@agent-native/core 0.112.0 → 0.113.0

package/corpus/core/src/cli/multi-frontier-runs.ts

@@ -1,7 +1,12 @@
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
+import {
+  appendUniqueJsonLineAtomically,
+  withFileLockSync,
+  writeJsonFileAtomically,
+  writeTextFileAtomically,
+} from "./atomic-json-file.js";
 import { codeAgentStoreRoot } from "./code-agent-runs.js";
 
 export type MultiFrontierPhase =
@@ -76,6 +81,8 @@ export interface MultiFrontierRecovery {
 export interface MultiFrontierRunState {
   schemaVersion: 1;
   collaborationId: string;
+  /** Opaque local workspace handle; never a filesystem path. */
+  workspaceId?: string;
   phase: MultiFrontierPhase;
   participants: MultiFrontierParticipantState[];
   driver: MultiFrontierDriverLease | null;
@@ -84,15 +91,19 @@ export interface MultiFrontierRunState {
   round: number;
   proposalIds: string[];
   reviewIds: string[];
+  /** Opt-in policy; explicit GO remains the durable default. */
+  autoContinueAfterAgreement: boolean;
   recovery?: MultiFrontierRecovery;
 }
 
 export interface CreateMultiFrontierRunInput {
   collaborationId: string;
+  workspaceId?: string;
   phase?: MultiFrontierPhase;
   participants: MultiFrontierParticipantState[];
   approval?: MultiFrontierApproval;
   checkpointIds?: string[];
+  autoContinueAfterAgreement?: boolean;
 }
 
 export interface RecoverMultiFrontierRunInput {
@@ -114,6 +125,88 @@ export interface PersistedMultiFrontierParticipantEvent extends MultiFrontierPar
   status?: MultiFrontierParticipantStatus;
 }
 
+export type MultiFrontierArtifactKind = "proposal" | "review" | "checkpoint";
+
+export interface MultiFrontierArtifactTestSummary {
+  name: string;
+  status: "passed" | "failed" | "skipped";
+  summary?: string;
+}
+
+/** A bounded, redacted projection used only for Desktop orchestrator recovery. */
+export interface MultiFrontierOrchestrationArtifact {
+  id: string;
+  kind:
+    | "proposal"
+    | "cross_review"
+    | "revision"
+    | "synthesis"
+    | "checkpoint"
+    | "watchdog_review"
+    | "finding_disposition"
+    | "completion";
+  round: number;
+  participantId?: string;
+  text: string;
+  attribution: { participantIds: string[]; sourceArtifactIds: string[] };
+  supersedesArtifactId?: string;
+  metadata?: Record<string, unknown>;
+}
+
+/**
+ * A deliberately narrow coordination record. Full diffs, transcripts, and
+ * provider payloads stay in their owning runtime rather than this durable
+ * cross-provider index.
+ */
+export interface PersistedMultiFrontierArtifact {
+  schemaVersion: 1;
+  id: string;
+  collaborationId: string;
+  kind: MultiFrontierArtifactKind;
+  createdAt: string;
+  participantId?: string;
+  title: string;
+  summary: string;
+  supersedesArtifactId?: string;
+  contentHash?: string;
+  fileRefs?: string[];
+  testSummary?: MultiFrontierArtifactTestSummary[];
+  orchestration?: MultiFrontierOrchestrationArtifact;
+}
+
+export interface AppendMultiFrontierArtifactInput {
+  id: string;
+  collaborationId: string;
+  kind: MultiFrontierArtifactKind;
+  createdAt?: string;
+  participantId?: string;
+  title: string;
+  summary: string;
+  supersedesArtifactId?: string;
+  contentHash?: string;
+  fileRefs?: string[];
+  testSummary?: MultiFrontierArtifactTestSummary[];
+  orchestration?: MultiFrontierOrchestrationArtifact;
+}
+
+export interface MultiFrontierParticipantEventRetention {
+  schemaVersion: 1;
+  retainedEventCount: number;
+  retainedByteCount: number;
+  droppedEventCount: number;
+  droppedByteCount: number;
+  truncated: boolean;
+  replay: {
+    requiresSnapshot: boolean;
+    firstRetainedEventId?: string;
+  };
+}
+
+export interface MultiFrontierParticipantEventRetentionLimits {
+  maxEventCount: number;
+  maxBytes: number;
+}
+
 export interface AppendMultiFrontierParticipantEventInput extends MultiFrontierParticipantEvent {
   id: string;
   collaborationId: string;
@@ -126,6 +219,14 @@ export interface MultiFrontierStoredRun extends MultiFrontierRunState {
   updatedAt: string;
 }
 
+/**
+ * The desktop main-process coordinator is the sole caller of this transition
+ * boundary. Its callback receives a detached snapshot, never renderer input.
+ */
+export type MultiFrontierCoordinatorTransition = (
+  current: MultiFrontierStoredRun,
+) => MultiFrontierRunState | MultiFrontierStoredRun | null;
+
 export type AppendMultiFrontierParticipantEventResult =
   | {
       accepted: true;
@@ -144,12 +245,44 @@ export type AppendMultiFrontierParticipantEventResult =
       run: MultiFrontierStoredRun | null;
     };
 
+export type AppendMultiFrontierArtifactResult =
+  | {
+      accepted: true;
+      deduplicated: boolean;
+      artifact: PersistedMultiFrontierArtifact;
+      run: MultiFrontierStoredRun;
+    }
+  | {
+      accepted: false;
+      reason:
+        | "missing-run"
+        | "artifact-conflict"
+        | "missing-participant"
+        | "missing-superseded-artifact"
+        | "artifact-limit-reached";
+      run: MultiFrontierStoredRun | null;
+    };
+
 const TERMINAL_PHASES = new Set<MultiFrontierPhase>([
   "completed",
   "failed",
   "canceled",
 ]);
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,191}$/;
+const SAFE_CONTENT_HASH = /^[a-f0-9]{64}$/;
+const SAFE_FILE_REF = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/@+-]+$/;
+const MAX_ARTIFACT_TITLE_BYTES = 280;
+const MAX_ARTIFACT_SUMMARY_BYTES = 8 * 1024;
+const MAX_ARTIFACT_FILE_REFS = 40;
+const MAX_ARTIFACT_TEST_SUMMARIES = 40;
+const MAX_ARTIFACT_TEST_NAME_BYTES = 280;
+const MAX_ARTIFACT_TEST_SUMMARY_BYTES = 2 * 1024;
+export const MAX_MULTI_FRONTIER_ARTIFACTS_PER_RUN = 200;
+export const DEFAULT_MULTI_FRONTIER_PARTICIPANT_EVENT_RETENTION: MultiFrontierParticipantEventRetentionLimits =
+  {
+    maxEventCount: 2_000,
+    maxBytes: 1_000_000,
+  };
 
