@agentcomms/events-daemon 0.17.0 → 0.18.1

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as createRule$1, $t as assertSocketPathFits, A as normaliseWhatsAppSourceOptions, At as deliveriesList, B as removeTarget$1, Bt as ControlFrameReader, C as canonicalSseSubscriber, Ct as assertDoctorReportV1, D as normaliseResendSourceOptions, Dt as isActivationFailureCode, E as normaliseGmailSourceOptions, Et as ACTIVATION_FAILURE, F as canonicalJudgeBudget, Ft as catalogueShow, G as removeSubscriber, Gt as negotiateVersion, H as updateTarget, Ht as encodeControlFrame, I as canonicalJudgeKindEnablement, It as approvalView, J as stop, Jt as processIsLive, K as subscribersList, Kt as mayRecoverStaleInstance, L as judgeKindDefinition, Lt as EventControlClient, M as JUDGE_BUDGET_ID, Mt as heldList, N as JUDGE_KIND_DEFINITIONS, Nt as retryDelivery, O as normaliseSlackSourceOptions, Ot as disableAll, P as canonicalJudge, Pt as catalogueList, Q as sourcesList, Qt as assertControlSupported, R as createEventsMcpServer, Rt as probeControl, S as normaliseActivationDocument, St as enableAll, T as classifySourceOptionChange, Tt as doctor, U as targetTest, Ut as isControlHello, V as targetsList, Vt as controlFailure, W as addSubscriber, Wt as isControlRequest, X as loadSqlite, Xt as removeInstance, Y as status, Yt as readInstance, Z as sourceShow$1, Zt as writeInstance, _ as activationDocumentDigest, _t as judgesList, an as ensureOwnerOnlyFile, at as updateRule, b as canonicalTarget, bt as updateBudget, ct as pause, d as B3_SECRET_TERMINAL_ORIGIN, dt as budgetShow, en as controlEndpoint, et as disableRule$1, f as isB3ControlOperation, ft as disableJudgeKind, g as isOwnerControlWireOperation, gt as judgeTest, h as OWNER_CONTROL_WIRES, ht as judgeModelStatus, in as ensureEventSocketDirectory, it as rulesList, j as APPROVED_TYPESAFE_MODELS, jt as dropDelivery, k as normaliseSourceOptions, kt as decideHeld, lt as resume, m as renderB3ApprovalPreviewV1, mt as judgeKindsList, nn as verifyPrivateSocketDirectory, nt as removeRule, on as eventPaths, ot as ruleTest, p as isB3SecretOperation, pt as enableJudgeKind, q as updateSubscriber, qt as newInstanceRecord, rn as ensureEventPaths, rt as ruleShow$1, sn as installErrorSink, st as ruleTestRetained, tn as verifyControlSocket, tt as enableRule, ut as addJudge, v as canonicalFullRuleDocument, vt as removeJudge, w as sseDeliveryTarget, wt as assertDoctorReportV2, x as disclosureBindingFor, xt as updateJudge, y as canonicalSubscriber, yt as removeJudgeModel, z as addTarget, zt as CONTROL_PROTOCOL_VERSIONS } from "./b3-contract-DFxcHY0I.mjs";
+import { $ as sourcesList, $t as assertControlSupported, A as normaliseWhatsAppSourceOptions, At as decideHeld, B as addTarget, Bt as CONTROL_PROTOCOL_VERSIONS, C as canonicalSseSubscriber, Ct as enableAll, D as normaliseResendSourceOptions, Dt as ACTIVATION_FAILURE, E as normaliseGmailSourceOptions, Et as doctor, F as canonicalJudgeBudget, Ft as catalogueList, G as addSubscriber, Gt as isControlRequest, H as targetsList, Ht as controlFailure, I as canonicalJudgeKindEnablement, It as catalogueShow, J as updateSubscriber, Jt as newInstanceRecord, K as removeSubscriber, Kt as negotiateVersion, L as judgeKindDefinition, Lt as approvalView, M as JUDGE_BUDGET_ID, Mt as dropDelivery, N as JUDGE_KIND_DEFINITIONS, Nt as heldList, O as normaliseSlackSourceOptions, Ot as isActivationFailureCode, P as canonicalJudge, Pt as retryDelivery, Q as sourceShow$1, Qt as writeInstance, R as createEventsMcpServer, Rt as EventControlClient, S as normaliseActivationDocument, St as updateJudge, T as classifySourceOptionChange, Tt as assertDoctorReportV2, U as updateTarget, Ut as encodeControlFrame, V as removeTarget$1, Vt as ControlFrameReader, W as targetTest, Wt as isControlHello, X as status, Xt as readInstance, Y as stop, Yt as processIsLive, Z as loadSqlite, Zt as removeInstance, _ as activationDocumentDigest, _t as judgeTest, an as ensureEventSocketDirectory, at as rulesList, b as canonicalTarget, bt as removeJudgeModel, cn as installErrorSink, ct as ruleTestRetained, d as B3_SECRET_TERMINAL_ORIGIN, dt as addJudge, en as assertSocketPathFits, et as createRule$1, f as isB3ControlOperation, ft as budgetShow, g as isOwnerControlWireOperation, gt as judgeModelStatus, h as OWNER_CONTROL_WIRES, ht as judgeKindsList, in as ensureEventPaths, it as ruleShow$1, j as APPROVED_TYPESAFE_MODELS, jt as deliveriesList, k as normaliseSourceOptions, kt as disableAll, lt as pause, m as renderB3ApprovalPreviewV1, mt as enableJudgeKind, nn as verifyControlSocket, nt as enableRule, on as ensureOwnerOnlyFile, ot as updateRule, p as isB3SecretOperation, pt as disableJudgeKind, q as subscribersList, qt as mayRecoverStaleInstance, rn as verifyPrivateSocketDirectory, rt as removeRule, sn as eventPaths, st as ruleTest, tn as controlEndpoint, tt as disableRule$1, ut as resume, v as canonicalFullRuleDocument, vt as judgesList, w as sseDeliveryTarget, wt as assertDoctorReportV1, x as disclosureBindingFor, xt as updateBudget, y as canonicalSubscriber, yt as removeJudge, z as VERSION, zt as probeControl } from "./b3-contract-BZIj-LWV.mjs";
 import { a as EventDomainError, d as isJudgeKind, f as validateLocalEndpoint, g as parseIpLiteral, h as assertApprovedAddressSet, i as webhookDeliveryTarget, l as JUDGE_KIND_TYPESAFE, m as assertAddressAllowed, n as canonicalWebhookTarget, o as JUDGE_KINDS, p as AddressPolicyError, r as secretWebhookUrlDescriptor, s as JUDGE_KIND_LAYA, t as canonicalSecretWebhookUrl, u as assertJudgeKindEnabled } from "./webhook-target-DyDTwWhV.mjs";
 import { a as WriterQuiescer, c as openEventSecretStore, o as withEventWriterLease, r as RecordStorageError, s as migrateEventSecrets, t as EventRecordCipher } from "./records-DsUxYBwb.mjs";
 import process$1 from "node:process";
@@ -3365,6 +3365,7 @@ var ImmutableVersions = class {
 	assertEmbeddedVersions(rule) {
 		const embedded = [
 			...rule.targets.map((target) => ({
+				kind: "target",
 				table: "target_versions",
 				column: "target_id",
 				id: target.targetId,
@@ -3372,6 +3373,7 @@ var ImmutableVersions = class {
 				document: target
 			})),
 			...rule.subscribers.map((subscriber) => ({
+				kind: "subscriber",
 				table: "subscriber_versions",
 				column: "subscriber_id",
 				id: subscriber.subscriberId,
@@ -3379,6 +3381,7 @@ var ImmutableVersions = class {
 				document: subscriber
 			})),
 			...rule.agentic === void 0 ? [] : [{
+				kind: "judge",
 				table: "judge_versions",
 				column: "judge_id",
 				id: rule.agentic.judge.judgeId,
@@ -3390,8 +3393,19 @@ var ImmutableVersions = class {
 			const row = this.#database.prepare(`SELECT document FROM ${entry.table} WHERE ${entry.column} = ? AND version = ?`).get(entry.id, entry.version);
 			if (row === void 0) throw new EventDomainError("VERSION_DOCUMENT_INVALID", `the rule names ${entry.id} version ${entry.version}, which is not a stored version`);
 			if (row.document !== canonicalJson(entry.document)) throw new EventDomainError("VERSION_DOCUMENT_INVALID", `the rule carries a copy of ${entry.id} version ${entry.version} that differs from the stored version`);
+			if (entry.kind === "judge" && this.#embeddedJudgeIsRevoked(entry.id, entry.version)) throw new EventDomainError("VERSION_DOCUMENT_INVALID", `the rule names revoked judge ${entry.id} version ${entry.version}`);
 		}
 	}
+	#embeddedJudgeIsRevoked(judgeId, version) {
+		return this.#database.prepare(`SELECT 1 AS present
+             FROM judge_versions AS stored
+             LEFT JOIN object_revocations AS revoked
+               ON revoked.kind = 'judge'
+              AND revoked.object_id = stored.judge_id
+              AND revoked.version = stored.version
+            WHERE stored.judge_id = ? AND stored.version = ?
