@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/storage/database.js

@@ -1,12 +1,224 @@
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
+import { channel } from "node:diagnostics_channel";
 import { createRequire } from "node:module";
 import { ensureDir } from "./paths.js";
 import { AppError } from "../shared/errors.js";
+import { executeStoreSchema, readStoreWriterContract, registerStoreWriter, registerReconciliationWriter, bindStoreWriterAdmission, STORE_WRITER_VERSION } from "./writer-contract.js";
+import { assertImportAdmission } from "./import-guard.js";
+import { withStoreCleanup, rollbackStoreTransaction } from "./native-cleanup.js";
+const workContinuationStorageSql = `
+  CREATE TABLE IF NOT EXISTS stage_work_memberships (
+    project_id TEXT NOT NULL, run_id TEXT NOT NULL, work_id TEXT NOT NULL REFERENCES works(work_id),
+    stage TEXT NOT NULL, attempt TEXT NOT NULL, cycle TEXT NOT NULL DEFAULT '',
+    PRIMARY KEY(project_id, run_id, work_id, stage, attempt, cycle)
+  );
+  CREATE TABLE IF NOT EXISTS repair_intents (
+    identity TEXT PRIMARY KEY, project_id TEXT NOT NULL, run_id TEXT NOT NULL,
+    stage TEXT NOT NULL, attempt TEXT NOT NULL, payload_hash TEXT NOT NULL,
+    payload_json TEXT NOT NULL, work_id TEXT NOT NULL REFERENCES works(work_id), created_at TEXT NOT NULL
+  );
+`;
+function closeAfterOpenFailure(db, error) {
+    return withStoreCleanup(() => { throw error; }, () => { if (db.isOpen)
+        db.close(); });
+}
 const require = createRequire(import.meta.url);
-const { DatabaseSync } = require("node:sqlite");
+const { DatabaseSync, constants } = require("node:sqlite");
 const resourceDatabases = new Map();
+const resourceDatabaseIdentities = new WeakMap();
+function assertResourceDatabaseIdentity(database) {
+    const expected = resourceDatabaseIdentities.get(database);
+    let actual;
+    try {
+        actual = fs.lstatSync(database.path);
+    }
+    catch { /* Refuse missing targets without reopening or initializing. */ }
+    if (!expected || !actual?.isFile() || actual.dev !== expected.dev || actual.ino !== expected.ino) {
+        throw new AppError("resource_storage_changed", "The cached resource registry no longer matches its physical database; close the owned connection before retrying", 1);
+    }
+}
+const publicationScopes = [];
+/** Defer committed cross-store projections until the surrounding writer exits. */
+export function withDeferredPublications(operation) {
+    const pending = [];
+    publicationScopes.push(pending);
+    let value;
+    let primary;
+    let failed = false;
+    try {
+        value = operation();
+        if (value && typeof value.then === "function")
+            throw new AppError("write_transaction_async", "Deferred publication scope must be synchronous", 1);
+    }
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    publicationScopes.pop();
+    const parent = publicationScopes.at(-1);
+    if (parent)
+        parent.push(...pending);
+    else {
+        try {
+            executePublications(pending);
+        }
+        catch (publicationError) {
+            if (failed && primary instanceof AppError)
+                throw new AppError(primary.code, primary.message, primary.exitCode, { ...primary.details, effect: "partial", committed_publications: pending.length, publication_pending: true, publication_error: errorDetails(publicationError) });
+            if (failed)
+                throw new AppError("cross_store_failed", "Cross-store mutation failed and committed projections need reconciliation", 1, { effect: "partial", cause: errorDetails(primary), committed_publications: pending.length, publication_pending: true, publication_error: errorDetails(publicationError) });
+            throw publicationError;
+        }
+    }
+    if (failed && pending.length && primary instanceof AppError)
+        throw new AppError(primary.code, primary.message, primary.exitCode, { ...primary.details, effect: "partial", committed_publications: pending.length });
+    if (failed && pending.length)
+        throw new AppError("cross_store_failed", "Cross-store mutation failed after a committed inner write", 1, { effect: "partial", cause: errorDetails(primary), committed_publications: pending.length });
+    if (failed)
+        throw primary;
+    return value;
+}
+function executePublications(pending) {
+    let firstError;
+    let failed = false;
+    for (const operation of pending) {
+        try {
+            operation();
+        }
+        catch (error) {
+            if (!failed)
+                firstError = error;
+            failed = true;
+        }
+    }
+    if (failed) {
+        if (firstError instanceof AppError && firstError.details.effect === "committed")
+            throw firstError;
+        throw new AppError("publication_pending", "SQL committed but a required projection needs reconciliation", 1, { effect: "committed", publication_pending: true, cause: errorDetails(firstError) });
+    }
+}
+/** Invocation authority is prepared once with the runtime schema. Native
+ * hooks must only verify this table; they never create it on the hot path. */
+export function ensureLifecycleInvocationStorage(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS lifecycle_invocations (
+      id TEXT PRIMARY KEY, scope_json TEXT NOT NULL, command TEXT NOT NULL,
+      fingerprint TEXT NOT NULL, status TEXT NOT NULL,
+      event_key TEXT UNIQUE, identity_json TEXT, admission_json TEXT, deadline INTEGER, outcome_json TEXT,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_lifecycle_invocations_scope
+      ON lifecycle_invocations(scope_json, fingerprint, created_at);
+    CREATE TABLE IF NOT EXISTS lifecycle_packet_assignments (
+      packet_sha256 TEXT NOT NULL,
+      invocation_id TEXT NOT NULL REFERENCES lifecycle_invocations(id),
+      PRIMARY KEY(packet_sha256, invocation_id)
+    );
+  `);
+    ensureColumn(db, "lifecycle_invocations", "admission_json", "ALTER TABLE lifecycle_invocations ADD COLUMN admission_json TEXT");
+}
+/** RUN authority stays in its existing store; process leases stay in runtime.sqlite. */
+export function ensureRunControlStorage(db) {
+    db.execSchema(`
+    CREATE TABLE IF NOT EXISTS run_controls (
+      control_id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL, run_id TEXT NOT NULL,
+      request_id TEXT NOT NULL, request_hash TEXT NOT NULL, request_json TEXT NOT NULL,
+      recovery_id TEXT NOT NULL REFERENCES run_recovery_guards(recovery_id),
+      action TEXT NOT NULL, status TEXT NOT NULL,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+      UNIQUE(project_id, run_id, request_id),
+      FOREIGN KEY(project_id, run_id) REFERENCES runs(project_id, id)
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_run_control_active
+      ON run_controls(project_id, run_id) WHERE status IN ('requested','settled','resuming');
+    CREATE TABLE IF NOT EXISTS run_control_admissions (
+      control_id TEXT NOT NULL REFERENCES run_controls(control_id),
+      work_session_id TEXT NOT NULL REFERENCES work_sessions(id),
+      work_id TEXT NOT NULL REFERENCES works(work_id),
+      session_id TEXT NOT NULL, admitted_at TEXT NOT NULL,
+      PRIMARY KEY(control_id, work_session_id)
+    );
+    CREATE TABLE IF NOT EXISTS run_control_stage_admissions (
+      control_id TEXT NOT NULL REFERENCES run_controls(control_id),
+      stage TEXT NOT NULL, attempt TEXT NOT NULL,
+      work_session_id TEXT NOT NULL REFERENCES work_sessions(id),
+      PRIMARY KEY(control_id, stage)
+    );
+    CREATE TABLE IF NOT EXISTS run_control_operations (
+      operation_id TEXT PRIMARY KEY, control_id TEXT NOT NULL REFERENCES run_controls(control_id),
+      target_json TEXT NOT NULL, status TEXT NOT NULL, receipt_json TEXT, error_json TEXT,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS run_control_workers (
+      control_id TEXT PRIMARY KEY REFERENCES run_controls(control_id),