 /** All multi-frontier state stays alongside the existing local Code store. */
 export function multiFrontierRunsStoreRoot(): string {
@@ -164,10 +297,17 @@ export function multiFrontierParticipantEventsDir(): string {
   return path.join(multiFrontierRunsStoreRoot(), "events");
 }
 
+export function multiFrontierArtifactsDir(): string {
+  return path.join(multiFrontierRunsStoreRoot(), "artifacts");
+}
+
 export function createMultiFrontierRun(
   input: CreateMultiFrontierRunInput,
 ): MultiFrontierStoredRun {
   assertSafeId(input.collaborationId, "collaboration id");
+  if (input.workspaceId !== undefined) {
+    assertSafeId(input.workspaceId, "workspace id");
+  }
   assertParticipants(input.participants);
   if (getMultiFrontierRun(input.collaborationId)) {
     throw new Error(
@@ -178,6 +318,7 @@ export function createMultiFrontierRun(
   const state: MultiFrontierStoredRun = {
     schemaVersion: 1,
     collaborationId: input.collaborationId,
+    ...(input.workspaceId ? { workspaceId: input.workspaceId } : {}),
     phase: input.phase ?? "proposing",
     participants: input.participants.map((participant) => ({
       ...participant,
@@ -191,6 +332,7 @@ export function createMultiFrontierRun(
     round: 1,
     proposalIds: [],
     reviewIds: [],
+    autoContinueAfterAgreement: input.autoContinueAfterAgreement ?? false,
     createdAt: now,
     updatedAt: now,
   };
@@ -235,6 +377,7 @@ export function recoverMultiFrontierRun(
     phase: "paused",
     participants: state.participants.map((participant) => ({
       ...participant,
+      role: "watchdog",
       permission: "read_only",
       status: participant.status === "running" ? "waiting" : participant.status,
     })),
@@ -253,11 +396,86 @@ export function recoverStoredMultiFrontierRun(
   collaborationId: string,
   input: RecoverMultiFrontierRunInput,
 ): MultiFrontierStoredRun | null {
-  const current = getMultiFrontierRun(collaborationId);
-  if (!current) return null;
-  const recovered = recoverMultiFrontierRun(current, input);
-  if (recovered === current) return current;
-  return writeNextStoredRun(current, recovered, input.now);
+  return mutateStoredMultiFrontierRun(collaborationId, input.now, (current) => {
+    const recovered = recoverMultiFrontierRun(current, input);
+    return recovered === current ? current : recovered;
+  });
+}
+
+/**
+ * Applies one durable coordinator-owned state transition under the run lock.
+ * A state-shaped result retains proposal and review references by default;
+ * returning a full stored record is the explicit escape hatch for a
+ * coordinator operation that intentionally changes those references.
+ */
+export function transitionStoredMultiFrontierRun(
+  collaborationId: string,
+  updatedAt: string,
+  transition: MultiFrontierCoordinatorTransition,
+): MultiFrontierStoredRun | null {
+  assertSafeId(collaborationId, "collaboration id");
+  assertTimestamp(updatedAt, "transition time");
+  if (typeof transition !== "function") {
+    throw new Error("Invalid multi-frontier coordinator transition.");
+  }
+
+  return mutateStoredMultiFrontierRun(collaborationId, updatedAt, (current) => {
+    const candidate = transition(cloneStoredMultiFrontierRun(current));
+    if (candidate === null) return null;
+    if (isThenable(candidate)) {
+      throw new Error(
+        "Multi-frontier coordinator transitions must be synchronous.",
+      );
+    }
+    if (
+      !candidate ||
+      typeof candidate !== "object" ||
+      Array.isArray(candidate)
+    ) {
+      throw new Error("Invalid multi-frontier coordinator transition state.");
+    }
+
+    const isFullStoredRun = hasStoredRunTimestamps(candidate);
+    if (
+      !isFullStoredRun &&
+      (Object.hasOwn(candidate, "createdAt") ||
+        Object.hasOwn(candidate, "updatedAt"))
+    ) {
+      throw new Error("Invalid multi-frontier coordinator transition state.");
+    }
+    if (
+      candidate.schemaVersion !== current.schemaVersion ||
+      candidate.collaborationId !== current.collaborationId
+    ) {
+      throw new Error(
+        "Multi-frontier coordinator transitions cannot change run identity.",
+      );
+    }
+    if (isFullStoredRun) {
+      if (!isCompleteMultiFrontierStoredRun(candidate)) {
+        throw new Error("Invalid multi-frontier coordinator transition state.");
+      }
+      if (candidate.createdAt !== current.createdAt) {
+        throw new Error(
+          "Multi-frontier coordinator transitions cannot change creation time.",
+        );
+      }
+    }
+
+    const nextState: MultiFrontierRunState = {
+      ...candidate,
+      ...(isFullStoredRun
+        ? {}
+        : {
+            proposalIds: [...current.proposalIds],
+            reviewIds: [...current.reviewIds],
+          }),
+    };
+    if (!isCompleteMultiFrontierRunState(nextState)) {
+      throw new Error("Invalid multi-frontier coordinator transition state.");
+    }
+    return nextState;
+  });
 }
 
 /**
@@ -376,10 +594,9 @@ export function activateStoredMultiFrontierDriver(
   now = new Date().toISOString(),
 ): MultiFrontierStoredRun | null {
   assertTimestamp(now, "activation time");
-  const current = getMultiFrontierRun(collaborationId);
-  if (!current) return null;
-  const activated = activateMultiFrontierDriver(current, participantId);
-  return activated ? writeNextStoredRun(current, activated, now) : null;
+  return mutateStoredMultiFrontierRun(collaborationId, now, (current) =>
+    activateMultiFrontierDriver(current, participantId),
+  );
 }
 
 /** Persist an explicit driver reactivation after the human-approved resume. */
@@ -389,10 +606,9 @@ export function reactivateStoredMultiFrontierDriver(
   now = new Date().toISOString(),
 ): MultiFrontierStoredRun | null {
   assertTimestamp(now, "reactivation time");
-  const current = getMultiFrontierRun(collaborationId);
-  if (!current) return null;
-  const reactivated = reactivateMultiFrontierDriver(current, participantId);
-  return reactivated ? writeNextStoredRun(current, reactivated, now) : null;
+  return mutateStoredMultiFrontierRun(collaborationId, now, (current) =>
+    reactivateMultiFrontierDriver(current, participantId),
+  );
 }
 
 /**
@@ -409,67 +625,190 @@ export function appendMultiFrontierParticipantEvent(
   const createdAt = input.createdAt ?? new Date().toISOString();
   assertTimestamp(createdAt, "event time");
 