+              AND (stored.revoked_at IS NOT NULL OR revoked.revoked_at IS NOT NULL)`).get(judgeId, version) !== void 0;
+	}
 	insert(table, kind, objectId, version, document) {
 		const id = versionId(objectId, version);
 		const persisted = documentRecord(document);
@@ -7292,7 +7306,7 @@ function readReservation(database, id) {
 function readReservationForSourceWork(database, workId, scope) {
 	return database.prepare(`SELECT * FROM judge_budget_reservations
           WHERE work_id = ? AND work_scope = 'source-owned' AND source = ? AND account_id = ?
-            AND event_id = ? AND rule_id = ? AND rule_version = ?`).get(workId, scope.source, scope.accountId, scope.eventId, scope.ruleId, scope.ruleVersion) ?? null;
+            AND event_id = ? AND rule_id = ? AND rule_version = ? AND state IN ('reserved', 'in-flight')`).get(workId, scope.source, scope.accountId, scope.eventId, scope.ruleId, scope.ruleVersion) ?? null;
 }
 function reservationView(row) {
 	const scope = sourceScope(row);
@@ -7399,8 +7413,7 @@ function reserveJudgeWork(input) {
 		activeKind(input.store.database, judge.kind);
 		const limits = ruleAuthority(input.store.database, input.scope, judge);
 		if (!sameCanonical(limits, input.limits)) refusal$2("JUDGE_AUTHORITY_CHANGED", "the supplied limits differ from the immutable rule authority");
-		const prior = readReservationForSourceWork(input.store.database, input.workId, input.scope);
-		if (prior?.state === "reserved" || prior?.state === "in-flight") refusal$2("JUDGE_WORK_OWNER_HELD", "a live judge reservation already owns this source work");
+		if (readReservationForSourceWork(input.store.database, input.workId, input.scope) !== null) refusal$2("JUDGE_WORK_OWNER_HELD", "a live judge reservation already owns this source work");
 		assertReservationLimits(input.store.database, {
 			scope: input.scope,
 			budget,
@@ -7410,15 +7423,6 @@ function reserveJudgeWork(input) {
 			now: input.now,
 			adding: true
 		});
-		if (prior?.state === "released") {
-			input.store.database.prepare(`UPDATE judge_budget_reservations
-           SET estimated_input_tokens = ?, actual_input_tokens = NULL, state = 'reserved', concurrency_owned = 1,
-               reserved_at = ?, in_flight_at = NULL, settled_at = NULL, released_at = NULL, switch_generation = ?
-           WHERE id = ? AND state = 'released' AND concurrency_owned = 0`).run(estimate, input.now, input.switchGeneration, prior.id);
-			const reactivated = readReservation(input.store.database, prior.id);
-			if (reactivated === null || reactivated.state !== "reserved") refusal$2("JUDGE_AUTHORITY_CHANGED", "the released judge work could not be re-reserved");
-			return reservationView(reactivated);
-		}
 		return insertReservation(input.store.database, {
 			...input,
 			judge,
@@ -7477,12 +7481,14 @@ function beginJudgeTransport(input) {
 		if (row === null || row.state !== "reserved") return false;
 		try {
 			const authority = assertReservationAuthority(input.store.database, row, input.now);
-			const scope = sourceScope(row) ?? {
+			const source = sourceScope(row);
+			const scope = source ?? {
 				scope: "synthetic-test",
 				testWorkId: row.test_work_id,
 				judgeId: row.judge_id,
 				judgeVersion: row.judge_version
 			};
+			if (source !== null) assertSourceReservationBoundary(input.store.database, source, row.switch_generation);
 			assertReservationLimits(input.store.database, {
 				scope,
 				budget: authority.budget,
@@ -7492,6 +7498,8 @@ function beginJudgeTransport(input) {
 				now: input.now,
 				adding: false
 			});
+			assertHostedKeyGeneration(input.store.database, row, input.hostedKey);
+			input.assertBeforeTransition?.();
 		} catch (error) {
 			releaseReservationInTransaction(input.store.database, row.id, input.now);
 			refused = true;
@@ -7506,6 +7514,67 @@ function beginJudgeTransport(input) {
 	return began;
 }
 /**
+* Couples the durable I/O transition to the sealed transport's synchronous gate. Hosted work enters at DNS; a
+* literal-loopback judge has no DNS action and enters at TCP. Every later gate rechecks the complete live authority.
+*/
+var JudgeReservationIoGate = class {
+	#store;
+	#reservationId;
+	#judgeKind;
+	#now;
+	#hostedKey;
+	#entered = false;
+	#firstGateError;
+	constructor(input) {
+		this.#store = input.store;
+		this.#reservationId = input.reservationId;
+		this.#judgeKind = input.judgeKind;
+		this.#now = input.now;
+		this.#hostedKey = input.hostedKey;
+	}
+	get firstGateError() {
+		return this.#firstGateError;
+	}
+	finalGate = (phase, assertBeforeTransition) => {
+		const firstPhysicalPhase = this.#judgeKind === "typesafe" ? "dns" : "tcp";
+		if (!this.#entered) {
+			if (phase !== firstPhysicalPhase) {
+				assertBeforeTransition?.();
+				return;
+			}
+			let deadlineRefused = false;
+			try {
+				if (!beginJudgeTransport({
+					store: this.#store,
+					reservationId: this.#reservationId,
+					now: this.#now(),
+					...this.#hostedKey === void 0 ? {} : { hostedKey: this.#hostedKey },
+					assertBeforeTransition: () => {
+						try {
+							assertBeforeTransition?.();
+						} catch (error) {
+							deadlineRefused = true;
+							throw error;
+						}
+					}
+				})) refusal$2("JUDGE_AUTHORITY_CHANGED", "the judge reservation was lost before physical I/O");
+			} catch (error) {
+				if (!deadlineRefused) this.#firstGateError = error;
+				throw error;
+			}
+			this.#entered = true;
+			return;
+		}
+		assertJudgeReservationStillInFlight({
+			store: this.#store,
+			reservationId: this.#reservationId,
+			now: this.#now(),
+			...this.#hostedKey === void 0 ? {} : { hostedKey: this.#hostedKey }
+		});
+		assertBeforeTransition?.();
+	};
+};
+/**
 * The synchronous final transport/decision fence.  It reuses the one reservation authority reader rather than
 * manufacturing a second reservation path, and is safe to call immediately beside each Task-6 I/O action.
 */
@@ -7513,21 +7582,23 @@ function assertJudgeReservationInFlightInTransaction(database, reservationId, no
 	const row = readReservation(database, reservationId);
 	if (row === null || row.state !== "in-flight" || row.concurrency_owned !== 1) refusal$2("JUDGE_AUTHORITY_CHANGED", "the judge reservation is no longer in flight");
 	assertReservationAuthority(database, row, now);
-	if (hostedKey !== void 0) {
-		if (row.judge_id !== hostedKey.judgeId || row.judge_version !== hostedKey.judgeVersion) refusal$2("JUDGE_AUTHORITY_CHANGED", "the hosted judge key does not belong to this reservation");
-		if (database.prepare(`SELECT 1 AS present
-           FROM event_secret_generations AS generation
-           JOIN judge_versions AS judge
-             ON judge.judge_id = generation.owner_id AND judge.version = generation.owner_version
-          WHERE generation.owner_kind = 'judge' AND generation.purpose = 'judge-key'
-            AND generation.owner_id = ? AND generation.owner_version = ? AND generation.generation = ?