+      owner_token TEXT NOT NULL, owner_pid INTEGER,
+      status TEXT NOT NULL, process_id TEXT, process_lease_token TEXT,
+      resource_home TEXT NOT NULL, state_dir TEXT NOT NULL,
+      snapshot_json TEXT, error_json TEXT,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    );
+  `);
+}
+export function ensureRunControllerStorage(db) {
+    db.execSchema(`
+    CREATE TABLE IF NOT EXISTS run_controllers (
+      controller_id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL, run_id TEXT NOT NULL,
+      request_id TEXT NOT NULL, request_hash TEXT NOT NULL,
+      generation INTEGER NOT NULL, status TEXT NOT NULL,
+      owner_token TEXT NOT NULL, process_id TEXT, process_lease_token TEXT,
+      owner_pid INTEGER, manifest_json TEXT NOT NULL, state_json TEXT NOT NULL,
+      state_dir TEXT NOT NULL, last_error_json TEXT,
+      created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+      FOREIGN KEY(project_id, run_id) REFERENCES runs(project_id, id),
+      UNIQUE(project_id, run_id, request_id)
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_run_controller_owner
+      ON run_controllers(project_id, run_id)
+      WHERE status NOT IN ('completed', 'cancelled', 'superseded');
+    CREATE TABLE IF NOT EXISTS run_controller_events (
+      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+      controller_id TEXT NOT NULL REFERENCES run_controllers(controller_id),
+      event_type TEXT NOT NULL, data_json TEXT NOT NULL, created_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_run_controller_events
+      ON run_controller_events(controller_id, sequence);
+    CREATE TABLE IF NOT EXISTS run_controller_operations (
+      operation_id TEXT PRIMARY KEY,
+      controller_id TEXT NOT NULL REFERENCES run_controllers(controller_id),
+      generation INTEGER NOT NULL, input_hash TEXT NOT NULL,
+      input_json TEXT NOT NULL, status TEXT NOT NULL,
+      receipt_json TEXT, error_json TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+    );
+  `);
+}
+/** Recovery guards apply to every RUN kind, including custom eval fixtures. */
+export function ensureRecoveryStorage(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS run_recovery_guards (
+      recovery_id TEXT PRIMARY KEY, project_id TEXT NOT NULL, run_id TEXT NOT NULL, generation INTEGER NOT NULL, status TEXT NOT NULL, interruption_json TEXT NOT NULL, settlement_json TEXT, capture_path TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, sealed_at TEXT, resumed_at TEXT, UNIQUE(project_id, run_id, generation), FOREIGN KEY(project_id, run_id) REFERENCES runs(project_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_run_recovery_guards_run ON run_recovery_guards(project_id, run_id, generation DESC);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_run_recovery_guards_active ON run_recovery_guards(project_id, run_id) WHERE status IN ('draining', 'sealed', 'resuming');
+    CREATE TABLE IF NOT EXISTS work_recovery_segments (
+      recovery_id TEXT NOT NULL, work_id TEXT NOT NULL, generation INTEGER NOT NULL, prior_started_at TEXT, evidence_path TEXT NOT NULL, status TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY(recovery_id, work_id), FOREIGN KEY(recovery_id) REFERENCES run_recovery_guards(recovery_id), FOREIGN KEY(work_id) REFERENCES works(work_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_recovery_segments_work ON work_recovery_segments(work_id, generation DESC);
+    CREATE TABLE IF NOT EXISTS run_recovery_bindings (
+      recovery_id TEXT PRIMARY KEY REFERENCES run_recovery_guards(recovery_id),
+      work_id TEXT NOT NULL REFERENCES works(work_id), prior_work_session_id TEXT NOT NULL,
+      session_id TEXT NOT NULL, harness TEXT NOT NULL, provider_session_id TEXT NOT NULL,
+      daemon_id TEXT NOT NULL, status TEXT NOT NULL, hook_event_key TEXT,
+      created_at TEXT NOT NULL, accepted_at TEXT
+    );
+  `);
+    ensureColumn(db, "run_recovery_bindings", "packet_json", "ALTER TABLE run_recovery_bindings ADD COLUMN packet_json TEXT");
+    ensureColumn(db, "run_recovery_bindings", "packet_sha256", "ALTER TABLE run_recovery_bindings ADD COLUMN packet_sha256 TEXT");
+    ensureColumn(db, "run_recovery_bindings", "runtime_dispatch_json", "ALTER TABLE run_recovery_bindings ADD COLUMN runtime_dispatch_json TEXT");
+}
 /** Creates the single Work/Session authority used by a fresh vNext beta runtime. */
 export function ensureVnextWorkStorage(db) {
     const legacy = db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('vnext_works', 'vnext_agent_turns', 'flow_agent_turns') LIMIT 1");
@@ -16,7 +228,7 @@ export function ensureVnextWorkStorage(db) {
     if (existing && (!/task TEXT NOT NULL/.test(existing.sql) || /launch_token|adapter_session_id/.test(existing.sql))) {
         throw new AppError("beta_storage_recreate_required", "This beta requires a fresh DD_FLOW_HOME; the existing works schema is not compatible", 1);
     }
-    db.exec(`
+    db.execSchema(`
     CREATE TABLE IF NOT EXISTS works (
       work_id TEXT PRIMARY KEY,
       project_id TEXT NOT NULL,
@@ -46,6 +258,9 @@ export function ensureVnextWorkStorage(db) {
       status TEXT NOT NULL,
       prompt_path TEXT NOT NULL,
       result_path TEXT,
+      start_receipt_json TEXT,
+      start_publication_status TEXT,
+      result_receipt_json TEXT,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL,
       completed_at TEXT,
@@ -53,6 +268,16 @@ export function ensureVnextWorkStorage(db) {
     );
     CREATE INDEX IF NOT EXISTS idx_work_sessions_work ON work_sessions(work_id, created_at DESC);
     CREATE UNIQUE INDEX IF NOT EXISTS idx_work_sessions_open ON work_sessions(work_id) WHERE status = 'running';
+
+    CREATE TABLE IF NOT EXISTS run_recovery_guards (
+      recovery_id TEXT PRIMARY KEY, project_id TEXT NOT NULL, run_id TEXT NOT NULL, generation INTEGER NOT NULL, status TEXT NOT NULL, interruption_json TEXT NOT NULL, settlement_json TEXT, capture_path TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, sealed_at TEXT, resumed_at TEXT, UNIQUE(project_id, run_id, generation), FOREIGN KEY(project_id, run_id) REFERENCES runs(project_id, id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_run_recovery_guards_run ON run_recovery_guards(project_id, run_id, generation DESC);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_run_recovery_guards_active ON run_recovery_guards(project_id, run_id) WHERE status IN ('draining', 'sealed', 'resuming');
+    CREATE TABLE IF NOT EXISTS work_recovery_segments (
+      recovery_id TEXT NOT NULL, work_id TEXT NOT NULL, generation INTEGER NOT NULL, prior_started_at TEXT, evidence_path TEXT NOT NULL, status TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY(recovery_id, work_id), FOREIGN KEY(recovery_id) REFERENCES run_recovery_guards(recovery_id), FOREIGN KEY(work_id) REFERENCES works(work_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_recovery_segments_work ON work_recovery_segments(work_id, generation DESC);
     CREATE TABLE IF NOT EXISTS check_receipts (
       id TEXT PRIMARY KEY,
       project_id TEXT NOT NULL,
@@ -65,6 +290,9 @@ export function ensureVnextWorkStorage(db) {
       command TEXT NOT NULL,
       input_hash TEXT NOT NULL DEFAULT '',
       verification_epoch TEXT NOT NULL DEFAULT '',
+      reservation_sequence INTEGER NOT NULL DEFAULT 0,
+      retry_of_receipt_id TEXT,
+      retry_reason TEXT,
       status TEXT NOT NULL,
       exit_code INTEGER,
       stdout_path TEXT NOT NULL,
@@ -81,50 +309,316 @@ export function ensureVnextWorkStorage(db) {
       FOREIGN KEY(work_id) REFERENCES works(work_id)
     );
     CREATE INDEX IF NOT EXISTS idx_check_receipts_run ON check_receipts(project_id, run_id, started_at);
+    ${workContinuationStorageSql}
   `);
+    // A committed Work start is authoritative even if publishing its prompt
+    // files is interrupted after commit.  Keep the exact bytes for repair.
