@caupulican/pi-adaptative 0.86.3 → 0.86.5

package/dist/core/orchestration/task-runtime.js

@@ -1,863 +1,19 @@
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { createAgentIdentity } from "./agent-resume.js";
-import { validateAttemptUsageSnapshot } from "./attempt-usage.js";
-import { isHarnessCapability, MAX_ORCHESTRATION_COLLECTION_LENGTH, MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH, MAX_ORCHESTRATION_IDENTIFIER_LENGTH, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH, ORCHESTRATION_SCHEMA_VERSION, toJsonObject, } from "./contracts.js";
+import { MAX_ORCHESTRATION_AGENT_BINDINGS, MAX_ORCHESTRATION_APPROVALS, MAX_ORCHESTRATION_ATTEMPTS, MAX_ORCHESTRATION_CHECKPOINTS, MAX_ORCHESTRATION_NOTIFICATIONS, MAX_ORCHESTRATION_OBJECTIVE_EVIDENCE, MAX_ORCHESTRATION_OBJECTIVES, MAX_ORCHESTRATION_TASKS, ORCHESTRATION_SCHEMA_VERSION, toJsonObject, } from "./contracts.js";
 import { OrchestrationSnapshotRequiredError } from "./event-store.js";
-import { validateRiskBudget } from "./risk-budget.js";
-import { parseWorkerExecutionContract } from "./worker-execution-contract.js";
-const MAX_DATE_EPOCH_MS = 8_640_000_000_000_000;
-export class DurableTaskRuntimeError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "DurableTaskRuntimeError";
-    }
-}
-function emptyProjection() {
-    return {
-        lastOrdinal: 0,
-        agents: {},
-        objectives: {},
-        tasks: {},
-        attempts: {},
-        checkpoints: {},
-        approvals: {},
-        notifications: {},
-    };
-}
-function cloneProjection(state) {
-    return structuredClone(state);
-}
-function projectionFromSnapshot(projection, throughOrdinal) {
-    const candidate = record(projection, "orchestration projection snapshot");
-    if (candidate.lastOrdinal !== throughOrdinal) {
-        throw new DurableTaskRuntimeError("Orchestration projection snapshot ordinal does not match its baseline.");
-    }
-    for (const field of [
-        "agents",
-        "objectives",
-        "tasks",
-        "attempts",
-        "checkpoints",
-        "approvals",
-        "notifications",
-    ]) {
-        record(candidate[field], `orchestration projection snapshot.${field}`);
-    }
-    const normalized = structuredClone(candidate);
-    const agents = normalized.agents;
-    for (const [agentId, agent] of Object.entries(agents)) {
-        agents[agentId] = normalizeAgentBinding(agent, `orchestration projection snapshot.agents.${agentId}`);
-    }
-    return normalized;
-}
-function record(value, label) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        throw new DurableTaskRuntimeError(`${label} is not an object.`);
-    }
-    return value;
-}
-function string(value, label) {
-    if (typeof value !== "string" || value.length === 0)
-        throw new DurableTaskRuntimeError(`${label} is required.`);
-    return value;
-}
-function number(value, label) {
-    if (typeof value !== "number" || !Number.isFinite(value))
-        throw new DurableTaskRuntimeError(`${label} is invalid.`);
-    return value;
-}
-function boolean(value, label) {
-    if (typeof value !== "boolean")
-        throw new DurableTaskRuntimeError(`${label} is invalid.`);
-    return value;
-}
-function assertRiskBudget(budget, label) {
-    try {
-        validateRiskBudget(budget ?? {}, label);
-    }
-    catch (error) {
-        throw new DurableTaskRuntimeError(error instanceof Error ? error.message : String(error));
-    }
-}
-function stringArray(value, label) {
-    if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
-        throw new DurableTaskRuntimeError(`${label} must be a string array.`);
-    }
-    return [...value];
-}
-function dispatchIdentifier(value, label) {
-    const identifier = string(value, label);
-    if (identifier.length > MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
-        throw new DurableTaskRuntimeError(`${label} exceeds its durable size bound.`);
-    }
-    return identifier;
-}
-function optionalDispatchIdentifier(value, label, maxLength = MAX_ORCHESTRATION_IDENTIFIER_LENGTH) {
-    if (value === undefined)
-        return undefined;
-    const identifier = string(value, label);
-    if (identifier.length > maxLength)
-        throw new DurableTaskRuntimeError(`${label} exceeds its durable size bound.`);
-    return identifier;
-}
-function dispatchInstructions(value, label) {
-    const instructions = string(value, label);
-    if (instructions.length > MAX_ORCHESTRATION_DISPATCH_INSTRUCTIONS_LENGTH) {
-        throw new DurableTaskRuntimeError(`${label} exceeds its durable size bound.`);
-    }
-    return instructions;
-}
-function dispatchIdentifierArray(value, label) {
-    if (!Array.isArray(value) ||
-        value.length > MAX_ORCHESTRATION_COLLECTION_LENGTH ||
-        !value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= MAX_ORCHESTRATION_IDENTIFIER_LENGTH)) {
-        throw new DurableTaskRuntimeError(`${label} must be a bounded identifier array.`);
-    }
-    if (new Set(value).size !== value.length) {
-        throw new DurableTaskRuntimeError(`${label} contains duplicates.`);
-    }
-    return [...value];
-}
-const DISPATCH_FIELDS = new Set([
-    "taskId",
-    "profileId",
-    "instructions",
-    "resourcePointerIds",
-    "parentAgentId",
-    "requirementIds",
-    "executionKind",
-    "logicalLaneId",
-    "dispatchSequence",
-    "provider",
-    "authorizationId",
-    "worktreeLaneKey",
-    "executionContract",
-]);
-function dispatchFromValue(value, label) {
-    const dispatch = record(value, label);
-    const unsupportedField = Object.keys(dispatch).find((field) => !DISPATCH_FIELDS.has(field));
-    if (unsupportedField)
-        throw new DurableTaskRuntimeError(`${label}.${unsupportedField} is unsupported.`);
-    const executionKind = dispatch.executionKind;
-    if (executionKind !== undefined && executionKind !== "in-process" && executionKind !== "managed-process") {
-        throw new DurableTaskRuntimeError(`${label}.executionKind is invalid.`);
-    }
-    const logicalLaneId = optionalDispatchIdentifier(dispatch.logicalLaneId, `${label}.logicalLaneId`);
-    const parentAgentId = optionalDispatchIdentifier(dispatch.parentAgentId, `${label}.parentAgentId`);
-    const provider = optionalDispatchIdentifier(dispatch.provider, `${label}.provider`, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH);
-    const authorizationId = optionalDispatchIdentifier(dispatch.authorizationId, `${label}.authorizationId`);
-    const worktreeLaneKey = optionalDispatchIdentifier(dispatch.worktreeLaneKey, `${label}.worktreeLaneKey`);
-    if (dispatch.dispatchSequence !== undefined &&
-        (!Number.isSafeInteger(dispatch.dispatchSequence) || Number(dispatch.dispatchSequence) < 1)) {
-        throw new DurableTaskRuntimeError(`${label}.dispatchSequence is invalid.`);
-    }
-    let executionContract;
-    try {
-        executionContract = dispatch.executionContract
-            ? parseWorkerExecutionContract(dispatch.executionContract)
-            : undefined;
-    }
-    catch (error) {
-        throw new DurableTaskRuntimeError(error instanceof Error ? error.message : String(error));
-    }
-    if (executionContract && executionKind === "managed-process") {
-        throw new DurableTaskRuntimeError(`${label} cannot combine a worker execution contract with managed execution.`);
-    }
-    return {
-        taskId: dispatchIdentifier(dispatch.taskId, `${label}.taskId`),
-        profileId: dispatchIdentifier(dispatch.profileId, `${label}.profileId`),
-        instructions: dispatchInstructions(dispatch.instructions, `${label}.instructions`),
-        resourcePointerIds: dispatchIdentifierArray(dispatch.resourcePointerIds, `${label}.resourcePointerIds`),
-        ...(parentAgentId ? { parentAgentId } : {}),
-        requirementIds: dispatch.requirementIds === undefined
-            ? []
-            : dispatchIdentifierArray(dispatch.requirementIds, `${label}.requirementIds`),
-        ...(executionKind ? { executionKind } : {}),
-        ...(logicalLaneId ? { logicalLaneId } : {}),
-        ...(typeof dispatch.dispatchSequence === "number" ? { dispatchSequence: dispatch.dispatchSequence } : {}),
-        ...(provider ? { provider } : {}),
-        ...(authorizationId ? { authorizationId } : {}),
-        ...(worktreeLaneKey ? { worktreeLaneKey } : {}),
-        ...(executionContract ? { executionContract } : {}),
-    };
-}
-function objectiveFromPayload(payload) {
-    return structuredClone(record(payload.objective, "objective"));
-}
-function evidenceFromPayload(payload) {
-    return structuredClone(record(payload.evidence, "evidence"));
-}
-function assertAcceptanceCriteria(criteria) {
-    const criterionIds = criteria.map((criterion) => criterion.id);
-    if (criterionIds.some((id) => !id.trim()) ||
-        new Set(criterionIds).size !== criterionIds.length ||
-        criteria.some((criterion) => !criterion.description.trim())) {
-        throw new DurableTaskRuntimeError("Objective acceptance criteria require unique ids and descriptions.");
-    }
-}
-function taskFromPayload(payload) {
-    return structuredClone(record(payload.task, "task"));
-}
-function leaseFromPayload(payload) {
-    const lease = record(payload.lease, "lease");
-    return {
-        leaseId: string(lease.leaseId, "lease.leaseId"),
-        attemptId: string(lease.attemptId, "lease.attemptId"),
-        ownerId: string(lease.ownerId, "lease.ownerId"),
-        fencingToken: number(lease.fencingToken, "lease.fencingToken"),
-        issuedAt: string(lease.issuedAt, "lease.issuedAt"),
-        expiresAt: string(lease.expiresAt, "lease.expiresAt"),
-    };
-}
-function checkpointFromPayload(payload) {
-    const checkpoint = record(payload.checkpoint, "checkpoint");
-    const usage = checkpoint.usage === undefined ? undefined : usageFromPayload(checkpoint.usage, "checkpoint.usage");
-    return {
-        checkpointId: string(checkpoint.checkpointId, "checkpoint.checkpointId"),
-        attemptId: string(checkpoint.attemptId, "checkpoint.attemptId"),
-        fencingToken: number(checkpoint.fencingToken, "checkpoint.fencingToken"),
-        summary: string(checkpoint.summary, "checkpoint.summary"),
-        artifactIds: stringArray(checkpoint.artifactIds, "checkpoint.artifactIds"),
-        evidenceIds: stringArray(checkpoint.evidenceIds, "checkpoint.evidenceIds"),
-        ...(usage ? { usage } : {}),
-        createdAt: string(checkpoint.createdAt, "checkpoint.createdAt"),
-    };
-}
-function usageFromPayload(value, label) {
-    const usage = record(value, label);
-    const expectedFields = [
-        "toolCalls",
-        "inputTokens",
-        "outputTokens",
-        "cacheReadTokens",
-        "cacheWriteTokens",
-        "totalTokens",
-        "costUsd",
-        "activeWallClockMs",
-    ];
-    const unexpected = Object.keys(usage).find((field) => !expectedFields.includes(field));
-    if (unexpected)
-        throw new DurableTaskRuntimeError(`${label}.${unexpected} is unsupported.`);
-    try {
-        return validateAttemptUsageSnapshot({
-            toolCalls: number(usage.toolCalls, `${label}.toolCalls`),
-            inputTokens: number(usage.inputTokens, `${label}.inputTokens`),
-            outputTokens: number(usage.outputTokens, `${label}.outputTokens`),
-            cacheReadTokens: number(usage.cacheReadTokens, `${label}.cacheReadTokens`),
-            cacheWriteTokens: number(usage.cacheWriteTokens, `${label}.cacheWriteTokens`),
-            totalTokens: number(usage.totalTokens, `${label}.totalTokens`),