-            AND generation.lifecycle = 'current' AND generation.owner_digest = judge.digest
-            AND judge.revoked_at IS NULL`).get(hostedKey.judgeId, hostedKey.judgeVersion, hostedKey.generation) === void 0) refusal$2("JUDGE_AUTHORITY_CHANGED", "the hosted judge key generation is no longer current");
-	}
+	assertHostedKeyGeneration(database, row, hostedKey);
 	const scope = sourceScope(row);
 	if (scope === null) return;
 	assertSourceReservationBoundary(database, scope, row.switch_generation);
 }
+function assertHostedKeyGeneration(database, row, hostedKey) {
+	if (hostedKey === void 0) return;
+	if (row.judge_id !== hostedKey.judgeId || row.judge_version !== hostedKey.judgeVersion) refusal$2("JUDGE_AUTHORITY_CHANGED", "the hosted judge key does not belong to this reservation");
+	if (database.prepare(`SELECT 1 AS present
+         FROM event_secret_generations AS generation
+         JOIN judge_versions AS judge
+           ON judge.judge_id = generation.owner_id AND judge.version = generation.owner_version
+        WHERE generation.owner_kind = 'judge' AND generation.purpose = 'judge-key'
+          AND generation.owner_id = ? AND generation.owner_version = ? AND generation.generation = ?
+          AND generation.lifecycle = 'current' AND generation.owner_digest = judge.digest
+          AND judge.revoked_at IS NULL`).get(hostedKey.judgeId, hostedKey.judgeVersion, hostedKey.generation) === void 0) refusal$2("JUDGE_AUTHORITY_CHANGED", "the hosted judge key generation is no longer current");
+}
 function assertSourceReservationBoundary(database, scope, switchGeneration) {
 	const settings = database.prepare("SELECT enabled, paused, switch_generation FROM event_settings WHERE singleton = 1").get();
 	if (settings?.paused === 1) refusal$2("JUDGE_PAUSED", "the event switch is paused before the judge boundary");
@@ -7540,20 +7611,10 @@ function assertJudgeReservationStillInFlight(input) {
 		assertJudgeReservationInFlightInTransaction(input.store.database, input.reservationId, input.now, input.hostedKey);
 	});
 }
-function releaseReservationInTransaction(database, reservationId, now, mayReleaseInFlight = false) {
+function releaseReservationInTransaction(database, reservationId, now) {
 	return database.prepare(`UPDATE judge_budget_reservations
          SET state = 'released', concurrency_owned = 0, released_at = ?
-         WHERE id = ? AND concurrency_owned = 1
-           AND state != 'settled' AND state != 'released'
-           AND state = CASE WHEN ? = 1 THEN state ELSE 'reserved' END`).run(now, reservationId, mayReleaseInFlight ? 1 : 0).changes === 1;
-}
-/**
-* Pre-I/O loss is free: a reserved call releases normally.  `beforeIo` is an intentionally narrow transport proof
-* that lets a final fence refusal release the just-marked in-flight row too, because no DNS, TCP, TLS, or raw write
-* was entered and therefore there is no provider work to charge.
-*/
-function releaseJudgeWork(input) {
-	return input.store.immediate(() => releaseReservationInTransaction(input.store.database, input.reservationId, input.now, input.beforeIo === true));
+         WHERE id = ? AND concurrency_owned = 1 AND state = 'reserved'`).run(now, reservationId).changes === 1;
 }
 function terminalReason(result) {
 	if (result === "unknown" || result === "timeout" || result === "transport-failure") return "judge-io-unknown";
@@ -7607,6 +7668,24 @@ function settleJudgeWork(input) {
 		testFailpoint: input.testFailpoint
 	}));
 }
+/**
+* Closes a refused transport from the durable boundary state, not from the transport's advisory `preIo` flag. A
+* refusal that reached the synchronous physical-I/O gate is already in flight and must settle pessimistically;
+* every earlier refusal is still reserved and releases without a rolling charge.
+*/
+function finalizeJudgeTransportRefusal(input) {
+	return input.store.immediate(() => {
+		const row = readReservation(input.store.database, input.reservationId);
+		if (row === null) return null;
+		if (row.state === "released" || row.state === "settled") return row.state;
+		if (row.state === "reserved") return releaseReservationInTransaction(input.store.database, row.id, input.now) ? "released" : null;
+		return settleReservationInTransaction(input.store.database, {
+			reservationId: row.id,
+			result: input.result,
+			now: input.now
+		}) ? "settled" : null;
+	});
+}
 /** Used only by the shared recovery closure; no other module may reimplement these state transitions. */
 function recoverOneJudgeReservationInTransaction(database, reservationId, now) {
 	const row = readReservation(database, reservationId);
@@ -9476,6 +9555,26 @@ async function assertLiveEventAccount(config, scope) {
 		source: scope.source
 	} });
 }
+/**
+* Every connected account a rule may name, loaded afresh: Gmail's inboxes by their stable `ibx_…` id and the other
+* channels' accounts by their `acc_…` id, each beside the name a person knows it by. What `sources list` shows, so
+* a first rule's account id can be read from it before any rule is active (CUE-474).
+*/
+async function connectedEventAccounts(config) {
+	const current = await config.load();
+	const found = [];
+	for (const [account, inbox] of Object.entries(current.inboxes)) if (inbox.provider === "gmail") found.push({
+		source: "gmail",
+		accountId: inbox.id,
+		account
+	});
+	for (const [account, entry] of Object.entries(current.accounts)) if (entry.platform === "slack" || entry.platform === "resend" || entry.platform === "whatsapp") found.push({
+		source: entry.platform,
+		accountId: entry.id,
+		account
+	});
+	return found.sort((left, right) => `${left.source}\u0000${left.account}`.localeCompare(`${right.source}\u0000${right.account}`));
+}
 /** The current stable ids for one source, loaded afresh at the boundary. */
 async function liveEventAccountIds(config, source) {
 	const current = await config.load();
@@ -11468,6 +11567,119 @@ const EVENT_MIGRATIONS = [
 			"CREATE INDEX account_revocations_account_source ON account_revocations(account_id, source)",
 			"UPDATE meta SET value = '21' WHERE key = 'schema_version'"
 		]
+	},
+	{
+		version: 22,
+		name: "event-judge-budget-attempts-v1",
+		statements: [
+			`CREATE TABLE judge_budget_reservations_v22 (
+        id TEXT PRIMARY KEY,
+        work_id TEXT NOT NULL,
+        work_scope TEXT NOT NULL CHECK (work_scope IN ('source-owned', 'synthetic-test')),
+        source TEXT,
+        account_id TEXT,
+        event_id TEXT,
+        rule_id TEXT,
+        rule_version INTEGER CHECK (rule_version > 0),
+        judge_id TEXT NOT NULL,
+        judge_version INTEGER NOT NULL CHECK (judge_version > 0),
+        judge_kind TEXT NOT NULL CHECK (judge_kind IN (${JUDGE_KIND_SQL_VALUES})),
+        test_work_id TEXT,
+        budget_version INTEGER NOT NULL REFERENCES judge_budget_versions(version),
+        provider TEXT,
+        global_ledger_key TEXT NOT NULL CHECK (global_ledger_key = 'installation'),
+        state TEXT NOT NULL CHECK (state IN ('reserved', 'in-flight', 'settled', 'released')),
+        estimated_input_tokens INTEGER NOT NULL CHECK (estimated_input_tokens >= 0),
+        actual_input_tokens INTEGER CHECK (actual_input_tokens >= 0),
+        concurrency_owned INTEGER NOT NULL CHECK (concurrency_owned IN (0, 1)),
+        reserved_at INTEGER NOT NULL,
+        in_flight_at INTEGER,
+        settled_at INTEGER,
+        released_at INTEGER,
+        switch_generation INTEGER NOT NULL CHECK (switch_generation >= 0),
+        test_authority_rule_id TEXT,
+        test_authority_rule_version INTEGER CHECK (test_authority_rule_version > 0),
+        test_authority_activation_id TEXT,
+        test_authority_approval_id TEXT,
+        test_authority_challenge_hash TEXT CHECK (
+          test_authority_challenge_hash IS NULL
+          OR (length(test_authority_challenge_hash) = 64
