@dsh-enhanced/assistant-evolution 0.1.7 → 0.1.14

package/lib/store.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { openEvolutionDatabase } from './sqlite.js';
 import { evolutionMutationReview } from './review.js';
-import { legacyEvolutionScope } from './types.js';
+import { legacyEvolutionScope, SUPERVISED_GROWTH_ANALYST_CONTRACT_VERSION, } from './types.js';
 export class EvolutionStoreError extends Error {
     code;
     constructor(code, message) {
@@ -22,12 +22,39 @@ function episode(row) {
         detail: row.detail,
         source: row.source,
         trust: row.trust,
+        evidenceKind: row.evidence_kind,
+        evidenceRef: row.evidence_ref ?? undefined,
+        learningSubjectRef: row.learning_subject_ref ?? undefined,
+        learningEligible: row.learning_eligible === 1,
         ruleId: row.rule_id ?? undefined,
         guidanceVersion: row.guidance_version ?? undefined,
         claimedRuleId: row.claimed_rule_id ?? undefined,
         occurredAt: row.occurred_at,
     });
 }
+function exactEpisodePayload(row, input, allowCompatibleQuarantinedReplay = false) {
+    const compatibleQuarantinedReplay = allowCompatibleQuarantinedReplay
+        && row.evidence_kind === 'legacy-unknown'
+        && row.evidence_ref === null
+        && row.learning_eligible === 0
+        && input.evidenceKind === 'operational'
+        && input.evidenceRef === undefined
+        && input.learningEligible === 0;
+    return row.scope_key === input.scopeKey
+        && row.situation === input.situation
+        && row.outcome === input.outcome
+        && row.detail === input.detail
+        && row.source === input.source
+        && row.trust === input.trust
+        && (row.evidence_kind === input.evidenceKind || compatibleQuarantinedReplay)
+        && (row.evidence_ref ?? undefined) === input.evidenceRef
+        && (row.learning_subject_ref ?? undefined) === input.learningSubjectRef
+        && (row.learning_eligible === input.learningEligible || compatibleQuarantinedReplay)
+        && (row.rule_id ?? undefined) === input.ruleId
+        && (row.guidance_version ?? undefined) === input.guidanceVersion
+        && (row.claimed_rule_id ?? undefined) === input.claimedRuleId
+        && row.occurred_at === input.occurredAt;
+}
 function rule(row) {
     return Object.freeze({
         id: row.id,
@@ -44,6 +71,57 @@ function rule(row) {
         generation: row.generation,
     });
 }
+function approvalDispatch(input, errorCode, allowLegacy) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new EvolutionStoreError(errorCode, 'Policy dispatch is invalid');
+    }
+    const route = input;
+    const keys = Object.keys(route).sort().join(',');
+    const legacyKeys = 'bindingId,principal,sourceId,workspace';
+    const versionedLegacyKeys = 'bindingId,principal,routeVersion,sourceId,workspace';
+    const v2Keys = [
+        'bindingGeneration', 'bindingId', 'bindingVersion', 'principal', 'principalRecordId',
+        'principalVersion', 'routeVersion', 'sourceId', 'workspace',
+    ].sort().join(',');
+    const legacy = keys === legacyKeys || (keys === versionedLegacyKeys && route['routeVersion'] === 1);
+    const v2 = keys === v2Keys && route['routeVersion'] === 2
+        && typeof route['bindingVersion'] === 'number'
+        && Number.isSafeInteger(route['bindingVersion']) && route['bindingVersion'] > 0
+        && typeof route['bindingGeneration'] === 'number'
+        && Number.isSafeInteger(route['bindingGeneration']) && route['bindingGeneration'] > 0
+        && typeof route['principalRecordId'] === 'string'
+        && route['principalRecordId'].trim() !== ''
+        && Buffer.byteLength(route['principalRecordId'], 'utf8') <= 500
+        && typeof route['principalVersion'] === 'number'
+        && Number.isSafeInteger(route['principalVersion']) && route['principalVersion'] > 0;
+    if ((!v2 && !(allowLegacy && legacy))
+        || typeof route['sourceId'] !== 'string' || route['sourceId'].trim() === ''
+        || typeof route['bindingId'] !== 'string' || route['bindingId'].trim() === ''
+        || typeof route['workspace'] !== 'string' || route['workspace'].trim() === ''
+        || typeof route['principal'] !== 'string' || route['principal'].trim() === '') {
+        throw new EvolutionStoreError(errorCode, 'Policy dispatch is invalid');
+    }
+    return Object.freeze(input);
+}
+function creationIntent(value) {
+    if (value === null)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new EvolutionStoreError('invalid-state', 'stored Policy creation intent is invalid');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new EvolutionStoreError('invalid-state', 'stored Policy creation intent is invalid');
+    }
+    const intent = parsed;
+    if (Object.hasOwn(intent, 'dispatch') && intent['dispatch'] !== undefined) {
+        intent['dispatch'] = approvalDispatch(intent['dispatch'], 'invalid-state', true);
+    }
+    return Object.freeze(parsed);
+}
 function proposal(row) {
     return Object.freeze({
         proposalId: row.id,
@@ -54,9 +132,7 @@ function proposal(row) {
         scopeKey: row.scope_key,
         mutationHash: row.mutation_hash,
         mutation: JSON.parse(row.mutation_json),
-        creationIntent: row.creation_intent_json === null
-            ? undefined
-            : JSON.parse(row.creation_intent_json),
+        creationIntent: creationIntent(row.creation_intent_json),
         status: row.status,
         expiresAt: row.expires_at,
         resultRuleId: row.result_rule_id ?? undefined,
@@ -104,6 +180,82 @@ function autonomousRollback(row, situation) {
         occurredAt: row.occurred_at,
     });
 }
+function taskLearningProjection(row) {
+    return Object.freeze({
+        scopeKey: row.scope_key,
+        scopeWatermark: row.scope_watermark,
+        subjectKind: row.subject_kind,
+        subjectRef: row.subject_ref,
+        version: row.version,
+        digest: row.digest,
+        disposition: row.disposition,
+        situation: row.situation,
+        ...(row.episode_id === null ? {} : { episodeId: row.episode_id }),
+        updatedAt: row.updated_at,
+    });
+}
+function supervisedGrowthAnalystReview(row) {
+    const evidence = JSON.parse(row.evidence_json);
+    return Object.freeze({
+        reviewToken: row.review_token,
+        scopeKey: row.scope_key,
+        occurrenceId: row.occurrence_id,
+        evidence: Object.freeze({
+            contractVersion: row.contract_version,
+            situation: row.situation,
+            failures: row.failures,
+            total: row.total,
+            evidenceDigest: row.evidence_digest,
+            evidenceTotal: row.evidence_total,
+            evidenceWindow: row.evidence_window,
+            sampleEpisodeIds: Object.freeze(JSON.parse(row.sample_episode_ids_json)),
+            evidence: Object.freeze(evidence.map(entry => Object.freeze({ ...entry }))),
+            scopeWatermark: row.scope_watermark,
+            taskRevisions: Object.freeze(JSON.parse(row.task_revisions_json).map(entry => Object.freeze({ ...entry }))),
+        }),
+        ...(row.proposal_id === null ? {} : { proposalId: row.proposal_id }),
+        createdAt: row.created_at,
+        ...(row.proposed_at === null ? {} : { proposedAt: row.proposed_at }),
+    });
+}
+function evolutionApplicationReceipt(row) {
+    return Object.freeze({
+        localProposalId: row.local_proposal_id,
+        policyProposalId: row.policy_proposal_id,
+        applicationStatus: row.application_status,
+        operation: row.operation,
+        terminalAt: row.terminal_at,
+        receiptDigest: row.receipt_digest,
+        revision: row.revision,
+        ...(row.rule_id === null ? {} : { ruleId: row.rule_id }),
+        ...(row.resulting_rule_version === null
+            ? {} : { resultingRuleVersion: row.resulting_rule_version }),
+        ...(row.rule_status === null ? {} : { ruleStatus: row.rule_status }),
+    });
+}
+function evolutionApplicationOutbox(row) {
+    return Object.freeze({
+        receipt: evolutionApplicationReceipt(row),
+        state: row.state,
+        attemptCount: row.attempt_count,
+        updatedAt: row.updated_at,
+        ...(row.published_at === null ? {} : { publishedAt: row.published_at }),
+        ...(row.last_error === null ? {} : { lastError: row.last_error }),
+    });
+}
+/**
+ * Stable analyst proposal identity. Deliberately do not add guidance, owner,
+ * execution, token, TTL, samples or timestamps: those are not the learned fact.
+ */
+export function supervisedGrowthAnalystProposalIdempotencyKey(input) {
+    return `evolution-analyst:${digest([
+        input.scopeKey,
+        input.situation,
+        input.evidenceDigest,
+        input.evidenceTotal,
+        input.contractVersion,
+    ])}`;
+}
 /**
  * Durable evidence and rule ledger.