-            costUsd: number(usage.costUsd, `${label}.costUsd`),
-            activeWallClockMs: number(usage.activeWallClockMs, `${label}.activeWallClockMs`),
-        }, label);
-    }
-    catch (error) {
-        throw new DurableTaskRuntimeError(error instanceof Error ? error.message : String(error));
-    }
-}
-function resultFromPayload(payload) {
-    return structuredClone(record(payload.result, "result"));
-}
-function normalizeAgentBinding(value, label) {
-    const agent = structuredClone(record(value, label));
-    if (!agent.agentId?.trim())
-        throw new DurableTaskRuntimeError(`${label}.agentId is required.`);
-    const parentAgentId = agent.parentAgentId?.trim();
-    const rootAgentId = agent.rootAgentId?.trim() || agent.agentId;
-    const depth = agent.depth ?? 0;
-    if (!rootAgentId || !Number.isSafeInteger(depth) || depth < 0) {
-        throw new DurableTaskRuntimeError(`${label} lineage is invalid.`);
-    }
-    if (parentAgentId && depth === 0)
-        throw new DurableTaskRuntimeError(`${label} child lineage depth is invalid.`);
-    return {
-        ...agent,
-        ...(parentAgentId ? { parentAgentId } : {}),
-        rootAgentId,
-        depth,
-    };
-}
-function agentFromPayload(payload) {
-    return normalizeAgentBinding(payload.agent, "agent");
-}
-function approvalFromPayload(payload) {
-    const approval = record(payload.approval, "approval");
-    const capabilities = stringArray(approval.requestedCapabilities, "approval.requestedCapabilities");
-    if (!capabilities.every(isHarnessCapability)) {
-        throw new DurableTaskRuntimeError("Approval contains an unknown capability.");
-    }
-    const requestedBudget = approval.requestedBudget
-        ? structuredClone(record(approval.requestedBudget, "approval.requestedBudget"))
-        : undefined;
-    assertRiskBudget(requestedBudget, "approval.requestedBudget");
-    if (capabilities.length === 0 && !requestedBudget) {
-        throw new DurableTaskRuntimeError("Approval must request capabilities or budget.");
-    }
-    if (approval.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {
-        throw new DurableTaskRuntimeError("Approval schema version is invalid.");
-    }
-    return {
-        schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
-        approvalId: string(approval.approvalId, "approval.approvalId"),
-        objectiveId: string(approval.objectiveId, "approval.objectiveId"),
-        ...(typeof approval.taskId === "string" ? { taskId: string(approval.taskId, "approval.taskId") } : {}),
-        ...(typeof approval.attemptId === "string"
-            ? { attemptId: string(approval.attemptId, "approval.attemptId") }
-            : {}),
-        reasonCode: string(approval.reasonCode, "approval.reasonCode"),
-        summary: string(approval.summary, "approval.summary"),
-        requestedCapabilities: capabilities,
-        ...(requestedBudget ? { requestedBudget } : {}),
-        reversible: boolean(approval.reversible, "approval.reversible"),
-        createdAt: string(approval.createdAt, "approval.createdAt"),
-    };
-}
-function approvalResolutionFromPayload(payload) {
-    const resolution = record(payload.resolution, "resolution");
-    if (resolution.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION) {
-        throw new DurableTaskRuntimeError("Approval resolution schema version is invalid.");
-    }
-    const outcome = string(resolution.outcome, "resolution.outcome");
-    if (outcome !== "approved" && outcome !== "rejected") {
-        throw new DurableTaskRuntimeError(`Unknown approval outcome '${outcome}'.`);
-    }
-    return {
-        schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
-        approvalId: string(resolution.approvalId, "resolution.approvalId"),
-        outcome,
-        reasonCode: string(resolution.reasonCode, "resolution.reasonCode"),
-        resolvedAt: string(resolution.resolvedAt, "resolution.resolvedAt"),
-    };
-}
-function updateObjectiveStatus(state, objectiveId, status, at) {
-    const current = state.objectives[objectiveId];
-    if (!current)
-        throw new DurableTaskRuntimeError(`Unknown objective '${objectiveId}'.`);
-    state.objectives[objectiveId] = {
-        ...current,
-        objective: { ...current.objective, status, updatedAt: at },
-    };
-}
-function terminalAttemptStatus(status) {
-    return ["completed", "partial", "blocked", "failed", "cancelled", "expired"].includes(status);
-}
-function cancelOpenObjectiveWork(state, objectiveId, at, reasonCode) {
-    const objective = state.objectives[objectiveId];
-    const tasks = state.tasks;
-    const attempts = state.attempts;
-    for (const taskId of objective?.taskIds ?? []) {
-        const taskState = tasks[taskId];
-        if (taskState && !["completed", "failed", "cancelled"].includes(taskState.task.status)) {
-            tasks[taskId] = {
-                ...taskState,
-                task: { ...taskState.task, status: "cancelled", updatedAt: at },
-            };
-        }
-        for (const attemptId of taskState?.attemptIds ?? []) {
-            const attempt = attempts[attemptId];
-            if (attempt && !terminalAttemptStatus(attempt.status)) {
-                attempts[attemptId] = { ...attempt, status: "cancelled", reasonCode, updatedAt: at };
-            }
-        }
-    }
-}
-function taskStatusForResult(status) {
-    if (status === "completed")
-        return "completed";
-    if (status === "failed")
-        return "failed";
-    if (status === "cancelled")
-        return "cancelled";
-    return "blocked";
-}
-function releaseAttemptAgent(agents, attempt, at) {
-    if (!attempt.agentId)
-        return;
-    const agent = agents[attempt.agentId];
-    if (!agent)
-        return;
-    const next = { ...agent, status: "registered", updatedAt: at };
-    delete next.activeAttemptId;
-    agents[attempt.agentId] = next;
-}
-function missingTrustedCriteria(result, criterionIds) {
-    const proven = new Set(result.evidence.flatMap((evidence) => (evidence.trusted && evidence.criterionId ? [evidence.criterionId] : [])));
-    return criterionIds.filter((criterionId) => !proven.has(criterionId));
-}
-function refreshReadyTasks(state, objectiveId, at) {
-    const objective = state.objectives[objectiveId];
-    if (!objective || objective.objective.status !== "active")
-        return;
-    const mutableTasks = state.tasks;
-    for (const taskId of objective.taskIds) {
-        const current = mutableTasks[taskId];
-        if (!current || current.task.status !== "pending")
-            continue;
-        if (current.task.dependsOn.every((dependencyId) => mutableTasks[dependencyId]?.task.status === "completed")) {
-            mutableTasks[taskId] = { ...current, task: { ...current.task, status: "ready", updatedAt: at } };
-        }
-    }
-}
-export function reduceOrchestrationEvent(projection, event) {
-    if (event.ordinal <= projection.lastOrdinal)
-        return projection;
-    const state = cloneProjection(projection);
-    const agents = state.agents;
-    const objectives = state.objectives;
-    const tasks = state.tasks;
-    const attempts = state.attempts;
-    const checkpoints = state.checkpoints;
-    const approvals = state.approvals;
-    const notifications = state.notifications;
-    switch (event.type) {
-        case "objective.created": {
-            const objective = objectiveFromPayload(event.payload);
-            if (objectives[objective.objectiveId]) {
-                throw new DurableTaskRuntimeError(`Objective '${objective.objectiveId}' was created more than once.`);
-            }
-            objectives[objective.objectiveId] = { objective, taskIds: [], evidence: [] };
-            break;
-        }
-        case "objective.updated": {
-            const objective = objectiveFromPayload(event.payload);
-            const current = objectives[event.aggregateId];
-            if (!current)
-                throw new DurableTaskRuntimeError(`Unknown objective '${event.aggregateId}'.`);
-            if (objective.objectiveId !== event.aggregateId) {
-                throw new DurableTaskRuntimeError(`Updated objective id '${objective.objectiveId}' does not match aggregate.`);
-            }
-            objectives[event.aggregateId] = { ...current, objective };
-            break;
-        }
-        case "objective.evidence_recorded": {
-            const evidence = evidenceFromPayload(event.payload);
-            const current = objectives[event.aggregateId];
-            if (!current)
-                throw new DurableTaskRuntimeError(`Unknown objective '${event.aggregateId}'.`);
-            const existing = current.evidence.find((candidate) => candidate.evidenceId === evidence.evidenceId);
-            if (existing && !isDeepStrictEqual(existing, evidence)) {
-                throw new DurableTaskRuntimeError(`Objective evidence '${evidence.evidenceId}' has conflicting content.`);
-            }
-            if (!existing)
-                objectives[event.aggregateId] = { ...current, evidence: [...current.evidence, evidence] };
-            break;
-        }
-        case "objective.paused":
-            updateObjectiveStatus(state, event.aggregateId, "paused", event.occurredAt);
-            break;
-        case "objective.resumed":
-            updateObjectiveStatus(state, event.aggregateId, "active", event.occurredAt);
-            refreshReadyTasks(state, event.aggregateId, event.occurredAt);
-            break;
-        case "objective.completed":
-            updateObjectiveStatus(state, event.aggregateId, "completed", event.occurredAt);
-            cancelOpenObjectiveWork(state, event.aggregateId, event.occurredAt, "objective_completed");
-            break;
-        case "objective.cancelled": {
-            updateObjectiveStatus(state, event.aggregateId, "cancelled", event.occurredAt);
-            cancelOpenObjectiveWork(state, event.aggregateId, event.occurredAt, "objective_cancelled");
-            break;
-        }
-        case "task.created": {
-            const task = taskFromPayload(event.payload);
-            const objective = objectives[task.objectiveId];
-            if (!objective)
-                throw new DurableTaskRuntimeError(`Task '${task.taskId}' references an unknown objective.`);
-            if (tasks[task.taskId])
-                throw new DurableTaskRuntimeError(`Task '${task.taskId}' was created more than once.`);
-            tasks[task.taskId] = { task, attemptIds: [] };
-            objectives[task.objectiveId] = { ...objective, taskIds: [...objective.taskIds, task.taskId] };
-            refreshReadyTasks(state, task.objectiveId, event.occurredAt);
-            break;
-        }
-        case "task.ready": {
-            const taskId = string(event.payload.taskId, "task.ready.taskId");
-            const current = tasks[taskId];
-            if (!current)
-                throw new DurableTaskRuntimeError(`Unknown task '${taskId}'.`);
-            tasks[taskId] = { ...current, task: { ...current.task, status: "ready", updatedAt: event.occurredAt } };
-            break;
-        }
-        case "task.failed": {
-            const taskId = string(event.payload.taskId, "task.failed.taskId");
-            const current = tasks[taskId];
-            if (!current)
-                throw new DurableTaskRuntimeError(`Unknown task '${taskId}'.`);
-            tasks[taskId] = { ...current, task: { ...current.task, status: "failed", updatedAt: event.occurredAt } };