-  const current = getMultiFrontierRun(input.collaborationId);
-  if (!current) return { accepted: false, reason: "missing-run", run: null };
-  const existing = listMultiFrontierParticipantEvents(
-    input.collaborationId,
-  ).find((event) => event.id === input.id);
-  if (existing) {
-    if (!isMatchingParticipantEvent(existing, input)) {
-      return { accepted: false, reason: "event-conflict", run: current };
+  const runPath = multiFrontierRunPath(input.collaborationId);
+  return withFileLockSync(runPath, () => {
+    const current = readStoredRun(runPath);
+    if (!current) return { accepted: false, reason: "missing-run", run: null };
+    const existing = listMultiFrontierParticipantEvents(
+      input.collaborationId,
+    ).find((event) => event.id === input.id);
+    if (existing) {
+      if (!isMatchingParticipantEvent(existing, input)) {
+        return { accepted: false, reason: "event-conflict", run: current };
+      }
+      return {
+        accepted: true,
+        deduplicated: true,
+        event: existing,
+        run: current,
+      };
     }
-    return {
-      accepted: true,
-      deduplicated: true,
-      event: existing,
-      run: current,
-    };
-  }
-  if (
-    !current.participants.some(
+    if (
+      !current.participants.some(
+        (candidate) => candidate.participantId === input.participantId,
+      )
+    ) {
+      return { accepted: false, reason: "missing-participant", run: current };
+    }
+    if (!canApplyMultiFrontierParticipantEvent(current, input)) {
+      return { accepted: false, reason: "stale-driver", run: current };
+    }
+    const participant = current.participants.find(
       (candidate) => candidate.participantId === input.participantId,
-    )
-  ) {
-    return { accepted: false, reason: "missing-participant", run: current };
-  }
-  if (!canApplyMultiFrontierParticipantEvent(current, input)) {
-    return { accepted: false, reason: "stale-driver", run: current };
-  }
-  const participant = current.participants.find(
-    (candidate) => candidate.participantId === input.participantId,
-  );
-  if (
-    input.status !== undefined &&
-    (participant?.status === "completed" || participant?.status === "failed") &&
-    input.status !== participant.status
-  ) {
-    return { accepted: false, reason: "terminal-participant", run: current };
-  }
+    );
+    if (
+      input.status !== undefined &&
+      (participant?.status === "completed" ||
+        participant?.status === "failed") &&
+      input.status !== participant.status
+    ) {
+      return { accepted: false, reason: "terminal-participant", run: current };
+    }
 
-  const event: PersistedMultiFrontierParticipantEvent = {
-    schemaVersion: 1,
-    id: input.id,
-    collaborationId: input.collaborationId,
-    participantId: input.participantId,
-    permission: input.permission,
-    createdAt,
-    ...(input.generation === undefined ? {} : { generation: input.generation }),
-    ...(input.status === undefined ? {} : { status: input.status }),
-  };
-  appendParticipantEvent(event);
-  const participants = input.status
-    ? current.participants.map((candidate) =>
-        candidate.participantId === input.participantId
-          ? { ...candidate, status: input.status }
-          : candidate,
+    const event: PersistedMultiFrontierParticipantEvent = {
+      schemaVersion: 1,
+      id: input.id,
+      collaborationId: input.collaborationId,
+      participantId: input.participantId,
+      permission: input.permission,
+      createdAt,
+      ...(input.generation === undefined
+        ? {}
+        : { generation: input.generation }),
+      ...(input.status === undefined ? {} : { status: input.status }),
+    };
+    appendParticipantEvent(event);
+    compactParticipantEventJournal(input.collaborationId);
+    const status = input.status;
+    const participants = status
+      ? current.participants.map((candidate) =>
+          candidate.participantId === input.participantId
+            ? { ...candidate, status }
+            : candidate,
+        )
+      : current.participants;
+    const run = writeNextStoredRun(
+      current,
+      { ...current, participants },
+      createdAt,
+    );
+    return { accepted: true, deduplicated: false, event, run };
+  });
+}
+
+/**
+ * Appends a bounded proposal, review, or checkpoint index record. The
+ * coordinator owns both the artifact and its run-state reference under one
+ * run lock, so a reader never observes a durable reference without its record.
+ */
+export function appendMultiFrontierArtifact(
+  input: AppendMultiFrontierArtifactInput,
+): AppendMultiFrontierArtifactResult {
+  assertArtifactInput(input);
+  const createdAt = input.createdAt ?? new Date().toISOString();
+  assertTimestamp(createdAt, "artifact time");
+  const artifact = toPersistedArtifact(input, createdAt);
+  const runPath = multiFrontierRunPath(input.collaborationId);
+  return withFileLockSync(runPath, () => {
+    const current = readStoredRun(runPath);
+    if (!current) return { accepted: false, reason: "missing-run", run: null };
+    if (
+      input.participantId !== undefined &&
+      !current.participants.some(
+        (participant) => participant.participantId === input.participantId,
       )
-    : current.participants;
-  const run = writeNextStoredRun(
-    current,
-    { ...current, participants },
-    createdAt,
+    ) {
+      return { accepted: false, reason: "missing-participant", run: current };
+    }
+    if (
+      input.supersedesArtifactId !== undefined &&
+      !readStoredArtifact(
+        multiFrontierArtifactPath(
+          input.collaborationId,
+          input.supersedesArtifactId,
+        ),
+      )
+    ) {
+      return {
+        accepted: false,
+        reason: "missing-superseded-artifact",
+        run: current,
+      };
+    }
+
+    const artifactPath = multiFrontierArtifactPath(
+      input.collaborationId,
+      input.id,
+    );
+    const existing = readStoredArtifact(artifactPath);
+    if (existing) {
+      if (!isMatchingArtifact(existing, artifact)) {
+        return { accepted: false, reason: "artifact-conflict", run: current };
+      }
+      const ids = artifactIdsForKind(current, existing.kind);
+      const run = ids.includes(existing.id)
+        ? current
+        : writeNextStoredRun(
+            current,
+            withArtifactId(current, existing.kind, existing.id),
+            new Date().toISOString(),
+          );
+      return {
+        accepted: true,
+        deduplicated: true,
+        artifact: existing,
+        run,
+      };
+    }
+    if (fs.existsSync(artifactPath)) {
+      return { accepted: false, reason: "artifact-conflict", run: current };
+    }
+    if (
+      listMultiFrontierArtifacts(input.collaborationId).length >=
+      MAX_MULTI_FRONTIER_ARTIFACTS_PER_RUN
+    ) {
+      return {
+        accepted: false,
+        reason: "artifact-limit-reached",
+        run: current,
+      };
+    }
+
+    writeJsonFileAtomically(artifactPath, artifact, { mode: 0o600 });
+    const ids = artifactIdsForKind(current, artifact.kind);
+    const next = ids.includes(artifact.id)
+      ? current
+      : withArtifactId(current, artifact.kind, artifact.id);
+    const run = writeNextStoredRun(current, next, createdAt);
+    return { accepted: true, deduplicated: false, artifact, run };
+  });
+}
+
+export function getMultiFrontierArtifact(
+  collaborationId: string,
+  artifactId: string,
+): PersistedMultiFrontierArtifact | null {
+  if (!SAFE_ID.test(collaborationId) || !SAFE_ID.test(artifactId)) return null;
+  return readStoredArtifact(
+    multiFrontierArtifactPath(collaborationId, artifactId),
   );
-  return { accepted: true, deduplicated: false, event, run };
+}
+
+export function listMultiFrontierArtifacts(
+  collaborationId: string,
+): PersistedMultiFrontierArtifact[] {
+  if (!SAFE_ID.test(collaborationId)) return [];
+  const directory = multiFrontierArtifactsRunDir(collaborationId);
+  if (!fs.existsSync(directory)) return [];
+  return fs
+    .readdirSync(directory)
+    .filter((file) => file.endsWith(".json"))
+    .map((file) => readStoredArtifact(path.join(directory, file)))
+    .filter(
+      (artifact): artifact is PersistedMultiFrontierArtifact =>
+        artifact !== null,
+    )
+    .sort((left, right) => left.createdAt.localeCompare(right.createdAt));
 }
 