+    db.writeTransaction(() => {
+        const workColumns = db.all("PRAGMA table_info(works)");
+        if (!workColumns.some(column => column.name === "current_start_invocation_id"))
+            db.execSchema("ALTER TABLE works ADD COLUMN current_start_invocation_id TEXT");
+        const columns = db.all("PRAGMA table_info(work_sessions)");
+        if (!columns.some((column) => column.name === "start_receipt_json"))
+            db.execSchema("ALTER TABLE work_sessions ADD COLUMN start_receipt_json TEXT");
+        if (!columns.some((column) => column.name === "start_publication_status"))
+            db.execSchema("ALTER TABLE work_sessions ADD COLUMN start_publication_status TEXT");
+        if (!columns.some((column) => column.name === "result_receipt_json"))
+            db.execSchema("ALTER TABLE work_sessions ADD COLUMN result_receipt_json TEXT");
+    });
+}
+/** Durable intent for a provider-root external Work.  It is deliberately
+ * separate from `work_sessions`: only a trusted hook may bind that Session. */
+export function ensureWorkLaunchStorage(db) {
+    db.execSchema(`
+    CREATE TABLE IF NOT EXISTS work_launches (
+      operation_id TEXT PRIMARY KEY,
+      work_id TEXT NOT NULL UNIQUE,
+      profile_json TEXT NOT NULL,
+      profile_hash TEXT NOT NULL,
+      status TEXT NOT NULL,
+      state_dir TEXT NOT NULL,
+      journal_path TEXT NOT NULL,
+      provider_session_id TEXT,
+      adapter_receipt_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      FOREIGN KEY(work_id) REFERENCES works(work_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_launches_status ON work_launches(status, updated_at DESC);
+  `);
+}
+/** Exclusive fresh creation; never reinterpret an empty/old database as fresh. */
+function claimNewStore(file) {
+    for (const candidate of [file, `${file}-wal`, `${file}-shm`, `${file}-journal`]) {
+        try {
+            fs.lstatSync(candidate);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        throw new AppError("store_already_exists", "Fresh store creation refuses existing database or sidecar files", 1, { effect: "no_effect", path: candidate });
+    }
+    ensureDir(path.dirname(file));
+    let fd;
+    try {
+        fd = fs.openSync(file, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new AppError("store_already_exists", "Another owner already created this store", 1, { effect: "no_effect", path: file });
+        throw error;
+    }
+    fs.closeSync(fd);
 }
-export function getDatabase(ddFlowHome, mode = "initialize") {
+export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hookDeadlineAt) {
+    channel("dd-flow.sqlite.ingress").publish({ phase: "store_open", store_kind: "run" });
+    if (hookDeadlineAt !== undefined && !Number.isSafeInteger(hookDeadlineAt))
+        throw new AppError("hook_deadline_invalid", "Deadline must be a finite absolute millisecond deadline", 1, { effect: "unknown" });
+    const deadline = hookDeadlineAt === undefined ? undefined : (phase) => {
+        const remaining = hookDeadlineAt - Date.now();
+        if (remaining <= 0)
+            throw new AppError("native_hook_timeout", "Native hook deadline expired before durable admission", 1, { phase, deadline_at: hookDeadlineAt, effect: "unknown" });
+        return Math.max(1, Math.min(4000, remaining));
+    };
+    deadline?.("store_open");
+    if (mode !== "read_existing")
+        assertImportAdmission(ddFlowHome, importPermitId);
     const dbPath = path.join(ddFlowHome, "db.sqlite");
+    if (mode === "create_new")
+        claimNewStore(dbPath);
     const exists = fs.existsSync(dbPath);
+    if (mode === "prepared_existing" && (!exists || !fs.lstatSync(dbPath).isFile()))
+        throw new AppError("run_storage_unprepared", "Prepare a regular existing RUN store before execution admission", 1);
     if (mode === "read_existing" && !exists) {
         return emptyReadOnlyDatabase(dbPath);
     }
+    if (mode === "hook" && !exists)
+        throw new AppError("hook_storage_unprepared", "Prepare the runtime store before starting native hooks", 1);
+    if (mode === "reconcile" && !exists)
+        throw new AppError("reconciliation_storage_unprepared", "Reconciliation cannot create a runtime store", 1);
     if (!exists || mode === "migrate")
         ensureDir(ddFlowHome);
     const db = mode === "read_existing" ? new DatabaseSync(dbPath, { readOnly: true }) : new DatabaseSync(dbPath);
-    configureDatabase(db, mode);
+    if (mode !== "read_existing")
+        installWriterAdmission(db, () => assertImportAdmission(ddFlowHome, importPermitId), () => db.isTransaction, true);
+    try {
+        db.exec(`PRAGMA busy_timeout = ${deadline?.("store_open") ?? 4000}`);
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
+    if (mode !== "read_existing") {
+        try {
+            const admission = () => { if (!db.isTransaction)
+                assertImportAdmission(ddFlowHome, importPermitId); };
+            if (mode === "reconcile")
+                registerReconciliationWriter(db, admission);
+            else
+                registerStoreWriter(db, admission);
+        }
+        catch (error) {
+            return closeAfterOpenFailure(db, error);
+        }
+    }
+    try {
+        configureDatabase(db, mode, deadline);
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
     // Internal additive schema changes must be available to every write command.
     // Higher-level Memory Bank migrations remain explicit in services/migrations.
-    if (mode !== "read_existing")
-        migrate(db, dbPath);
+    if (mode !== "read_existing" && mode !== "reconcile") {
+        try {
+            const initialize = () => { migrate(db); ensureRecoveryStorage(db); ensureLifecycleInvocationStorage(db); };
+            if (mode === "prepared_existing") {
+                const required = readStoreWriterContract(db);
+                if (required !== STORE_WRITER_VERSION)
+                    throw new AppError("store_writer_incompatible", "Existing RUN store has no compatible writer contract", 1, { required, supported: STORE_WRITER_VERSION });
+            }
+            else if (mode !== "hook") {
+                const fresh = !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get();
+                if (fresh || readStoreWriterContract(db) !== null)
+                    executeStoreSchema(db, initialize, fresh);
+                else
+                    initialize();
+                // This migration owns a VACUUM backup and a separate data transaction.
+                migrateSessionStorageKeys(db, dbPath);
+            }
+            else {
+                deadline?.("store_validation");
+                assertHookStoreReady(db);
+            }
+        }
+        catch (error) {
+            return closeAfterOpenFailure(db, error);
+        }
+    }
     if (mode === "read_existing")
         db.exec("PRAGMA query_only = ON");
+    if (mode === "reconcile") {
+        try {
+            db.prepare("SELECT id, project_id, status, verdict, next_action, index_json, updated_at, completed_at FROM runs LIMIT 0");
+            db.prepare("SELECT id, root FROM projects LIMIT 0");
+            db.prepare("SELECT id, event_type, payload_json FROM audit_events LIMIT 0");
+        }
+        catch (error) {
+            return closeAfterOpenFailure(db, error);
+        }
+    }
     db.exec("PRAGMA foreign_keys = ON");
-    return {
-        path: dbPath,
-        writable: mode !== "read_existing",
-        close: () => db.close?.(),
-        exec: (sql) => db.exec(sql),
-        run: (sql, params = []) => db.prepare(sql).run(...params),
-        get: (sql, params = []) => db.prepare(sql).get(...params),
-        all: (sql, params = []) => db.prepare(sql).all(...params)
+    return databaseFacade(dbPath, mode !== "read_existing", db, undefined, deadline, mode === "read_existing" ? undefined : () => assertImportAdmission(ddFlowHome, importPermitId));
+}
+/**
+ * Hook ingress is a hot, synchronous path.  It may write receipts, but it
+ * must never perform schema migration or VACUUM while the native host waits.