-            break;
-        }
-        case "task.verification_finished": {
-            const taskId = string(event.payload.taskId, "task.verification_finished.taskId");
-            const verifierTaskId = string(event.payload.verifierTaskId, "task.verification_finished.verifierTaskId");
-            const verifierAttemptId = string(event.payload.verifierAttemptId, "task.verification_finished.verifierAttemptId");
-            const verdict = string(event.payload.verdict, "task.verification_finished.verdict");
-            if (verdict !== "accepted" && verdict !== "rejected" && verdict !== "inconclusive") {
-                throw new DurableTaskRuntimeError(`Unknown verification verdict '${verdict}'.`);
-            }
-            const current = tasks[taskId];
-            if (!current)
-                throw new DurableTaskRuntimeError(`Unknown task '${taskId}'.`);
-            const reasonCode = string(event.payload.reasonCode, "task.verification_finished.reasonCode");
-            tasks[taskId] = {
-                ...current,
-                task: {
-                    ...current.task,
-                    status: verdict === "accepted" ? "completed" : "blocked",
-                    updatedAt: event.occurredAt,
-                },
-                verification: {
-                    verifierTaskId,
-                    verifierAttemptId,
-                    verdict,
-                    reasonCode,
-                    completedAt: event.occurredAt,
-                },
-            };
-            refreshReadyTasks(state, current.task.objectiveId, event.occurredAt);
-            break;
-        }
-        case "agent.registered": {
-            const agent = agentFromPayload(event.payload);
-            if (agents[agent.agentId])
-                throw new DurableTaskRuntimeError(`Agent '${agent.agentId}' was registered more than once.`);
-            if (agent.parentAgentId) {
-                const parent = agents[agent.parentAgentId];
-                if (!parent)
-                    throw new DurableTaskRuntimeError(`Unknown parent agent '${agent.parentAgentId}'.`);
-                if (agent.rootAgentId !== parent.rootAgentId || agent.depth !== parent.depth + 1) {
-                    throw new DurableTaskRuntimeError(`Agent '${agent.agentId}' lineage conflicts with its parent.`);
-                }
-            }
-            else if (agent.rootAgentId !== agent.agentId || agent.depth !== 0) {
-                throw new DurableTaskRuntimeError(`Root agent '${agent.agentId}' lineage is invalid.`);
-            }
-            agents[agent.agentId] = agent;
-            break;
-        }
-        case "agent.suspended": {
-            const agentId = string(event.payload.agentId, "agent.suspended.agentId");
-            const agent = agents[agentId];
-            if (!agent)
-                throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-            agents[agentId] = { ...agent, status: "suspended", updatedAt: event.occurredAt };
-            break;
-        }
-        case "agent.resume_requested": {
-            const agentId = string(event.payload.agentId, "agent.resume_requested.agentId");
-            const agent = agents[agentId];
-            if (!agent)
-                throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-            agents[agentId] = { ...agent, status: "resuming", updatedAt: event.occurredAt };
-            break;
-        }
-        case "agent.resumed": {
-            const agentId = string(event.payload.agentId, "agent.resumed.agentId");
-            const attemptId = string(event.payload.attemptId, "agent.resumed.attemptId");
-            const agent = agents[agentId];
-            if (!agent)
-                throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-            agents[agentId] = { ...agent, status: "active", activeAttemptId: attemptId, updatedAt: event.occurredAt };
-            break;
-        }
-        case "attempt.queued": {
-            const attemptId = string(event.payload.attemptId, "attempt.queued.attemptId");
-            const taskId = string(event.payload.taskId, "attempt.queued.taskId");
-            const task = tasks[taskId];
-            if (!task)
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' references an unknown task.`);
-            if (attempts[attemptId])
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' was queued more than once.`);
-            const dispatch = dispatchFromValue(event.payload.dispatch, "attempt.queued.dispatch");
-            if (dispatch.taskId !== taskId) {
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' dispatch task does not match its task.`);
-            }
-            if (dispatch.executionContract &&
-                (dispatch.executionContract.worker.profile.profileId !== dispatch.profileId ||
-                    dispatch.executionContract.worker.profile.role !== task.task.role)) {
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' execution contract does not match its dispatch.`);
-            }
-            attempts[attemptId] = {
-                attemptId,
-                taskId,
-                dispatch,
-                status: "queued",
-                ...(typeof event.payload.grantId === "string" ? { grantId: event.payload.grantId } : {}),
-                checkpointIds: [],
-                createdAt: event.occurredAt,
-                updatedAt: event.occurredAt,
-            };
-            tasks[taskId] = {
-                ...task,
-                task: { ...task.task, status: "running", updatedAt: event.occurredAt },
-                attemptIds: [...task.attemptIds, attemptId],
-            };
-            break;
-        }
-        case "attempt.grant_bound": {
-            const attemptId = string(event.payload.attemptId, "attempt.grant_bound.attemptId");
-            const attempt = attempts[attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${attemptId}'.`);
-            const grant = event.payload.grant
-                ? structuredClone(record(event.payload.grant, "attempt.grant_bound.grant"))
-                : undefined;
-            attempts[attemptId] = {
-                ...attempt,
-                grantId: grant?.grantId ?? string(event.payload.grantId, "attempt.grant_bound.grantId"),
-                ...(grant ? { grant } : {}),
-                updatedAt: event.occurredAt,
-            };
-            break;
-        }
-        case "attempt.leased": {
-            const lease = leaseFromPayload(event.payload);
-            const attempt = attempts[lease.attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${lease.attemptId}'.`);
-            const agentId = typeof event.payload.agentId === "string" ? event.payload.agentId : undefined;
-            if (agentId) {
-                const agent = agents[agentId];
-                if (!agent)
-                    throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-                agents[agentId] = {
-                    ...agent,
-                    status: "active",
-                    activeAttemptId: lease.attemptId,
-                    updatedAt: event.occurredAt,
-                };
-            }
-            attempts[lease.attemptId] = {
-                ...attempt,
-                status: "leased",
-                lease,
-                ...(agentId ? { agentId } : {}),
-                updatedAt: event.occurredAt,
-            };
-            break;
-        }
-        case "attempt.started": {
-            const attemptId = string(event.payload.attemptId, "attempt.started.attemptId");
-            const attempt = attempts[attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${attemptId}'.`);
-            attempts[attemptId] = { ...attempt, status: "running", updatedAt: event.occurredAt };
-            break;
-        }
-        case "attempt.checkpointed": {
-            const checkpoint = checkpointFromPayload(event.payload);
-            const attempt = attempts[checkpoint.attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${checkpoint.attemptId}'.`);
-            checkpoints[checkpoint.checkpointId] = checkpoint;
-            attempts[checkpoint.attemptId] = {
-                ...attempt,
-                checkpointIds: [...attempt.checkpointIds, checkpoint.checkpointId],
-                updatedAt: event.occurredAt,
-            };
-            if (attempt.agentId) {
-                const agent = agents[attempt.agentId];
-                if (agent) {
-                    agents[attempt.agentId] = {
-                        ...agent,
-                        resumeContext: { ...agent.resumeContext, latestCheckpointId: checkpoint.checkpointId },
-                        updatedAt: event.occurredAt,
-                    };
-                }
-            }
-            break;
-        }
-        case "attempt.suspended": {
-            const attemptId = string(event.payload.attemptId, "attempt.suspended.attemptId");
-            const attempt = attempts[attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${attemptId}'.`);
-            const leaseId = string(event.payload.leaseId, "attempt.suspended.leaseId");
-            const fencingToken = number(event.payload.fencingToken, "attempt.suspended.fencingToken");
-            if (!attempt.lease || attempt.lease.leaseId !== leaseId || attempt.lease.fencingToken !== fencingToken) {
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' lease or fencing token is stale.`);
-            }
-            if (attempt.status !== "leased" && attempt.status !== "running") {
-                throw new DurableTaskRuntimeError(`Attempt '${attemptId}' cannot suspend from '${attempt.status}'.`);
-            }
-            attempts[attemptId] = {
-                ...attempt,
-                status: "suspended",
-                ...(typeof event.payload.reasonCode === "string" ? { reasonCode: event.payload.reasonCode } : {}),
-                updatedAt: event.occurredAt,
-            };
-            if (attempt.agentId) {
-                const agent = agents[attempt.agentId];
-                if (agent)
-                    agents[attempt.agentId] = { ...agent, status: "suspended", updatedAt: event.occurredAt };
-            }
-            break;
-        }
-        case "attempt.resumed": {
-            const lease = leaseFromPayload(event.payload);
-            const agentId = string(event.payload.agentId, "attempt.resumed.agentId");
-            const attempt = attempts[lease.attemptId];
-            const agent = agents[agentId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${lease.attemptId}'.`);
-            if (!agent)
-                throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-            attempts[lease.attemptId] = {
-                ...attempt,
-                status: "leased",
-                agentId,
-                lease,
-                updatedAt: event.occurredAt,
-            };
-            agents[agentId] = {
-                ...agent,
-                status: "active",
-                activeAttemptId: lease.attemptId,
-                updatedAt: event.occurredAt,
-            };
-            break;
-        }
-        case "attempt.cancelled": {
-            const attemptId = string(event.payload.attemptId, "attempt.cancelled.attemptId");
-            const attempt = attempts[attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${attemptId}'.`);
-            attempts[attemptId] = {
-                ...attempt,
-                status: "cancelled",
-                reasonCode: string(event.payload.reasonCode, "attempt.cancelled.reasonCode"),