  *
@@ -125,6 +277,7 @@ export class EvolutionStore {
         this.#maxSituationBytes = options.maxSituationBytes ?? 200;
         this.#maxGuidanceBytes = options.maxGuidanceBytes ?? 2_048;
         this.#maxDetailBytes = options.maxDetailBytes ?? 1_024;
+        this.#backfillEvolutionApplicationReceipts();
     }
     close() {
         this.#database.close();
@@ -141,11 +294,42 @@ export class EvolutionStore {
         (SELECT COUNT(*) FROM evolution_proposals WHERE status = 'pending') AS pending_proposals,
         (SELECT COUNT(*) FROM evolution_proposals WHERE status = 'conflicted') AS conflicted_proposals,
         (SELECT COUNT(*) FROM evolution_episodes WHERE trust = 'trusted') AS trusted_episodes,
+        (SELECT COUNT(*) FROM evolution_episodes
+          WHERE learning_eligible = 1) AS quality_eligible_episodes,
+        (SELECT COUNT(*) FROM evolution_episodes
+          WHERE evidence_kind = 'operational') AS operational_episodes,
+        (SELECT COUNT(*) FROM evolution_episodes
+          WHERE evidence_kind = 'legacy-unknown') AS legacy_quarantined_episodes,
         (SELECT COUNT(*) FROM evolution_episodes
           WHERE trust = 'trusted' AND rule_id IS NULL) AS unattributed_trusted_episodes,
+        (SELECT COUNT(*) FROM evolution_episodes
+          WHERE learning_eligible = 1 AND rule_id IS NULL) AS unattributed_quality_eligible_episodes,
         (SELECT COALESCE(MAX(occurred_at), 0) FROM evolution_episodes
           WHERE trust = 'trusted') AS last_trusted_episode_at,
+        (SELECT COALESCE(MAX(occurred_at), 0) FROM evolution_episodes
+          WHERE learning_eligible = 1) AS last_quality_eligible_episode_at,
         (SELECT COUNT(*) FROM evolution_autonomous_rollbacks) AS autonomous_rollbacks
+        ,(SELECT COUNT(*) FROM evolution_task_learning_state) AS task_learning_projections
+        ,(SELECT COUNT(*) FROM evolution_task_learning_state
+          WHERE disposition = 'retract') AS retracted_task_learning_projections
+        ,(SELECT COUNT(*) FROM evolution_task_learning_revisions) AS task_learning_projection_revisions
+        ,(SELECT COUNT(*)
+          FROM evolution_task_learning_state state
+          LEFT JOIN evolution_task_learning_revisions revision
+            ON revision.scope_key = state.scope_key
+            AND revision.subject_kind = state.subject_kind
+            AND revision.subject_ref = state.subject_ref
+            AND revision.version = state.version
+          LEFT JOIN evolution_episodes episode ON episode.id = state.episode_id
+          WHERE revision.version IS NULL OR revision.digest <> state.digest
+            OR revision.disposition <> state.disposition
+            OR revision.situation <> state.situation
+            OR NOT (revision.episode_id IS state.episode_id)
+            OR (state.disposition = 'upsert' AND (
+              episode.id IS NULL OR episode.learning_eligible <> 1
+              OR episode.scope_key <> state.scope_key))
+            OR (state.disposition = 'retract' AND state.episode_id IS NOT NULL)
+        ) AS task_learning_projection_integrity_errors
     `).get();
         return Object.freeze({
             activeRules: row.active_rules,
@@ -153,9 +337,18 @@ export class EvolutionStore {
             pendingProposals: row.pending_proposals,
             conflictedProposals: row.conflicted_proposals,
             trustedEpisodes: row.trusted_episodes,
+            qualityEligibleEpisodes: row.quality_eligible_episodes,
+            operationalEpisodes: row.operational_episodes,
+            legacyQuarantinedEpisodes: row.legacy_quarantined_episodes,
             unattributedTrustedEpisodes: row.unattributed_trusted_episodes,
+            unattributedQualityEligibleEpisodes: row.unattributed_quality_eligible_episodes,
             lastTrustedEpisodeAt: row.last_trusted_episode_at,
+            lastQualityEligibleEpisodeAt: row.last_quality_eligible_episode_at,
             autonomousRollbacks: row.autonomous_rollbacks,
+            taskLearningProjections: row.task_learning_projections,
+            retractedTaskLearningProjections: row.retracted_task_learning_projections,
+            taskLearningProjectionRevisions: row.task_learning_projection_revisions,
+            taskLearningProjectionIntegrityErrors: row.task_learning_projection_integrity_errors,
         });
     }
     /** Record one observed outcome. Idempotent on `idempotencyKey`. */
@@ -170,9 +363,36 @@ export class EvolutionStore {
         if (!['trusted', 'self-reported', 'legacy'].includes(input.trust)) {
             throw new EvolutionStoreError('invalid-input', 'trust is invalid');
         }
+        if (!['operational', 'objective', 'verification', 'legacy-unknown'].includes(input.evidenceKind)) {
+            throw new EvolutionStoreError('invalid-input', 'evidenceKind is invalid');
+        }
         if (scopeKey === legacyEvolutionScope && input.trust !== 'legacy') {
             throw new EvolutionStoreError('invalid-input', 'legacy scope may only contain quarantined evidence');
         }
+        if (input.trust === 'legacy' && input.evidenceKind !== 'legacy-unknown') {
+            throw new EvolutionStoreError('invalid-input', 'legacy evidence must remain quarantined');
+        }
+        const evidenceRef = input.evidenceRef === undefined
+            ? undefined
+            : this.#opaque(input.evidenceRef, 'evidenceRef', 500);
+        const learningSubjectRef = input.learningSubjectRef === undefined
+            ? undefined
+            : this.#opaque(input.learningSubjectRef, 'learningSubjectRef', 1_000);
+        const isQualityKind = input.evidenceKind === 'objective' || input.evidenceKind === 'verification';
+        if ((input.source === 'evaluation') !== isQualityKind) {
+            throw new EvolutionStoreError('invalid-input', 'learning-eligible quality evidence must use authoritative Evaluation provenance');
+        }
+        if (isQualityKind && (input.trust !== 'trusted' || evidenceRef === undefined
+            || learningSubjectRef === undefined)) {
+            throw new EvolutionStoreError('invalid-input', 'quality evidence requires trusted attribution, an Evaluation reference, and a learning subject');
+        }
+        if (!isQualityKind && evidenceRef !== undefined) {
+            throw new EvolutionStoreError('invalid-input', 'only quality evidence may carry an Evaluation reference');
+        }
+        if (!isQualityKind && learningSubjectRef !== undefined) {
+            throw new EvolutionStoreError('invalid-input', 'only quality evidence may carry a learning subject');
+        }
+        const learningEligible = isQualityKind ? 1 : 0;
         const trustedRuleId = input.trust === 'trusted' && input.ruleId !== undefined
             ? this.#bounded(input.ruleId, 'ruleId', 200)
             : undefined;
@@ -189,29 +409,363 @@ export class EvolutionStore {
             : (input.claimedRuleId ?? input.ruleId) === undefined
                 ? undefined
                 : this.#bounded((input.claimedRuleId ?? input.ruleId), 'claimedRuleId', 200);
+        const normalized = {
+            scopeKey,
+            situation,
+            outcome: input.outcome,
+            detail,
+            source: input.source,
+            trust: input.trust,
+            evidenceKind: input.evidenceKind,
+            evidenceRef,
+            learningSubjectRef,
+            learningEligible,
+            ruleId: trustedRuleId,
+            guidanceVersion,
+            claimedRuleId,
+            occurredAt: input.occurredAt,
+        };
         const id = `episode-${randomUUID()}`;
         this.#database.prepare(`
       INSERT INTO evolution_episodes(
         id, idempotency_key, scope_key, situation, outcome, detail, source,
-        trust, rule_id, guidance_version, claimed_rule_id, occurred_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(idempotency_key) DO NOTHING
-    `).run(id, key, scopeKey, situation, input.outcome, detail, input.source, input.trust, trustedRuleId ?? null, guidanceVersion ?? null, claimedRuleId ?? null, input.occurredAt);
-        const winner = this.#database.prepare('SELECT * FROM evolution_episodes WHERE idempotency_key = ?')
-            .get(key);
-        // Replay must be exact; a reused key with different content is a caller bug.
-        if (winner.scope_key !== scopeKey || winner.situation !== situation
-            || winner.outcome !== input.outcome || winner.detail !== detail
-            || winner.source !== input.source || winner.trust !== input.trust
-            || (winner.rule_id ?? undefined) !== trustedRuleId
-            || (winner.guidance_version ?? undefined) !== guidanceVersion
-            || (winner.claimed_rule_id ?? undefined) !== claimedRuleId
-            || winner.occurred_at !== input.occurredAt) {
-            throw new EvolutionStoreError('idempotency-conflict', 'episode idempotency key was reused with different content');
-        }
-        return episode(winner);
-    }
-    /** Failure counts for one situation over the most recent `window` episodes. */
+        trust, evidence_kind, evidence_ref, learning_subject_ref, learning_eligible,
+        rule_id, guidance_version, claimed_rule_id, occurred_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT DO NOTHING
+    `).run(id, key, scopeKey, situation, input.outcome, detail, input.source, input.trust, input.evidenceKind, evidenceRef ?? null, learningSubjectRef ?? null, learningEligible, trustedRuleId ?? null, guidanceVersion ?? null, claimedRuleId ?? null, input.occurredAt);
+        const idempotencyWinner = this.#database.prepare('SELECT * FROM evolution_episodes WHERE idempotency_key = ?').get(key);
+        if (idempotencyWinner !== undefined) {
+            // Replay must be exact; a reused key with different content is a caller bug.
+            if (!exactEpisodePayload(idempotencyWinner, normalized, true)) {
+                throw new EvolutionStoreError('idempotency-conflict', 'episode idempotency key was reused with different content');
+            }
+            return episode(idempotencyWinner);
+        }
+        if (learningEligible === 1) {
+            const subjectWinner = this.#database.prepare(`
+        SELECT * FROM evolution_episodes
+        WHERE scope_key = ? AND learning_subject_ref = ?
+          AND learning_eligible = 1
+      `).get(scopeKey, learningSubjectRef);
+            if (subjectWinner !== undefined) {
+                const exactEvaluationReplay = subjectWinner.evidence_ref === evidenceRef;
+                const matches = exactEvaluationReplay
+                    ? exactEpisodePayload(subjectWinner, normalized)
+                    : this.#sameLearningSubjectResult(subjectWinner, normalized);
+                if (!matches) {
+                    throw new EvolutionStoreError('idempotency-conflict', 'immutable learning subject was assessed with a contradictory result');
+                }
+                return episode(subjectWinner);
+            }
+            const evidenceWinner = this.#database.prepare(`
+        SELECT * FROM evolution_episodes
+        WHERE scope_key = ? AND evidence_ref = ?
+          AND learning_eligible = 1
+      `).get(scopeKey, evidenceRef);
+            if (evidenceWinner !== undefined) {
+                if (!exactEpisodePayload(evidenceWinner, normalized)) {
+                    throw new EvolutionStoreError('idempotency-conflict', 'immutable quality evidence reference was reused with different content');
+                }
+                return episode(evidenceWinner);
+            }
+        }
+        throw new EvolutionStoreError('invalid-state', 'episode insert did not produce an exact idempotency or evidence winner');
+    }
+    /**
+     * Apply one authoritative Evaluation task revision.  The current pointer,
+     * immutable revision audit, active learning vote and stale-proposal fence are
+     * committed under one SQLite writer lock.
+     *
+     * The first accepted revision may be greater than one because several old
+     * Evaluation outbox triggers all resolve to the latest canonical task.  A
+     * lower revision is never acknowledged: it indicates an Evaluation rollback
+     * or a mismatched database restore and must remain visible to recovery.
+     */
+    applyTaskLearningProjection(input) {
+        const scopeKey = this.#scopeKey(input.scopeKey);
+        const subjectKind = input.subjectKind;
+        if (subjectKind !== 'automation-run' && subjectKind !== 'outcome') {
+            throw new EvolutionStoreError('invalid-input', 'task learning subjectKind is invalid');
+        }
+        const subjectRef = this.#opaque(input.subjectRef, 'subjectRef', 1_000);
+        if (!Number.isSafeInteger(input.version) || input.version < 1
+            || input.version > 1_000_000_000) {
+            throw new EvolutionStoreError('invalid-input', 'task learning version must be a positive safe integer');
+        }
+        if (!Number.isSafeInteger(input.scopeWatermark) || input.scopeWatermark < 1) {
+            throw new EvolutionStoreError('invalid-input', 'task learning scope watermark must be a positive safe integer');
+        }
+        const projectionDigest = this.#bounded(input.digest, 'digest', 64);
+        if (!/^[a-f\d]{64}$/u.test(projectionDigest)) {
+            throw new EvolutionStoreError('invalid-input', 'task learning digest must be lowercase SHA-256');
+        }
+        const situation = this.#situation(input.situation);
+        if (!Number.isSafeInteger(input.occurredAt) || input.occurredAt < 0) {
+            throw new EvolutionStoreError('invalid-input', 'task learning occurredAt is invalid');
+        }
+        if (input.disposition !== 'upsert' && input.disposition !== 'retract') {
+            throw new EvolutionStoreError('invalid-input', 'task learning disposition is invalid');
+        }
+        let result;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const scopeWatermark = this.#database.prepare(`
+        SELECT watermark FROM evolution_scope_learning_watermarks WHERE scope_key = ?