+ * Startup/migration owns this contract; a missing table is an explicit
+ * preparation error instead of an implicit migration race.
+ */
+function assertHookStoreReady(db) {
+    const required = ["projects", "hook_events", "codex_session_bindings", "sessions", "flow_session_segments", "lifecycle_invocations", "lifecycle_packet_assignments"];
+    const missing = required.filter((table) => !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = ?").get(table));
+    if (missing.length)
+        throw new AppError("hook_storage_unprepared", "Managed store is not prepared for synchronous hook admission", 1, { missing_tables: missing, next_action: "Open the runtime with a normal dd-flow command and complete migration before starting the native Session." });
+    // Table presence alone does not establish compatibility with an older home.
+    const receiptColumns = {
+        hook_events: "id, project_id, harness, provider_session_id, parent_session_id, daemon_id, session_id, agent_id, turn_id, event_name, tool_name, event_key, cwd, match_key, transcript_path, status, sanitized_summary, outcome_json, created_at",
+        lifecycle_invocations: "id, scope_json, command, fingerprint, status, event_key, identity_json, deadline, outcome_json, created_at, updated_at",
+        codex_session_bindings: "session_id, project_id, protocol_id, handshake_id, cwd, transcript_path, status, created_at, updated_at"
     };
+    for (const [table, columns] of Object.entries(receiptColumns)) {
+        try {
+            db.prepare(`SELECT ${columns} FROM ${table} LIMIT 0`);
+        }
+        catch {
+            throw new AppError("hook_storage_unprepared", "Managed receipt schema needs preparation before native hooks start", 1, { table });
+        }
+    }
 }
 /**
  * Opens the small host-wide resource registry.  It is intentionally separate
  * from a RUN database: a process or a port can outlive the CLI client that
  * created it, while a RUN database belongs to one flow home.
  */
-export function getResourceDatabase(resourceHome) {
-    ensureDir(resourceHome);
+export function withResourceReadSnapshot(resourceHome, read) {
     const dbPath = path.join(resourceHome, "runtime.sqlite");
     const cached = resourceDatabases.get(dbPath);
+    if (!cached && !fs.existsSync(dbPath))
+        return read(emptyReadOnlyDatabase(dbPath));
+    const db = cached ?? new DatabaseSync(dbPath, { readOnly: true });
+    const operation = () => {
+        if (!cached)
+            db.exec("PRAGMA busy_timeout = 4000; PRAGMA query_only = ON");
+        // A second process can observe SQLite's file before the initializing
+        // transaction publishes its schema. Treat that pre-commit view exactly
+        // like an absent registry; the writer path remains the serialization
+        // boundary and will reopen the committed schema.
+        if (!cached && !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get()) {
+            return read(emptyReadOnlyDatabase(dbPath));
+        }
+        const reader = cached
+            ? { ...emptyReadOnlyDatabase(dbPath), get: cached.get, all: cached.all }
+            : databaseFacade(dbPath, false, db);
+        // The facade owns savepoint cleanup and poisons a connection when rollback
+        // fails; the callback only receives the read-only view.
+        return (cached ?? reader).readSnapshot(() => read(reader));
+    };
     if (cached)
-        return cached;
+        return operation();
+    const native = db;
+    return withStoreCleanup(operation, () => { if (native.isOpen)
+        native.close(); });
+}
+export function getResourceDatabase(resourceHome, mode = "initialize", deadlineAt, importPermitId) {
+    channel("dd-flow.sqlite.ingress").publish({ phase: "store_open", store_kind: "resource" });
+    const deadline = requestDeadline(deadlineAt);
+    deadline?.("resource_open");
+    const dbPath = path.join(resourceHome, "runtime.sqlite");
+    if (mode !== "read_existing" && mode !== "read_isolated")
+        assertImportAdmission(resourceHome, importPermitId);
+    if (mode === "retirement" && !fs.existsSync(dbPath))
+        return getResourceDatabase(resourceHome, "initialize", deadlineAt, importPermitId);
+    const cached = resourceDatabases.get(dbPath);
+    if (mode === "create_new") {
+        if (cached)
+            throw new AppError("store_already_exists", "Fresh store creation refuses a cached resource owner", 1, { effect: "no_effect", path: dbPath });
+        claimNewStore(dbPath);
+    }
+    if (mode === "read_existing" || mode === "read_isolated") {
+        // Reuse a current transaction's view without exposing its write capability.
+        if (cached && mode === "read_existing") {
+            const bounded = deadlineAt === undefined ? cached : cached.withDeadline(deadlineAt);
+            return { ...emptyReadOnlyDatabase(dbPath), get: bounded.get, all: bounded.all };
+        }
+        if (!fs.existsSync(dbPath))
+            return emptyReadOnlyDatabase(dbPath);
+        channel("dd-flow.sqlite.ingress").publish({ phase: "store_connection", store_kind: "resource" });
+        const db = new DatabaseSync(dbPath, { readOnly: true });
+        try {
+            db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}; PRAGMA query_only = ON`);
+            if (!db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get()) {
+                db.close();
+                return emptyReadOnlyDatabase(dbPath);
+            }
+        }
+        catch (error) {
+            return closeAfterOpenFailure(db, error);
+        }
+        return databaseFacade(dbPath, false, db, undefined, deadline);
+    }
+    if (mode === "prepared_existing" && !fs.existsSync(dbPath))
+        throw new AppError("resource_storage_unprepared", "Prepare the resource registry before maintenance", 1);
+    if (cached) {
+        if (importPermitId && resourceDatabaseIdentities.get(cached)?.importPermitId !== importPermitId)
+            throw new AppError("resource_writer_reopen_required", "Close the owned cached resource writer before opening a privileged maintenance connection", 1);
+        if (mode === "prepared_existing" || mode === "retirement")
+            assertResourceDatabaseIdentity(cached);
+        const bounded = deadlineAt === undefined ? cached : cached.withDeadline(deadlineAt);
+        const reader = { prepare: (sql) => ({ get: (...params) => bounded.get(sql, params), all: (...params) => bounded.all(sql, params), run: (...params) => bounded.run(sql, params) }) };
+        assertResourceStoreReady(reader, mode === "retirement");
+        return bounded;
+    }
+    if (mode !== "prepared_existing" && mode !== "retirement")
+        ensureDir(resourceHome);
+    channel("dd-flow.sqlite.ingress").publish({ phase: "store_connection", store_kind: "resource" });
     const db = new DatabaseSync(dbPath);
-    configureDatabase(db, "initialize");
-    db.exec("PRAGMA foreign_keys = ON");
-    db.exec(`
+    installWriterAdmission(db, () => assertImportAdmission(resourceHome, importPermitId), () => db.isTransaction, true);
+    try {
+        channel("dd-flow.sqlite.ingress").publish({ phase: "store_writer_registration", store_kind: "resource" });
+        db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}`);
+        const admission = () => { if (!db.isTransaction)
+            assertImportAdmission(resourceHome, importPermitId); };
+        if (mode === "retirement")
+            registerReconciliationWriter(db, admission);
+        else
+            registerStoreWriter(db, admission);
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
+    channel("dd-flow.sqlite.ingress").publish({ phase: "store_validation", store_kind: "resource" });
+    try {
+        if (mode === "prepared_existing" || mode === "retirement")