-                updatedAt: event.occurredAt,
-            };
-            const task = tasks[attempt.taskId];
-            if (task) {
-                tasks[attempt.taskId] = {
-                    ...task,
-                    task: { ...task.task, status: "cancelled", updatedAt: event.occurredAt },
-                };
-            }
-            releaseAttemptAgent(agents, attempt, event.occurredAt);
-            break;
-        }
-        case "attempt.finished": {
-            const result = resultFromPayload(event.payload);
-            const attempt = attempts[result.attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${result.attemptId}'.`);
-            attempts[result.attemptId] = { ...attempt, status: result.status, result, updatedAt: event.occurredAt };
-            const task = tasks[result.taskId];
-            if (!task)
-                throw new DurableTaskRuntimeError(`Unknown task '${result.taskId}'.`);
-            tasks[result.taskId] = {
-                ...task,
-                task: { ...task.task, status: taskStatusForResult(result.status), updatedAt: event.occurredAt },
-            };
-            releaseAttemptAgent(agents, attempt, event.occurredAt);
-            refreshReadyTasks(state, task.task.objectiveId, event.occurredAt);
-            break;
-        }
-        case "attempt.lease_expired": {
-            const attemptId = string(event.payload.attemptId, "attempt.lease_expired.attemptId");
-            const attempt = attempts[attemptId];
-            if (!attempt)
-                throw new DurableTaskRuntimeError(`Unknown attempt '${attemptId}'.`);
-            attempts[attemptId] = {
-                ...attempt,
-                status: "expired",
-                ...(typeof event.payload.reasonCode === "string" ? { reasonCode: event.payload.reasonCode } : {}),
-                updatedAt: event.occurredAt,
-            };
-            const task = tasks[attempt.taskId];
-            if (task)
-                tasks[attempt.taskId] = { ...task, task: { ...task.task, status: "ready", updatedAt: event.occurredAt } };
-            break;
-        }
-        case "approval.requested": {
-            const approval = approvalFromPayload(event.payload);
-            if (approvals[approval.approvalId]) {
-                throw new DurableTaskRuntimeError(`Approval '${approval.approvalId}' was requested more than once.`);
-            }
-            approvals[approval.approvalId] = { request: approval, status: "pending" };
-            const notificationId = `approval-requested:${approval.approvalId}`;
-            if (notifications[notificationId]) {
-                throw new DurableTaskRuntimeError(`Notification '${notificationId}' already exists.`);
-            }
-            notifications[notificationId] = {
-                notificationId,
-                objectiveId: approval.objectiveId,
-                ...(approval.attemptId ? { attemptId: approval.attemptId } : {}),
-                status: "pending",
-                message: approval.summary,
-                createdAt: event.occurredAt,
-            };
-            break;
-        }
-        case "approval.resolved": {
-            const resolution = approvalResolutionFromPayload(event.payload);
-            const approval = approvals[resolution.approvalId];
-            if (!approval)
-                throw new DurableTaskRuntimeError(`Unknown approval '${resolution.approvalId}'.`);
-            approvals[resolution.approvalId] = {
-                ...approval,
-                status: resolution.outcome,
-                resolution,
-            };
-            const approvalNotification = notifications[`approval-requested:${resolution.approvalId}`];
-            if (approvalNotification?.status === "pending") {
-                notifications[approvalNotification.notificationId] = {
-                    ...approvalNotification,
-                    status: "delivered",
-                    deliveredAt: event.occurredAt,
-                };
-            }
-            if (resolution.outcome === "rejected" && approval.request.attemptId) {
-                const attempt = attempts[approval.request.attemptId];
-                if (attempt && !terminalAttemptStatus(attempt.status)) {
-                    attempts[attempt.attemptId] = {
-                        ...attempt,
-                        status: "blocked",
-                        reasonCode: "approval_rejected",
-                        updatedAt: event.occurredAt,
-                    };
-                    const task = tasks[attempt.taskId];
-                    if (task) {
-                        tasks[attempt.taskId] = {
-                            ...task,
-                            task: { ...task.task, status: "blocked", updatedAt: event.occurredAt },
-                        };
-                    }
-                }
-            }
-            break;
-        }
-        case "notification.enqueued": {
-            const notificationId = string(event.payload.notificationId, "notification.enqueued.notificationId");
-            notifications[notificationId] = {
-                notificationId,
-                objectiveId: string(event.payload.objectiveId, "notification.enqueued.objectiveId"),
-                ...(typeof event.payload.attemptId === "string" ? { attemptId: event.payload.attemptId } : {}),
-                status: "pending",
-                message: string(event.payload.message, "notification.enqueued.message"),
-                createdAt: event.occurredAt,
-            };
-            break;
-        }
-        case "notification.delivered": {
-            const notificationId = string(event.payload.notificationId, "notification.delivered.notificationId");
-            const notification = notifications[notificationId];
-            if (!notification)
-                throw new DurableTaskRuntimeError(`Unknown notification '${notificationId}'.`);
-            notifications[notificationId] = { ...notification, status: "delivered", deliveredAt: event.occurredAt };
-            break;
-        }
-    }
-    return { ...state, lastOrdinal: event.ordinal };
-}
-export function projectOrchestrationEvents(events) {
-    return events.reduce(reduceOrchestrationEvent, emptyProjection());
-}
+import { approvalFromPayload, assertAcceptanceCriteria, assertReferencedAcceptanceCriteriaRetained, assertRiskBudget, checkpointSummary, dispatchFromValue, dispatchIdentifier, dispatchIdentifierArray, executionGrantFromValue, MAX_DATE_EPOCH_MS, projectionFromSnapshot, retryStateFromValue, taskFromValue, usageFromPayload, validateTaskContractForState, validateTaskDependencyIds, } from "./task-runtime-codecs.js";
+import { assertBoundedIdentifierList, assertIdentifierListHasCapacity, assertObjectiveEvidenceHasCapacity, assertProjectionRecordReplacementWithinLimits, assertRecordHasCapacity, cloneProjection, projectionCapacity, requestedProjectionSlots, } from "./task-runtime-projection.js";
+import { activeTaskAttempt, assertAgentNotRetired, assertAgentRetirementEligible, assertApprovalRequestTransition, assertApprovalResolutionTransition, assertAttemptCheckpointTransition, assertAttemptFinishTransition, assertAttemptGrantTransition, assertAttemptLeaseTransition, assertAttemptStartTransition, assertNotificationTarget, assertObjectiveStatusTransition, assertRetryBackoffElapsedAt, assertTaskAttemptBudgetForState, assertTaskFailureTransition, assertVerificationTransition, attemptDispatchReadiness, projectOrchestrationEvents, reduceOrchestrationEvent, requireActiveObjectiveForAttemptInProjection, } from "./task-runtime-reducer.js";
+import { DurableTaskRuntimeError, terminalAttemptStatus, } from "./task-runtime-state.js";
+export { validateTaskDependencyIds } from "./task-runtime-codecs.js";
+export { projectOrchestrationEvents, reduceOrchestrationEvent, } from "./task-runtime-reducer.js";
+export { DurableTaskRuntimeError, } from "./task-runtime-state.js";
 export class DurableTaskRuntime {
     constructor(options) {
         this.store = options.store;
-        this.now = options.now ?? Date.now;
+        this.now = options.now ?? (() => Date.now());
         this.createId = options.createId ?? randomUUID;
         const snapshot = this.store.readProjectionSnapshot();
         if (snapshot) {
@@ -881,6 +37,146 @@ export class DurableTaskRuntime {
         this.refresh();
         return cloneProjection(this.state);
     }
+    /** Read-only retained-record counts and remaining lifetime slots for orchestration admission. */
+    getProjectionCapacity() {
+        this.refresh();
+        return projectionCapacity(this.state);
+    }
+    /**
+     * Preflight every record needed by a multi-event operation before its first append. Callers use
+     * this to reserve implementation and mandatory-verifier task/attempt pairs atomically.
+     */
+    assertProjectionHeadroom(required) {
+        this.refresh();
+        const capacity = projectionCapacity(this.state);
+        const agents = requestedProjectionSlots(required.agents, "Agent binding");
+        const objectives = requestedProjectionSlots(required.objectives, "Objective");
+        const tasks = requestedProjectionSlots(required.tasks, "Task");
+        const attempts = requestedProjectionSlots(required.attempts, "Attempt");
+        const checkpoints = requestedProjectionSlots(required.checkpoints, "Checkpoint");
+        const approvals = requestedProjectionSlots(required.approvals, "Approval");
+        const notifications = requestedProjectionSlots(required.notifications, "Notification");
+        const evidence = requestedProjectionSlots(required.evidence, "Evidence");
+        if (agents > capacity.headroom.agents) {
+            throw new DurableTaskRuntimeError(`Orchestration agent binding limit (${capacity.limits.agents}) lacks ${agents} required slots.`);
+        }
+        if (tasks > capacity.headroom.tasks) {
+            throw new DurableTaskRuntimeError(`Orchestration task limit (${capacity.limits.tasks}) lacks ${tasks} required slots.`);
+        }
+        if (attempts > capacity.headroom.attempts) {
+            throw new DurableTaskRuntimeError(`Orchestration attempt limit (${capacity.limits.attempts}) lacks ${attempts} required slots.`);
+        }
+        if (objectives > capacity.headroom.objectives) {
+            throw new DurableTaskRuntimeError(`Orchestration objective limit (${capacity.limits.objectives}) lacks ${objectives} required slots.`);
+        }
+        if (checkpoints > capacity.headroom.checkpoints) {
+            throw new DurableTaskRuntimeError(`Orchestration checkpoint limit (${capacity.limits.checkpoints}) lacks ${checkpoints} required slots.`);
+        }
+        if (approvals > capacity.headroom.approvals) {
+            throw new DurableTaskRuntimeError(`Orchestration approval limit (${capacity.limits.approvals}) lacks ${approvals} required slots.`);
+        }
+        if (notifications > capacity.headroom.notifications) {
+            throw new DurableTaskRuntimeError(`Orchestration notification limit (${capacity.limits.notifications}) lacks ${notifications} required slots.`);
+        }
+        if (evidence > capacity.headroom.evidence) {
+            throw new DurableTaskRuntimeError(`Orchestration evidence limit (${capacity.limits.evidence}) lacks ${evidence} required slots.`);
+        }
+        return capacity;
+    }
+    /**
+     * Preflight the idempotent evidence batch for one objective before synchronizing any member.