+      `).get(scopeKey);
+            if (scopeWatermark !== undefined && input.scopeWatermark < scopeWatermark.watermark) {
+                throw new EvolutionStoreError('version-conflict', 'task learning receipt carries an older Evaluation scope watermark');
+            }
+            const current = this.#database.prepare(`
+        SELECT * FROM evolution_task_learning_state
+        WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ?
+      `).get(scopeKey, subjectKind, subjectRef);
+            if (current !== undefined)
+                this.#assertTaskLearningState(current);
+            if (current !== undefined && input.version < current.version) {
+                throw new EvolutionStoreError('version-conflict', 'task learning revision is older than the current authoritative state');
+            }
+            if (current !== undefined && input.version === current.version) {
+                if (current.digest !== projectionDigest || current.disposition !== input.disposition
+                    || current.situation !== situation) {
+                    throw new EvolutionStoreError('idempotency-conflict', 'task learning version was reused with different canonical content');
+                }
+                this.#recordScopeLearningWatermark(scopeKey, input.scopeWatermark, this.#now());
+                this.#database.prepare(`
+          UPDATE evolution_task_learning_state SET scope_watermark = ?
+          WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ?
+            AND scope_watermark <= ?
+        `).run(input.scopeWatermark, scopeKey, subjectKind, subjectRef, input.scopeWatermark);
+                const replayState = this.#database.prepare(`
+          SELECT * FROM evolution_task_learning_state
+          WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ?
+        `).get(scopeKey, subjectKind, subjectRef);
+                const currentEpisode = replayState.episode_id === null
+                    ? undefined
+                    : this.#database.prepare('SELECT * FROM evolution_episodes WHERE id = ?')
+                        .get(replayState.episode_id);
+                result = Object.freeze({
+                    projection: taskLearningProjection(replayState),
+                    ...(currentEpisode === undefined ? {} : { episode: episode(currentEpisode) }),
+                    replayed: true,
+                });
+                this.#database.exec('COMMIT');
+                return result;
+            }
+            if (current?.episode_id !== null && current?.episode_id !== undefined) {
+                const invalidated = this.#database.prepare(`
+          UPDATE evolution_episodes
+          SET learning_subject_ref = NULL, learning_eligible = 0
+          WHERE id = ? AND scope_key = ? AND learning_eligible = 1
+        `).run(current.episode_id, scopeKey);
+                if (invalidated.changes !== 1) {
+                    throw new EvolutionStoreError('invalid-state', 'current task learning vote could not be retracted');
+                }
+            }
+            const now = this.#now();
+            let storedEpisode;
+            if (input.disposition === 'upsert') {
+                const identity = digest([
+                    'evaluation-task-revision/v1', scopeKey, subjectKind, subjectRef,
+                    input.version, projectionDigest,
+                ]);
+                storedEpisode = this.recordEpisode({
+                    scopeKey,
+                    situation,
+                    outcome: input.outcome,
+                    detail: input.detail,
+                    source: 'evaluation',
+                    trust: 'trusted',
+                    evidenceKind: 'objective',
+                    evidenceRef: input.evidenceRef,
+                    learningSubjectRef: JSON.stringify([subjectKind, subjectRef]),
+                    occurredAt: input.occurredAt,
+                    idempotencyKey: `evaluation-task-revision:${identity}`,
+                    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),
+                    ...(input.guidanceVersion === undefined
+                        ? {} : { guidanceVersion: input.guidanceVersion }),
+                });
+            }
+            this.#database.prepare(`
+        INSERT INTO evolution_task_learning_revisions(
+          scope_key, scope_watermark, subject_kind, subject_ref, version, digest, disposition,
+          situation, episode_id, applied_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(scopeKey, input.scopeWatermark, subjectKind, subjectRef, input.version, projectionDigest, input.disposition, situation, storedEpisode?.id ?? null, now);
+            this.#database.prepare(`
+        INSERT INTO evolution_task_learning_state(
+          scope_key, scope_watermark, subject_kind, subject_ref, version, digest, disposition,
+          situation, episode_id, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(scope_key, subject_kind, subject_ref) DO UPDATE SET
+          scope_watermark = excluded.scope_watermark,
+          version = excluded.version,
+          digest = excluded.digest,
+          disposition = excluded.disposition,
+          situation = excluded.situation,
+          episode_id = excluded.episode_id,
+          updated_at = excluded.updated_at
+      `).run(scopeKey, input.scopeWatermark, subjectKind, subjectRef, input.version, projectionDigest, input.disposition, situation, storedEpisode?.id ?? null, now);
+            this.#recordScopeLearningWatermark(scopeKey, input.scopeWatermark, now);
+            // Any evidence-dependent card for this exact scoped situation was built
+            // from an older complete window.  Fence it before a later Policy decision
+            // can apply stale guidance. Owner-undo is independent of learning data.
+            const affected = this.#database.prepare(`
+        SELECT * FROM evolution_proposals
+        WHERE status = 'pending' AND scope_key = ?
+          AND json_extract(mutation_json, '$.op') IN ('adopt', 'retire')
+          AND COALESCE(
+            json_extract(mutation_json, '$.input.situation'),
+            json_extract(mutation_json, '$.situation')
+          ) = ?
+        ORDER BY id
+      `).all(scopeKey, situation);
+            this.#database.prepare(`
+        UPDATE evolution_proposals
+        SET status = 'conflicted', version = version + 1, updated_at = ?
+        WHERE status = 'pending' AND scope_key = ?
+          AND json_extract(mutation_json, '$.op') IN ('adopt', 'retire')
+          AND COALESCE(
+            json_extract(mutation_json, '$.input.situation'),
+            json_extract(mutation_json, '$.situation')
+          ) = ?
+      `).run(now, scopeKey, situation);
+            for (const pending of affected) {
+                const terminal = this.#requireProposal(pending.id);
+                this.#recordEvolutionApplicationReceipt(terminal);
+            }
+            // A correction to an exact subject that justified an already-applied
+            // local rule wins after that legal linearization point as well. Retire
+            // only rules whose frozen full tuple contained this subject; unrelated
+            // new evidence does not churn active guidance.
+            this.#retireRulesDependingOnTaskRevision({
+                scopeKey,
+                subjectKind,
+                subjectRef,
+                now,
+            });
+            const saved = this.#database.prepare(`
+        SELECT * FROM evolution_task_learning_state
+        WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ?
+      `).get(scopeKey, subjectKind, subjectRef);
+            this.#assertTaskLearningState(saved);
+            result = Object.freeze({
+                projection: taskLearningProjection(saved),
+                ...(storedEpisode === undefined ? {} : { episode: storedEpisode }),
+                replayed: false,
+            });
+            this.#database.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    getTaskLearningProjection(input) {
+        const row = this.#database.prepare(`
+      SELECT * FROM evolution_task_learning_state
+      WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ?
+    `).get(this.#scopeKey(input.scopeKey), input.subjectKind, this.#opaque(input.subjectRef, 'subjectRef', 1_000));
+        if (row === undefined)
+            return undefined;
+        this.#assertTaskLearningState(row);
+        return taskLearningProjection(row);
+    }
+    #sameLearningSubjectResult(row, input) {
+        // evidenceRef, detail, and evidenceKind are deliberately absent: several
+        // immutable Evaluation rows (for example objective + verification) may
+        // independently reach the same behavioural result for one immutable run.
+        // The first row remains the provenance anchor; behavioural identity,
+        // attribution, outcome, and run time must still match.
+        return row.scope_key === input.scopeKey
+            && row.learning_subject_ref === input.learningSubjectRef
+            && row.situation === input.situation
+            && row.outcome === input.outcome
+            && row.source === input.source
+            && row.trust === input.trust
+            && row.learning_eligible === input.learningEligible
+            && (row.rule_id ?? undefined) === input.ruleId
+            && (row.guidance_version ?? undefined) === input.guidanceVersion
+            && (row.claimed_rule_id ?? undefined) === input.claimedRuleId
+            && row.occurred_at === input.occurredAt;
+    }
+    #assertTaskLearningState(row) {
+        const revision = this.#database.prepare(`
+      SELECT scope_key, scope_watermark, subject_kind, subject_ref, version, digest, disposition,
+        situation, episode_id, applied_at AS updated_at
+      FROM evolution_task_learning_revisions
+      WHERE scope_key = ? AND subject_kind = ? AND subject_ref = ? AND version = ?
+    `).get(row.scope_key, row.subject_kind, row.subject_ref, row.version);
+        if (revision === undefined || revision.digest !== row.digest
+            || revision.disposition !== row.disposition || revision.situation !== row.situation
+            || revision.episode_id !== row.episode_id) {
+            throw new EvolutionStoreError('invalid-state', 'task learning current state does not match its immutable revision');
+        }
+        if (row.disposition === 'retract') {
+            if (row.episode_id !== null) {
+                throw new EvolutionStoreError('invalid-state', 'retracted task learning state has an active vote');
+            }
+            return;
+        }
+        if (row.episode_id === null) {
+            throw new EvolutionStoreError('invalid-state', 'upserted task learning state is missing its vote');
+        }
+        const active = this.#database.prepare('SELECT * FROM evolution_episodes WHERE id = ?')
+            .get(row.episode_id);
+        if (active === undefined || active.scope_key !== row.scope_key || active.situation !== row.situation
+            || active.learning_eligible !== 1
+            || active.learning_subject_ref !== JSON.stringify([row.subject_kind, row.subject_ref])) {
+            throw new EvolutionStoreError('invalid-state', 'task learning vote does not match current state');
+        }
+    }
+    /** Must be called under this store's writer transaction. */
+    #recordScopeLearningWatermark(scopeKey, watermark, now) {
+        this.#database.prepare(`
+      INSERT INTO evolution_scope_learning_watermarks(scope_key, watermark, updated_at)
+      VALUES (?, ?, ?)
+      ON CONFLICT(scope_key) DO UPDATE SET
+        watermark = excluded.watermark,
+        updated_at = excluded.updated_at
+      WHERE excluded.watermark >= evolution_scope_learning_watermarks.watermark
+    `).run(scopeKey, watermark, now);
+        const saved = this.#database.prepare(`
+      SELECT watermark FROM evolution_scope_learning_watermarks WHERE scope_key = ?