+            AND test_authority_challenge_hash NOT GLOB '*[^0-9a-f]*')
+        ),
+        test_authority_challenge_origin TEXT CHECK (test_authority_challenge_origin IN ('terminal', 'view')),
+        test_authority_challenge_expires_at INTEGER,
+        FOREIGN KEY (rule_id, rule_version) REFERENCES rule_versions(rule_id, version),
+        FOREIGN KEY (judge_id, judge_version) REFERENCES judge_versions(judge_id, version),
+        CHECK (
+          (work_scope = 'source-owned'
+            AND source IS NOT NULL
+            AND source IN ('gmail', 'slack', 'resend', 'whatsapp')
+            AND account_id IS NOT NULL
+            AND event_id IS NOT NULL
+            AND rule_id IS NOT NULL
+            AND rule_version IS NOT NULL
+            AND test_work_id IS NULL
+            AND provider IS NOT NULL)
+          OR
+          (work_scope = 'synthetic-test'
+            AND source IS NULL
+            AND account_id IS NULL
+            AND event_id IS NULL
+            AND rule_id IS NULL
+            AND rule_version IS NULL
+            AND test_work_id IS NOT NULL
+            AND provider IS NULL)
+        )
+      ) STRICT`,
+			`INSERT INTO judge_budget_reservations_v22
+       (id, work_id, work_scope, source, account_id, event_id, rule_id, rule_version, judge_id, judge_version,
+        judge_kind, test_work_id, budget_version, provider, global_ledger_key, state, estimated_input_tokens,
+        actual_input_tokens, concurrency_owned, reserved_at, in_flight_at, settled_at, released_at, switch_generation,
+        test_authority_rule_id, test_authority_rule_version, test_authority_activation_id, test_authority_approval_id,
+        test_authority_challenge_hash, test_authority_challenge_origin, test_authority_challenge_expires_at)
+       SELECT id, work_id, work_scope, source, account_id, event_id, rule_id, rule_version, judge_id, judge_version,
+              judge_kind, test_work_id, budget_version, provider, global_ledger_key, state, estimated_input_tokens,
+              actual_input_tokens, concurrency_owned, reserved_at, in_flight_at, settled_at, released_at,
+              switch_generation, test_authority_rule_id, test_authority_rule_version, test_authority_activation_id,
+              test_authority_approval_id, test_authority_challenge_hash, test_authority_challenge_origin,
+              test_authority_challenge_expires_at
+       FROM judge_budget_reservations`,
+			"DROP TABLE judge_budget_reservations",
+			"ALTER TABLE judge_budget_reservations_v22 RENAME TO judge_budget_reservations",
+			`CREATE UNIQUE INDEX judge_budget_reservations_live_work_identity
+        ON judge_budget_reservations(work_id)
+        WHERE state IN ('reserved', 'in-flight')`,
+			`CREATE INDEX judge_budget_reservations_rule_rolling
+        ON judge_budget_reservations(rule_id, reserved_at)
+        WHERE work_scope = 'source-owned'`,
+			`CREATE INDEX judge_budget_reservations_provider_rolling
+        ON judge_budget_reservations(provider, reserved_at)
+        WHERE provider IS NOT NULL`,
+			`CREATE INDEX judge_budget_reservations_global_rolling
+        ON judge_budget_reservations(global_ledger_key, reserved_at)`,
+			`CREATE UNIQUE INDEX judge_budget_reservations_source_scope
+        ON judge_budget_reservations(source, account_id, event_id, rule_id, rule_version)
+        WHERE work_scope = 'source-owned' AND state IN ('reserved', 'in-flight')`,
+			`CREATE INDEX judge_budget_reservations_synthetic_scope
+        ON judge_budget_reservations(test_work_id, judge_id, judge_version, state)
+        WHERE work_scope = 'synthetic-test'`,
+			`CREATE INDEX judge_budget_reservations_kind_scope
+        ON judge_budget_reservations(judge_kind, work_scope, state)`,
+			`CREATE INDEX judge_budget_reservations_synthetic_authority
+        ON judge_budget_reservations(test_authority_rule_id, test_authority_rule_version, test_authority_activation_id,
+          test_authority_approval_id, test_authority_challenge_hash)
+        WHERE work_scope = 'synthetic-test'`,
+			`CREATE TRIGGER judge_budget_reservations_state_machine
+       BEFORE UPDATE OF state ON judge_budget_reservations
+       WHEN NEW.state <> OLD.state AND NOT (
+         (OLD.state = 'reserved' AND NEW.state IN ('in-flight', 'released'))
+         OR (OLD.state = 'in-flight' AND NEW.state = 'settled')
+       )
+       BEGIN
+         SELECT RAISE(ABORT, 'invalid judge reservation state transition');
+       END`,
+			"UPDATE meta SET value = '22' WHERE key = 'schema_version'"
+		]
 	}
 ];
 function initialiseLedger(database) {
@@ -11477,12 +11689,32 @@ function initialiseLedger(database) {
     applied_at INTEGER NOT NULL
   ) STRICT`);
 }
+/** The highest schema version a database's ledger records, or 0 when it has no ledger yet. It only reads. */
+function recordedSchemaVersion(database) {
+	if (database.prepare("SELECT 1 AS found FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'").get() === void 0) return 0;
+	return database.prepare("SELECT MAX(version) AS version FROM schema_migrations").get().version ?? 0;
+}
+/** Refuses a recorded schema version newer than this binary's, naming both and nothing else. */
+function refuseNewerVersion(databaseVersion, migrations = EVENT_MIGRATIONS) {
+	const binaryVersion = migrations.at(-1)?.version ?? 0;
+	if (databaseVersion > binaryVersion) throw new Error(`event database schema version ${databaseVersion} is newer than this release's schema version ${binaryVersion}; only the newer release that migrated it can open it`);
+}
+/**
+* Refuses a database a newer agent-events has migrated, by reading its ledger and nothing else: no table is created and
+* nothing is written, so it runs before the opener sets a journal mode or this file creates its ledger. A database
+* with no ledger yet is new, and passes.
+*/
+function refuseNewerSchema(database, migrations = EVENT_MIGRATIONS) {
+	refuseNewerVersion(recordedSchemaVersion(database), migrations);
+}
 /** Applies ordered daemon-owned migrations, one BEGIN IMMEDIATE transaction per version. */
 function applyMigrations(database, migrations = EVENT_MIGRATIONS, hooks = {}) {
+	refuseNewerSchema(database, migrations);
 	initialiseLedger(database);
+	for (const [index, migration] of migrations.entries()) if (migration.version !== index + 1) throw new Error("event migrations must have consecutive versions starting at 1");
 	const applied = database.prepare("SELECT version, name FROM schema_migrations ORDER BY version").all();
-	for (const [index, migration] of migrations.entries()) {
-		if (migration.version !== index + 1) throw new Error("event migrations must have consecutive versions starting at 1");
+	refuseNewerVersion(applied.at(-1)?.version ?? 0, migrations);
+	for (const migration of migrations) {
 		const recorded = applied.find((entry) => entry.version === migration.version);
 		if (recorded) {
 			if (recorded.name !== migration.name) throw new Error(`event migration ${migration.version} does not match its ledger name`);
@@ -11517,18 +11749,44 @@ function installationIdFor(database) {
 	database.prepare("INSERT INTO meta (key, value) VALUES (?, ?)").run("installation_id", created);
 	return created;
 }
+/** SQLite's primary result code for a read that has to write first: recovering what a crash interrupted. */
+const SQLITE_READONLY = 8;
+/**
+* The schema version a database records, read through a read-only connection, so that a database a newer agent-events
+* migrated is refused without this release ever opening it for writing. It waits out a lock as the writable opener
+* would. Null only when SQLite must first recover an interrupted transaction, which takes a writable connection: the
+* opener checks again there. Any other failure, a lock held past the wait among them, refuses the open as it is.