+     * The objective may be absent when its creation is part of the same compound operation.
+     */
+    assertObjectiveEvidenceHeadroom(objectiveId, evidenceIds) {
+        this.refresh();
+        assertBoundedIdentifierList(evidenceIds, MAX_ORCHESTRATION_OBJECTIVE_EVIDENCE, "Objective evidence ids");
+        const objective = this.state.objectives[objectiveId];
+        const existingIds = new Set(objective?.evidence.map((evidence) => evidence.evidenceId) ?? []);
+        let required = 0;
+        for (const evidenceId of evidenceIds) {
+            if (!existingIds.has(evidenceId))
+                required += 1;
+        }
+        if ((objective?.evidence.length ?? 0) + required > MAX_ORCHESTRATION_OBJECTIVE_EVIDENCE) {
+            throw new DurableTaskRuntimeError(`Orchestration objective evidence limit (${MAX_ORCHESTRATION_OBJECTIVE_EVIDENCE}) lacks ${required} required slots.`);
+        }
+        const capacity = projectionCapacity(this.state);
+        if (required > capacity.headroom.evidence) {
+            throw new DurableTaskRuntimeError(`Orchestration evidence limit (${capacity.limits.evidence}) lacks ${required} required slots.`);
+        }
+        return required;
+    }
+    /**
+     * Preflight the final retained objective record for a multi-event owner synchronization. This
+     * validates the objective metadata and the complete idempotently merged evidence batch before
+     * ensureObjective can append the first event, so a later byte rejection cannot leave a prefix.
+     */
+    assertObjectiveSynchronizationHeadroom(input, evidence) {
+        this.refresh();
+        const objectiveId = dispatchIdentifier(input.objectiveId, "objective.objectiveId");
+        const current = this.state.objectives[objectiveId];
+        const requiredEvidence = this.assertObjectiveEvidenceHeadroom(objectiveId, evidence.map((item) => item.evidenceId));
+        this.assertProjectionHeadroom({ objectives: current ? 0 : 1, evidence: requiredEvidence });
+        assertRiskBudget(input.riskBudget, "objective.riskBudget");
+        const acceptanceCriteria = structuredClone(input.acceptanceCriteria ?? []);
+        assertAcceptanceCriteria(acceptanceCriteria);
+        const title = input.title.trim();
+        const description = input.description.trim();
+        if (!title || !description)
+            throw new DurableTaskRuntimeError("Objective title and description are required.");
+        const now = this.nowIso();
+        const objective = current
+            ? {
+                ...current.objective,
+                title,
+                description,
+                constraints: [...(input.constraints ?? [])],
+                acceptanceCriteria,
+                riskBudget: { ...(input.riskBudget ?? {}) },
+                updatedAt: now,
+            }
+            : {
+                schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
+                objectiveId,
+                title,
+                description,
+                status: "active",
+                constraints: [...(input.constraints ?? [])],
+                acceptanceCriteria,
+                riskBudget: { ...(input.riskBudget ?? {}) },
+                createdAt: now,
+                updatedAt: now,
+            };
+        if (current) {
+            assertReferencedAcceptanceCriteriaRetained(this.state.tasks, current, acceptanceCriteria);
+        }
+        const mergedEvidence = current?.evidence.map((item) => structuredClone(item)) ?? [];
+        const evidenceById = new Map(mergedEvidence.map((item) => [item.evidenceId, item]));
+        for (const item of evidence) {
+            const evidenceId = dispatchIdentifier(item.evidenceId, "objective evidence.evidenceId");
+            if (!item.summary.trim() || !item.createdAt.trim()) {
+                throw new DurableTaskRuntimeError("Objective evidence requires an id, summary, and creation time.");
+            }
+            if (item.criterionId && !objective.acceptanceCriteria.some((criterion) => criterion.id === item.criterionId)) {
+                throw new DurableTaskRuntimeError(`Objective evidence references unknown acceptance criterion '${item.criterionId}'.`);
+            }
+            const existing = evidenceById.get(evidenceId);
+            if (existing) {
+                if (!isDeepStrictEqual(existing, item)) {
+                    throw new DurableTaskRuntimeError(`Objective evidence '${evidenceId}' has conflicting content.`);
+                }
+                continue;
+            }
+            const retained = structuredClone(item);
+            mergedEvidence.push(retained);
+            evidenceById.set(evidenceId, retained);
+        }
+        assertProjectionRecordReplacementWithinLimits(this.state, "objectives", objectiveId, {
+            objective,
+            taskIds: current?.taskIds ?? [],
+            evidence: mergedEvidence,
+        });
+    }
     registerAgent(input) {
         this.refresh();
         const now = this.nowIso();
@@ -916,6 +212,7 @@ export class DurableTaskRuntime {
         };
         if (this.state.agents[agent.agentId])
             throw new DurableTaskRuntimeError(`Agent '${agent.agentId}' already exists.`);
+        assertRecordHasCapacity(this.state.agents, MAX_ORCHESTRATION_AGENT_BINDINGS, "agent binding");
         this.commit({
             type: "agent.registered",
             aggregateId: agent.agentId,
@@ -925,6 +222,25 @@ export class DurableTaskRuntime {
         });
         return structuredClone(agent);
     }
+    /**
+     * Retire one idle persistent identity without deleting its binding, lineage, transcript pointers,
+     * or attempt history. A repeated call is inert and returns the durable retired binding.
+     */
+    retireAgent(agentId) {
+        this.refresh();
+        const normalizedAgentId = dispatchIdentifier(agentId.trim(), "agentId");
+        const agent = assertAgentRetirementEligible(this.state, normalizedAgentId);
+        if (agent.status === "retired")
+            return structuredClone(agent);
+        this.commit({
+            type: "agent.retired",
+            aggregateId: normalizedAgentId,
+            actor: "runtime",
+            idempotencyKey: `agent-retired:${normalizedAgentId}`,
+            payload: toJsonObject({ agentId: normalizedAgentId }),
+        });
+        return structuredClone(this.state.agents[normalizedAgentId]);
+    }
     createObjective(input) {
         this.refresh();
         assertRiskBudget(input.riskBudget, "objective.riskBudget");
@@ -947,6 +263,7 @@ export class DurableTaskRuntime {
         if (this.state.objectives[objective.objectiveId]) {
             throw new DurableTaskRuntimeError(`Objective '${objective.objectiveId}' already exists.`);
         }
+        assertRecordHasCapacity(this.state.objectives, MAX_ORCHESTRATION_OBJECTIVES, "objective");
         this.commit({
             type: "objective.created",
             aggregateId: objective.objectiveId,
@@ -984,11 +301,7 @@ export class DurableTaskRuntime {
         };
         if (isDeepStrictEqual(currentFields, nextFields))
             return structuredClone(current.objective);
-        const retainedCriterionIds = new Set(acceptanceCriteria.map((criterion) => criterion.id));
-        const referencedRemovedIds = current.taskIds.flatMap((taskId) => (this.state.tasks[taskId]?.task.acceptanceCriterionIds ?? []).filter((criterionId) => !retainedCriterionIds.has(criterionId)));
-        if (referencedRemovedIds.length > 0) {
-            throw new DurableTaskRuntimeError(`Cannot remove acceptance criteria referenced by tasks: ${[...new Set(referencedRemovedIds)].join(", ")}.`);
-        }
+        assertReferencedAcceptanceCriteriaRetained(this.state.tasks, current, acceptanceCriteria);
         const objective = {
             ...current.objective,
             ...nextFields,
@@ -1019,6 +332,7 @@ export class DurableTaskRuntime {
             !objective.objective.acceptanceCriteria.some((criterion) => criterion.id === evidence.criterionId)) {
             throw new DurableTaskRuntimeError(`Objective evidence references unknown acceptance criterion '${evidence.criterionId}'.`);
         }
+        assertObjectiveEvidenceHasCapacity(this.state.objectives, objective);
         this.commit({
             type: "objective.evidence_recorded",
             aggregateId: objectiveId,
@@ -1030,59 +344,9 @@ export class DurableTaskRuntime {
     }
     createTask(input) {
         this.refresh();
-        assertRiskBudget(input.riskBudget, "task.riskBudget");
-        const objectiveState = this.state.objectives[input.objectiveId];
-        if (!objectiveState)
-            throw new DurableTaskRuntimeError(`Unknown objective '${input.objectiveId}'.`);
-        if (objectiveState.objective.status !== "active") {
-            throw new DurableTaskRuntimeError(`Objective '${input.objectiveId}' is not active.`);
-        }
-        const dependsOn = [...new Set(input.dependsOn ?? [])];
-        const acceptanceCriterionIds = [...new Set(input.acceptanceCriterionIds ?? [])];
-        const objectiveCriterionIds = new Set(objectiveState.objective.acceptanceCriteria.map((criterion) => criterion.id));
-        const unknownCriterionIds = acceptanceCriterionIds.filter((criterionId) => !objectiveCriterionIds.has(criterionId));
-        if (unknownCriterionIds.length > 0) {
-            throw new DurableTaskRuntimeError(`Task references unknown acceptance criteria: ${unknownCriterionIds.join(", ")}.`);
-        }
-        for (const dependencyId of dependsOn) {
-            const dependency = this.state.tasks[dependencyId];
-            if (!dependency || dependency.task.objectiveId !== input.objectiveId) {
-                throw new DurableTaskRuntimeError(`Task dependency '${dependencyId}' is not in objective '${input.objectiveId}'.`);
-            }
-        }
-        if (input.verificationOfTaskId) {
-            const subject = this.state.tasks[input.verificationOfTaskId];
-            if (!subject || subject.task.objectiveId !== input.objectiveId) {
-                throw new DurableTaskRuntimeError(`Verification subject '${input.verificationOfTaskId}' is not in objective '${input.objectiveId}'.`);
-            }
-            if (input.role !== "verifier") {
-                throw new DurableTaskRuntimeError("Only verifier tasks may declare verificationOfTaskId.");
-            }
-            if (subject.task.role === "verifier") {
-                throw new DurableTaskRuntimeError("A verifier task cannot independently verify another verifier task.");
-            }
-        }
-        const now = this.nowIso();
-        const task = {
-            schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
-            taskId: input.taskId ?? `task-${this.createId()}`,
-            objectiveId: input.objectiveId,
-            title: input.title.trim(),
-            description: input.description.trim(),
-            role: input.role,
-            status: dependsOn.length === 0 ? "ready" : "pending",