+    `).get(scopeKey);
+        if (saved?.watermark !== watermark) {
+            throw new EvolutionStoreError('version-conflict', 'Evaluation scope watermark moved backwards');
+        }
+    }
+    /** Must be called after the new task state is durable in the current writer transaction. */
+    #retireRulesDependingOnTaskRevision(input) {
+        const rows = this.#database.prepare(`
+      SELECT rule.*
+      FROM evolution_proposals proposal
+      JOIN evolution_rules rule ON rule.id = proposal.result_rule_id
+      JOIN json_each(proposal.mutation_json, '$.evidence.taskRevisions') revision
+      WHERE proposal.status = 'approved'
+        AND proposal.scope_key = ?
+        AND json_extract(proposal.mutation_json, '$.op') = 'adopt'
+        AND rule.status = 'active'
+        AND json_extract(revision.value, '$.subjectKind') = ?
+        AND json_extract(revision.value, '$.subjectRef') = ?
+      ORDER BY rule.id
+    `).all(input.scopeKey, input.subjectKind, input.subjectRef);
+        for (const row of rows) {
+            const reason = 'Automatic safe rollback: authoritative Evaluation evidence '
+                + `${input.subjectKind}:${input.subjectRef} changed after adoption.`;
+            const version = row.version + 1;
+            const retired = this.#database.prepare(`
+        UPDATE evolution_rules
+        SET status = 'retired', retired_reason = ?, updated_at = ?, version = ?
+        WHERE id = ? AND status = 'active' AND version = ?
+      `).run(reason, input.now, version, row.id, row.version);
+            if (retired.changes === 1) {
+                this.#audit('evidence-correction-rollback', row.id, version, input.now);
+            }
+        }
+    }
+    /** Failure counts over the most recent explicitly quality-eligible episodes. */
     stats(scopeKey, situation, window) {
         const scope = this.#scopeKey(scopeKey);
         const label = this.#situation(situation);
@@ -219,7 +773,7 @@ export class EvolutionStore {
         const row = this.#database.prepare(`
       SELECT COUNT(*) AS total, SUM(outcome = 'failed') AS failures FROM (
         SELECT outcome FROM evolution_episodes
-        WHERE scope_key = ? AND situation = ? AND trust = 'trusted' AND rule_id IS NULL
+        WHERE scope_key = ? AND situation = ? AND learning_eligible = 1 AND rule_id IS NULL
         ORDER BY occurred_at DESC, id DESC LIMIT ?
       )
     `).get(scope, label, window);
@@ -239,6 +793,17 @@ export class EvolutionStore {
             .get(ruleId);
         return row === undefined ? undefined : rule(row);
     }
+    /** Principal whose exact approved adoption created this immutable rule. */
+    ruleApprovalPrincipal(ruleId) {
+        const id = this.#serverRuleId(ruleId);
+        const rows = this.#database.prepare(`
+      SELECT principal FROM evolution_proposals
+      WHERE result_rule_id = ? AND status = 'approved'
+        AND json_extract(mutation_json, '$.op') = 'adopt'
+      ORDER BY id LIMIT 2
+    `).all(id);
+        return rows.length === 1 ? rows[0].principal : undefined;
+    }
     activeRule(scopeKey, situation) {
         const row = this.#database.prepare("SELECT * FROM evolution_rules WHERE scope_key = ? AND situation = ? AND status = 'active'").get(this.#scopeKey(scopeKey), this.#situation(situation));
         return row === undefined ? undefined : rule(row);
@@ -288,6 +853,13 @@ export class EvolutionStore {
     `).get(this.#opaque(sessionId, 'sessionId', 500), this.#scopeKey(scopeKey), this.#bounded(ruleId, 'ruleId', 200), guidanceVersion);
         return row !== undefined;
     }
+    countGuidanceExposures(sessionId, scopeKey) {
+        const row = this.#database.prepare(`
+      SELECT COUNT(*) AS count FROM evolution_guidance_exposures
+      WHERE session_id = ? AND scope_key = ?
+    `).get(this.#opaque(sessionId, 'sessionId', 500), this.#scopeKey(scopeKey));
+        return row.count;
+    }
     /** Return only an unambiguous exact-situation receipt for one session. */
     captureGuidanceExposure(sessionId, scopeKey, situation) {
         const rows = this.#database.prepare(`
@@ -337,7 +909,7 @@ export class EvolutionStore {
         }
         const situations = this.#database.prepare(`
       SELECT DISTINCT situation FROM evolution_episodes
-      WHERE scope_key = ? AND trust = 'trusted'
+      WHERE scope_key = ? AND learning_eligible = 1
       ORDER BY situation
     `).all(scopeKey);
         const candidates = [];
@@ -394,6 +966,180 @@ export class EvolutionStore {
             return undefined;
         return this.#retirementCandidateFromRule(active, options.window, options.minSample, options.retireFailureRate, evidenceSampleLimit);
     }
+    /**
+     * Freeze the one adoption candidate shown to an exact production analyst
+     * execution. Repeating review in the same occurrence returns the same opaque
+     * token; if its evidence changed, the old execution is fenced instead.
+     */
+    registerSupervisedGrowthAnalystReview(input) {
+        const scopeKey = this.#scopeKey(input.scopeKey);
+        const occurrenceId = this.#opaque(input.occurrenceId, 'occurrenceId', 500);
+        const evidence = this.#normalizeSupervisedGrowthAnalystEvidence(scopeKey, input.candidate, input.evidenceWindow);
+        const reviewToken = `analyst-review-${randomUUID()}`;
+        const sampleJson = JSON.stringify(evidence.sampleEpisodeIds);
+        const evidenceJson = JSON.stringify(evidence.evidence);
+        const taskRevisionsJson = JSON.stringify(evidence.taskRevisions);
+        let row;
+        let proposalExists = false;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            if (!this.#supervisedGrowthAnalystEvidenceMatches(scopeKey, evidence)) {
+                throw new EvolutionStoreError('version-conflict', 'analyst review evidence changed before it could be frozen');
+            }
+            const existing = this.#database.prepare(`
+        SELECT * FROM evolution_supervised_analyst_reviews
+        WHERE scope_key = ? AND occurrence_id = ?
+      `).get(scopeKey, occurrenceId);
+            if (existing === undefined) {
+                const now = this.#now();
+                this.#database.prepare(`
+          INSERT INTO evolution_supervised_analyst_reviews(
+            review_token, scope_key, occurrence_id, contract_version, situation,
+            failures, total, evidence_digest, evidence_total, evidence_window,
+            sample_episode_ids_json, evidence_json, scope_watermark, task_revisions_json,
+            proposal_id, created_at, proposed_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, NULL)
+        `).run(reviewToken, scopeKey, occurrenceId, evidence.contractVersion, evidence.situation, evidence.failures, evidence.total, evidence.evidenceDigest, evidence.evidenceTotal, evidence.evidenceWindow, sampleJson, evidenceJson, evidence.scopeWatermark, taskRevisionsJson, now);
+                row = this.#database.prepare(`
+          SELECT * FROM evolution_supervised_analyst_reviews WHERE review_token = ?
+        `).get(reviewToken);
+            }
+            else {
+                if (!this.#sameSupervisedGrowthAnalystReview(existing, evidence, sampleJson, evidenceJson, taskRevisionsJson)) {
+                    throw new EvolutionStoreError('version-conflict', 'one analyst execution cannot review more than one evidence identity');
+                }
+                row = existing;
+            }
+            const key = supervisedGrowthAnalystProposalIdempotencyKey({
+                scopeKey,
+                situation: evidence.situation,
+                evidenceDigest: evidence.evidenceDigest,
+                evidenceTotal: evidence.evidenceTotal,
+                contractVersion: evidence.contractVersion,
+            });
+            const winner = this.#database.prepare(`
+        SELECT * FROM evolution_proposals WHERE idempotency_key = ?
+      `).get(key);
+            if (winner !== undefined && !this.#supervisedGrowthAnalystProposalMatches(winner, evidence)) {
+                throw new EvolutionStoreError('invalid-state', 'analyst proposal identity points to invalid content');
+            }
+            if (row.proposal_id !== null && winner?.id !== row.proposal_id) {
+                throw new EvolutionStoreError('invalid-state', 'analyst execution points to another proposal');
+            }
+            proposalExists = winner !== undefined;
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+        return Object.freeze({ review: supervisedGrowthAnalystReview(row), proposalExists });
+    }
+    getSupervisedGrowthAnalystReview(reviewToken) {
+        const token = this.#analystReviewToken(reviewToken);
+        const row = this.#database.prepare(`
+      SELECT * FROM evolution_supervised_analyst_reviews WHERE review_token = ?
+    `).get(token);
+        return row === undefined ? undefined : supervisedGrowthAnalystReview(row);
+    }
+    /**
+     * Create or join the proposal for one evidence identity under the SQLite
+     * writer lock. The existing proposal is deliberately returned without
+     * comparing guidance: the first committed wording is the durable winner.
+     */
+    createSupervisedGrowthAnalystProposal(input) {
+        const reviewToken = this.#analystReviewToken(input.reviewToken);
+        const scopeKey = this.#scopeKey(input.scopeKey);
+        const occurrenceId = this.#opaque(input.occurrenceId, 'occurrenceId', 500);
+        const requester = this.#bounded(input.requester, 'requester', 200);
+        const principal = this.#bounded(input.principal, 'principal', 500);
+        if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt < 0) {
+            throw new EvolutionStoreError('invalid-input', 'proposal expiresAt must be a non-negative safe integer');
+        }
+        const mutation = this.#validateStoredMutation(input.mutation);
+        if (mutation.op !== 'adopt' || mutation.evidence === undefined
+            || mutation.input.scopeKey !== scopeKey) {
+            throw new EvolutionStoreError('invalid-input', 'analyst may only create an evidence-bound adoption');
+        }
+        const key = supervisedGrowthAnalystProposalIdempotencyKey({
+            scopeKey,
+            situation: mutation.input.situation,
+            evidenceDigest: mutation.evidence.digest,
+            evidenceTotal: mutation.evidence.total,
+            contractVersion: SUPERVISED_GROWTH_ANALYST_CONTRACT_VERSION,
+        });
+        const creationIntent = this.#validateCreationIntent(input.creationIntent, {
+            key,
+            requester,
+            principal,
+        });
+        const creationIntentJson = JSON.stringify(creationIntent);
+        const mutationJson = JSON.stringify(mutation);
+        const mutationHash = digest(mutation);
+        const id = `evolution-proposal-${randomUUID()}`;
+        let winner;
+        let replayed = false;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const review = this.#database.prepare(`
+        SELECT * FROM evolution_supervised_analyst_reviews WHERE review_token = ?
+      `).get(reviewToken);
+            if (review === undefined || review.scope_key !== scopeKey
+                || review.occurrence_id !== occurrenceId) {
+                throw new EvolutionStoreError('not-found', 'analyst review token does not belong to this production execution');
+            }
+            const evidence = supervisedGrowthAnalystReview(review).evidence;
+            if (!this.#supervisedGrowthAnalystMutationMatches(mutation, evidence)
+                || !this.#proposalEvidenceMatches(mutation)) {
+                throw new EvolutionStoreError('version-conflict', 'analyst proposal evidence no longer matches the frozen review');
+            }
+            const existing = this.#database.prepare(`
+        SELECT * FROM evolution_proposals WHERE idempotency_key = ?