+*/
+function recordedVersionReadOnly(Database, path, busyTimeoutMs = 5e3) {
+	try {
+		const probe = new Database(path, { readOnly: true });
+		try {
+			probe.exec(`PRAGMA busy_timeout = ${Math.trunc(busyTimeoutMs)}`);
+			return recordedSchemaVersion(probe);
+		} finally {
+			probe.close();
+		}
+	} catch (error) {
+		const code = error.errcode;
+		if (typeof code === "number" && (code & 255) === SQLITE_READONLY) return null;
+		throw error;
+	}
+}
 /** Opens the daemon’s one local authority after the Task 4 owner-only path checks have succeeded. */
 async function openEventDatabase(options) {
 	const { DatabaseSync: Database } = await loadSqlite();
 	const paths = await ensureEventPaths(eventPaths(options.stateDir));
 	await ensureOwnerOnlyFile(paths.database);
+	const recorded = recordedVersionReadOnly(Database, paths.database);
+	if (recorded !== null) refuseNewerVersion(recorded);
 	const database = new Database(paths.database);
 	try {
+		database.exec("PRAGMA busy_timeout = 5000");
+		refuseNewerSchema(database);
 		database.exec("PRAGMA foreign_keys = ON");
 		database.exec("PRAGMA journal_mode = WAL");
 		database.exec("PRAGMA synchronous = FULL");
 		database.exec("PRAGMA secure_delete = ON");
-		database.exec("PRAGMA busy_timeout = 5000");
 		applyMigrations(database);
 		return {
 			database,
@@ -11841,16 +12099,20 @@ var ActivationRuntime = class {
 	}
 	/** A narrowing revocation is allowed to win over a claimed completion, but no other pointer mutation is. */
 	async cancelForRevocation(input) {
+		this.#store.immediate(() => {
+			this.cancelForRevocationInTransaction(input);
+		});
+	}
+	/** A caller already holding the removal transaction cancels every matching intent before revocation commits. */
+	cancelForRevocationInTransaction(input) {
 		const rows = this.#store.database.prepare("SELECT id, document FROM activation_intents WHERE status IN ('pending', 'pending-completion') ORDER BY id").all();
-		const cancelled = [];
+		let cancelled = 0;
 		for (const row of rows) {
 			if (!this.#isRevokedBinding(JSON.parse(row.document), input)) continue;
-			cancelled.push(row.id);
+			this.#cancel(row.id, ACTIVATION_FAILURE.AUTHORIZATION_REVOKED);
+			cancelled += 1;
 		}
-		if (cancelled.length === 0) return;
-		this.#store.immediate(() => {
-			for (const intentId of cancelled) this.#cancel(intentId, ACTIVATION_FAILURE.AUTHORIZATION_REVOKED);
-		});
+		return cancelled;
 	}
 	/** Called by the kind-disable transaction; no pending kind approval may recreate the pointer after disable wins. */
 	cancelForJudgeKindInTransaction(kind) {
@@ -11858,7 +12120,7 @@ var ActivationRuntime = class {
 		let cancelled = 0;
 		for (const row of rows) {
 			const document = JSON.parse(row.document);
-			if (document.kind === "judge-kind" && document.enablement.kind === kind || document.kind === "rule" && document.rule.agentic?.judge.kind === kind) {
+			if (document.kind === "judge-kind" && document.enablement.kind === kind || document.kind === "rule" && document.rule.agentic?.judge.kind === kind || document.kind === "enable-all" && this.#ruleVersionsBindJudgeKind(document.ruleVersions, kind)) {
 				this.#cancel(row.id, ACTIVATION_FAILURE.AUTHORIZATION_REVOKED);
 				cancelled += 1;
 			}
@@ -11976,6 +12238,8 @@ var ActivationRuntime = class {
 		const now = this.#now();
 		const plannedAccounts = [...new Map(points.map((point) => [`${point.source}\u0000${point.accountId}`, point])).values()];
 		this.#store.immediate(() => {
+			this.#assertBoundRuleAuthority(document);
+			this.#assertPreparationPlanLive(document, effect, replacementOfVersion);
 			this.#assertJudgeActivationLive(document, effect);
 			const latestRevocation = plannedAccounts.reduce((latest, point) => {
 				const row = this.#store.database.prepare(`SELECT MAX(revoked_at) AS revoked_at FROM account_revocations
@@ -11988,9 +12252,28 @@ var ActivationRuntime = class {
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)`).run(intentId, document.kind, canonicalJson(document), binding.digest, canonicalJson(effect), replacementOfVersion ?? null, canonicalJson(points), canonicalJson([...new Set(points.map((point) => `${point.accountId}:${point.positionScope}`))]), createdAt, createdAt);
 		});
 		const approval = await this.#approvals.createDisclosure(binding);
+		let settled;
 		this.#store.immediate(() => {
-			this.#store.database.prepare("UPDATE activation_intents SET approval_id = ?, updated_at = ? WHERE id = ? AND approval_id IS NULL").run(approval.approvalId, this.#now(), intentId);
+			const latest = this.#intent(intentId);
+			const linkApproval = () => this.#store.database.prepare("UPDATE activation_intents SET approval_id = ?, updated_at = ? WHERE id = ? AND approval_id IS NULL").run(approval.approvalId, this.#now(), intentId).changes;
+			if (latest.status !== "pending") {
+				if (linkApproval() !== 1) throw new CommsError("APPROVAL_VOID", "the cancelled activation could not retain its disclosure link");
+				settled = new CommsError("APPROVAL_VOID", "the activation was cancelled before its approval could be linked");
+				return;
+			}
+			try {
+				this.#assertBoundRuleAuthority(document);
+				this.#assertPreparationPlanLive(document, effect, replacementOfVersion);
+				this.#assertJudgeActivationLive(document, effect);
+			} catch (error) {
+				if (linkApproval() !== 1) throw new CommsError("APPROVAL_VOID", "the stale activation could not retain its disclosure link");
+				this.#cancel(intentId, ACTIVATION_FAILURE.APPROVAL_BINDING_DRIFT);
+				settled = error;
+				return;
+			}
+			if (this.#store.database.prepare("UPDATE activation_intents SET approval_id = ?, updated_at = ? WHERE id = ? AND status = 'pending' AND approval_id IS NULL").run(approval.approvalId, this.#now(), intentId).changes !== 1) throw new CommsError("APPROVAL_VOID", "the activation approval link changed before it could be written");
 		});
+		if (settled !== void 0) throw settled;
 		return {
 			intentId,
 			approvalId: approval.approvalId,
@@ -12013,7 +12296,7 @@ var ActivationRuntime = class {
 			if (allowIssuingChallengeResidue) this.#assertApprovalIssuingChallengeResidue(intent.approval_id);
 			if (row.status === "cancelled") throw new CommsError("APPROVAL_VOID", "the activation was cancelled before completion");
 			const document = this.#document(row);
-			this.#assertRuleJudgeKindEnabled(document);
+			this.#assertBoundRuleAuthority(document);
 			if (document.kind === "judge-budget" || document.kind === "judge-kind") try {
 				this.#assertJudgeActivationLive(document, JSON.parse(row.effect));
 			} catch (_error) {
@@ -12166,7 +12449,7 @@ var ActivationRuntime = class {
 				settled = new CommsError("APPROVAL_VOID", "the activation completion deadline has passed");
 				return;
 			}
-			this.#assertRuleJudgeKindEnabled(document);
+			this.#assertBoundRuleAuthority(document);
 			const effect = JSON.parse(latest.effect);
 			const settings = this.#switch();
 			if ((document.kind === "rule" || document.kind === "enable-all") && settings.generation !== effect.switchGeneration) {
@@ -12280,12 +12563,10 @@ var ActivationRuntime = class {
 		const document = this.#document(intent);
 		const binding = disclosureBindingFor(intent.id, document);
 		if (binding.digest !== intent.digest || activationDocumentDigest(document) !== intent.digest) throw new CommsError("APPROVAL_VOID", "the activation document changed after preparation");
+		this.#assertBoundRuleAuthority(document);
 		if (document.kind === "rule") {
-			const versions = new ImmutableVersions(this.#store.database);
-			const active = versions.activeVersion("rule", document.rule.ruleId);
+			const active = new ImmutableVersions(this.#store.database).activeVersion("rule", document.rule.ruleId);