-            dependsOn,
-            requiredCapabilities: [...new Set(input.requiredCapabilities ?? [])],
-            acceptanceCriterionIds,
-            ...(input.verificationOfTaskId ? { verificationOfTaskId: input.verificationOfTaskId } : {}),
-            riskBudget: { ...(input.riskBudget ?? {}) },
-            createdAt: now,
-            updatedAt: now,
-        };
-        if (!task.title || !task.description)
-            throw new DurableTaskRuntimeError("Task title and description are required.");
-        if (this.state.tasks[task.taskId])
-            throw new DurableTaskRuntimeError(`Task '${task.taskId}' already exists.`);
+        const { task, objectiveState } = this.buildTask(input);
+        assertRecordHasCapacity(this.state.tasks, MAX_ORCHESTRATION_TASKS, "task");
+        assertIdentifierListHasCapacity(objectiveState.taskIds, MAX_ORCHESTRATION_TASKS, "objective task list");
         this.commit({
             type: "task.created",
             aggregateId: task.objectiveId,
@@ -1092,6 +356,35 @@ export class DurableTaskRuntime {
         });
         return structuredClone(this.state.tasks[task.taskId].task);
     }
+    /** Atomically create a new task and its first queued attempt in one durable transition. */
+    prepareTaskAttempt(input, dispatch, grantId) {
+        this.refresh();
+        const { task, objectiveState } = this.buildTask(input);
+        const taskState = { task, attemptIds: [] };
+        const normalizedDispatch = this.normalizeDispatchForTask(taskState, dispatch);
+        this.assertTaskAttemptBudget(taskState, objectiveState.objective);
+        assertRecordHasCapacity(this.state.tasks, MAX_ORCHESTRATION_TASKS, "task");
+        assertIdentifierListHasCapacity(objectiveState.taskIds, MAX_ORCHESTRATION_TASKS, "objective task list");
+        assertRecordHasCapacity(this.state.attempts, MAX_ORCHESTRATION_ATTEMPTS, "attempt");
+        const attemptId = `attempt-${this.createId()}`;
+        this.commit({
+            type: "task.attempt_prepared",
+            aggregateId: task.taskId,
+            actor: "runtime",
+            idempotencyKey: `task-attempt-prepared:${task.taskId}:${attemptId}`,
+            payload: toJsonObject({
+                task,
+                attemptId,
+                taskId: task.taskId,
+                dispatch: normalizedDispatch,
+                ...(grantId ? { grantId } : {}),
+            }),
+        });
+        return {
+            task: structuredClone(this.state.tasks[task.taskId].task),
+            attempt: structuredClone(this.state.attempts[attemptId]),
+        };
+    }
     queueAttempt(taskId, dispatch, grantId) {
         this.refresh();
         const task = this.requireDispatchableTask(taskId);
@@ -1099,21 +392,10 @@ export class DurableTaskRuntime {
         if (pendingApproval) {
             throw new DurableTaskRuntimeError(`Task '${taskId}' is awaiting approval '${pendingApproval.request.approvalId}'.`);
         }
-        const normalizedDispatch = dispatchFromValue(dispatch, "dispatch");
-        if (normalizedDispatch.taskId !== taskId) {
-            throw new DurableTaskRuntimeError("Dispatch taskId does not match the queued task.");
-        }
-        if (normalizedDispatch.executionContract &&
-            (normalizedDispatch.executionContract.worker.profile.profileId !== normalizedDispatch.profileId ||
-                normalizedDispatch.executionContract.worker.profile.role !== task.task.role)) {
-            throw new DurableTaskRuntimeError("Execution contract does not match the dispatch profile and task role.");
-        }
-        const objective = this.state.objectives[task.task.objectiveId].objective;
-        const attemptCeilings = [task.task.riskBudget.maxAttempts, objective.riskBudget.maxAttempts].filter((value) => value !== undefined);
-        const maxAttempts = attemptCeilings.length > 0 ? Math.min(...attemptCeilings) : undefined;
-        if (maxAttempts !== undefined && task.attemptIds.length >= maxAttempts) {
-            throw new DurableTaskRuntimeError(`Task '${taskId}' exhausted its ${maxAttempts} attempt budget.`);
-        }
+        const normalizedDispatch = this.normalizeDispatchForTask(task, dispatch);
+        this.assertTaskAttemptBudget(task, this.state.objectives[task.task.objectiveId].objective);
+        assertRecordHasCapacity(this.state.attempts, MAX_ORCHESTRATION_ATTEMPTS, "attempt");
+        assertIdentifierListHasCapacity(task.attemptIds, MAX_ORCHESTRATION_ATTEMPTS, "task attempt list");
         const attemptId = `attempt-${this.createId()}`;
         this.commit({
             type: "attempt.queued",
@@ -1124,32 +406,17 @@ export class DurableTaskRuntime {
         });
         return structuredClone(this.state.attempts[attemptId]);
     }
+    /** Read-only controller seam for deciding whether one durable queued or suspended attempt may run. */
+    getAttemptDispatchReadiness(attemptId) {
+        this.refresh();
+        return structuredClone(attemptDispatchReadiness(this.state, this.requireAttempt(attemptId)));
+    }
     bindAttemptGrant(attemptId, grant) {
         this.refresh();
-        const attempt = this.requireAttempt(attemptId);
-        if (!["queued", "leased", "running"].includes(attempt.status)) {
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' cannot bind a grant from '${attempt.status}'.`);
-        }
-        if (!grant.grantId.trim())
-            throw new DurableTaskRuntimeError("Grant id is required.");
-        const task = this.state.tasks[attempt.taskId];
-        if (!task ||
-            grant.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION ||
-            grant.attemptId !== attemptId ||
-            grant.taskId !== attempt.taskId ||
-            grant.objectiveId !== task.task.objectiveId ||
-            grant.role !== task.task.role) {
-            throw new DurableTaskRuntimeError("Execution grant target does not match the attempt.");
-        }
-        const approval = this.approvalForAttempt(attemptId);
-        if (approval?.status === "pending") {
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' is awaiting approval '${approval.request.approvalId}'.`);
-        }
-        if (approval?.status === "rejected") {
-            throw new DurableTaskRuntimeError(`Approval '${approval.request.approvalId}' was rejected.`);
-        }
-        if (attempt.grantId === grant.grantId) {
-            if (attempt.grant && !isDeepStrictEqual(attempt.grant, grant)) {
+        const normalizedGrant = executionGrantFromValue(grant, "grant");
+        const attempt = assertAttemptGrantTransition(this.state, attemptId, attemptId, normalizedGrant);
+        if (attempt.grantId === normalizedGrant.grantId) {
+            if (attempt.grant && !isDeepStrictEqual(attempt.grant, normalizedGrant)) {
                 throw new DurableTaskRuntimeError(`Attempt '${attemptId}' grant has conflicting content.`);
             }
             return structuredClone(attempt);
@@ -1160,35 +427,16 @@ export class DurableTaskRuntime {
             type: "attempt.grant_bound",
             aggregateId: attemptId,
             actor: "policy",
-            idempotencyKey: `attempt-grant-bound:${attemptId}:${grant.grantId}`,
-            payload: toJsonObject({ attemptId, grant }),
+            idempotencyKey: `attempt-grant-bound:${attemptId}:${normalizedGrant.grantId}`,
+            payload: toJsonObject({ attemptId, grant: normalizedGrant }),
         });
         return structuredClone(this.state.attempts[attemptId]);
     }
     leaseAttempt(attemptId, ownerId, ttlMs, agentId) {
         this.refresh();
         const attempt = this.requireAttempt(attemptId);
-        if (attempt.status !== "queued")
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' is not queued.`);
-        this.requireActiveObjectiveForAttempt(attempt);
-        const approval = this.approvalForAttempt(attemptId);
-        if (approval?.status === "pending") {
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' is awaiting approval '${approval.request.approvalId}'.`);
-        }
-        if (!attempt.grantId) {
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' requires an execution grant before leasing.`);
-        }
-        if (agentId) {
-            const agent = this.state.agents[agentId];
-            if (!agent)
-                throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
-            if (agent.status !== "registered")
-                throw new DurableTaskRuntimeError(`Agent '${agentId}' is not idle.`);
-            const task = this.state.tasks[attempt.taskId];
-            if (!task || task.task.role !== agent.role)
-                throw new DurableTaskRuntimeError(`Agent '${agentId}' role does not match task.`);
-        }
         const lease = this.issueLease(attempt, ownerId, ttlMs);
+        assertAttemptLeaseTransition(this.state, attemptId, lease, agentId, this.nowIso());
         this.commit({
             type: "attempt.leased",
             aggregateId: attemptId,
@@ -1200,10 +448,7 @@ export class DurableTaskRuntime {
     }
     startAttempt(attemptId, leaseId, fencingToken) {
         this.refresh();
-        const attempt = this.requireLiveLease(attemptId, leaseId, fencingToken);
-        this.requireActiveObjectiveForAttempt(attempt);
-        if (attempt.status !== "leased")
-            throw new DurableTaskRuntimeError(`Attempt '${attemptId}' is not leased.`);
+        assertAttemptStartTransition(this.state, attemptId, attemptId, leaseId, fencingToken, this.nowIso());
         this.commit({
             type: "attempt.started",
             aggregateId: attemptId,
@@ -1218,18 +463,22 @@ export class DurableTaskRuntime {
         const attempt = this.requireLiveLease(args.attemptId, args.leaseId, args.fencingToken);
         if (attempt.status !== "running")
             throw new DurableTaskRuntimeError(`Attempt '${args.attemptId}' is not running.`);
+        const summary = checkpointSummary(args.summary, "checkpoint.summary");
+        const artifactIds = dispatchIdentifierArray(args.artifactIds ?? [], "checkpoint.artifactIds");
+        const evidenceIds = dispatchIdentifierArray(args.evidenceIds ?? [], "checkpoint.evidenceIds");
+        assertIdentifierListHasCapacity(attempt.checkpointIds, MAX_ORCHESTRATION_CHECKPOINTS, "attempt checkpoint list");
+        assertRecordHasCapacity(this.state.checkpoints, MAX_ORCHESTRATION_CHECKPOINTS, "checkpoint");
         const checkpoint = {
             checkpointId: `checkpoint-${this.createId()}`,
             attemptId: args.attemptId,
             fencingToken: args.fencingToken,
-            summary: args.summary.trim(),
-            artifactIds: [...(args.artifactIds ?? [])],
-            evidenceIds: [...(args.evidenceIds ?? [])],
+            summary,
+            artifactIds,
+            evidenceIds,
             ...(args.usage ? { usage: usageFromPayload(args.usage, "checkpoint.usage") } : {}),
             createdAt: this.nowIso(),