 export function listMultiFrontierParticipantEvents(
@@ -489,30 +828,46 @@ export function listMultiFrontierParticipantEvents(
     );
 }
 
-function writeMultiFrontierRun(run: MultiFrontierStoredRun): void {
-  fs.mkdirSync(multiFrontierRunsDir(), { recursive: true });
-  writeFileAtomically(
-    multiFrontierRunPath(run.collaborationId),
-    `${JSON.stringify(run, null, 2)}\n`,
+export function getMultiFrontierParticipantEventRetention(
+  collaborationId: string,
+): MultiFrontierParticipantEventRetention | null {
+  if (!SAFE_ID.test(collaborationId)) return null;
+  return readParticipantEventRetention(
+    multiFrontierParticipantEventRetentionPath(collaborationId),
   );
 }
 
+/**
+ * Coordinator maintenance for a bounded event journal. It deliberately keeps
+ * the newest contiguous tail and a replay marker instead of deleting run state.
+ */
+export function compactMultiFrontierParticipantEvents(
+  collaborationId: string,
+  limits = DEFAULT_MULTI_FRONTIER_PARTICIPANT_EVENT_RETENTION,
+): MultiFrontierParticipantEventRetention | null {
+  assertSafeId(collaborationId, "collaboration id");
+  assertRetentionLimits(limits);
+  const runPath = multiFrontierRunPath(collaborationId);
+  return withFileLockSync(runPath, () => {
+    if (!readStoredRun(runPath)) return null;
+    return compactParticipantEventJournal(collaborationId, limits);
+  });
+}
+
+function writeMultiFrontierRun(run: MultiFrontierStoredRun): void {
+  writeJsonFileAtomically(multiFrontierRunPath(run.collaborationId), run);
+}
+
 function writeNewMultiFrontierRun(run: MultiFrontierStoredRun): void {
-  fs.mkdirSync(multiFrontierRunsDir(), { recursive: true });
-  try {
-    fs.writeFileSync(
-      multiFrontierRunPath(run.collaborationId),
-      `${JSON.stringify(run, null, 2)}\n`,
-      { encoding: "utf-8", flag: "wx" },
-    );
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "EEXIST") {
+  const filePath = multiFrontierRunPath(run.collaborationId);
+  withFileLockSync(filePath, () => {
+    if (fs.existsSync(filePath)) {
       throw new Error(
         `Multi-frontier run already exists: ${run.collaborationId}`,
       );
     }
-    throw error;
-  }
+    writeJsonFileAtomically(filePath, run);
+  });
 }
 
 function writeNextStoredRun(
@@ -532,13 +887,90 @@ function writeNextStoredRun(
 function appendParticipantEvent(
   event: PersistedMultiFrontierParticipantEvent,
 ): void {
-  fs.mkdirSync(multiFrontierParticipantEventsDir(), { recursive: true });
-  fs.appendFileSync(
+  appendUniqueJsonLineAtomically(
     multiFrontierParticipantEventsPath(event.collaborationId),
-    `${JSON.stringify(event)}\n`,
+    event,
+    readParticipantEventValue,
+    { mode: 0o600 },
   );
 }
 
+function compactParticipantEventJournal(
+  collaborationId: string,
+  limits = DEFAULT_MULTI_FRONTIER_PARTICIPANT_EVENT_RETENTION,
+): MultiFrontierParticipantEventRetention {
+  const eventPath = multiFrontierParticipantEventsPath(collaborationId);
+  return withFileLockSync(eventPath, () => {
+    const previous = readParticipantEventRetention(
+      multiFrontierParticipantEventRetentionPath(collaborationId),
+    );
+    const events = listMultiFrontierParticipantEvents(collaborationId);
+    const retained: PersistedMultiFrontierParticipantEvent[] = [];
+    let retainedByteCount = 0;
+    for (const event of [...events].reverse()) {
+      const bytes = eventLineByteLength(event);
+      if (
+        retained.length >= limits.maxEventCount ||
+        retainedByteCount + bytes > limits.maxBytes
+      ) {
+        break;
+      }
+      retained.push(event);
+      retainedByteCount += bytes;
+    }
+    retained.reverse();
+    const retainedIds = new Set(retained.map((event) => event.id));
+    const dropped = events.filter((event) => !retainedIds.has(event.id));
+    if (dropped.length > 0) {
+      writeTextFileAtomically(
+        eventPath,
+        retained.map((event) => `${JSON.stringify(event)}\n`).join(""),
+      );
+    }
+    const retention: MultiFrontierParticipantEventRetention = {
+      schemaVersion: 1,
+      retainedEventCount: retained.length,
+      retainedByteCount,
+      droppedEventCount: (previous?.droppedEventCount ?? 0) + dropped.length,
+      droppedByteCount:
+        (previous?.droppedByteCount ?? 0) +
+        dropped.reduce((total, event) => total + eventLineByteLength(event), 0),
+      truncated: (previous?.truncated ?? false) || dropped.length > 0,
+      replay: {
+        requiresSnapshot: (previous?.truncated ?? false) || dropped.length > 0,
+        ...(retained[0] ? { firstRetainedEventId: retained[0].id } : {}),
+      },
+    };
+    writeJsonFileAtomically(
+      multiFrontierParticipantEventRetentionPath(collaborationId),
+      retention,
+      { mode: 0o600 },
+    );
+    return retention;
+  });
+}
+
+function mutateStoredMultiFrontierRun(
+  collaborationId: string,
+  updatedAt: string,
+  mutate: (current: MultiFrontierStoredRun) => MultiFrontierRunState | null,
+): MultiFrontierStoredRun | null {
+  const filePath = multiFrontierRunPath(collaborationId);
+  return withFileLockSync(filePath, () => {
+    const current = readStoredRun(filePath);
+    if (!current) return null;
+    const nextState = mutate(current);
+    if (!nextState) return null;
+    const next: MultiFrontierStoredRun = {
+      ...nextState,
+      createdAt: current.createdAt,
+      updatedAt,
+    };
+    writeMultiFrontierRun(next);
+    return next;
+  });
+}
+
 function multiFrontierRunPath(collaborationId: string): string {
   return path.join(multiFrontierRunsDir(), `${collaborationId}.json`);
 }
@@ -550,46 +982,122 @@ function multiFrontierParticipantEventsPath(collaborationId: string): string {
   );
 }
 