 			if (active !== null && (intent.replacement_of_version === null || `${document.rule.ruleId}@${active.version}` !== intent.replacement_of_version)) throw new CommsError("APPROVAL_VOID", "the rule gained an active pointer after preparation");
-			const live = versions.prepareRule(document.rule.ruleId, document.rule.version);
-			if (canonicalJson(live) !== canonicalJson(document)) throw new CommsError("APPROVAL_VOID", "the rule changed after preparation");
 		} else if (document.kind === "enable-all") {
 			const current = this.#switch();
 			const live = this.#store.database.prepare("SELECT object_id, version, current_cutover_id FROM active_versions WHERE kind = 'rule' ORDER BY object_id, version").all();
@@ -12319,12 +12600,48 @@ var ActivationRuntime = class {
 	#judgeKindDisableGeneration(kind) {
 		return this.#store.database.prepare("SELECT generation FROM judge_kind_disable_generations WHERE kind = ?").get(kind)?.generation ?? 0;
 	}
-	/** The absence of the sole judge-kind pointer is disabled; deterministic-only rules need no kind check. */
-	#assertRuleJudgeKindEnabled(document) {
-		if (document.kind !== "rule" || document.rule.agentic === void 0) return;
-		const kind = document.rule.agentic.judge.kind;
+	/** Re-read every exact bound rule, including its embedded judge revocation and kind pointer, at each authority gate. */
+	#assertBoundRuleAuthority(document) {
+		if (document.kind !== "rule" && document.kind !== "enable-all") return;
 		const versions = new ImmutableVersions(this.#store.database);
-		assertJudgeKindEnabled(kind, versions.activeVersion("judge-kind", kind) !== null);
+		if (document.kind === "rule") {
+			const live = versions.prepareRule(document.rule.ruleId, document.rule.version);
+			if (canonicalJson(live) !== canonicalJson(document)) throw new CommsError("APPROVAL_VOID", "the rule changed after preparation");
+			return;
+		}
+		for (const entry of document.ruleVersions) versions.prepareRule(entry.ruleId, entry.ruleVersion);
+	}
+	/** Preparation may await local stores; the exact pointer plan captured before those awaits must still be current. */
+	#assertPreparationPlanLive(document, effect, replacementOfVersion) {
+		if (document.kind === "rule") {
+			const active = new ImmutableVersions(this.#store.database).activeVersion("rule", document.rule.ruleId);
+			if ((active === null ? null : `${document.rule.ruleId}@${active.version}`) !== (replacementOfVersion ?? null) || this.#switch().generation !== effect.switchGeneration) throw new CommsError("APPROVAL_VOID", "the rule activation pointer plan changed during preparation");
+			return;
+		}
+		if (document.kind !== "enable-all") return;
+		const settings = this.#switch();
+		const live = this.#store.database.prepare("SELECT object_id, version, current_cutover_id FROM active_versions WHERE kind = 'rule' ORDER BY object_id, version").all();
+		if (settings.enabled || settings.generation !== document.switchGeneration || settings.generation !== effect.switchGeneration || canonicalJson(live.map((row) => ({
+			ruleId: row.object_id,
+			ruleVersion: row.version
+		}))) !== canonicalJson(document.ruleVersions) || canonicalJson(live.map((row) => ({
+			ruleId: row.object_id,
+			ruleVersion: row.version,
+			cutoverId: row.current_cutover_id
+		}))) !== canonicalJson(effect.currentCutovers ?? [])) throw new CommsError("APPROVAL_VOID", "the global enablement pointer plan changed during preparation");
+	}
+	/** A damaged captured rule row cannot prove that a kind disable is unrelated, so cancellation is fail-closed. */
+	#ruleVersionsBindJudgeKind(entries, kind) {
+		for (const entry of entries) {
+			const row = this.#store.database.prepare("SELECT document FROM rule_versions WHERE rule_id = ? AND version = ?").get(entry.ruleId, entry.ruleVersion);
+			if (row === void 0) return true;
+			try {
+				if (canonicalFullRuleDocument(JSON.parse(row.document)).agentic?.judge.kind === kind) return true;
+			} catch {
+				return true;
+			}
+		}
+		return false;
 	}
 	#document(intent) {
 		return JSON.parse(intent.document);
@@ -13583,10 +13900,10 @@ var B3OperatorControl = class {
 		}).disable(kind);
 	}
 	async removeJudge(judgeId) {
-		await this.#activations?.cancelForRevocation({ judgeId });
 		return this.#store.immediate(() => {
 			const rows = this.#store.database.prepare("SELECT version FROM judge_versions WHERE judge_id = ? AND revoked_at IS NULL ORDER BY version").all(judgeId);
 			if (rows.length === 0) throw new CommsError("NOT_FOUND", "the judge has no live version to remove");
+			this.#activations?.cancelForRevocationInTransaction({ judgeId });
 			const revokedAt = this.#now();
 			const removedVersions = new Set(rows.map((row) => row.version));
 			for (const row of rows) {
@@ -14246,7 +14563,8 @@ var B3TargetTestControl = class {
              SELECT 1 FROM object_revocations AS revoked
              WHERE revoked.kind = 'target' AND revoked.object_id = target.target_id AND revoked.version = target.version
            )`).get(targetId, targetVersion);
-		if (row === void 0 || row.enabled !== 1) return refuse("the exact target version is not live");
+		if (row === void 0) return refuse("the exact target version is not live");
+		if (row.enabled !== 1) return refuse("collection is switched off: switch it on with enable-all first, or approve without the test");
 		if (selectorKind === "active") {
 			if (this.#store.database.prepare(`SELECT 1 AS present
            FROM target_version_references AS reference
@@ -15547,9 +15865,9 @@ var JudgeTransport = class {
 		let enteredIo = false;
 		try {
 			await this.#beforeGate(hooks, "dns");
-			this.#finalGate(hooks, "dns");
-			assertBeforeDeadline(deadline, this.#clock);
+			this.#finalGate(hooks, "dns", deadline);
 			enteredIo = call.judge.kind === JUDGE_KIND_TYPESAFE;
+			assertBeforeDeadline(deadline, this.#clock);
 			const connection = await beforeDeadline$1(preparePinnedConnection(call.judge.kind === "typesafe" ? {
 				url: endpoint,
 				addressMode: "global-only",
@@ -15562,9 +15880,9 @@ var JudgeTransport = class {
 			}), deadline, this.#clock);
 			assertBeforeDeadline(deadline, this.#clock);
 			await this.#beforeGate(hooks, "tcp");
-			this.#finalGate(hooks, "tcp");
-			assertBeforeDeadline(deadline, this.#clock);
+			this.#finalGate(hooks, "tcp", deadline);
 			enteredIo = true;
+			assertBeforeDeadline(deadline, this.#clock);
 			const tcp = await beforeDeadline$1(this.#tcpConnect({
 				host: connection.address,
 				port: connection.port
@@ -15573,7 +15891,7 @@ var JudgeTransport = class {
 			socket = tcp;
 			if (connection.useTls) {
 				await this.#beforeGate(hooks, "tls");
-				this.#finalGate(hooks, "tls");
+				this.#finalGate(hooks, "tls", deadline);
 				assertBeforeDeadline(deadline, this.#clock);
 				socket = await beforeDeadline$1(this.#tlsConnect({
 					socket: tcp,
@@ -15582,7 +15900,7 @@ var JudgeTransport = class {
 				assertBeforeDeadline(deadline, this.#clock);
 			}
 			await this.#beforeGate(hooks, "write");
-			this.#finalGate(hooks, "write");
+			this.#finalGate(hooks, "write", deadline);
 			assertBeforeDeadline(deadline, this.#clock);
 			socket.write(request);
 			const body = await beforeDeadline$1(boundedResponse(socket), deadline, this.#clock);
@@ -15613,14 +15931,16 @@ var JudgeTransport = class {
 		}
 	}
 	/**
-	* At every call site only the synchronous deadline check stands between this gate and the physical B2 network action;
-	* no await may be inserted between them.
+	* The deadline is checked after the awaited preparation and again inside the durable production gate immediately
+	* before its state transition. No await may be inserted between this gate and the physical B2 network action.
