Add runtime SQLite query targets

protocol/job.md

@@ -76,7 +76,7 @@ The executor resolves lifecycle action templates under the scoped server workspa
 - Remote database and RCON jobs must use scoped input/artifact refs rather than embedding query or command bodies in job results.
 - Run self-update, dependency, and log backfill jobs must use declared capabilities, logical target keys, scoped refs, and bounded result refs.
 - Job payloads must not include logs, artifact chunks, raw host paths, raw credentials, direct sockets, or large inline result bodies.
-- Process stdout/stderr must be redacted and sent through the asynchronous live
+- Process stdout/stderr must be relayed verbatim through the asynchronous live
   relay rather than embedded in progress/result bodies. Relay failure or drop
   must not block job execution or create a local log backlog.
 - Job ack/progress/result/cancel/reconcile calls are lightweight lifecycle metadata and must be able to complete while artifact/file transfer work is active or retrying.

protocol/log-ingest.md

@@ -16,8 +16,8 @@ channel. Game plugins own durable log storage and analysis.
 
 ## Payloads
 
-- `LogBatchIngestRequest`: run ID, session token, server instance ID, stream ID, source, sequence range, compression metadata, checksum, and bounded entries.
-- `LogEntry`: sequence, timestamp, level, line, parser metadata, and redaction state.
+- `LogBatchIngestRequest`: run ID, session token, server instance ID, stream ID, source, sequence range, compression metadata, checksum, and opaque entries.
+- `LogEntry`: sequence, timestamp, level, opaque line, and parser metadata.
 - `LogBatchIngestResponse`: accepted sequence range, latest stream metadata sequence, compatibility duplicate/retry fields, and server time.
 - `LogStreamCursorRequest`: stream ID, sequence cursor, and limit.
 - `LogStreamCursorResponse`: compatibility ordered entries, next cursor, and latest stored metadata sequence.
@@ -35,9 +35,10 @@ progress. A full in-memory relay queue or a failed relay request drops the
 current event and never blocks, retries, or changes lifecycle state. Run does
 not create a log spool, resend backlog, or platform delivery watermark.
 
-Log relay payloads carry bounded redacted entries only and must not include
-artifact chunks, file bodies, host paths, raw credentials, or direct socket
-details.
+Log relay payloads preserve supervised stdout/stderr and plugin-declared file
+tail text verbatim. Run does not inspect, filter, redact, or content-truncate
+those payloads; the channel still must not carry artifact chunks or direct
+socket APIs.
 
 ## Browser Channel
 

protocol/protected-request.md

@@ -32,7 +32,7 @@ safe result `protected_request_unknown`; other transport failures use bounded
 diagnostics without forwarding handler errors or response bodies. These errors
 affect only the current request.
 
-Management-program stdout and stderr are bounded, redacted, and sent to the
-live log relay with source `management-program` and streams
+Management-program stdout and stderr are sent verbatim to the live log relay
+with source `management-program` and streams
 `management-program.stdout` / `management-program.stderr`. They are not file
 execution logs and are never embedded in job result content.