+      `).get(key);
+            if (review.proposal_id !== null) {
+                if (existing?.id !== review.proposal_id) {
+                    throw new EvolutionStoreError('invalid-state', 'analyst execution proposal binding is corrupt');
+                }
+                winner = existing;
+                replayed = true;
+            }
+            else if (existing !== undefined) {
+                winner = existing;
+                replayed = true;
+            }
+            else {
+                const now = this.#now();
+                this.#database.prepare(`
+          INSERT INTO evolution_proposals(
+            id, policy_proposal_id, idempotency_key, requester, principal, scope_key, mutation_hash,
+            mutation_json, creation_intent_json, settlement_expectation_json,
+            status, expires_at, created_at, updated_at, version)
+          VALUES (?, NULL, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?, 1)
+        `).run(id, key, requester, principal, scopeKey, mutationHash, mutationJson, creationIntentJson, input.expiresAt, now, now);
+                winner = this.#database.prepare(`
+          SELECT * FROM evolution_proposals WHERE idempotency_key = ?
+        `).get(key);
+            }
+            if (!this.#supervisedGrowthAnalystProposalMatches(winner, evidence)) {
+                throw new EvolutionStoreError('invalid-state', 'analyst proposal winner does not match its evidence identity');
+            }
+            const proposedAt = this.#now();
+            const linked = this.#database.prepare(`
+        UPDATE evolution_supervised_analyst_reviews
+        SET proposal_id = ?, proposed_at = COALESCE(proposed_at, ?)
+        WHERE review_token = ? AND proposal_id IS NULL
+      `).run(winner.id, proposedAt, reviewToken);
+            if (linked.changes === 0 && review.proposal_id !== winner.id) {
+                throw new EvolutionStoreError('invalid-state', 'analyst execution already proposed another change');
+            }
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+        return Object.freeze({ proposal: proposal(winner), replayed });
+    }
     /**
      * Retire one exact active guidance generation through the narrow autonomous
      * rollback lane.
@@ -552,24 +1298,44 @@ export class EvolutionStore {
     `).get(scopeKey, situation);
         if (retired === undefined) {
             return this.#database.prepare(`
-        SELECT * FROM evolution_episodes
-        WHERE scope_key = ? AND situation = ? AND trust = 'trusted' AND rule_id IS NULL
-        ORDER BY occurred_at DESC, id DESC LIMIT ?
+        SELECT episode.*, state.subject_kind AS task_subject_kind,
+          state.subject_ref AS task_subject_ref, state.version AS task_version,
+          state.digest AS task_digest, state.disposition AS task_disposition
+        FROM evolution_episodes episode
+        JOIN evolution_task_learning_state state
+          ON state.scope_key = episode.scope_key AND state.episode_id = episode.id
+          AND state.disposition = 'upsert'
+        WHERE episode.scope_key = ? AND episode.situation = ?
+          AND episode.learning_eligible = 1 AND episode.rule_id IS NULL
+        ORDER BY episode.occurred_at DESC, episode.id DESC LIMIT ?
       `).all(scopeKey, situation, window);
         }
         return this.#database.prepare(`
-      SELECT * FROM evolution_episodes
-      WHERE scope_key = ? AND situation = ? AND trust = 'trusted'
-        AND rule_id IS NULL AND occurred_at > ?
-      ORDER BY occurred_at DESC, id DESC LIMIT ?
+      SELECT episode.*, state.subject_kind AS task_subject_kind,
+        state.subject_ref AS task_subject_ref, state.version AS task_version,
+        state.digest AS task_digest, state.disposition AS task_disposition
+      FROM evolution_episodes episode
+      JOIN evolution_task_learning_state state
+        ON state.scope_key = episode.scope_key AND state.episode_id = episode.id
+        AND state.disposition = 'upsert'
+      WHERE episode.scope_key = ? AND episode.situation = ?
+        AND episode.learning_eligible = 1 AND episode.rule_id IS NULL
+        AND episode.occurred_at > ?
+      ORDER BY episode.occurred_at DESC, episode.id DESC LIMIT ?
     `).all(scopeKey, situation, retired.updated_at, window);
     }
     #evaluationEpisodes(active, window) {
         return this.#database.prepare(`
-      SELECT * FROM evolution_episodes
-      WHERE scope_key = ? AND situation = ? AND trust = 'trusted'
-        AND rule_id = ? AND guidance_version = ? AND occurred_at > ?
-      ORDER BY occurred_at DESC, id DESC LIMIT ?
+      SELECT episode.*, state.subject_kind AS task_subject_kind,
+        state.subject_ref AS task_subject_ref, state.version AS task_version,
+        state.digest AS task_digest, state.disposition AS task_disposition
+      FROM evolution_episodes episode
+      JOIN evolution_task_learning_state state
+        ON state.scope_key = episode.scope_key AND state.episode_id = episode.id
+        AND state.disposition = 'upsert'
+      WHERE episode.scope_key = ? AND episode.situation = ? AND episode.learning_eligible = 1
+        AND episode.rule_id = ? AND episode.guidance_version = ? AND episode.occurred_at > ?
+      ORDER BY episode.occurred_at DESC, episode.id DESC LIMIT ?
     `).all(active.scopeKey, active.situation, active.id, active.generation, active.adoptedAt, window);
     }
     #statsFromEpisodes(scopeKey, situation, episodes) {
@@ -581,9 +1347,28 @@ export class EvolutionStore {
         });
     }
     #candidateEvidence(episodes, sampleLimit) {
+        if (episodes.length < 1) {
+            throw new EvolutionStoreError('invalid-state', 'candidate evidence window is empty');
+        }
+        const watermark = this.#database.prepare(`
+      SELECT watermark FROM evolution_scope_learning_watermarks WHERE scope_key = ?
+    `).get(episodes[0].scope_key);
+        if (watermark === undefined || !Number.isSafeInteger(watermark.watermark)
+            || watermark.watermark < 1) {
+            throw new EvolutionStoreError('invalid-state', 'candidate has no authoritative scope watermark');
+        }
+        const taskRevisions = episodes.map(row => Object.freeze({
+            subjectKind: row.task_subject_kind,
+            subjectRef: row.task_subject_ref,
+            version: row.task_version,
+            digest: row.task_digest,
+            disposition: 'upsert',
+        }));
         const evidence = episodes.slice(0, sampleLimit).map(row => Object.freeze({
             episodeId: row.id,
             outcome: row.outcome,
+            evidenceKind: row.evidence_kind,
+            evidenceRef: row.evidence_ref,
             detail: row.detail,
             occurredAt: row.occurred_at,
         }));
@@ -597,14 +1382,23 @@ export class EvolutionStore {
             detail: row.detail,
             source: row.source,
             trust: row.trust,
+            evidenceKind: row.evidence_kind,
+            evidenceRef: row.evidence_ref,
+            learningEligible: row.learning_eligible,
             ruleId: row.rule_id,
             guidanceVersion: row.guidance_version,
             occurredAt: row.occurred_at,
+            taskSubjectKind: row.task_subject_kind,
+            taskSubjectRef: row.task_subject_ref,
+            taskVersion: row.task_version,
+            taskDigest: row.task_digest,
         })));
         return Object.freeze({
             evidence: Object.freeze(evidence),
             evidenceDigest,
             evidenceTotal: episodes.length,
+            scopeWatermark: watermark.watermark,
+            taskRevisions: Object.freeze(taskRevisions),
         });
     }
     // ---- proposals -----------------------------------------------------------
@@ -628,64 +1422,97 @@ export class EvolutionStore {
         const hash = digest(mutation);
         const scopeKey = mutation.op === 'adopt'
             ? mutation.input.scopeKey
-            : (this.getRule(mutation.ruleId)?.scopeKey ?? legacyEvolutionScope);
-        this.#database.prepare(`
-      INSERT INTO evolution_proposals(
-        id, policy_proposal_id, idempotency_key, requester, principal, scope_key, mutation_hash,
-        mutation_json, creation_intent_json, settlement_expectation_json,
-        status, expires_at, created_at, updated_at, version)
-      VALUES (?, NULL, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?, 1)
-      ON CONFLICT(idempotency_key) DO NOTHING
-    `).run(id, key, requester, principal, scopeKey, hash, JSON.stringify(mutation), creationIntentJson, input.expiresAt, now, now);
-        const winner = this.#database.prepare('SELECT * FROM evolution_proposals WHERE idempotency_key = ?')
-            .get(key);
-        let winnerIntentMatches = false;
+            : mutation.op === 'owner-undo'
+                ? mutation.scopeKey
+                : (this.getRule(mutation.ruleId)?.scopeKey ?? legacyEvolutionScope);
+        let winner;
+        this.#database.exec('BEGIN IMMEDIATE');
         try {
-            winnerIntentMatches = digest(this.#proposalIntent(this.#validateMutation(JSON.parse(winner.mutation_json)))) === digest(this.#proposalIntent(normalized));
-        }
-        catch {
-            winnerIntentMatches = false;
+            winner = this.#database.prepare('SELECT * FROM evolution_proposals WHERE idempotency_key = ?')
+                .get(key);
+            if (winner === undefined) {
+                // Candidate selection happens before this method is called. Recompute the
+                // complete frozen window under the writer lock so a concurrent task
+                // revision cannot create a proposal from stale evidence.
+                if (!this.#proposalEvidenceMatches(mutation)) {
+                    throw new EvolutionStoreError('version-conflict', 'proposal evidence changed before the immutable proposal could be created');
+                }
+                this.#database.prepare(`
+          INSERT INTO evolution_proposals(
+            id, policy_proposal_id, idempotency_key, requester, principal, scope_key, mutation_hash,
+            mutation_json, creation_intent_json, settlement_expectation_json,
+            status, expires_at, created_at, updated_at, version)
+          VALUES (?, NULL, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?, 1)
+        `).run(id, key, requester, principal, scopeKey, hash, JSON.stringify(mutation), creationIntentJson, input.expiresAt, now, now);
+                winner = this.#database.prepare('SELECT * FROM evolution_proposals WHERE idempotency_key = ?')