 	*/
-	#finalGate(hooks, phase) {
+	#finalGate(hooks, phase, deadline) {
+		assertBeforeDeadline(deadline, this.#clock);
 		let decision;
 		try {
-			decision = hooks.finalGate(phase);
-		} catch {
+			decision = hooks.finalGate(phase, () => assertBeforeDeadline(deadline, this.#clock));
+		} catch (error) {
+			if (error instanceof DeadlineExceeded) throw error;
 			throw new FenceRefused();
 		}
 		if (decision !== void 0) {
@@ -15798,33 +16118,19 @@ var JudgeTestControl = class {
 		} catch (error) {
 			return refusal(input.judgeId, input.version, error);
 		}
-		try {
-			if (!beginJudgeTransport({
-				store: this.#store,
-				reservationId: reservation.id,
-				now: this.#now()
-			})) return {
-				kind: "refused",
-				judgeId: input.judgeId,
-				version: input.version,
-				code: "JUDGE_AUTHORITY_CHANGED"
-			};
-		} catch (error) {
-			return refusal(input.judgeId, input.version, error);
-		}
+		const ioGate = new JudgeReservationIoGate({
+			store: this.#store,
+			reservationId: reservation.id,
+			judgeKind: authority.judge.kind,
+			now: this.#now,
+			...prepared.hostedKeyGeneration === null ? {} : { hostedKey: {
+				judgeId: authority.judge.judgeId,
+				judgeVersion: authority.judge.version,
+				generation: prepared.hostedKeyGeneration
+			} }
+		});
 		const result = await this.#transport.execute(call, {
-			finalGate: () => {
-				assertJudgeReservationStillInFlight({
-					store: this.#store,
-					reservationId: reservation.id,
-					now: this.#now(),
-					...prepared.hostedKeyGeneration === null ? {} : { hostedKey: {
-						judgeId: authority.judge.judgeId,
-						judgeVersion: authority.judge.version,
-						generation: prepared.hostedKeyGeneration
-					} }
-				});
-			},
+			finalGate: ioGate.finalGate,
 			preparedRequest: prepared
 		});
 		if (result.kind === "answer") {
@@ -15844,27 +16150,13 @@ var JudgeTestControl = class {
 				reservationId: reservation.id
 			};
 		}
-		if (result.preIo) {
-			releaseJudgeWork({
-				store: this.#store,
-				reservationId: reservation.id,
-				now: this.#now(),
-				beforeIo: true
-			});
-			return {
-				kind: "deferred",
-				judgeId: input.judgeId,
-				version: input.version,
-				code: result.code,
-				reservationId: reservation.id
-			};
-		}
-		settleJudgeWork({
+		finalizeJudgeTransportRefusal({
 			store: this.#store,
 			reservationId: reservation.id,
 			result: result.code === "OUTPUT_TOKEN_LIMIT_EXCEEDED" ? "output-token-limit" : result.code === "NETWORK_DEADLINE_EXCEEDED" ? "timeout" : "transport-failure",
 			now: this.#now()
 		});
+		if (ioGate.firstGateError !== void 0) return refusal(input.judgeId, input.version, ioGate.firstGateError);
 		return {
 			kind: "deferred",
 			judgeId: input.judgeId,
@@ -16586,61 +16878,44 @@ var JudgeCoordinator = class {
 				reservationId: null
 			};
 		}
-		try {
-			if (!beginJudgeTransport({
-				store: this.#store,
-				reservationId: reservation.id,
-				now: this.#now()
-			})) return {
-				kind: "closed",
-				reason: "reservation-lost",
-				reservationId: reservation.id
-			};
-		} catch (error) {
-			if (error instanceof JudgeBudgetError && error.code === "JUDGE_PAUSED") return {
-				kind: "deferred",
-				reservationId: reservation.id
-			};
-			return {
-				kind: "closed",
-				reason: error instanceof Error && "code" in error ? String(error.code) : "authority-changed",
-				reservationId: reservation.id
-			};
-		}
+		const ioGate = new JudgeReservationIoGate({
+			store: this.#store,
+			reservationId: reservation.id,
+			judgeKind: agentic.judge.kind,
+			now: this.#now,
+			...prepared.hostedKeyGeneration === null ? {} : { hostedKey: {
+				judgeId: agentic.judge.judgeId,
+				judgeVersion: agentic.judge.version,
+				generation: prepared.hostedKeyGeneration
+			} }
+		});
 		const result = await this.#transport.execute(call, {
-			finalGate: () => {
-				assertJudgeReservationStillInFlight({
-					store: this.#store,
-					reservationId: reservation.id,
-					...prepared.hostedKeyGeneration === null ? {} : { hostedKey: {
-						judgeId: agentic.judge.judgeId,
-						judgeVersion: agentic.judge.version,
-						generation: prepared.hostedKeyGeneration
-					} }
-				});
-			},
+			finalGate: ioGate.finalGate,
 			preparedRequest: prepared
 		});
 		if (result.kind !== "answer") {
-			if (result.preIo === true) {
-				releaseJudgeWork({
-					store: this.#store,
-					reservationId: reservation.id,
-					now: this.#now(),
-					beforeIo: true
-				});
-				return {
-					kind: "deferred",
-					reservationId: reservation.id
-				};
-			}
 			const settlement = result.code === "OUTPUT_TOKEN_LIMIT_EXCEEDED" ? "output-token-limit" : result.code === "NETWORK_DEADLINE_EXCEEDED" ? "timeout" : "unknown";
-			settleJudgeWork({
+			const disposition = finalizeJudgeTransportRefusal({
 				store: this.#store,
 				reservationId: reservation.id,
 				result: settlement,
 				now: this.#now()
 			});
+			if (ioGate.firstGateError !== void 0) {
+				if (ioGate.firstGateError instanceof JudgeBudgetError && ioGate.firstGateError.code === "JUDGE_PAUSED") return {
+					kind: "deferred",
+					reservationId: reservation.id
+				};
+				return {
+					kind: "closed",
+					reason: ioGate.firstGateError instanceof Error && "code" in ioGate.firstGateError ? String(ioGate.firstGateError.code) : "authority-changed",
+					reservationId: reservation.id
+				};
+			}
+			if (disposition === "released") return {
+				kind: "deferred",
+				reservationId: reservation.id
+			};
 			return {
 				kind: "closed",
 				reason: closedReason(result),
@@ -19851,7 +20126,7 @@ function sourceOfDeliveryRule(document) {
 /** Composes every Task 3/4 control behind the authenticated owner; public adapters never reach a runtime class. */
 function createOwnerB3ControlService(options) {
 	const now = options.now ?? Date.now;
-	const judgeActivations = typeof options.activations.prepareJudgeBudget === "function" && typeof options.activations.prepareJudgeKind === "function" && typeof options.activations.cancelForJudgeKindInTransaction === "function" && typeof options.activations.cancelForRevocation === "function" ? options.activations : void 0;
+	const judgeActivations = typeof options.activations.prepareJudgeBudget === "function" && typeof options.activations.prepareJudgeKind === "function" && typeof options.activations.cancelForJudgeKindInTransaction === "function" && typeof options.activations.cancelForRevocationInTransaction === "function" ? options.activations : void 0;
 	const operator = new B3OperatorControl({
 		store: options.store,
 		ports: options.ports,
@@ -20815,7 +21090,7 @@ async function startOwnerWithLock(options, stateDir, paths, lock, started, onDat
 		control = await (options.startControlServer ?? startControlServer)({
 			endpoint: instance.endpoint,
 			token,
-			handle: async (request) => handleControl(owner, lifecycle, database, activations, dryrun, sourceRegistry, writerQuiescer, request, ownerB3Service, doctorReport),
+			handle: async (request) => handleControl(owner, lifecycle, database, activations, dryrun, sourceRegistry, writerQuiescer, request, ownerB3Service, doctorReport, () => connectedEventAccounts(core.config)),
 			verifyEndpoint: () => verifyPrivateSocketDirectory(paths)
 		});
 		if (options.startControlServer === void 0) {
@@ -20846,7 +21121,7 @@ async function runEventOwner(options = {}) {
 		await owner.stop();
 	}
 }
-async function handleControl(owner, lifecycle, database, activations, dispatcher, sourceRegistry, writerQuiescer, request, b3OwnerService, doctorReport) {
+async function handleControl(owner, lifecycle, database, activations, dispatcher, sourceRegistry, writerQuiescer, request, b3OwnerService, doctorReport, connectedAccounts = async () => []) {
 	if (!isOwnerControlWireOperation(request.operation)) throw new CommsError("USAGE", "the local event control operation is not recognised");
 	if (isB3ControlOperation(request.operation)) {
 		if (!b3OwnerService) throw new CommsError("USAGE", "the local B3 control operation is not available");
@@ -20889,8 +21164,8 @@ async function handleControl(owner, lifecycle, database, activations, dispatcher
 				channel: definition.type.split(".")[0]
 			};
 		}
-		case OWNER_CONTROL_WIRES.sourcesList: return sourceRows(database, sourceRegistry);
-		case OWNER_CONTROL_WIRES.sourceShow: return sourceShow(database, sourceRegistry, requiredText(request.args.source, "source"));
+		case OWNER_CONTROL_WIRES.sourcesList: return sourceRows(database, sourceRegistry, await connectedAccounts());
+		case OWNER_CONTROL_WIRES.sourceShow: return sourceShow(database, sourceRegistry, requiredText(request.args.source, "source"), await connectedAccounts());
 		case OWNER_CONTROL_WIRES.rulesList: return ruleRows(database);
 		case OWNER_CONTROL_WIRES.ruleShow: return ruleShow(database, requiredText(request.args.ruleId, "rule id"));
 		case OWNER_CONTROL_WIRES.createRule:
@@ -20963,7 +21238,12 @@ function targetRows(database) {
 function createTarget(database, document) {
 	return domain(() => new ImmutableVersions(database.database).createTarget(document));
 }
-function sourceRows(database, sourceRegistry) {
+/**
+* Each source's accounts: the scopes active rules read, and every connected account a rule may name, which has no
+* cursor scope until a rule reads it. Each carries the name it was connected under, so a person, or an agent writing
+* a first rule, can tell `ibx_…` from `ibx_…` (CUE-474).