+            assertResourceStoreReady(db, mode === "retirement");
+        else
+            configureDatabase(db, "initialize", deadline);
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
+    let fresh;
+    try {
+        db.exec("PRAGMA foreign_keys = ON");
+        fresh = !db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' LIMIT 1").get();
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
+    try {
+        if (mode !== "prepared_existing" && mode !== "retirement")
+            executeStoreSchema(db, `
     CREATE TABLE IF NOT EXISTS managed_processes (
       id TEXT PRIMARY KEY,
       kind TEXT NOT NULL,
@@ -163,37 +657,401 @@ export function getResourceDatabase(resourceHome) {
     );
     CREATE INDEX IF NOT EXISTS idx_managed_resources_lease
       ON managed_resources(lease_expires_at, updated_at);
-  `);
-    const database = {
-        path: dbPath,
-        writable: true,
-        close: () => { resourceDatabases.delete(dbPath); db.close?.(); },
-        exec: (sql) => db.exec(sql),
-        run: (sql, params = []) => db.prepare(sql).run(...params),
-        get: (sql, params = []) => db.prepare(sql).get(...params),
-        all: (sql, params = []) => db.prepare(sql).all(...params)
-    };
+  `, fresh);
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
+    const database = databaseFacade(dbPath, true, db, () => {
+        resourceDatabases.delete(dbPath);
+        db.close?.();
+    }, undefined, () => assertImportAdmission(resourceHome, importPermitId));
+    try {
+        const identity = fs.lstatSync(dbPath);
+        if (!identity.isFile())
+            throw new AppError("resource_storage_changed", "Resource registry target is not a regular file", 1);
+        resourceDatabaseIdentities.set(database, { dev: identity.dev, ino: identity.ino, ...(importPermitId ? { importPermitId } : {}) });
+    }
+    catch (error) {
+        return closeAfterOpenFailure(db, error);
+    }
     resourceDatabases.set(dbPath, database);
-    return database;
+    return deadlineAt === undefined ? database : database.withDeadline(deadlineAt);
+}
+function requestDeadline(at) {
+    if (at === undefined)
+        return undefined;
+    if (!Number.isSafeInteger(at))
+        throw new AppError("maintenance_deadline_invalid", "Maintenance deadline must be an absolute millisecond timestamp", 1);
+    return phase => { const remaining = at - Date.now(); if (remaining <= 0)
+        throw new AppError("process_heartbeat_timeout", "Maintenance storage deadline expired", 1, { phase, deadline_at: at, effect: "unknown" }); return Math.max(1, Math.min(4000, remaining)); };
+}
+function assertResourceStoreReady(db, retirement = false) {
+    const version = readStoreWriterContract(db);
+    if (version === null && !retirement)
+        throw new AppError("resource_storage_unprepared", "Prepare the resource registry writer contract before maintenance", 1);
+    if (version !== null && version !== STORE_WRITER_VERSION && !(retirement && version === 1))
+        throw new AppError("store_writer_incompatible", "This CLI cannot maintain the resource registry's required contract", 1, { required: version, supported: STORE_WRITER_VERSION });
+    for (const [table, columns] of Object.entries({ managed_processes: "id,kind,pid,pid_started_at,owner_id,lease_token,lease_expires_at,project_id,run_id,work_id,check_id,operation_id,stdout_path,stderr_path,state,started_at,updated_at,finished_at,termination_reason,metadata_json", managed_resources: "resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at" })) {
+        try {
+            db.prepare(`SELECT ${columns} FROM ${table} LIMIT 0`);
+        }
+        catch {
+            throw new AppError("resource_storage_unprepared", "Prepare the resource registry schema before maintenance", 1, { table });
+        }
+    }
+    for (const name of ["idx_managed_processes_lease", "idx_managed_resources_lease"])
+        if (!db.prepare("SELECT 1 FROM sqlite_schema WHERE type='index' AND name=?").get(name))
+            throw new AppError("resource_storage_unprepared", "Prepare resource registry indexes before maintenance", 1, { index: name });
 }
 function emptyReadOnlyDatabase(dbPath) {
     return {
         path: dbPath,
         writable: false,
         exec: () => { throw new AppError("read_only_storage", "Read-only access cannot write absent dd-flow storage", 1, { path: dbPath }); },
+        execSchema: () => { throw new AppError("read_only_storage", "Read-only access cannot write absent dd-flow storage", 1, { path: dbPath }); },
+        beginWriteTransaction: () => { throw new AppError("read_only_storage", "Read-only access cannot start a write transaction", 1, { path: dbPath }); },
+        writeTransaction: () => { throw new AppError("read_only_storage", "Read-only access cannot start a write transaction", 1, { path: dbPath }); },
+        readSnapshot: (operation) => operation(),
+        afterCommit: () => { throw new AppError("read_only_storage", "Read-only access cannot publish absent dd-flow storage", 1, { path: dbPath }); },
         run: () => { throw new AppError("read_only_storage", "Read-only access cannot write absent dd-flow storage", 1, { path: dbPath }); },
         get: () => undefined,
         all: () => []
     };
 }
-function configureDatabase(db, mode) {
-    db.exec("PRAGMA busy_timeout = 4000");
-    if (mode !== "read_existing") {
-        db.exec("PRAGMA journal_mode = WAL");
+function installWriterAdmission(db, assertAdmission, reserved, initializing = false) {
+    const writes = new Set([constants.SQLITE_INSERT, constants.SQLITE_UPDATE, constants.SQLITE_DELETE,
+        constants.SQLITE_CREATE_INDEX, constants.SQLITE_CREATE_TABLE, constants.SQLITE_CREATE_TEMP_INDEX, constants.SQLITE_CREATE_TEMP_TABLE,
+        constants.SQLITE_CREATE_TEMP_TRIGGER, constants.SQLITE_CREATE_TEMP_VIEW, constants.SQLITE_CREATE_TRIGGER, constants.SQLITE_CREATE_VIEW,
+        constants.SQLITE_DROP_INDEX, constants.SQLITE_DROP_TABLE, constants.SQLITE_DROP_TEMP_INDEX, constants.SQLITE_DROP_TEMP_TABLE,
+        constants.SQLITE_DROP_TEMP_TRIGGER, constants.SQLITE_DROP_TEMP_VIEW, constants.SQLITE_DROP_TRIGGER, constants.SQLITE_DROP_VIEW,
+        constants.SQLITE_ATTACH, constants.SQLITE_DETACH, constants.SQLITE_ALTER_TABLE, constants.SQLITE_REINDEX, constants.SQLITE_ANALYZE,
+        constants.SQLITE_CREATE_VTABLE, constants.SQLITE_DROP_VTABLE]);
+    const filePragmas = new Set(["journal_mode", "wal_checkpoint", "optimize", "incremental_vacuum", "user_version", "application_id", "writable_schema", "auto_vacuum", "page_size", "max_page_count", "encoding", "locking_mode"]);
+    db.setAuthorizer((action, first, second) => {
+        if (initializing && action === constants.SQLITE_TRANSACTION && first === "BEGIN")
+            assertAdmission();
+        if (!reserved() && (writes.has(action) || action === constants.SQLITE_PRAGMA
+            && filePragmas.has(first?.toLowerCase() ?? "") && (second !== null || ["wal_checkpoint", "optimize", "incremental_vacuum"].includes(first?.toLowerCase() ?? ""))))
+            assertAdmission();
+        return constants.SQLITE_OK;
+    });
+}
+function databaseFacade(dbPath, writable, db, close = () => db.close?.(), deadline, assertAdmission) {
+    let scopedDeadline = deadline;
+    let reserved = false;
+    let poisoned = false;
+    let closed = false;
+    const closeOnce = () => { if (closed || !db.isOpen) {
+        closed = true;
+        return;
+    } closed = true; close(); };
+    let savepoint = 0;
+    let afterCommit = [];
+    let manualFrames = [];
+    let readDepth = 0;
+    let ownedWriterToken = null;
+    if (writable && assertAdmission) {
+        // SQLite identifies DML/DDL even behind comments, CTEs or RETURNING.
