feat(store): TREE subscriptions and delivery over derived participants (RIG-4189)

[rigel-mintaka]

This PR is part of a stack containing 5 PRs:

1. main
2. feat(store): attach channels to agents with tree or explicit membership (RIG-4186) #1762
3. feat(store): authorize channel writes and reads by tree participation (RIG-4187) #1764
4. feat(store): owner-set visibility and derived TREE members on channel reads (RIG-4188) #1772
5. "feat(store): TREE subscriptions and delivery over derived participants (RIG-4189)" (this PR)
6. feat(comms): wire ReparentChannel and attached CreateChannel (RIG-4190) #1779

Summary

Channels-in-the-agent-tree, task T5 (docs/designs/ui/compass-channels-in-agent-tree/design.md § Plan): subscriptions and delivery for TREE channels. Stacked on #1772.

• Membership writes: on a TREE channel, UpdateChannelMembers returns ErrInvalidArgument for add or remove. A subscribe or explicit unsubscribe of a derived participant upserts its channel_subscriptions override (new UpsertChannelSubscription); subscribe seeds the D2 cursor in the same tx. A toggle for an account outside the derived set is ErrNotFound.
• Delivery driving relation: the five delivery membership queries read from a participants CTE: stored member rows UNION ALL the TREE-derived set, with COALESCE(cs.subscribed, FALSE).
  • Channel-keyed sites walk the anchor's subtree: SubscribedAgents, ChannelAgentMembers (@mentions and @agents).
  • Account-keyed sites walk the agent's chain to the root: SweepChannels, UndeliveredMessages, InSweepSet.
  • The membership_mode = 1 guard keeps EXPLICIT channels out of the recursions, and the stored arm skips TREE channels, so the arms never overlap. Recursions use UNION, so parent cycles terminate.
• Policy: SetChannelPolicy refuses a mandatory flip and OWNER_ONLY on TREE.

Tests

• TestChannelTreeSubscriptionDrivesEveryDeliverySite: an untoggled participant is in none of the four delivery gates; after subscribe it is in all four (SubscribedAgents, SweepChannels, UndeliveredMessages, InSweepSet); its override does not reach the mid agent; unsubscribe removes it again.
• TestChannelTreeReparentOutMakesOverrideInert: after a reparent out, the override row remains but the agent is in no delivery site and not in ChannelAgentMembers.
• TestChannelTreeAgentMembersAreTheSubtree: ChannelAgentMembers is exactly the subtree minus the author.
• TestChannelTreeMembershipWritesRefused: add, remove, mandatory and OWNER_ONLY return ErrInvalidArgument (OWNER_ONLY checks that the TREE guard fired, not the owner-is-member check); an outsider subscribe returns ErrNotFound.
• TestTreeChannelMentionsRouteToDerivedAgents (delivery): through the consumer's recovery scan, @leaf and @agents posted by the anchor reach leaf and mid as owed mentions; the author and an agent outside the subtree get none.
• Mutations, each failing a test above: descent removed from ChannelAgentMembers; COALESCE default TRUE; InSweepSet TREE arm removed.
• Store, comms and delivery pgtest suites: ok. vet, sqlc-drift, the migration gate and lint: clean.

Open decision: RIG-4678 (whether TREE re-entry replays messages from the agent's absence; today it does, the same as EXPLICIT remove/re-add).

Spec-impact: none
Ledger-impact: none

Refs RIG-4189, RIG-1622

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-4189

RIG-1622

[github-actions]

Compass engineering docs preview: https://compass-comms-rig-4189-tree.compass-eng-docs.pages.dev

Deployed from compass-comms/rig-4189-tree-delivery at 5b7fa1e.

[trunk-io]

This pull request is queued for merge as part of 1779, which will merge 1762, 1764, 1772, 1778, 1779.

[trunk-io]

Stacked PR 1779 failed testing in the merge queue. Please investigate the failure and re-submit the stack.

[rigel-mintaka]

Review at head 5b7fa1e0: high 0, medium 0, low 0, nit 1

Scope: the rebase delta from the last reviewed head fcc49bc0 to 5b7fa1e0, onto main ec7a10ad. The rest of this PR's diff was reviewed earlier and is unchanged.

• Changes beyond a clean rebase: go/internal/delivery/pre_settle_closure_pgtest_test.go: removed main's //nolint:unparam on waitOwed. This PR's tree_mention test passes want=2, so the directive was unused and failed nolintlint.
• Schema: only in 0001_init.sql; no numbered migration files.
• Checks: go vet -tags pgtest and sqlc diff clean at every bookmark in the stack. Tip lint is 0 issues, with and without the extra build tags. pgtests passed for store, comms, delivery and gatewaycred. CI rollup is green.
• low/nit: a comment in go/internal/store/channels_test.go:883 (TestSubscriberAccountIDsHomeChannelSeeding) still names scanChannels; that path now uses loadChannelMembers. Left for the next fix so this approved head is not restarted for a comment.