+function multiFrontierParticipantEventRetentionPath(
+  collaborationId: string,
+): string {
+  return path.join(
+    multiFrontierParticipantEventsDir(),
+    `${collaborationId}.retention.json`,
+  );
+}
+
+function multiFrontierArtifactsRunDir(collaborationId: string): string {
+  return path.join(multiFrontierArtifactsDir(), collaborationId);
+}
+
+function multiFrontierArtifactPath(
+  collaborationId: string,
+  artifactId: string,
+): string {
+  return path.join(
+    multiFrontierArtifactsRunDir(collaborationId),
+    `${artifactId}.json`,
+  );
+}
+
 function readStoredRun(filePath: string): MultiFrontierStoredRun | null {
   try {
     const raw = JSON.parse(fs.readFileSync(filePath, "utf-8")) as unknown;
-    if (!raw || typeof raw !== "object") return null;
-    const run = raw as Partial<MultiFrontierStoredRun>;
-    if (
-      run.schemaVersion !== 1 ||
-      typeof run.collaborationId !== "string" ||
-      !SAFE_ID.test(run.collaborationId) ||
-      !isPhase(run.phase) ||
-      !isStoredRunParticipantsAndDriverValid(run.participants, run.driver) ||
-      !isApproval(run.approval) ||
-      !Array.isArray(run.checkpointIds) ||
-      !run.checkpointIds.every(
-        (checkpointId) => typeof checkpointId === "string",
-      ) ||
-      typeof run.round !== "number" ||
-      !Number.isInteger(run.round) ||
-      run.round < 1 ||
-      !isStringArray(run.proposalIds) ||
-      !isStringArray(run.reviewIds) ||
-      (run.recovery !== undefined && !isRecovery(run.recovery)) ||
-      typeof run.createdAt !== "string" ||
-      Number.isNaN(Date.parse(run.createdAt)) ||
-      typeof run.updatedAt !== "string" ||
-      Number.isNaN(Date.parse(run.updatedAt))
-    ) {
-      return null;
-    }
-    return run as MultiFrontierStoredRun;
+    const normalized = normalizeStoredRunDefaults(raw);
+    return isCompleteMultiFrontierStoredRun(normalized) ? normalized : null;
   } catch {
     return null;
   }
 }
 
+function isCompleteMultiFrontierStoredRun(
+  value: unknown,
+): value is MultiFrontierStoredRun {
+  if (!hasStoredRunTimestamps(value)) return false;
+  return (
+    isCompleteMultiFrontierRunState(value) &&
+    !Number.isNaN(Date.parse(value.createdAt)) &&
+    !Number.isNaN(Date.parse(value.updatedAt))
+  );
+}
+
+function isCompleteMultiFrontierRunState(
+  value: unknown,
+): value is MultiFrontierRunState {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const run = value as Partial<MultiFrontierRunState>;
+  return (
+    run.schemaVersion === 1 &&
+    typeof run.collaborationId === "string" &&
+    SAFE_ID.test(run.collaborationId) &&
+    (run.workspaceId === undefined ||
+      (typeof run.workspaceId === "string" && SAFE_ID.test(run.workspaceId))) &&
+    isPhase(run.phase) &&
+    isStoredRunParticipantsAndDriverValid(run.participants, run.driver) &&
+    isApproval(run.approval) &&
+    Array.isArray(run.checkpointIds) &&
+    run.checkpointIds.every(
+      (checkpointId) => typeof checkpointId === "string",
+    ) &&
+    typeof run.round === "number" &&
+    Number.isInteger(run.round) &&
+    run.round >= 1 &&
+    isStringArray(run.proposalIds) &&
+    isStringArray(run.reviewIds) &&
+    typeof run.autoContinueAfterAgreement === "boolean" &&
+    (run.recovery === undefined || isRecovery(run.recovery))
+  );
+}
+
+function normalizeStoredRunDefaults(value: unknown): unknown {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  if (!Object.hasOwn(value, "autoContinueAfterAgreement")) {
+    return { ...value, autoContinueAfterAgreement: false };
+  }
+  return value;
+}
+
+function hasStoredRunTimestamps(
+  value: unknown,
+): value is MultiFrontierStoredRun {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const run = value as Partial<MultiFrontierStoredRun>;
+  return typeof run.createdAt === "string" && typeof run.updatedAt === "string";
+}
+
+function cloneStoredMultiFrontierRun(
+  run: MultiFrontierStoredRun,
+): MultiFrontierStoredRun {
+  return JSON.parse(JSON.stringify(run)) as MultiFrontierStoredRun;
+}
+
+function isThenable(value: unknown): value is PromiseLike<unknown> {
+  return (
+    Boolean(value) &&
+    (typeof value === "object" || typeof value === "function") &&
+    typeof (value as { then?: unknown }).then === "function"
+  );
+}
+
 function readParticipantEvent(
   line: string,
 ): PersistedMultiFrontierParticipantEvent | null {
   try {
-    const raw = JSON.parse(line) as unknown;
+    return readParticipantEventValue(JSON.parse(line) as unknown);
+  } catch {
+    return null;
+  }
+}
+
+function readParticipantEventValue(
+  raw: unknown,
+): PersistedMultiFrontierParticipantEvent | null {
+  try {
     if (!raw || typeof raw !== "object") return null;
     const event = raw as Partial<PersistedMultiFrontierParticipantEvent>;
     if (
@@ -612,6 +1120,627 @@ function readParticipantEvent(
   }
 }
 