+        // An already reserved writer may finish; maintenance must acquire its
+        // own barriers and recheck drain before mutating either store.
+        installWriterAdmission(db, assertAdmission, () => reserved && db.isTransaction);
+        // Existing writer triggers also check at execution time. This closes the
+        // prepare-before-fence / step-after-fence window for protected DML.
+        bindStoreWriterAdmission(db, () => { if (!(reserved && db.isTransaction))
+            assertAdmission(); });
+    }
+    const writerTiming = channel("dd-flow.sqlite.writer");
+    const ingressPhase = channel("dd-flow.sqlite.ingress");
+    const storeKind = path.basename(dbPath) === "runtime.sqlite" ? "resource" : "run";
+    const bound = (phase) => {
+        const remaining = scopedDeadline?.(phase);
+        if (remaining !== undefined)
+            db.exec(`PRAGMA busy_timeout = ${remaining}`);
+        if (ingressPhase.hasSubscribers)
+            ingressPhase.publish({ phase, store_kind: storeKind, ...(remaining !== undefined ? { remaining_ms: remaining } : {}) });
+    };
+    const publishCommitted = () => {
+        const pending = afterCommit;
+        afterCommit = [];
+        const scope = publicationScopes.at(-1);
+        if (scope)
+            scope.push(...pending);
+        else
+            executePublications(pending);
+    };
+    const assertUsable = () => { if (poisoned || closed || !db.isOpen)
+        throw new AppError("write_transaction_unresolved", "Transaction cleanup failed or the connection is closed; reopen the connection before continuing", 1); };
+    const beginWriteTransaction = () => {
+        assertUsable();
+        if (readDepth)
+            throw new AppError("read_snapshot_write", "Cannot reserve a writer inside a read snapshot", 1);
+        if (!writable)
+            throw new AppError("read_only_storage", "Read-only access cannot start a write transaction", 1, { path: dbPath });
+        assertAdmission?.();
+        bound("writer_reservation");
+        db.exec("BEGIN IMMEDIATE");
+        reserved = true;
+        ownedWriterToken = Object.freeze({});
+        if (ingressPhase.hasSubscribers)
+            ingressPhase.publish({ phase: "writer_reserved", store_kind: storeKind });
+    };
+    const rollback = (sql, original) => {
+        try {
+            db.exec(sql);
+        }
+        catch (cleanup) {
+            poisoned = true;
+            let closeError;
+            try {
+                closeOnce();
+            }
+            catch (error) {
+                closeError = errorDetails(error);
+            }
+            const secondary = { transaction_cleanup_error: errorDetails(cleanup), ...(closeError ? { transaction_close_error: closeError } : {}) };
+            if (original instanceof AppError)
+                throw new AppError(original.code, original.message, original.exitCode, { ...original.details, ...secondary });
+            throw new AppError("write_transaction_failed", "Write transaction failed and SQLite cleanup also failed", 1, { cause: errorDetails(original), ...secondary });
+        }
+        throw original;
+    };
+    const writeTransaction = (operation, operationName = "writeTransaction") => {
+        assertUsable();
+        if (readDepth)
+            throw new AppError("read_snapshot_write", "Cannot reserve a writer inside a read snapshot", 1);
+        if (!writable)
+            throw new AppError("read_only_storage", "Read-only access cannot start a write transaction", 1, { path: dbPath });
+        if (db.isTransaction && !reserved)
+            throw new AppError("write_transaction_unowned", "Cannot write inside an unowned transaction or read snapshot", 1);
+        const nested = db.isTransaction;
+        const callbackLength = afterCommit.length;
+        const marker = `dd_flow_write_${++savepoint}`;
+        const startedAt = performance.now();
+        try {
+            if (nested)
+                db.exec(`SAVEPOINT ${marker}`);
+            else
+                beginWriteTransaction();
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            throw new AppError("storage_write_failed", "Cannot reserve SQLite writer", 1, { cause: errorDetails(error), transaction_phase: "begin", transaction_rolled_back: true });
+        }
+        let phase = "body";
+        try {
+            const value = operation();
+            if (value && typeof value.then === "function") {
+                void Promise.resolve(value).catch(() => { });
+                throw new AppError("write_transaction_async", "Write transaction callback must be synchronous", 1);
+            }
+            phase = "commit";
+            bound("commit");
+            if (nested)
+                db.exec(`RELEASE ${marker}`);
+            else
+                db.exec("COMMIT");
+            phase = "committed";
+            if (!nested && ingressPhase.hasSubscribers)
+                ingressPhase.publish({ phase: "committed", store_kind: storeKind });
+            if (!nested && writerTiming.hasSubscribers)
+                writerTiming.publish({ operation: operationName, wall_time_ms: performance.now() - startedAt, path: dbPath });
+            if (!nested)
+                publishCommitted();
+            return value;
+        }
+        catch (error) {
+            if (phase === "committed")
+                throw error;
+            afterCommit.length = callbackLength;
+            try {
+                return rollback(nested ? `ROLLBACK TO ${marker}; RELEASE ${marker}` : "ROLLBACK", error);
+            }
+            catch (failure) {
+                if (failure === error && !(error instanceof AppError) && typeof error === "object" && error !== null && "code" in error && String(error.code).startsWith("ERR_SQLITE"))
+                    throw new AppError("storage_write_failed", "SQLite write failed", 1, { cause: errorDetails(error), transaction_phase: phase, transaction_rolled_back: true });
+                throw failure;
+            }
+        }
+        finally {
+            if (closed || !db.isOpen || !db.isTransaction) {
+                reserved = false;
+                if (phase !== "committed") {
+                    afterCommit = [];
+                    manualFrames = [];
+                }
+            }
+        }
+    };
+    const readSnapshot = (operation) => {
+        assertUsable();
+        const nested = db.isTransaction;
+        const marker = `dd_flow_read_${++savepoint}`;
+        const callbackLength = afterCommit.length;
+        try {
+            db.exec(nested ? `SAVEPOINT ${marker}` : "BEGIN");
+        }
+        catch (error) {
+            throw new AppError("read_snapshot_failed", "Cannot start SQLite read snapshot", 1, { cause: errorDetails(error) });
+        }
+        readDepth += 1;
+        let phase = "body";
+        try {
+            const value = operation();
+            if (value && typeof value.then === "function") {
+                void Promise.resolve(value).catch(() => { });
+                throw new AppError("read_snapshot_async", "Read snapshot callback must be synchronous", 1);
+            }
+            phase = "commit";
+            db.exec(nested ? `RELEASE ${marker}` : "COMMIT");
+            phase = "committed";
+            return value;
+        }
+        catch (error) {
+            if (phase === "committed")
+                throw error;
+            afterCommit.length = callbackLength;
+            return rollback(nested ? `ROLLBACK TO ${marker}; RELEASE ${marker}` : "ROLLBACK", error);
+        }
+        finally {
+            readDepth -= 1;
+        }
+    };
+    const applyManualBoundary = (sql) => {
+        for (const statement of sql.split(";")) {
+            const save = /^\s*SAVEPOINT\s+([\w-]+)/i.exec(statement);
+            if (save) {
+                manualFrames.push({ name: save[1], length: afterCommit.length });
+                continue;
+            }
+            const rollbackTo = /^\s*ROLLBACK\s+TO(?:\s+SAVEPOINT)?\s+([\w-]+)/i.exec(statement);
+            if (rollbackTo) {
+                const frame = manualFrames.findLastIndex((item) => item.name === rollbackTo[1]);
+                if (frame >= 0) {
+                    afterCommit.length = manualFrames[frame].length;
+                    manualFrames.length = frame + 1;
+                }
+                continue;
+            }
+            const release = /^\s*RELEASE(?:\s+SAVEPOINT)?\s+([\w-]+)/i.exec(statement);
+            if (release) {
+                const frame = manualFrames.findLastIndex((item) => item.name === release[1]);
+                if (frame >= 0)
+                    manualFrames.length = frame;
+                continue;
+            }
+            if (/^\s*ROLLBACK\b/i.test(statement)) {
+                afterCommit = [];
+                manualFrames = [];
+                continue;
+            }
+            if (/^\s*COMMIT\b/i.test(statement)) {
+                manualFrames = [];
+                publishCommitted();
+            }
+        }
+    };
+    const facade = {
+        path: dbPath,
+        writable,
+        close: closeOnce,
+        exec: (sql) => {
+            assertUsable();
+            if (readDepth)
+                throw new AppError("read_snapshot_write", "Cannot execute SQL inside a read snapshot", 1);
+            // Raw SQL may replace the transaction (including behind comments).