+                    .get(key);
+            }
+            let winnerIntentMatches = false;
+            try {
+                winnerIntentMatches = digest(this.#proposalIntent(this.#validateMutation(JSON.parse(winner.mutation_json)))) === digest(this.#proposalIntent(normalized));
+            }
+            catch {
+                winnerIntentMatches = false;
+            }
+            if (!winnerIntentMatches || winner.requester !== requester
+                || winner.principal !== principal || winner.scope_key !== scopeKey
+                || winner.creation_intent_json !== creationIntentJson) {
+                throw new EvolutionStoreError('idempotency-conflict', 'proposal idempotency key was reused with different content');
+            }
+            this.#database.exec('COMMIT');
         }
-        if (!winnerIntentMatches || winner.requester !== requester
-            || winner.principal !== principal || winner.scope_key !== scopeKey
-            || winner.creation_intent_json !== creationIntentJson) {
-            throw new EvolutionStoreError('idempotency-conflict', 'proposal idempotency key was reused with different content');
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
         }
         return proposal(winner);
     }
     attachPolicy(proposalId, policyProposalId, expectation) {
         const policyId = this.#bounded(policyProposalId, 'policyProposalId', 200);
-        const initial = this.#requireProposal(proposalId);
-        let expectationJson = null;
-        if (expectation !== undefined) {
-            const intent = initial.creation_intent_json === null
-                ? undefined
-                : JSON.parse(initial.creation_intent_json);
-            if (expectation.proposalId !== policyId
-                || expectation.requester !== initial.requester
-                || expectation.principal !== initial.principal
-                || !Number.isSafeInteger(expectation.expiresAt) || expectation.expiresAt < 0
-                || expectation.expectedVersion !== 1
-                || intent === undefined
-                || expectation.action !== intent.action
-                || expectation.resource.kind !== intent.resource.kind
-                || expectation.resource.id !== intent.resource.id
-                || expectation.summary !== intent.summary
-                || expectation.diff !== intent.diff) {
-                throw new EvolutionStoreError('invalid-input', 'settlement expectation does not match local creation intent');
+        let attached;
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const initial = this.#requireProposal(proposalId);
+            let expectationJson = null;
+            if (expectation !== undefined) {
+                const intent = initial.creation_intent_json === null
+                    ? undefined
+                    : JSON.parse(initial.creation_intent_json);
+                if (expectation.proposalId !== policyId
+                    || expectation.requester !== initial.requester
+                    || expectation.principal !== initial.principal
+                    || !Number.isSafeInteger(expectation.expiresAt) || expectation.expiresAt < 0
+                    || expectation.expectedVersion !== 1
+                    || intent === undefined
+                    || expectation.action !== intent.action
+                    || expectation.resource.kind !== intent.resource.kind
+                    || expectation.resource.id !== intent.resource.id
+                    || expectation.summary !== intent.summary
+                    || expectation.diff !== intent.diff) {
+                    throw new EvolutionStoreError('invalid-input', 'settlement expectation does not match local creation intent');
+                }
+                expectationJson = JSON.stringify(expectation);
             }
-            expectationJson = JSON.stringify(expectation);
+            this.#database.prepare(`
+        UPDATE evolution_proposals
+        SET policy_proposal_id = ?, settlement_expectation_json = ?,
+            expires_at = ?, updated_at = ?
+        WHERE id = ? AND policy_proposal_id IS NULL
+      `).run(policyId, expectationJson, expectation?.expiresAt ?? initial.expires_at, this.#now(), proposalId);
+            attached = this.#requireProposal(proposalId);
+            if (attached.policy_proposal_id !== policyId
+                || attached.settlement_expectation_json !== expectationJson) {
+                throw new EvolutionStoreError('invalid-state', 'proposal is already attached to a different policy proposal');
+            }
+            // Projection invalidation may have won while Policy was creating the
+            // external card. Attach the exact id anyway and atomically create its
+            // terminal application receipt so the card is updated in place.
+            this.#recordEvolutionApplicationReceipt(attached);
+            this.#database.exec('COMMIT');
         }
-        this.#database.prepare(`
-      UPDATE evolution_proposals
-      SET policy_proposal_id = ?, settlement_expectation_json = ?,
-          expires_at = ?, updated_at = ?
-      WHERE id = ? AND policy_proposal_id IS NULL
-    `).run(policyId, expectationJson, expectation?.expiresAt ?? initial.expires_at, this.#now(), proposalId);
-        const attached = this.#requireProposal(proposalId);
-        if (attached.policy_proposal_id !== policyId
-            || attached.settlement_expectation_json !== expectationJson) {
-            throw new EvolutionStoreError('invalid-state', 'proposal is already attached to a different policy proposal');
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
         }
         return proposal(attached);
     }
@@ -694,6 +1521,11 @@ export class EvolutionStore {
             .get(proposalId);
         return row === undefined ? undefined : proposal(row);
     }
+    getProposalByIdempotencyKey(idempotencyKey) {
+        const key = this.#bounded(idempotencyKey, 'idempotencyKey', 200);
+        const row = this.#database.prepare('SELECT * FROM evolution_proposals WHERE idempotency_key = ?').get(key);
+        return row === undefined ? undefined : proposal(row);
+    }
     listPendingProposals(limit) {
         if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 1_000) {
             throw new EvolutionStoreError('invalid-input', 'pending proposal limit must be between 1 and 1000');
@@ -704,13 +1536,128 @@ export class EvolutionStore {
     `).all(limit);
         return rows.map(row => proposal(row));
     }
+    /**
+     * Recover cross-database creation intents that may already own a Policy card
+     * even when local evidence invalidation made the proposal terminal first.
+     */
+    listUnattachedProposalIntents(limit) {
+        if (!Number.isSafeInteger(limit) || limit <= 0 || limit > 1_000) {
+            throw new EvolutionStoreError('invalid-input', 'unattached proposal limit must be between 1 and 1000');
+        }
+        const rows = this.#database.prepare(`
+      SELECT * FROM evolution_proposals
+      WHERE policy_proposal_id IS NULL AND creation_intent_json IS NOT NULL
+      ORDER BY updated_at, id LIMIT ?
+    `).all(limit);
+        return rows.map(row => proposal(row));
+    }
+    /**
+     * Policy has authoritatively confirmed that an expired unattached intent did
+     * not create a proposal.  Drop only that now-useless recovery payload so the
+     * terminal local conflict is not rediscovered forever.
+     */
+    completeAbandonedProposalRecovery(proposalId) {
+        const id = this.#opaque(proposalId, 'proposalId', 200);
+        const current = this.#requireProposal(id);
+        if (current.policy_proposal_id !== null || current.status === 'pending') {
+            throw new EvolutionStoreError('invalid-state', 'only a terminal unattached proposal can complete abandoned recovery');
+        }
+        if (current.creation_intent_json === null)
+            return proposal(current);
+        const updated = this.#database.prepare(`
+      UPDATE evolution_proposals SET creation_intent_json = NULL
+      WHERE id = ? AND policy_proposal_id IS NULL AND status <> 'pending'
+        AND creation_intent_json IS NOT NULL
+    `).run(id);
+        if (updated.changes !== 1) {
+            throw new EvolutionStoreError('invalid-state', 'abandoned proposal recovery lost its update');
+        }
+        return proposal(this.#requireProposal(id));
+    }
+    getEvolutionApplicationReceipt(localProposalId) {
+        const id = this.#opaque(localProposalId, 'localProposalId', 200);
+        const row = this.#database.prepare(`
+      SELECT * FROM evolution_application_receipts WHERE local_proposal_id = ?
+    `).get(id);
+        return row === undefined ? undefined : evolutionApplicationReceipt(row);
+    }
+    /** Independent terminal-presentation outbox; it never scans pending proposals. */
+    listPendingEvolutionApplicationReceipts(limit) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1_000) {
+            throw new EvolutionStoreError('invalid-input', 'application outbox limit must be between 1 and 1000');
+        }
+        const rows = this.#database.prepare(`
+      SELECT receipt.*, outbox.state, outbox.attempt_count, outbox.updated_at,
+        outbox.published_at, outbox.last_error
+      FROM evolution_application_outbox outbox
+      JOIN evolution_application_receipts receipt
+        ON receipt.local_proposal_id = outbox.local_proposal_id
+      WHERE outbox.state = 'pending'
+      ORDER BY outbox.updated_at, outbox.local_proposal_id
+      LIMIT ?
+    `).all(limit);
+        return rows.map(row => evolutionApplicationOutbox(row));
+    }
+    settleEvolutionApplicationPublication(input) {
+        const localProposalId = this.#opaque(input.localProposalId, 'localProposalId', 200);
+        if (!/^[a-f0-9]{64}$/u.test(input.receiptDigest)) {
+            throw new EvolutionStoreError('invalid-input', 'application receipt digest is invalid');
+        }
+        if (input.outcome !== 'published' && input.outcome !== 'retry') {
+            throw new EvolutionStoreError('invalid-input', 'application publication outcome is invalid');
+        }
+        const error = input.error === undefined
+            ? undefined
+            : this.#rawBounded(input.error, 'application publication error', 500);
+        if (input.outcome === 'published' && error !== undefined) {
+            throw new EvolutionStoreError('invalid-input', 'published application receipt cannot carry an error');
+        }
+        const now = this.#now();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const receipt = this.#database.prepare(`
+        SELECT * FROM evolution_application_receipts WHERE local_proposal_id = ?
+      `).get(localProposalId);
+            if (receipt === undefined || receipt.receipt_digest !== input.receiptDigest) {
+                throw new EvolutionStoreError('idempotency-conflict', 'application publication receipt changed');
+            }
+            const current = this.#database.prepare(`
+        SELECT * FROM evolution_application_outbox WHERE local_proposal_id = ?
+      `).get(localProposalId);
+            if (current === undefined) {
+                throw new EvolutionStoreError('invalid-state', 'application receipt has no durable outbox row');
+            }
+            if (current.state !== 'published') {
+                this.#database.prepare(`
+          UPDATE evolution_application_outbox
+          SET state = ?, attempt_count = attempt_count + 1, updated_at = ?,
+            published_at = ?, last_error = ?
+          WHERE local_proposal_id = ? AND state = 'pending'
+        `).run(input.outcome === 'published' ? 'published' : 'pending', now, input.outcome === 'published' ? now : null, error ?? null, localProposalId);
+            }
+            this.#database.exec('COMMIT');
+        }
+        catch (failure) {
+            this.#database.exec('ROLLBACK');
+            throw failure;
+        }
+        const row = this.#database.prepare(`
+      SELECT receipt.*, outbox.state, outbox.attempt_count, outbox.updated_at,
+        outbox.published_at, outbox.last_error
+      FROM evolution_application_outbox outbox
+      JOIN evolution_application_receipts receipt
+        ON receipt.local_proposal_id = outbox.local_proposal_id
+      WHERE outbox.local_proposal_id = ?
+    `).get(localProposalId);
+        return evolutionApplicationOutbox(row);
+    }
     /** Move an inspected-but-still-pending row behind its peers, durably. */
     deferPendingProposal(proposalId) {
         const now = this.#now();
         this.#database.prepare(`
       UPDATE evolution_proposals
       SET updated_at = CASE WHEN updated_at >= ? THEN updated_at + 1 ELSE ? END
-      WHERE id = ? AND status = 'pending'
+      WHERE id = ?