         };
-        if (!checkpoint.summary)
-            throw new DurableTaskRuntimeError("Checkpoint summary is required.");
+        assertAttemptCheckpointTransition(this.state, args.attemptId, checkpoint, args.leaseId, this.nowIso());
         this.commit({
             type: "attempt.checkpointed",
             aggregateId: args.attemptId,
@@ -1241,22 +490,7 @@ export class DurableTaskRuntime {
     }
     finishAttempt(result) {
         this.refresh();
-        const attempt = this.requireLiveLease(result.attemptId, result.leaseId, result.fencingToken);
-        if (attempt.status !== "running" && attempt.status !== "leased") {
-            throw new DurableTaskRuntimeError(`Attempt '${result.attemptId}' cannot finish from '${attempt.status}'.`);
-        }
-        if (attempt.taskId !== result.taskId)
-            throw new DurableTaskRuntimeError("Worker result taskId does not match attempt.");
-        const task = this.state.tasks[attempt.taskId];
-        if (!task || task.task.objectiveId !== result.objectiveId) {
-            throw new DurableTaskRuntimeError("Worker result objectiveId does not match attempt.");
-        }
-        if (result.status === "completed") {
-            const missingCriteria = missingTrustedCriteria(result, task.task.acceptanceCriterionIds);
-            if (missingCriteria.length > 0) {
-                throw new DurableTaskRuntimeError(`Completed result lacks trusted evidence for acceptance criteria: ${missingCriteria.join(", ")}.`);
-            }
-        }
+        assertAttemptFinishTransition(this.state, result.attemptId, result, this.nowIso());
         this.commit({
             type: "attempt.finished",
             aggregateId: result.attemptId,
@@ -1268,36 +502,7 @@ export class DurableTaskRuntime {
     }
     finishVerification(args) {
         this.refresh();
-        const subject = this.state.tasks[args.taskId];
-        const verifierTask = this.state.tasks[args.verifierTaskId];
-        const verifierAttempt = this.state.attempts[args.verifierAttemptId];
-        if (!subject)
-            throw new DurableTaskRuntimeError(`Unknown verification subject '${args.taskId}'.`);
-        if (!verifierTask || verifierTask.task.verificationOfTaskId !== args.taskId) {
-            throw new DurableTaskRuntimeError(`Task '${args.verifierTaskId}' is not the verifier for '${args.taskId}'.`);
-        }
-        if (!verifierAttempt || verifierAttempt.taskId !== args.verifierTaskId) {
-            throw new DurableTaskRuntimeError(`Unknown verifier attempt '${args.verifierAttemptId}'.`);
-        }
-        if (args.verdict === "inconclusive") {
-            if (verifierAttempt.status === "queued" ||
-                verifierAttempt.status === "leased" ||
-                verifierAttempt.status === "running") {
-                throw new DurableTaskRuntimeError(`Verifier attempt '${args.verifierAttemptId}' is not terminal.`);
-            }
-        }
-        else if (verifierAttempt.status !== "completed" || !verifierAttempt.result) {
-            throw new DurableTaskRuntimeError(`Verifier attempt '${args.verifierAttemptId}' is not completed.`);
-        }
-        if (subject.task.status !== "blocked") {
-            throw new DurableTaskRuntimeError(`Verification subject '${args.taskId}' cannot reconcile from '${subject.task.status}'.`);
-        }
-        if (!args.reasonCode.trim())
-            throw new DurableTaskRuntimeError("Verification reason code is required.");
-        if (args.verdict === "accepted" &&
-            !verifierAttempt.result?.evidence.some((evidence) => evidence.trusted && evidence.kind === "review" && evidence.metadata?.subjectTaskId === args.taskId)) {
-            throw new DurableTaskRuntimeError("Accepted verification requires trusted review evidence for the subject task.");
-        }
+        assertVerificationTransition(this.state, args.taskId, args);
         this.commit({
             type: "task.verification_finished",
             aggregateId: args.taskId,
@@ -1341,6 +546,15 @@ export class DurableTaskRuntime {
         }
         if (!args.reasonCode.trim())
             throw new DurableTaskRuntimeError("Suspension reason is required.");
+        const retry = args.retry ? retryStateFromValue(args.retry, "attempt.suspended.retry") : undefined;
+        if (retry) {
+            if (retry.retriesUsed !== (attempt.retry?.retriesUsed ?? 0) + 1) {
+                throw new DurableTaskRuntimeError(`Attempt '${args.attemptId}' retry count is not monotonic.`);
+            }
+            if (Date.parse(retry.notBefore) <= this.now()) {
+                throw new DurableTaskRuntimeError("Retry not-before deadline must be in the future.");
+            }
+        }
         this.commit({
             type: "attempt.suspended",
             aggregateId: args.attemptId,
@@ -1351,6 +565,7 @@ export class DurableTaskRuntime {
                 leaseId: args.leaseId,
                 fencingToken: args.fencingToken,
                 reasonCode: args.reasonCode.trim(),
+                ...(retry ? { retry } : {}),
             }),
         });
         return structuredClone(this.state.attempts[args.attemptId]);
@@ -1362,8 +577,7 @@ export class DurableTaskRuntime {
             throw new DurableTaskRuntimeError(`Unknown task '${taskId}'.`);
         if (["completed", "failed", "cancelled"].includes(task.task.status))
             return structuredClone(task.task);
-        if (!reasonCode.trim())
-            throw new DurableTaskRuntimeError("Task failure reason is required.");
+        assertTaskFailureTransition(this.state, taskId, taskId, reasonCode);
         this.commit({
             type: "task.failed",
             aggregateId: taskId,
@@ -1425,11 +639,20 @@ export class DurableTaskRuntime {
         }
         return expired;
     }
-    requestAgentResume(agentId) {
+    requestAgentResume(agentId, attemptId) {
         this.refresh();
         const agent = this.state.agents[agentId];
         if (!agent)
             throw new DurableTaskRuntimeError(`Unknown agent '${agentId}'.`);
+        assertAgentNotRetired(agent, "request resume");
+        const attempt = this.requireAttempt(attemptId);
+        if (attempt.status !== "suspended" || attempt.agentId !== agentId || agent.activeAttemptId !== attemptId) {
+            throw new DurableTaskRuntimeError(`Agent '${agentId}' cannot resume suspended attempt '${attemptId}'.`);
+        }
+        this.assertRetryBackoffElapsed(attempt);
+        this.requireActiveObjectiveForAttempt(attempt);
+        if (agent.status === "resuming")
+            return structuredClone(agent);
         if (agent.status !== "suspended")
             throw new DurableTaskRuntimeError(`Agent '${agentId}' is not suspended.`);
         this.commit({
@@ -1437,10 +660,15 @@ export class DurableTaskRuntime {
             aggregateId: agentId,
             actor: "runtime",
             idempotencyKey: `agent-resume-requested:${agentId}:${this.state.lastOrdinal}`,
-            payload: toJsonObject({ agentId }),
+            payload: toJsonObject({ agentId, attemptId }),
         });
         return structuredClone(this.state.agents[agentId]);
     }
+    /** Read-only guard used before changing agent state; resumeAttempt repeats it authoritatively. */
+    assertAttemptReadyForResume(attemptId) {
+        this.refresh();
+        this.assertRetryBackoffElapsed(this.requireAttempt(attemptId));
+    }
     resumeAttempt(attemptId, agentId, ttlMs, ownerId = agentId) {
         this.refresh();
         const attempt = this.requireAttempt(attemptId);
@@ -1450,6 +678,7 @@ export class DurableTaskRuntime {
         }
         if (!agent || agent.status !== "resuming")
             throw new DurableTaskRuntimeError(`Agent '${agentId}' is not resuming.`);
+        this.assertRetryBackoffElapsed(attempt);
         this.requireActiveObjectiveForAttempt(attempt);
         const lease = this.issueLease(attempt, ownerId, ttlMs);
         this.commit({
@@ -1471,28 +700,9 @@ export class DurableTaskRuntime {
         this.transitionObjective(objectiveId, "objective.cancelled", "cancelled");
     }
     completeObjective(objectiveId) {
-        this.refresh();
-        const objective = this.requireObjective(objectiveId);
-        const incomplete = objective.taskIds.filter((taskId) => this.state.tasks[taskId]?.task.status !== "completed");
-        if (incomplete.length > 0) {
-            throw new DurableTaskRuntimeError(`Objective '${objectiveId}' has incomplete tasks: ${incomplete.join(", ")}.`);
-        }
-        const requiredCriterionIds = objective.objective.acceptanceCriteria
-            .filter((criterion) => criterion.required)
-            .map((criterion) => criterion.id);
-        const evidence = [
-            ...objective.evidence,
-            ...objective.taskIds.flatMap((taskId) => {
-                const task = this.state.tasks[taskId];
-                return (task?.attemptIds.flatMap((attemptId) => this.state.attempts[attemptId]?.result?.evidence ?? []) ?? []);
-            }),
-        ];
-        const provenCriterionIds = new Set(evidence.flatMap((item) => (item.trusted && item.criterionId ? [item.criterionId] : [])));
-        const unproven = requiredCriterionIds.filter((criterionId) => !provenCriterionIds.has(criterionId));
-        if (unproven.length > 0) {
-            throw new DurableTaskRuntimeError(`Objective '${objectiveId}' lacks trusted evidence for required criteria: ${unproven.join(", ")}.`);
-        }
-        this.transitionObjective(objectiveId, "objective.completed", "completed");
+        this.transitionObjective(objectiveId, "objective.completed", "completed", {
+            completionPolicy: "task_evidence",
+        });
     }
     completeObjectiveFromOwner(objectiveId, acceptanceOverride) {
         this.refresh();
@@ -1502,16 +712,9 @@ export class DurableTaskRuntime {
         if (objective.objective.status === "cancelled") {
             throw new DurableTaskRuntimeError(`Objective '${objectiveId}' is terminal.`);
         }
-        if (!acceptanceOverride) {
-            const provenCriterionIds = new Set(objective.evidence.flatMap((evidence) => evidence.trusted && evidence.criterionId ? [evidence.criterionId] : []));
-            const unproven = objective.objective.acceptanceCriteria
-                .filter((criterion) => criterion.required && !provenCriterionIds.has(criterion.id))
-                .map((criterion) => criterion.id);
-            if (unproven.length > 0) {
-                throw new DurableTaskRuntimeError(`Objective '${objectiveId}' lacks trusted owner evidence for required criteria: ${unproven.join(", ")}.`);
-            }
-        }
-        this.transitionObjective(objectiveId, "objective.completed", "completed");
+        this.transitionObjective(objectiveId, "objective.completed", "completed", {
+            completionPolicy: acceptanceOverride ? "owner_override" : "owner_evidence",
+        });
     }
     requestApproval(approval) {