+function readStoredArtifact(
+  filePath: string,
+): PersistedMultiFrontierArtifact | null {
+  try {
+    return readArtifactValue(
+      JSON.parse(fs.readFileSync(filePath, "utf-8")) as unknown,
+    );
+  } catch {
+    return null;
+  }
+}
+
+function readArtifactValue(
+  raw: unknown,
+): PersistedMultiFrontierArtifact | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const artifact = raw as Partial<PersistedMultiFrontierArtifact>;
+  if (
+    artifact.schemaVersion !== 1 ||
+    !isSafeId(artifact.id) ||
+    !isSafeId(artifact.collaborationId) ||
+    !isArtifactKind(artifact.kind) ||
+    typeof artifact.createdAt !== "string" ||
+    Number.isNaN(Date.parse(artifact.createdAt)) ||
+    (artifact.participantId !== undefined &&
+      !isSafeId(artifact.participantId)) ||
+    !isBoundedText(artifact.title, MAX_ARTIFACT_TITLE_BYTES) ||
+    !isArtifactSummary(artifact.summary) ||
+    (artifact.supersedesArtifactId !== undefined &&
+      !isSafeId(artifact.supersedesArtifactId)) ||
+    (artifact.contentHash !== undefined &&
+      !SAFE_CONTENT_HASH.test(artifact.contentHash)) ||
+    !isArtifactFileRefs(artifact.fileRefs) ||
+    !isArtifactTestSummaries(artifact.testSummary) ||
+    !isOrchestrationArtifact(artifact.orchestration)
+  ) {
+    return null;
+  }
+  return artifact as PersistedMultiFrontierArtifact;
+}
+
+function readParticipantEventRetention(
+  filePath: string,
+): MultiFrontierParticipantEventRetention | null {
+  try {
+    const raw = JSON.parse(fs.readFileSync(filePath, "utf-8")) as unknown;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const retention = raw as Partial<MultiFrontierParticipantEventRetention>;
+    if (
+      retention.schemaVersion !== 1 ||
+      !isNonNegativeInteger(retention.retainedEventCount) ||
+      !isNonNegativeInteger(retention.retainedByteCount) ||
+      !isNonNegativeInteger(retention.droppedEventCount) ||
+      !isNonNegativeInteger(retention.droppedByteCount) ||
+      typeof retention.truncated !== "boolean" ||
+      !retention.replay ||
+      typeof retention.replay !== "object" ||
+      typeof retention.replay.requiresSnapshot !== "boolean" ||
+      (retention.replay.firstRetainedEventId !== undefined &&
+        !isSafeId(retention.replay.firstRetainedEventId))
+    ) {
+      return null;
+    }
+    return retention as MultiFrontierParticipantEventRetention;
+  } catch {
+    return null;
+  }
+}
+
+function assertArtifactInput(input: AppendMultiFrontierArtifactInput): void {
+  assertAllowlistedArtifactInput(input);
+  assertSafeId(input.id, "artifact id");
+  assertSafeId(input.collaborationId, "collaboration id");
+  if (!isArtifactKind(input.kind))
+    throw new Error("Invalid multi-frontier artifact kind.");
+  if (input.participantId !== undefined) {
+    assertSafeId(input.participantId, "participant id");
+  }
+  assertBoundedText(input.title, MAX_ARTIFACT_TITLE_BYTES, "artifact title");
+  if (!isArtifactSummary(input.summary)) {
+    throw new Error("Invalid multi-frontier artifact summary.");
+  }
+  if (input.supersedesArtifactId !== undefined) {
+    assertSafeId(input.supersedesArtifactId, "superseded artifact id");
+  }
+  if (
+    input.contentHash !== undefined &&
+    !SAFE_CONTENT_HASH.test(input.contentHash)
+  ) {
+    throw new Error("Invalid multi-frontier artifact content hash.");
+  }
+  if (!isArtifactFileRefs(input.fileRefs)) {
+    throw new Error("Invalid multi-frontier artifact file references.");
+  }
+  if (!isArtifactTestSummaries(input.testSummary)) {
+    throw new Error("Invalid multi-frontier artifact test summary.");
+  }
+  if (!isOrchestrationArtifact(input.orchestration)) {
+    throw new Error("Invalid multi-frontier orchestration artifact.");
+  }
+}
+
+function assertAllowlistedArtifactInput(
+  input: AppendMultiFrontierArtifactInput,
+): void {
+  const allowed = new Set([
+    "id",
+    "collaborationId",
+    "kind",
+    "createdAt",
+    "participantId",
+    "title",
+    "summary",
+    "supersedesArtifactId",
+    "contentHash",
+    "fileRefs",
+    "testSummary",
+    "orchestration",
+  ]);
+  if (
+    !input ||
+    typeof input !== "object" ||
+    Array.isArray(input) ||
+    Object.keys(input).some((key) => !allowed.has(key))
+  ) {
+    throw new Error(
+      "Multi-frontier artifacts only accept allowlisted summary fields.",
+    );
+  }
+}
+
+function toPersistedArtifact(
+  input: AppendMultiFrontierArtifactInput,
+  createdAt: string,
+): PersistedMultiFrontierArtifact {
+  return {
+    schemaVersion: 1,
+    id: input.id,
+    collaborationId: input.collaborationId,
+    kind: input.kind,
+    createdAt,
+    title: input.title,
+    summary: input.summary,
+    ...(input.participantId === undefined
+      ? {}
+      : { participantId: input.participantId }),
+    ...(input.supersedesArtifactId === undefined
+      ? {}
+      : { supersedesArtifactId: input.supersedesArtifactId }),
+    ...(input.contentHash === undefined
+      ? {}
+      : { contentHash: input.contentHash }),
+    ...(input.fileRefs === undefined ? {} : { fileRefs: [...input.fileRefs] }),
+    ...(input.testSummary === undefined
+      ? {}
+      : {
+          testSummary: input.testSummary.map((summary) => ({ ...summary })),
+        }),
+    ...(input.orchestration === undefined
+      ? {}
+      : { orchestration: cloneOrchestrationArtifact(input.orchestration) }),
+  };
+}
+
+function artifactIdsForKind(
+  run: MultiFrontierStoredRun,
+  kind: MultiFrontierArtifactKind,
+): string[] {
+  if (kind === "proposal") return run.proposalIds;
+  if (kind === "review") return run.reviewIds;
+  return run.checkpointIds;
+}
+
+function withArtifactId(
+  run: MultiFrontierStoredRun,
+  kind: MultiFrontierArtifactKind,
+  artifactId: string,
+): MultiFrontierStoredRun {
+  if (kind === "proposal") {
+    return { ...run, proposalIds: [...run.proposalIds, artifactId] };
+  }
+  if (kind === "review") {
+    return { ...run, reviewIds: [...run.reviewIds, artifactId] };
+  }
+  return { ...run, checkpointIds: [...run.checkpointIds, artifactId] };
+}
+
+function isMatchingArtifact(
+  existing: PersistedMultiFrontierArtifact,
+  candidate: PersistedMultiFrontierArtifact,
+): boolean {
+  return JSON.stringify(existing) === JSON.stringify(candidate);
+}
+
+function isArtifactKind(value: unknown): value is MultiFrontierArtifactKind {
+  return value === "proposal" || value === "review" || value === "checkpoint";
+}
+
+function isArtifactSummary(value: unknown): value is string {
+  return (
+    isBoundedText(value, MAX_ARTIFACT_SUMMARY_BYTES) &&