     `).run(now, now, proposalId);
     }
     /**
@@ -728,6 +1675,7 @@ export class EvolutionStore {
             const row = this.#requireProposal(input.proposalId);
             if (row.status !== 'pending') {
                 replayed = true;
+                this.#recordEvolutionApplicationReceipt(row);
                 this.#database.exec('COMMIT');
             }
             else {
@@ -788,6 +1736,7 @@ export class EvolutionStore {
                 if (updated.changes !== 1) {
                     throw new EvolutionStoreError('invalid-state', 'pending proposal settlement lost its transaction lock');
                 }
+                this.#recordEvolutionApplicationReceipt(this.#requireProposal(input.proposalId));
                 this.#database.exec('COMMIT');
             }
         }
@@ -802,10 +1751,175 @@ export class EvolutionStore {
             rule: settled.result_rule_id === null ? undefined : this.getRule(settled.result_rule_id),
         };
     }
+    #backfillEvolutionApplicationReceipts() {
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const rows = this.#database.prepare(`
+        SELECT proposal.* FROM evolution_proposals proposal
+        LEFT JOIN evolution_application_receipts receipt
+          ON receipt.local_proposal_id = proposal.id
+        WHERE proposal.status <> 'pending' AND proposal.policy_proposal_id IS NOT NULL
+          AND receipt.local_proposal_id IS NULL
+        ORDER BY proposal.updated_at, proposal.id
+      `).all();
+            for (const row of rows)
+                this.#recordEvolutionApplicationReceipt(row);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Must be called while the proposal/rule writer transaction is held. */
+    #recordEvolutionApplicationReceipt(row) {
+        if (row.status === 'pending' || row.policy_proposal_id === null)
+            return;
+        // The receipt describes the atomic application result at the proposal's
+        // terminal linearization point.  A later authoritative evidence correction
+        // may legitimately retire that rule, so terminal replay must not rebuild
+        // the old receipt from the rule's newer state.  Keep the immutable winner,
+        // but still bind it to this exact local/Policy proposal pair so a swapped or
+        // forged receipt cannot be accepted during recovery.
+        const existing = this.#database.prepare(`
+      SELECT * FROM evolution_application_receipts WHERE local_proposal_id = ?
+    `).get(row.id);
+        if (existing !== undefined) {
+            if (existing.local_proposal_id !== row.id
+                || existing.policy_proposal_id !== row.policy_proposal_id) {
+                throw new EvolutionStoreError('idempotency-conflict', 'application receipt proposal binding changed after settlement');
+            }
+            const immutable = {
+                schemaVersion: 1,
+                localProposalId: existing.local_proposal_id,
+                policyProposalId: existing.policy_proposal_id,
+                applicationStatus: existing.application_status,
+                operation: existing.operation,
+                terminalAt: existing.terminal_at,
+                revision: existing.revision,
+                ...(existing.rule_id === null ? {} : { ruleId: existing.rule_id }),
+                ...(existing.resulting_rule_version === null
+                    ? {} : { resultingRuleVersion: existing.resulting_rule_version }),
+                ...(existing.rule_status === null ? {} : { ruleStatus: existing.rule_status }),
+            };
+            if (existing.receipt_digest
+                !== digest(['evolution-application-receipt/v1', immutable])) {
+                throw new EvolutionStoreError('idempotency-conflict', 'application receipt payload changed after settlement');
+            }
+            this.#database.prepare(`
+        INSERT INTO evolution_application_outbox(
+          local_proposal_id, state, attempt_count, updated_at, published_at, last_error)
+        VALUES (?, 'pending', 0, ?, NULL, NULL)
+        ON CONFLICT(local_proposal_id) DO NOTHING
+      `).run(row.id, existing.terminal_at);
+            return;
+        }
+        const operation = this.#evolutionApplicationOperation(row);
+        // An ancient or externally corrupted row with no recoverable operation is
+        // not safe to present. Normal settlements always have a validated operation.
+        if (operation === undefined)
+            return;
+        const applicationStatus = row.status === 'approved' ? 'applied' : row.status;
+        if (applicationStatus !== 'applied' && applicationStatus !== 'conflicted'
+            && applicationStatus !== 'expired' && applicationStatus !== 'rejected')
+            return;
+        let targetRuleId = row.result_rule_id ?? undefined;
+        if (targetRuleId === undefined) {
+            try {
+                const raw = JSON.parse(row.mutation_json);
+                if (typeof raw.ruleId === 'string')
+                    targetRuleId = raw.ruleId;
+            }
+            catch {
+                // The operation may still be recoverable from the creation intent.
+            }
+        }
+        const targetRule = targetRuleId === undefined
+            ? undefined
+            : this.#database.prepare('SELECT * FROM evolution_rules WHERE id = ?')
+                .get(targetRuleId);
+        if (applicationStatus === 'applied' && targetRule === undefined) {
+            throw new EvolutionStoreError('invalid-state', 'applied evolution proposal has no exact resulting rule state');
+        }
+        const canonical = {
+            schemaVersion: 1,
+            localProposalId: row.id,
+            policyProposalId: row.policy_proposal_id,
+            applicationStatus,
+            operation,
+            terminalAt: row.updated_at,
+            revision: Math.max(2, row.version),
+            ...(targetRuleId === undefined ? {} : { ruleId: targetRuleId }),
+            ...(targetRule === undefined ? {} : {
+                resultingRuleVersion: targetRule.version,
+                ruleStatus: targetRule.status,
+            }),
+        };
+        const receiptDigest = digest(['evolution-application-receipt/v1', canonical]);
+        this.#database.prepare(`
+      INSERT INTO evolution_application_receipts(
+        local_proposal_id, policy_proposal_id, application_status, operation,
+        terminal_at, receipt_digest, revision, rule_id, resulting_rule_version, rule_status)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(local_proposal_id) DO NOTHING
+    `).run(canonical.localProposalId, canonical.policyProposalId, canonical.applicationStatus, canonical.operation, canonical.terminalAt, receiptDigest, canonical.revision, targetRuleId ?? null, targetRule?.version ?? null, targetRule?.status ?? null);
+        const saved = this.#database.prepare(`
+      SELECT * FROM evolution_application_receipts WHERE local_proposal_id = ?
+    `).get(row.id);
+        const expected = evolutionApplicationReceipt({
+            local_proposal_id: canonical.localProposalId,
+            policy_proposal_id: canonical.policyProposalId,
+            application_status: canonical.applicationStatus,
+            operation: canonical.operation,
+            terminal_at: canonical.terminalAt,
+            receipt_digest: receiptDigest,
+            revision: canonical.revision,
+            rule_id: targetRuleId ?? null,
+            resulting_rule_version: targetRule?.version ?? null,
+            rule_status: targetRule?.status ?? null,
+        });
+        if (JSON.stringify(evolutionApplicationReceipt(saved)) !== JSON.stringify(expected)) {
+            throw new EvolutionStoreError('idempotency-conflict', 'application receipt changed after settlement');
+        }
+        this.#database.prepare(`
+      INSERT INTO evolution_application_outbox(
+        local_proposal_id, state, attempt_count, updated_at, published_at, last_error)
+      VALUES (?, 'pending', 0, ?, NULL, NULL)
+      ON CONFLICT(local_proposal_id) DO NOTHING
+    `).run(row.id, row.updated_at);
+    }
+    #evolutionApplicationOperation(row) {
+        try {
+            const mutation = JSON.parse(row.mutation_json);
+            if (mutation.op === 'adopt' || mutation.op === 'owner-undo' || mutation.op === 'retire') {
+                return mutation.op;
+            }
+        }
+        catch {
+            // Fall through to the immutable Policy creation intent.
+        }
+        try {
+            const intent = row.creation_intent_json === null
+                ? undefined
+                : JSON.parse(row.creation_intent_json);
+            if (intent?.action === 'evolution.adopt')
+                return 'adopt';
+            if (intent?.action === 'evolution.owner-undo')
+                return 'owner-undo';
+            if (intent?.action === 'evolution.retire')
+                return 'retire';
+        }
+        catch {
+            return undefined;
+        }
+        return undefined;
+    }
     #applyMutation(mutation, proposalScopeKey, now) {
         if (mutation.op === 'adopt') {
             const ruleId = mutation.ruleId;
-            if (ruleId === undefined || mutation.input.scopeKey !== proposalScopeKey) {
+            if (ruleId === undefined || mutation.input.scopeKey !== proposalScopeKey
+                || (mutation.evidence !== undefined
+                    && !this.#adoptionEvidenceMatches(mutation, mutation.evidence))) {
                 return { status: 'conflicted', ruleId: undefined };
             }
             // A second active rule for the same situation would make injected guidance
@@ -825,16 +1939,24 @@ export class EvolutionStore {
         }
         const existing = this.#database.prepare('SELECT * FROM evolution_rules WHERE id = ?')
             .get(mutation.ruleId);
+        const evidenceMismatch = mutation.op === 'retire' && existing !== undefined && (mutation.scopeKey !== existing.scope_key
+            || mutation.situation !== existing.situation
+            || mutation.guidance !== existing.guidance
+            || mutation.generation !== existing.generation
+            || mutation.evaluation.scopeKey !== existing.scope_key
+            || mutation.evaluation.situation !== existing.situation
+            || mutation.baseline.scopeKey !== existing.scope_key
+            || mutation.baseline.situation !== existing.situation
+            || mutation.baseline.failures !== existing.baseline_failures
+            || mutation.baseline.total !== existing.baseline_total
+            || !this.#retirementEvidenceMatches(mutation, existing));
         if (existing === undefined || existing.scope_key !== proposalScopeKey || existing.status !== 'active'
             || existing.version !== mutation.expectedVersion
-            || (mutation.evaluation !== undefined && mutation.baseline !== undefined
-                && mutation.evidence !== undefined && (mutation.evaluation.scopeKey !== existing.scope_key
-                || mutation.evaluation.situation !== existing.situation
-                || mutation.baseline.scopeKey !== existing.scope_key
-                || mutation.baseline.situation !== existing.situation
-                || mutation.baseline.failures !== existing.baseline_failures
-                || mutation.baseline.total !== existing.baseline_total
-                || !this.#retirementEvidenceSamplesMatch(mutation, existing)))) {
+            || (mutation.op === 'owner-undo' && (mutation.scopeKey !== proposalScopeKey
+                || mutation.situation !== existing.situation
+                || mutation.guidance !== existing.guidance
+                || mutation.generation !== existing.generation))
+            || evidenceMismatch) {
             return { status: 'conflicted', ruleId: undefined };
         }
         const version = existing.version + 1;
@@ -843,10 +1965,198 @@ export class EvolutionStore {
       SET status = 'retired', retired_reason = ?, updated_at = ?, version = ?
       WHERE id = ? AND version = ?