         this.refresh();
@@ -1523,14 +726,9 @@ export class DurableTaskRuntime {
             }
             return structuredClone(existing);
         }
-        this.validateApprovalRequest(normalized);
-        const pendingForTarget = Object.values(this.state.approvals).find((candidate) => candidate.status === "pending" &&
-            candidate.request.objectiveId === normalized.objectiveId &&
-            candidate.request.taskId === normalized.taskId &&
-            candidate.request.attemptId === normalized.attemptId);
-        if (pendingForTarget) {
-            throw new DurableTaskRuntimeError(`Target already awaits approval '${pendingForTarget.request.approvalId}'.`);
-        }
+        assertApprovalRequestTransition(this.state, normalized.attemptId ?? normalized.taskId ?? normalized.objectiveId, normalized);
+        assertRecordHasCapacity(this.state.approvals, MAX_ORCHESTRATION_APPROVALS, "approval");
+        assertRecordHasCapacity(this.state.notifications, MAX_ORCHESTRATION_NOTIFICATIONS, "notification");
         this.commit({
             type: "approval.requested",
             aggregateId: normalized.attemptId ?? normalized.taskId ?? normalized.objectiveId,
@@ -1562,6 +760,7 @@ export class DurableTaskRuntime {
             reasonCode: reasonCode.trim(),
             resolvedAt: this.nowIso(),
         };
+        assertApprovalResolutionTransition(this.state, approval.request.attemptId ?? approval.request.taskId ?? approval.request.objectiveId, resolution);
         this.commit({
             type: "approval.resolved",
             aggregateId: approval.request.attemptId ?? approval.request.taskId ?? approval.request.objectiveId,
@@ -1573,11 +772,18 @@ export class DurableTaskRuntime {
     }
     enqueueNotification(args) {
         this.refresh();
-        this.requireObjective(args.objectiveId);
+        assertNotificationTarget(this.state, args.objectiveId, args.attemptId);
         const notificationId = args.notificationId ?? `notification-${this.createId()}`;
         const existing = this.state.notifications[notificationId];
-        if (existing)
+        if (existing) {
+            if (existing.objectiveId !== args.objectiveId ||
+                existing.attemptId !== args.attemptId ||
+                existing.message !== args.message) {
+                throw new DurableTaskRuntimeError(`Notification id '${notificationId}' has conflicting content.`);
+            }
             return structuredClone(existing);
+        }
+        assertRecordHasCapacity(this.state.notifications, MAX_ORCHESTRATION_NOTIFICATIONS, "notification");
         this.commit({
             type: "notification.enqueued",
             aggregateId: args.objectiveId,
@@ -1603,20 +809,67 @@ export class DurableTaskRuntime {
         });
         return structuredClone(this.state.notifications[notificationId]);
     }
-    transitionObjective(objectiveId, type, target) {
+    buildTask(input) {
+        assertRiskBudget(input.riskBudget, "task.riskBudget");
+        const objectiveState = this.state.objectives[input.objectiveId];
+        if (!objectiveState)
+            throw new DurableTaskRuntimeError(`Unknown objective '${input.objectiveId}'.`);
+        if (objectiveState.objective.status !== "active") {
+            throw new DurableTaskRuntimeError(`Objective '${input.objectiveId}' is not active.`);
+        }
+        const dependsOn = validateTaskDependencyIds(this.state.tasks, input.objectiveId, input.dependsOn);
+        const acceptanceCriterionIds = [...new Set(input.acceptanceCriterionIds ?? [])];
+        const now = this.nowIso();
+        const task = taskFromValue({
+            schemaVersion: ORCHESTRATION_SCHEMA_VERSION,
+            taskId: input.taskId ?? `task-${this.createId()}`,
+            objectiveId: input.objectiveId,
+            title: input.title.trim(),
+            description: input.description.trim(),
+            role: input.role,
+            status: dependsOn.length === 0 ? "ready" : "pending",
+            dependsOn,
+            requiredCapabilities: [...new Set(input.requiredCapabilities ?? [])],
+            acceptanceCriterionIds,
+            ...(input.verificationOfTaskId ? { verificationOfTaskId: input.verificationOfTaskId } : {}),
+            riskBudget: { ...(input.riskBudget ?? {}) },
+            createdAt: now,
+            updatedAt: now,
+        }, "task");
+        if (this.state.tasks[task.taskId])
+            throw new DurableTaskRuntimeError(`Task '${task.taskId}' already exists.`);
+        validateTaskContractForState(this.state, task, `Task '${task.taskId}'`);
+        return { task, objectiveState };
+    }
+    normalizeDispatchForTask(task, dispatch) {
+        const normalizedDispatch = dispatchFromValue(dispatch, "dispatch");
+        if (normalizedDispatch.taskId !== task.task.taskId) {
+            throw new DurableTaskRuntimeError("Dispatch taskId does not match the queued task.");
+        }
+        if (normalizedDispatch.executionContract &&
+            (normalizedDispatch.executionContract.worker.profile.profileId !== normalizedDispatch.profileId ||
+                normalizedDispatch.executionContract.worker.profile.role !== task.task.role)) {
+            throw new DurableTaskRuntimeError("Execution contract does not match the dispatch profile and task role.");
+        }
+        return normalizedDispatch;
+    }
+    assertTaskAttemptBudget(task, objective) {
+        assertTaskAttemptBudgetForState(task, objective);
+    }
+    transitionObjective(objectiveId, type, target, payload = {}) {
         this.refresh();
         const objective = this.requireObjective(objectiveId);
         if (objective.objective.status === target)
             return;
-        if (["completed", "cancelled"].includes(objective.objective.status)) {
-            throw new DurableTaskRuntimeError(`Objective '${objectiveId}' is terminal.`);
-        }
+        assertObjectiveStatusTransition(this.state, objectiveId, target, type === "objective.completed"
+            ? payload.completionPolicy
+            : undefined);
         this.commit({
             type,
             aggregateId: objectiveId,
             actor: "human",
             idempotencyKey: `${type}:${objectiveId}:${this.state.lastOrdinal}`,
-            payload: {},
+            payload,
         });
     }
     requireObjective(objectiveId) {
@@ -1633,9 +886,13 @@ export class DurableTaskRuntime {
         if (objective.objective.status !== "active") {
             throw new DurableTaskRuntimeError(`Objective '${objective.objective.objectiveId}' is not active.`);
         }
-        if (!["ready", "blocked", "failed"].includes(task.task.status)) {
+        if (!["pending", "ready", "blocked", "failed"].includes(task.task.status)) {
             throw new DurableTaskRuntimeError(`Task '${taskId}' is not dispatchable from '${task.task.status}'.`);
         }
+        const active = activeTaskAttempt(this.state, task);
+        if (active) {
+            throw new DurableTaskRuntimeError(`Task '${taskId}' already owns active attempt '${active.attemptId}'.`);
+        }
         return task;
     }
     requireAttempt(attemptId) {
@@ -1658,9 +915,6 @@ export class DurableTaskRuntime {
             expiresAt: new Date(expiresAtMs).toISOString(),
         };
     }
-    approvalForAttempt(attemptId) {
-        return Object.values(this.state.approvals).find((approval) => approval.request.attemptId === attemptId);
-    }
     pendingApprovalForTask(taskId) {
         const task = this.state.tasks[taskId];
         if (!task)
@@ -1671,37 +925,10 @@ export class DurableTaskRuntime {
             (approval.request.taskId === undefined || approval.request.taskId === taskId));
     }
     requireActiveObjectiveForAttempt(attempt) {
-        const task = this.state.tasks[attempt.taskId];
-        if (!task)
-            throw new DurableTaskRuntimeError(`Unknown task '${attempt.taskId}'.`);
-        const objective = this.requireObjective(task.task.objectiveId).objective;
-        if (objective.status !== "active") {
-            throw new DurableTaskRuntimeError(`Objective '${objective.objectiveId}' is not active.`);
-        }
+        requireActiveObjectiveForAttemptInProjection(this.state, attempt);
     }
-    validateApprovalRequest(approval) {
-        const objective = this.requireObjective(approval.objectiveId).objective;
-        if (objective.status !== "active") {
-            throw new DurableTaskRuntimeError(`Objective '${approval.objectiveId}' is not active.`);
-        }
-        if (approval.attemptId && !approval.taskId) {
-            throw new DurableTaskRuntimeError("Attempt-scoped approval requires a taskId.");
-        }
-        if (approval.taskId) {
-            const task = this.state.tasks[approval.taskId];
-            if (!task || task.task.objectiveId !== approval.objectiveId) {
-                throw new DurableTaskRuntimeError(`Approval task '${approval.taskId}' does not belong to its objective.`);
-            }
-        }
-        if (approval.attemptId) {
-            const attempt = this.state.attempts[approval.attemptId];
-            if (!attempt || attempt.taskId !== approval.taskId) {
-                throw new DurableTaskRuntimeError(`Approval attempt '${approval.attemptId}' does not belong to its task.`);
-            }
-            if (attempt.status !== "queued" || attempt.grantId) {
-                throw new DurableTaskRuntimeError(`Approval attempt '${approval.attemptId}' is not awaiting policy.`);
-            }
-        }
+    assertRetryBackoffElapsed(attempt) {
+        assertRetryBackoffElapsedAt(attempt, this.now());
     }
     requireLiveLease(attemptId, leaseId, fencingToken) {
         const attempt = this.requireAttempt(attemptId);
@@ -1735,7 +962,24 @@ export class DurableTaskRuntime {
     }
     commit(input) {
         this.compactCurrentProjection();
-        const event = this.store.append(input, { expectedLastOrdinal: this.state.lastOrdinal });
+        let admittedProjection;
+        const event = this.store.append(input, {
+            expectedLastOrdinal: this.state.lastOrdinal,
+            validateBeforeCommit: (candidate) => {
+                if (candidate.ordinal > this.state.lastOrdinal) {
+                    admittedProjection = reduceOrchestrationEvent(this.state, candidate);
+                }
+            },
+        });
+        if (admittedProjection) {
+            this.state = admittedProjection;
+            return;
+        }
+        // Exact idempotent replay can return an older event after another writer committed a
+        // contiguous suffix. Adopt through readAfter so no intervening ordinal is skipped. Test stores
+        // that do not execute append admission still fall back to reducing their returned next event.
+        if (event.ordinal > this.state.lastOrdinal)
+            this.refresh();
         if (event.ordinal > this.state.lastOrdinal)
             this.state = reduceOrchestrationEvent(this.state, event);
     }