+            // Do not infer continuity by parsing SQL or its final isTransaction.
+            ownedWriterToken = null;
+            try {
+                db.exec(sql);
+                applyManualBoundary(sql);
+            }
+            catch (error) {
+                if (/^\s*ROLLBACK\b/i.test(sql)) {
+                    poisoned = true;
+                    try {
+                        closeOnce();
+                    }
+                    catch { /* Keep the primary SQLite failure. */ }
+                }
+                throw error;
+            }
+            finally {
+                if (closed || !db.isOpen || !db.isTransaction) {
+                    reserved = false;
+                    if (!/^\s*COMMIT\b/i.test(sql)) {
+                        afterCommit = [];
+                        manualFrames = [];
+                    }
+                }
+            }
+        },
+        execSchema: (sql) => { assertUsable(); if (db.isTransaction && !reserved)
+            throw new AppError("write_transaction_unowned", "Cannot change schema inside an unowned transaction", 1); ownedWriterToken = null; executeStoreSchema(db, sql); },
+        beginWriteTransaction,
+        writeTransaction,
+        isOwnedWriteTransaction: () => { assertUsable(); return writable && reserved && ownedWriterToken !== null && db.isTransaction && readDepth === 0; },
+        ownedWriteTransactionToken: () => { assertUsable(); return writable && reserved && db.isTransaction && readDepth === 0 ? ownedWriterToken : null; },
+        readSnapshot,
+        afterCommit: (operation) => { assertUsable(); if (readDepth)
+            throw new AppError("read_snapshot_write", "Cannot queue publication inside a read snapshot", 1); if (db.isTransaction)
+            afterCommit.push(operation);
+        else {
+            const scope = publicationScopes.at(-1);
+            if (scope)
+                scope.push(operation);
+            else
+                executePublications([operation]);
+        } },
+        run: (sql, params = []) => { assertUsable(); if (readDepth)
+            throw new AppError("read_snapshot_write", "Cannot write inside a read snapshot", 1); bound("write"); return db.prepare(sql).run(...params); },
+        get: (sql, params = []) => { assertUsable(); bound("lookup"); return db.prepare(sql).get(...params); },
+        all: (sql, params = []) => { assertUsable(); bound("lookup"); return db.prepare(sql).all(...params); }
+    };
+    facade.withDeadline = (at) => {
+        const bounded = requestDeadline(at);
+        const scoped = (operation) => { const previous = scopedDeadline; scopedDeadline = phase => Math.min(bounded(phase), previous?.(phase) ?? 4000); try {
+            return operation();
+        }
+        finally {
+            scopedDeadline = previous;
+            if (db.isOpen)
+                db.exec("PRAGMA busy_timeout = 4000");
+        } };
+        return { ...facade, exec: sql => scoped(() => facade.exec(sql)), execSchema: sql => scoped(() => facade.execSchema(sql)), beginWriteTransaction: () => scoped(() => facade.beginWriteTransaction()), writeTransaction: (operation, name) => scoped(() => facade.writeTransaction(operation, name)), readSnapshot: operation => scoped(() => facade.readSnapshot(operation)), get: (sql, params) => scoped(() => facade.get(sql, params)), all: (sql, params) => scoped(() => facade.all(sql, params)), run: (sql, params) => scoped(() => facade.run(sql, params)) };
+    };
+    return facade;
+}
+function errorDetails(error) {
+    const value = error;
+    return { message: String(value?.message ?? error), ...(typeof value?.code === "string" ? { code: value.code } : {}), ...(typeof value?.errcode === "number" ? { sqlite_extended_code: value.errcode } : {}) };
+}
+function configureDatabase(db, mode, ingressDeadline) {
+    if (mode !== "read_existing" && mode !== "prepared_existing") {
+        // Concurrent first openers can collide while changing journal mode, even
+        // with busy_timeout set. Retrying this configuration does not replay writes.
+        const deadline = performance.now() + 4000, pause = new Int32Array(new SharedArrayBuffer(4));
+        for (;;) {
+            try {
+                const remaining = ingressDeadline?.("store_configuration");
+                if (remaining !== undefined)
+                    db.exec(`PRAGMA busy_timeout = ${remaining}`);
+                const current = db.prepare("PRAGMA journal_mode").get();
+                if (current.journal_mode !== "wal")
+                    db.exec("PRAGMA journal_mode = WAL");
+                break;
+            }
+            catch (error) {
+                if ((error.errcode ?? 0) % 256 !== 5 || performance.now() >= deadline)
+                    throw error;
+                Atomics.wait(pause, 0, 0, Math.min(25, Math.max(1, deadline - performance.now())));
+            }
+        }
         db.exec("PRAGMA synchronous = NORMAL");
     }
 }
-function migrate(db, dbPath) {
+function migrate(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS projects (
       id TEXT PRIMARY KEY,
@@ -229,6 +1087,7 @@ function migrate(db, dbPath) {
     CREATE TABLE IF NOT EXISTS plan_bindings (
       project_id TEXT NOT NULL,
       protocol_id TEXT NOT NULL,
+      plan_id TEXT,
       plan_revision INTEGER NOT NULL,
       plan_sha256 TEXT NOT NULL,
       plan_path TEXT NOT NULL,
@@ -551,6 +1410,8 @@ function migrate(db, dbPath) {
     CREATE INDEX IF NOT EXISTS idx_check_receipts_run
       ON check_receipts(project_id, run_id, started_at);
 
+    ${workContinuationStorageSql}
+
     CREATE TABLE IF NOT EXISTS merge_requests (
       merge_request_id TEXT PRIMARY KEY,
       project_id TEXT NOT NULL,
@@ -799,7 +1660,6 @@ function migrate(db, dbPath) {
     ensureColumn(db, "sessions", "plan_item_id", "ALTER TABLE sessions ADD COLUMN plan_item_id TEXT");
     ensureColumn(db, "sessions", "session_kind", "ALTER TABLE sessions ADD COLUMN session_kind TEXT");
     ensureColumn(db, "sessions", "coverage_units_json", "ALTER TABLE sessions ADD COLUMN coverage_units_json TEXT NOT NULL DEFAULT '[]'");
-    migrateSessionStorageKeys(db, dbPath);
     ensureColumn(db, "usage", "cache_read_input_tokens", "ALTER TABLE usage ADD COLUMN cache_read_input_tokens INTEGER");
     ensureColumn(db, "usage", "cache_write_input_tokens", "ALTER TABLE usage ADD COLUMN cache_write_input_tokens INTEGER");
     ensureColumn(db, "usage", "uncached_input_tokens", "ALTER TABLE usage ADD COLUMN uncached_input_tokens INTEGER");
@@ -809,17 +1669,41 @@ function migrate(db, dbPath) {
     ensureColumn(db, "usage", "source_mtime_ms", "ALTER TABLE usage ADD COLUMN source_mtime_ms INTEGER");
     db.prepare("UPDATE usage SET cache_read_input_tokens = cached_input_tokens WHERE cache_read_input_tokens IS NULL AND cached_input_tokens IS NOT NULL").run();
     ensureColumn(db, "runs", "run_home_path", "ALTER TABLE runs ADD COLUMN run_home_path TEXT");
+    ensureColumn(db, "plan_bindings", "plan_id", "ALTER TABLE plan_bindings ADD COLUMN plan_id TEXT");
+    // Historical RUN projections already retain the canonical identifier. Use
+    // those SQL bytes to backfill without opening plan files under the writer.
