES routine(id),\n  saved_id TEXT, saved_revision INTEGER,\n  CHECK(task_id IS NULL OR routine_id IS NULL),\n  FOREIGN KEY(saved_id, saved_revision) REFERENCES workflow_recipe(id, revision)\n);\nCREATE INDEX workflow_preview_project ON workflow_preview(repo, created_at DESC);\nCREATE INDEX workflow_preview_source ON workflow_preview(repo, source, created_at DESC)\nWHERE task_id IS NOT NULL OR routine_id IS NOT NULL;\nCREATE TABLE plan_authorization (\n  task_id TEXT PRIMARY KEY REFERENCES task(id),\n  source_digest TEXT NOT NULL,\n  scope_digest TEXT NOT NULL,\n  mode_digest TEXT NOT NULL,\n  signed_by TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\nCREATE TRIGGER ledger_run_started AFTER INSERT ON run BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.started_at,NEW.runner,(SELECT repo FROM task_ref WHERE id = NEW.task_ref),(SELECT external_id FROM task_ref WHERE id = NEW.task_ref),NEW.id,'run started',NEW.role,'work');\nEND;\nCREATE TRIGGER ledger_run_finished AFTER UPDATE OF outcome ON run\nWHEN NEW.outcome IS NOT NULL AND OLD.outcome IS NOT NEW.outcome BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (COALESCE(NEW.finished_at, NEW.started_at),NEW.runner,(SELECT repo FROM task_ref WHERE id = NEW.task_ref),(SELECT external_id FROM task_ref WHERE id = NEW.task_ref),NEW.id,'run finished',NEW.outcome,'work');\nEND;\nCREATE TRIGGER ledger_decision_opened AFTER INSERT ON decision BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.created_at,'system',(SELECT repo FROM task_ref WHERE id = (SELECT task_ref FROM run WHERE id = NEW.run)),(SELECT external_id FROM task_ref WHERE id = (SELECT task_ref FROM run WHERE id = NEW.run)),NEW.run,'decision opened',NEW.state,'work');\nEND;\nCREATE TRIGGER ledger_decision_answered AFTER UPDATE OF answered_at ON decision\nWHEN NEW.answered_at IS NOT NULL AND OLD.answered_at IS NULL BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.answered_at,COALESCE(NEW.answered_by,'system'),(SELECT repo FROM task_ref WHERE id = (SELECT task_ref FROM run WHERE id = NEW.run)),(SELECT external_id FROM task_ref WHERE id = (SELECT task_ref FROM run WHERE id = NEW.run)),NEW.run,'decision answered',NEW.state,'work');\nEND;\nCREATE TRIGGER ledger_scope_approved AFTER UPDATE OF approved_at, approved_digest ON task_scope\nWHEN NEW.approved_at IS NOT NULL AND (OLD.approved_at IS NOT NEW.approved_at OR OLD.approved_digest IS NOT NEW.approved_digest) BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.approved_at,COALESCE(NEW.approved_by,'system'),(SELECT repo FROM task_ref WHERE backend = 'built-in' AND external_id = NEW.task_id),NEW.task_id,NULL,'scope approved','approved','work');\nEND;\nCREATE TRIGGER ledger_task_state AFTER UPDATE OF state ON task\nWHEN OLD.state IS NOT NEW.state BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.updated_at,'system',(SELECT repo FROM task_ref WHERE backend = 'built-in' AND external_id = NEW.id),NEW.id,NULL,'task state changed',NEW.state,'work');\nEND;\nCREATE TRIGGER ledger_task_placed AFTER UPDATE OF repo ON task_ref\nWHEN OLD.repo IS NOT NEW.repo BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (strftime('%Y-%m-%dT%H:%M:%fZ','now'),'system',NEW.repo,NEW.external_id,NULL,'task placed','recorded','work');\nEND;\nCREATE TRIGGER ledger_coordinator_minted AFTER INSERT ON coordinator_credential BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source,detail) VALUES (NEW.created_at, NEW.created_by, NULL, NULL, NULL,\n    'coordinator minted: ' || NEW.name, 'minted', 'access', 'projects: ' || NEW.repos);\nEND;\nCREATE TRIGGER ledger_task_registered AFTER INSERT ON task_ref BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (strftime('%Y-%m-%dT%H:%M:%fZ','now'),'system',NEW.repo,NEW.external_id,NULL,'task registered','recorded','work');\nEND;\nCREATE TRIGGER ledger_steer AFTER INSERT ON task_steer BEGIN\n  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (NEW.created_at,NEW.author,(SELECT repo FROM task_ref WHERE id = NEW.task_ref),(SELECT external_id FROM task_ref WHERE id = NEW.task_ref),NEW.attached_run,'steering added',NEW.authorship_state,'work');\nEND;\nCREATE INDEX decision_attention ON decision (run, id) WHERE state IN ('open','expired');\nCREATE INDEX incident_attention ON incident (run, id) WHERE resolved_at IS NULL;\nCREATE INDEX task_ref_repo ON task_ref (repo, id);\nCREATE INDEX work_family_parent ON task_ref (backend, revision_of, repo, id);\nCREATE INDEX work_result ON run (task_ref, id DESC, role, outcome, head_revision, scope_digest, finished_at) WHERE finished_at IS NOT NULL AND role IN ('builder','scout');\nCREATE INDEX work_spawned_run ON run (task_ref, id) WHERE provider_started_at IS NOT NULL;\nCREATE INDEX work_unsettled_custody ON run_process (run) WHERE exited_at IS NULL AND container_empty_at IS NULL;\nCREATE INDEX work_unfinished ON run (task_ref, id DESC) WHERE outcome IS NULL;\nCREATE INDEX work_live_claim ON claim (task_ref, lease_generation DESC, expires_at) WHERE released_at IS NULL;\nCREATE INDEX work_runner_claim ON claim (runner, expires_at) WHERE released_at IS NULL;\nCREATE INDEX work_completion ON action_ledger (task_id, action, source, run_id, id DESC);\nCREATE INDEX work_task_ledger ON action_ledger (task_id, id DESC);\nCREATE INDEX work_artifact_run ON artifact (run, created_at);\nCREATE INDEX work_open_decision ON decision (run, id DESC) WHERE state <> 'answered' AND answered_at IS NULL;\nCREATE INDEX run_task_outcome ON run (task_ref, outcome, id DESC);\nCREATE INDEX task_done_recent ON task (updated_at DESC, id DESC) WHERE state = 'done';\nCREATE INDEX run_started ON run (started_at, id);\nCREATE INDEX lead_status_task_run ON run (task_ref, id DESC);\nCREATE UNIQUE INDEX diff_comment_source ON diff_comment (source_key) WHERE source_key IS NOT NULL;\nCREATE UNIQUE INDEX one_open_decision_per_contestant\n  ON decision (contestant) WHERE contestant IS NOT NULL AND state IN ('open','expired');\nCREATE INDEX task_steer_pending\n  ON task_steer (task_ref, id) WHERE delivered_at IS NULL AND superseded_at IS NULL;\nCREATE UNIQUE INDEX one_open_authorization_per_task\n  ON attended_authorization (task_ref) WHERE closed_at IS NULL;\nCREATE UNIQUE INDEX one_live_merge_blocker\n  ON merge_blocker (publication) WHERE lifted_at IS NULL;\nCREATE UNIQUE INDEX session_turn_answer_once\n  ON session_turn (source_kind, source_id)\n  WHERE source_kind = 'answer' AND state NOT IN ('uncertain','cancelled');\nCREATE UNIQUE INDEX one_open_decision_per_run\n  ON decision (run) WHERE state IN ('open','expired');\nCREATE INDEX decision_undelivered\n  ON decision (run, id) WHERE state = 'answered' AND delivered_turn IS NULL;\nCREATE UNIQUE INDEX one_open_review_request\n  ON review_request (run) WHERE consumed_at IS NULL;\nCREATE UNIQUE INDEX root_review_attempt_ordinal\n  ON run (parent_run, review_attempt) WHERE role = 'reviewer' AND review_attempt IS NOT NULL;\nCREATE UNIQUE INDEX one_live_root_review_per_source\n  ON run (parent_run) WHERE role = 'reviewer' AND review_attempt IS NOT NULL AND outcome IS NULL;\nCREATE UNIQUE INDEX one_successful_root_review_per_source\n  ON run (parent_run) WHERE role = 'reviewer' AND review_attempt IS NOT NULL AND outcome = 'no-change';\nCREATE UNIQUE INDEX one_correction_per_reviewer\n  ON run (parent_run) WHERE role = 'reviewer' AND review_attempt IS NULL;\nCREATE UNIQUE INDEX one_root_review_per_request\n  ON review_request (reviewer_run) WHERE reviewer_run IS NOT NULL;\nCREATE UNIQUE INDEX fallback_transition_step\n  ON fallback_transition (cycle, from_index);\nCREATE UNIQUE INDEX one_live_fallback_cycle_per_task\n  ON fallback_cycle (task_ref) WHERE state NOT IN ('closed','incident');\nCREATE UNIQUE INDEX one_blocked_revision_per_task\n  ON plan_revision (task_ref) WHERE status = 'blocked';\nCREATE INDEX run_checkpoint_by_run ON run_checkpoint (run, id);\nCREATE INDEX run_checkpoint_by_task ON run_checkpoint (task_ref, id);\nINSERT INTO queue_state (id, revision) VALUES (1, 0);\nINSERT INTO permission_default (id, mode, updated_at, updated_by) VALUES (1, 'auto', NULL, NULL);\nINSERT INTO quality_default (id, mode, updated_at, updated_by) VALUES (1, 'default', NULL, NULL);\nINSERT INTO telegram_digest (id, every_ms, set_by, set_at, last_sent_at) VALUES (1, NULL, NULL, NULL, NULL);\nINSERT INTO wake (id, seq) VALUES (1, 0);\n";