+    !/(?:^|\n)diff --git\s|(?:^|\n)@@\s+-\d+/m.test(value)
+  );
+}
+
+function isArtifactFileRefs(value: unknown): value is string[] | undefined {
+  return (
+    value === undefined ||
+    (Array.isArray(value) &&
+      value.length <= MAX_ARTIFACT_FILE_REFS &&
+      value.every(
+        (fileRef) =>
+          typeof fileRef === "string" &&
+          Buffer.byteLength(fileRef, "utf-8") <= 512 &&
+          SAFE_FILE_REF.test(fileRef),
+      ))
+  );
+}
+
+function isArtifactTestSummaries(
+  value: unknown,
+): value is MultiFrontierArtifactTestSummary[] | undefined {
+  return (
+    value === undefined ||
+    (Array.isArray(value) &&
+      value.length <= MAX_ARTIFACT_TEST_SUMMARIES &&
+      value.every(
+        (summary) =>
+          Boolean(summary) &&
+          typeof summary === "object" &&
+          isBoundedText(
+            (summary as MultiFrontierArtifactTestSummary).name,
+            MAX_ARTIFACT_TEST_NAME_BYTES,
+          ) &&
+          ["passed", "failed", "skipped"].includes(
+            (summary as MultiFrontierArtifactTestSummary).status,
+          ) &&
+          ((summary as MultiFrontierArtifactTestSummary).summary ===
+            undefined ||
+            isBoundedText(
+              (summary as MultiFrontierArtifactTestSummary).summary,
+              MAX_ARTIFACT_TEST_SUMMARY_BYTES,
+            )),
+      ))
+  );
+}
+
+function isOrchestrationArtifact(
+  value: unknown,
+): value is MultiFrontierOrchestrationArtifact | undefined {
+  if (value === undefined) return true;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const artifact = value as Partial<MultiFrontierOrchestrationArtifact>;
+  return (
+    hasExactKeys(artifact, [
+      "id",
+      "kind",
+      "round",
+      "participantId",
+      "text",
+      "attribution",
+      "supersedesArtifactId",
+      "metadata",
+    ]) &&
+    isSafeId(artifact.id) &&
+    [
+      "proposal",
+      "cross_review",
+      "revision",
+      "synthesis",
+      "checkpoint",
+      "watchdog_review",
+      "finding_disposition",
+      "completion",
+    ].includes(artifact.kind ?? "") &&
+    Number.isSafeInteger(artifact.round) &&
+    artifact.round! >= 1 &&
+    artifact.round! <= 3 &&
+    (artifact.participantId === undefined ||
+      isSafeId(artifact.participantId)) &&
+    isSafeOrchestrationText(artifact.text) &&
+    isOrchestrationAttribution(artifact.attribution) &&
+    (artifact.supersedesArtifactId === undefined ||
+      isSafeId(artifact.supersedesArtifactId)) &&
+    isSafeOrchestrationMetadata(artifact.kind!, artifact.metadata)
+  );
+}
+
+function hasExactKeys(value: object, allowed: readonly string[]): boolean {
+  return Object.keys(value).every((key) => allowed.includes(key));
+}
+
+function isOrchestrationAttribution(
+  value: unknown,
+): value is MultiFrontierOrchestrationArtifact["attribution"] {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const attribution = value as Partial<
+    MultiFrontierOrchestrationArtifact["attribution"]
+  >;
+  return (
+    hasExactKeys(attribution as Record<string, unknown>, [
+      "participantIds",
+      "sourceArtifactIds",
+    ]) &&
+    isSafeIdArray(attribution.participantIds, 2) &&
+    isSafeIdArray(
+      attribution.sourceArtifactIds,
+      MAX_MULTI_FRONTIER_ARTIFACTS_PER_RUN,
+    )
+  );
+}
+
+function isSafeIdArray(value: unknown, max: number): value is string[] {
+  return (
+    Array.isArray(value) &&
+    value.length <= max &&
+    value.every((item) => isSafeId(item))
+  );
+}
+
+function isSafeOrchestrationText(value: unknown): value is string {
+  return (
+    isArtifactSummary(value) &&
+    !/(?:bearer\s+|api[_-]?key\s*[:=]|authorization\s*[:=]|(?:sk|rk|pk)[_-][A-Za-z0-9_-]{12,}|(?:access|refresh)[_-]?token\s*[:=])/i.test(
+      value,
+    )
+  );
+}
+
+function isSafeOrchestrationMetadata(
+  kind: NonNullable<MultiFrontierOrchestrationArtifact["kind"]>,
+  value: unknown,
+): value is Record<string, unknown> | undefined {
+  const allowedKeys = metadataKeysForOrchestrationKind(kind);
+  if (allowedKeys.length === 0) return value === undefined;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entries = Object.entries(value);
+  if (
+    entries.length === 0 ||
+    entries.some(([key]) => !allowedKeys.includes(key)) ||
+    entries.some(([key]) =>
+      /(token|secret|authorization|credential|password|email|organization|account)/i.test(
+        key,
+      ),
+    )
+  ) {
+    return false;
+  }
+  try {
+    return (
+      isArtifactSummary(JSON.stringify(value)) &&
+      isValidOrchestrationMetadata(kind, value as Record<string, unknown>)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function isValidOrchestrationMetadata(
+  kind: NonNullable<MultiFrontierOrchestrationArtifact["kind"]>,
+  metadata: Record<string, unknown>,
+): boolean {
+  if (kind === "synthesis") {
+    return (
+      typeof metadata.agreed === "boolean" &&
+      typeof metadata.deterministicallyResolved === "boolean" &&
+      (metadata.reversibleResolution === undefined ||
+        isReversibleResolution(metadata.reversibleResolution))
+    );
+  }
+  if (kind === "checkpoint") return isCheckpointBundle(metadata.bundle);
+  if (kind === "cross_review" || kind === "watchdog_review") {
+    return isFindingList(metadata.findings);
+  }
+  if (kind === "finding_disposition") {
+    return isFindingDispositionList(metadata.dispositions);
+  }
+  if (kind === "completion") {
+    return (
+      isCompletionTests(metadata.tests) &&
+      isSafeTextList(metadata.proofRefs, 40) &&
+      isSafeTextList(metadata.remainingRisks, 40)
+    );
+  }
+  return false;
+}
+
+function isFindingList(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length <= 40 &&
+    value.every((finding) => {
+      if (!finding || typeof finding !== "object" || Array.isArray(finding))
+        return false;
+      const item = finding as Record<string, unknown>;
+      return (
+        hasExactKeys(item, [
+          "id",
+          "category",
+          "summary",
+          "rawFindingId",
+          "reviewerParticipantId",
+        ]) &&
+        isSafeId(item.id) &&
+        isSafeOrchestrationText(item.summary) &&
+        isSafeId(item.rawFindingId) &&
+        isSafeId(item.reviewerParticipantId) &&
+        [
+          "reversible_technical",
+          "intent_or_scope",
+          "destructive_action",
+          "security_or_privacy",
+          "outward_effect",
+          "meaningful_cost_expansion",
+          "irreversible_architecture",