+    for (const row of db.prepare("SELECT project_id, protocol_id FROM plan_bindings WHERE plan_id IS NULL").all()) {
+        const runs = db.prepare("SELECT index_json FROM runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ? ORDER BY updated_at DESC").all(row.project_id, row.protocol_id);
+        for (const run of runs) {
+            try {
+                const planId = JSON.parse(run.index_json).plan_ref?.plan_id;
+                if (typeof planId !== "string" || !planId || planId === "unknown-plan")
+                    continue;
+                db.prepare("UPDATE plan_bindings SET plan_id = ? WHERE project_id = ? AND protocol_id = ? AND plan_id IS NULL").run(planId, row.project_id, row.protocol_id);
+                break;
+            }
+            catch { /* A malformed historical RUN cannot establish plan identity. */ }
+        }
+    }
     ensureColumn(db, "runs", "run_root", "ALTER TABLE runs ADD COLUMN run_root TEXT");
     db.prepare("UPDATE runs SET run_root = COALESCE(run_root, run_home_path, run_dir) WHERE run_root IS NULL OR run_root = ''").run();
     ensureColumn(db, "merge_requests", "accepted_tree", "ALTER TABLE merge_requests ADD COLUMN accepted_tree TEXT");
     ensureColumn(db, "merge_requests", "replacement_of_merge_request_id", "ALTER TABLE merge_requests ADD COLUMN replacement_of_merge_request_id TEXT");
     // A failed integration gate may create a new immutable source candidate in
     // the same RUN. The historical unique index made that repair path impossible.
-    db.exec("DROP INDEX IF EXISTS idx_merge_requests_run");
+    // Rebuilding an already-current index changes schema/data_version on every
+    // CLI observation and prevents a controller's writer barrier from settling.
+    const mergeRunIndex = db.prepare("PRAGMA index_list(merge_requests)").all().find(index => index.name === "idx_merge_requests_run");
+    if (mergeRunIndex?.unique)
+        db.exec("DROP INDEX idx_merge_requests_run");
     db.exec("CREATE INDEX IF NOT EXISTS idx_merge_requests_run ON merge_requests(project_id, run_id, created_at)");
     ensureColumn(db, "runs", "layout_version", "ALTER TABLE runs ADD COLUMN layout_version TEXT");
     ensureColumn(db, "runs", "artifact_root_kind", "ALTER TABLE runs ADD COLUMN artifact_root_kind TEXT");
     ensureColumn(db, "works", "payload_json", "ALTER TABLE works ADD COLUMN payload_json TEXT");
+    ensureColumn(db, "works", "current_start_invocation_id", "ALTER TABLE works ADD COLUMN current_start_invocation_id TEXT");
+    ensureColumn(db, "work_sessions", "start_receipt_json", "ALTER TABLE work_sessions ADD COLUMN start_receipt_json TEXT");
+    ensureColumn(db, "work_sessions", "start_publication_status", "ALTER TABLE work_sessions ADD COLUMN start_publication_status TEXT");
+    ensureColumn(db, "work_sessions", "result_receipt_json", "ALTER TABLE work_sessions ADD COLUMN result_receipt_json TEXT");
     ensureColumn(db, "check_receipts", "declaration_id", "ALTER TABLE check_receipts ADD COLUMN declaration_id TEXT NOT NULL DEFAULT 'CHK-LEGACY'");
     ensureColumn(db, "check_receipts", "workspace_fingerprint", "ALTER TABLE check_receipts ADD COLUMN workspace_fingerprint TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "artifacts_json", "ALTER TABLE check_receipts ADD COLUMN artifacts_json TEXT NOT NULL DEFAULT '[]'");
@@ -827,10 +1711,17 @@ function migrate(db, dbPath) {
     ensureColumn(db, "check_receipts", "gate", "ALTER TABLE check_receipts ADD COLUMN gate TEXT NOT NULL DEFAULT 'work'");
     ensureColumn(db, "check_receipts", "input_hash", "ALTER TABLE check_receipts ADD COLUMN input_hash TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "verification_epoch", "ALTER TABLE check_receipts ADD COLUMN verification_epoch TEXT NOT NULL DEFAULT ''");
+    ensureColumn(db, "check_receipts", "reservation_sequence", "ALTER TABLE check_receipts ADD COLUMN reservation_sequence INTEGER NOT NULL DEFAULT 0");
+    ensureColumn(db, "check_receipts", "retry_of_receipt_id", "ALTER TABLE check_receipts ADD COLUMN retry_of_receipt_id TEXT");
+    ensureColumn(db, "check_receipts", "retry_reason", "ALTER TABLE check_receipts ADD COLUMN retry_reason TEXT");
     ensureColumn(db, "check_receipts", "before_fingerprint", "ALTER TABLE check_receipts ADD COLUMN before_fingerprint TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "after_fingerprint", "ALTER TABLE check_receipts ADD COLUMN after_fingerprint TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "profile_hash", "ALTER TABLE check_receipts ADD COLUMN profile_hash TEXT");
     ensureColumn(db, "check_receipts", "mutation_paths_json", "ALTER TABLE check_receipts ADD COLUMN mutation_paths_json TEXT NOT NULL DEFAULT '[]'");
+    ensureColumn(db, "check_receipts", "fingerprint_scope", "ALTER TABLE check_receipts ADD COLUMN fingerprint_scope TEXT");
+    ensureColumn(db, "check_receipts", "input_manifest_json", "ALTER TABLE check_receipts ADD COLUMN input_manifest_json TEXT");
+    ensureColumn(db, "check_receipts", "execution_failures_json", "ALTER TABLE check_receipts ADD COLUMN execution_failures_json TEXT");
+    ensureColumn(db, "check_receipts", "execution_contract_hash", "ALTER TABLE check_receipts ADD COLUMN execution_contract_hash TEXT");
     ensureColumn(db, "hook_events", "event_key", "ALTER TABLE hook_events ADD COLUMN event_key TEXT");
     ensureColumn(db, "hook_events", "match_key", "ALTER TABLE hook_events ADD COLUMN match_key TEXT");
     ensureColumn(db, "hook_events", "claimed_at", "ALTER TABLE hook_events ADD COLUMN claimed_at TEXT");
@@ -846,6 +1737,7 @@ function migrate(db, dbPath) {
     ensureColumn(db, "hook_events", "parent_session_id", "ALTER TABLE hook_events ADD COLUMN parent_session_id TEXT");
     ensureColumn(db, "hook_events", "daemon_id", "ALTER TABLE hook_events ADD COLUMN daemon_id TEXT");
     ensureColumn(db, "hook_events", "cwd", "ALTER TABLE hook_events ADD COLUMN cwd TEXT");
+    ensureColumn(db, "hook_events", "outcome_json", "ALTER TABLE hook_events ADD COLUMN outcome_json TEXT");
     ensureColumn(db, "harness_usage_snapshots", "tool_calls", "ALTER TABLE harness_usage_snapshots ADD COLUMN tool_calls INTEGER");
     ensureColumn(db, "harness_usage_snapshots", "tool_failures", "ALTER TABLE harness_usage_snapshots ADD COLUMN tool_failures INTEGER");
     ensureColumn(db, "harness_usage_snapshots", "tool_by_name_json", "ALTER TABLE harness_usage_snapshots ADD COLUMN tool_by_name_json TEXT");
@@ -908,8 +1800,7 @@ function migrateSessionStorageKeys(db, dbPath) {
         db.exec("COMMIT");
     }
     catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
+        return rollbackStoreTransaction(db, "ROLLBACK", error);
     }
 }
 function storageSessionKey(harness, native) {