+*/
+function sourceRows(database, sourceRegistry, connected = []) {
 	const rows = database.database.prepare("SELECT document FROM rule_versions WHERE state IN ('active', 'superseded')").all();
 	const scopes = /* @__PURE__ */ new Map();
 	for (const row of rows) {
@@ -20985,17 +21265,28 @@ function sourceRows(database, sourceRegistry) {
 			} catch {}
 		}
 	}
-	const ordered = [...scopes.values()].sort((left, right) => `${left.source}\u0000${left.accountId}\u0000${left.cursorScope}`.localeCompare(`${right.source}\u0000${right.accountId}\u0000${right.cursorScope}`));
+	const nameOf = new Map(connected.map((entry) => [`${entry.source}\u0000${entry.accountId}`, entry.account]));
+	const accounts = [...scopes.values()].map((scope) => ({
+		...scope,
+		account: nameOf.get(`${scope.source}\u0000${scope.accountId}`) ?? null
+	}));
+	for (const entry of connected) if (!accounts.some((row) => row.source === entry.source && row.accountId === entry.accountId)) accounts.push({
+		source: entry.source,
+		accountId: entry.accountId,
+		account: entry.account,
+		cursorScope: null
+	});
+	const ordered = accounts.sort((left, right) => `${left.source}\u0000${left.accountId}\u0000${left.cursorScope ?? ""}`.localeCompare(`${right.source}\u0000${right.accountId}\u0000${right.cursorScope ?? ""}`));
 	return sourceRegistry.sources().map((source) => ({
 		source,
 		accounts: ordered.filter((scope) => scope.source === source)
 	}));
 }
-function sourceShow(database, sourceRegistry, source) {
+function sourceShow(database, sourceRegistry, source, connected = []) {
 	if (!sourceRegistry.sources().includes(source)) throw new CommsError("NOT_FOUND", "the requested source is not configured");
 	return {
 		source,
-		accounts: sourceRows(database, sourceRegistry).find((row) => row.source === source).accounts
+		accounts: sourceRows(database, sourceRegistry, connected).find((row) => row.source === source).accounts
 	};
 }
 async function acquireWithStaleRecovery(paths) {
@@ -21143,6 +21434,22 @@ function terminalSafeJson(value) {
 function renderApprovalViewForTerminal(result) {
 	return escapeForDisplay(renderB3ApprovalPreviewV1(result).terminal);
 }
+/**
+* An optional test the owner refused is reported and the approval goes on to its challenge (CUE-475): declining the
+* test was always allowed, so a test that could not run must not end the approval for the person.
+*/
+async function optionalTest(label, test) {
+	try {
+		return await test();
+	} catch (error) {
+		if (!isCommsError(error)) throw error;
+		return {
+			...label,
+			test: "not run",
+			reason: error.message
+		};
+	}
+}
 /** Runs the only interactive terminal approval path; the owner, not this client, made every pending-target selector. */
 async function runTerminalApprovalFlow(input) {
 	const start = await input.start(input.approvalId);
@@ -21150,13 +21457,14 @@ async function runTerminalApprovalFlow(input) {
 		const selector = start.pendingTargetSelectors[index];
 		if (selector === void 0) continue;
 		const answer = await input.terminal.question(`Test pending target ${index + 1} with the fixed synthetic payload before approving? [y/N] `);
-		if (/^\s*(?:y|yes)\s*$/iu.test(answer)) input.print(await input.testPendingTarget(selector));
+		if (/^\s*(?:y|yes)\s*$/iu.test(answer)) input.print(await optionalTest({ pendingTarget: index + 1 }, () => input.testPendingTarget(selector)));
 	}
 	for (let index = 0; index < start.pendingRuleJudgeTestSelectors.length; index += 1) {
 		const selector = start.pendingRuleJudgeTestSelectors[index];
 		if (selector === void 0) continue;
 		const answer = await input.terminal.question(`Test pending rule judge ${index + 1} with the fixed synthetic payload before approving? [y/N] `);
-		if (/^\s*(?:y|yes)\s*$/iu.test(answer) && input.testPendingRuleJudge !== void 0) input.print(await input.testPendingRuleJudge(selector));
+		const testPendingRuleJudge = input.testPendingRuleJudge;
+		if (/^\s*(?:y|yes)\s*$/iu.test(answer) && testPendingRuleJudge !== void 0) input.print(await optionalTest({ pendingRuleJudge: index + 1 }, () => testPendingRuleJudge(selector)));
 	}
 	const answer = await input.terminal.question(`Type this approval challenge: ${escapeForDisplay(start.challenge)}\n> `);
 	input.print(await input.approve(input.approvalId, answer));
@@ -21176,8 +21484,13 @@ async function run(argv, deps = {}) {
 		stdout: process.stdout,
 		stderr: process.stderr
 	};
+	if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-V")) {
+		streams.stdout.write(`${VERSION}\n`);
+		return 0;
+	}
 	const env = deps.env ?? process.env;
 	const program = new Command();
+	runEnvironment.set(program, env);
 	let ran = false;
 	program.name("agent-events").description("The local event-emission service: one foreground owner and local control clients.").option("--json", "write machine-readable output").option("--no-color", "never colour the output").option("--config-dir <dir>", "pin the configuration directory for this run").option("--state-dir <dir>", "pin the state directory for this run").option("--data-dir <dir>", "pin the data directory for this run").option("--secrets-dir <dir>", "pin the secrets directory for this run").option("--downloads-dir <dir>", "pin the downloads directory for this run").configureOutput({
 		writeOut: (text) => streams.stdout.write(escapeForDisplay(text)),
@@ -21610,10 +21923,19 @@ async function run(argv, deps = {}) {
 		return 1;
 	}
 }
+/**
+* The state directory a control client looks in: the one pinned for this run, or the one the environment this CLI was
+* given resolves to. A caller that passes its own `env` to `run` reaches its own owner, never the one the process
+* environment names.
+*/
 function controlOptions(program) {
 	const { stateDir } = program.opts();
-	return stateDir === void 0 ? {} : { stateDir };
+	if (stateDir !== void 0) return { stateDir };
+	const env = runEnvironment.get(program);
+	return env === void 0 ? {} : { stateDir: resolvePaths({ env }).stateDir };
 }
+/** The environment each program was made with, read by `controlOptions` outside `run`'s closure. */
+const runEnvironment = /* @__PURE__ */ new WeakMap();
 function parseVersion(value) {
 	const version = Number(value);
 	if (!Number.isSafeInteger(version) || version < 1) throw new CommsError("USAGE", "rule version must be a positive integer");