+        ].includes(item.category as string)
+      );
+    })
+  );
+}
+
+function isFindingDispositionList(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length <= 40 &&
+    value.every((disposition) => {
+      if (
+        !disposition ||
+        typeof disposition !== "object" ||
+        Array.isArray(disposition)
+      )
+        return false;
+      const item = disposition as Record<string, unknown>;
+      return (
+        hasExactKeys(item, ["findingId", "disposition", "reason"]) &&
+        isSafeId(item.findingId) &&
+        ["addressed", "rejected", "deferred"].includes(
+          item.disposition as string,
+        ) &&
+        isSafeOrchestrationText(item.reason)
+      );
+    })
+  );
+}
+
+function isReversibleResolution(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const item = value as Record<string, unknown>;
+  return (
+    hasExactKeys(item, [
+      "alternatives",
+      "comparator",
+      "selected",
+      "reversibility",
+    ]) &&
+    isSafeTextList(item.alternatives, 8) &&
+    isSafeOrchestrationText(item.comparator) &&
+    isSafeOrchestrationText(item.selected) &&
+    isSafeOrchestrationText(item.reversibility)
+  );
+}
+
+function isCheckpointBundle(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const item = value as Record<string, unknown>;
+  return (
+    hasExactKeys(item, [
+      "requestSummary",
+      "requestRef",
+      "acceptedPlanArtifactId",
+      "contentRef",
+      "contentHash",
+      "testOutput",
+      "driverSummary",
+      "openRisks",
+      "unresolvedFindingIds",
+    ]) &&
+    isSafeOrchestrationText(item.requestSummary) &&
+    (item.requestRef === undefined || isSafeId(item.requestRef)) &&
+    isSafeId(item.acceptedPlanArtifactId) &&
+    typeof item.contentRef === "string" &&
+    /^(?!\/)(?!.*\.\.)[A-Za-z0-9._/@:-]{1,512}$/.test(item.contentRef) &&
+    typeof item.contentHash === "string" &&
+    SAFE_CONTENT_HASH.test(item.contentHash) &&
+    isSafeOrchestrationText(item.testOutput) &&
+    isSafeOrchestrationText(item.driverSummary) &&
+    isSafeTextList(item.openRisks, 40) &&
+    isSafeIdArray(item.unresolvedFindingIds, 40)
+  );
+}
+
+function isCompletionTests(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length <= 40 &&
+    value.every((test) => {
+      if (!test || typeof test !== "object" || Array.isArray(test))
+        return false;
+      const item = test as Record<string, unknown>;
+      return (
+        hasExactKeys(item, ["name", "status", "evidence"]) &&
+        isSafeOrchestrationText(item.name) &&
+        ["passed", "failed", "skipped"].includes(item.status as string) &&
+        isSafeOrchestrationText(item.evidence)
+      );
+    })
+  );
+}
+
+function isSafeTextList(value: unknown, max: number): boolean {
+  return (
+    Array.isArray(value) &&
+    value.length <= max &&
+    value.every((item) => isSafeOrchestrationText(item))
+  );
+}
+
+function metadataKeysForOrchestrationKind(
+  kind: NonNullable<MultiFrontierOrchestrationArtifact["kind"]>,
+): string[] {
+  if (kind === "synthesis") {
+    return ["agreed", "deterministicallyResolved", "reversibleResolution"];
+  }
+  if (kind === "checkpoint") return ["bundle"];
+  if (kind === "cross_review" || kind === "watchdog_review") {
+    return ["findings"];
+  }
+  if (kind === "finding_disposition") return ["dispositions"];
+  if (kind === "completion") return ["tests", "proofRefs", "remainingRisks"];
+  return [];
+}
+
+function containsUnsafeOrchestrationValue(
+  value: unknown,
+  depth: number,
+): boolean {
+  if (depth > 8) return true;
+  if (typeof value === "string") return !isSafeOrchestrationText(value);
+  if (
+    value === null ||
+    typeof value === "boolean" ||
+    (typeof value === "number" && Number.isFinite(value))
+  ) {
+    return false;
+  }
+  if (Array.isArray(value)) {
+    return (
+      value.length > 40 ||
+      value.some((item) => containsUnsafeOrchestrationValue(item, depth + 1))
+    );
+  }
+  if (!value || typeof value !== "object") return true;
+  const entries = Object.entries(value);
+  return (
+    entries.length > 40 ||
+    entries.some(
+      ([key, item]) =>
+        !isBoundedText(key, 160) ||
+        /(token|secret|authorization|credential|password|email|organization|account)/i.test(
+          key,
+        ) ||
+        containsUnsafeOrchestrationValue(item, depth + 1),
+    )
+  );
+}
+
+function cloneOrchestrationArtifact(
+  artifact: MultiFrontierOrchestrationArtifact,
+): MultiFrontierOrchestrationArtifact {
+  return JSON.parse(
+    JSON.stringify(artifact),
+  ) as MultiFrontierOrchestrationArtifact;
+}
+
+function isBoundedText(value: unknown, maxBytes: number): value is string {
+  return (
+    typeof value === "string" &&
+    value.trim().length > 0 &&
+    Buffer.byteLength(value, "utf-8") <= maxBytes
+  );
+}
+
+function assertBoundedText(
+  value: unknown,
+  maxBytes: number,
+  label: string,
+): void {
+  if (!isBoundedText(value, maxBytes)) {
+    throw new Error(`Invalid multi-frontier ${label}.`);
+  }
+}
+
+function assertRetentionLimits(
+  limits: MultiFrontierParticipantEventRetentionLimits,
+): void {
+  if (
+    !isNonNegativeInteger(limits.maxEventCount) ||
+    limits.maxEventCount < 1 ||
+    !isNonNegativeInteger(limits.maxBytes) ||
+    limits.maxBytes < 512
+  ) {
+    throw new Error(
+      "Invalid multi-frontier participant event retention limits.",
+    );
+  }
+}
+
+function eventLineByteLength(
+  event: PersistedMultiFrontierParticipantEvent,
+): number {
+  return Buffer.byteLength(`${JSON.stringify(event)}\n`, "utf-8");
+}
+
+function isSafeId(value: unknown): value is string {
+  return typeof value === "string" && SAFE_ID.test(value);
+}
+
+function isNonNegativeInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+
 function assertParticipants(
   participants: MultiFrontierParticipantState[],
 ): void {
@@ -821,21 +1950,3 @@ function assertTimestamp(value: string, label: string): void {
     throw new Error(`Invalid multi-frontier ${label}.`);
   }
 }
-
-function writeFileAtomically(filePath: string, contents: string): void {
-  const directory = path.dirname(filePath);
-  const temporaryPath = path.join(
-    directory,
-    `.${path.basename(filePath)}.tmp-${process.pid}-${crypto.randomUUID()}`,
-  );
-  try {
-    fs.writeFileSync(temporaryPath, contents, {
-      encoding: "utf-8",
-      flag: "wx",
-    });
-    fs.renameSync(temporaryPath, filePath);
-  } catch (error) {
-    fs.rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-}