     `).run(mutation.reason, now, version, mutation.ruleId, mutation.expectedVersion);
-        this.#audit('retire', mutation.ruleId, version, now);
+        this.#audit(mutation.op === 'owner-undo' ? 'owner-undo' : 'retire', mutation.ruleId, version, now);
         return { status: 'approved', ruleId: mutation.ruleId };
     }
-    #retirementEvidenceSamplesMatch(mutation, active) {
+    #normalizeSupervisedGrowthAnalystEvidence(scopeKey, candidate, evidenceWindow) {
+        this.#requireWindow(evidenceWindow);
+        if (candidate.kind !== 'adopt' || candidate.scopeKey !== scopeKey) {
+            throw new EvolutionStoreError('invalid-input', 'analyst review requires one scoped adoption candidate');
+        }
+        const stats = this.#validateStats(candidate.stats, 'analyst candidate');
+        const situation = this.#situation(candidate.situation);
+        if (stats.scopeKey !== scopeKey || stats.situation !== situation
+            || candidate.evidenceTotal !== stats.total || evidenceWindow < candidate.evidenceTotal) {
+            throw new EvolutionStoreError('invalid-input', 'analyst candidate statistics are inconsistent');
+        }
+        const reference = this.#validateEvidenceReference({
+            sampleEpisodeIds: candidate.evidence.map(entry => entry.episodeId),
+            digest: candidate.evidenceDigest,
+            total: candidate.evidenceTotal,
+            window: evidenceWindow,
+            scopeWatermark: candidate.scopeWatermark,
+            taskRevisions: candidate.taskRevisions,
+        }, stats.total);
+        if (candidate.evidence.length !== reference.sampleEpisodeIds.length) {
+            throw new EvolutionStoreError('invalid-input', 'analyst evidence projection is incomplete');
+        }
+        const evidence = candidate.evidence.map((entry, index) => {
+            const episodeId = reference.sampleEpisodeIds[index];
+            if (entry.episodeId !== episodeId
+                || (entry.outcome !== 'succeeded' && entry.outcome !== 'failed')
+                || (entry.evidenceKind !== 'objective' && entry.evidenceKind !== 'verification')
+                || !Number.isSafeInteger(entry.occurredAt) || entry.occurredAt < 0) {
+                throw new EvolutionStoreError('invalid-input', 'analyst evidence sample is invalid');
+            }
+            return Object.freeze({
+                episodeId,
+                outcome: entry.outcome,
+                evidenceKind: entry.evidenceKind,
+                evidenceRef: this.#opaque(entry.evidenceRef, 'evidenceRef', 500),
+                detail: this.#bounded(entry.detail, 'detail', this.#maxDetailBytes),
+                occurredAt: entry.occurredAt,
+            });
+        });
+        return Object.freeze({
+            contractVersion: SUPERVISED_GROWTH_ANALYST_CONTRACT_VERSION,
+            situation,
+            failures: stats.failures,
+            total: stats.total,
+            evidenceDigest: reference.digest,
+            evidenceTotal: reference.total,
+            evidenceWindow,
+            sampleEpisodeIds: reference.sampleEpisodeIds,
+            evidence: Object.freeze(evidence),
+            scopeWatermark: reference.scopeWatermark,
+            taskRevisions: reference.taskRevisions,
+        });
+    }
+    #supervisedGrowthAnalystEvidenceMatches(scopeKey, evidence) {
+        const mutation = {
+            op: 'adopt',
+            input: {
+                scopeKey,
+                situation: evidence.situation,
+                guidance: 'Pending supervised analyst guidance.',
+            },
+            baseline: {
+                scopeKey,
+                situation: evidence.situation,
+                failures: evidence.failures,
+                total: evidence.total,
+            },
+            evidence: {
+                sampleEpisodeIds: evidence.sampleEpisodeIds,
+                digest: evidence.evidenceDigest,
+                total: evidence.evidenceTotal,
+                window: evidence.evidenceWindow,
+                scopeWatermark: evidence.scopeWatermark,
+                taskRevisions: evidence.taskRevisions,
+            },
+        };
+        return this.#proposalEvidenceMatches(mutation);
+    }
+    #sameSupervisedGrowthAnalystReview(row, evidence, sampleJson, evidenceJson, taskRevisionsJson) {
+        return row.contract_version === evidence.contractVersion
+            && row.situation === evidence.situation
+            && row.failures === evidence.failures
+            && row.total === evidence.total
+            && row.evidence_digest === evidence.evidenceDigest
+            && row.evidence_total === evidence.evidenceTotal
+            && row.evidence_window === evidence.evidenceWindow
+            && row.sample_episode_ids_json === sampleJson
+            && row.evidence_json === evidenceJson
+            && row.scope_watermark === evidence.scopeWatermark
+            && row.task_revisions_json === taskRevisionsJson;
+    }
+    #supervisedGrowthAnalystMutationMatches(mutation, evidence) {
+        return mutation.input.scopeKey !== ''
+            && mutation.input.situation === evidence.situation
+            && mutation.baseline.scopeKey === mutation.input.scopeKey
+            && mutation.baseline.situation === evidence.situation
+            && mutation.baseline.failures === evidence.failures
+            && mutation.baseline.total === evidence.total
+            && mutation.evidence !== undefined
+            && mutation.evidence.digest === evidence.evidenceDigest
+            && mutation.evidence.total === evidence.evidenceTotal
+            && mutation.evidence.window === evidence.evidenceWindow
+            && mutation.evidence.scopeWatermark === evidence.scopeWatermark
+            && mutation.evidence.taskRevisions !== undefined
+            && this.#sameTaskRevisions(mutation.evidence.taskRevisions, evidence.taskRevisions)
+            && this.#sameEvidenceSamples(evidence.evidence, mutation.evidence.sampleEpisodeIds);
+    }
+    #supervisedGrowthAnalystProposalMatches(row, evidence) {
+        let mutation;
+        try {
+            mutation = this.#validateStoredMutation(JSON.parse(row.mutation_json));
+        }
+        catch {
+            return false;
+        }
+        if (mutation.op !== 'adopt' || mutation.evidence === undefined
+            || row.scope_key !== mutation.input.scopeKey
+            || !this.#supervisedGrowthAnalystMutationMatches(mutation, evidence))
+            return false;
+        const expectedKey = supervisedGrowthAnalystProposalIdempotencyKey({
+            scopeKey: row.scope_key,
+            situation: evidence.situation,
+            evidenceDigest: evidence.evidenceDigest,
+            evidenceTotal: evidence.evidenceTotal,
+            contractVersion: evidence.contractVersion,
+        });
+        return row.idempotency_key === expectedKey && row.mutation_hash === digest(mutation);
+    }
+    #analystReviewToken(value) {
+        const token = this.#opaque(value, 'reviewToken', 200);
+        if (!/^analyst-review-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u
+            .test(token)) {
+            throw new EvolutionStoreError('invalid-input', 'analyst review token is invalid');
+        }
+        return token;
+    }
+    #proposalEvidenceMatches(mutation) {
+        if (mutation.op === 'owner-undo')
+            return true;
+        if (mutation.op === 'adopt') {
+            return mutation.evidence === undefined
+                || this.#adoptionEvidenceMatches(mutation, mutation.evidence);
+        }
+        const active = this.#database.prepare('SELECT * FROM evolution_rules WHERE id = ?')
+            .get(mutation.ruleId);
+        return active !== undefined && this.#retirementEvidenceMatches(mutation, active);
+    }
+    #adoptionEvidenceMatches(mutation, evidence) {
+        if (evidence.window !== undefined) {
+            if (this.activeRule(mutation.input.scopeKey, mutation.input.situation) !== undefined)
+                return false;
+            const episodes = this.#adoptionEpisodes(mutation.input.scopeKey, mutation.input.situation, evidence.window);
+            const stats = this.#statsFromEpisodes(mutation.input.scopeKey, mutation.input.situation, episodes);
+            const current = this.#candidateEvidence(episodes, evidence.sampleEpisodeIds.length);
+            return stats.failures === mutation.baseline.failures
+                && stats.total === mutation.baseline.total
+                && current.evidenceTotal === evidence.total
+                && current.evidenceDigest === evidence.digest
+                && (evidence.scopeWatermark === undefined
+                    || current.scopeWatermark === evidence.scopeWatermark)
+                && (evidence.taskRevisions === undefined
+                    || this.#sameTaskRevisions(current.taskRevisions, evidence.taskRevisions))
+                && this.#sameEvidenceSamples(current.evidence, evidence.sampleEpisodeIds);
+        }
+        const ids = evidence.sampleEpisodeIds;
+        const placeholders = ids.map(() => '?').join(',');
+        const rows = this.#database.prepare(`
+      SELECT * FROM evolution_episodes WHERE id IN (${placeholders})
+    `).all(...ids);
+        return rows.length === ids.length && rows.every(row => row.scope_key === mutation.input.scopeKey
+            && row.situation === mutation.input.situation && row.trust === 'trusted'
+            && row.learning_eligible === 1 && row.rule_id === null);
+    }
+    #retirementEvidenceMatches(mutation, active) {
+        if (mutation.evidence.window !== undefined) {
+            const currentRule = rule(active);
+            const episodes = this.#evaluationEpisodes(currentRule, mutation.evidence.window);
+            const stats = this.#statsFromEpisodes(active.scope_key, active.situation, episodes);
+            const current = this.#candidateEvidence(episodes, mutation.evidence.sampleEpisodeIds.length);
+            return stats.failures === mutation.evaluation.failures
+                && stats.total === mutation.evaluation.total
+                && current.evidenceTotal === mutation.evidence.total
+                && current.evidenceDigest === mutation.evidence.digest
+                && (mutation.evidence.scopeWatermark === undefined
+                    || current.scopeWatermark === mutation.evidence.scopeWatermark)
+                && (mutation.evidence.taskRevisions === undefined
+                    || this.#sameTaskRevisions(current.taskRevisions, mutation.evidence.taskRevisions))
+                && this.#sameEvidenceSamples(current.evidence, mutation.evidence.sampleEpisodeIds);
+        }
         const ids = mutation.evidence.sampleEpisodeIds;
         const placeholders = ids.map(() => '?').join(',');
         const rows = this.#database.prepare(`
@@ -854,9 +2164,18 @@ export class EvolutionStore {
     `).all(...ids);
         return rows.length === ids.length && rows.every(row => row.scope_key === active.scope_key
             && row.situation === active.situation && row.trust === 'trusted'
+            && row.learning_eligible === 1
             && row.rule_id === active.id && row.guidance_version === active.generation
             && row.occurred_at > active.adopted_at);
     }
+    #sameEvidenceSamples(current, expectedIds) {
+        return current.length === expectedIds.length
+            && current.every((entry, index) => entry.episodeId === expectedIds[index]);
+    }
+    #sameTaskRevisions(current, expected) {
+        return current.length === expected.length
+            && current.every((entry, index) => JSON.stringify(entry) === JSON.stringify(expected[index]));
+    }
     #audit(operation, ruleId, resultVersion, now) {
         this.#database.prepare(`
       INSERT INTO evolution_audit(idempotency_key, operation, rule_id, result_version, occurred_at)
@@ -899,20 +2218,41 @@ export class EvolutionStore {
         if (!Number.isSafeInteger(mutation.expectedVersion) || mutation.expectedVersion < 1) {
             throw new EvolutionStoreError('invalid-input', 'expectedVersion must be a positive safe integer');
         }
-        const ruleId = this.#bounded(mutation.ruleId, 'ruleId', 200);
+        const ruleId = this.#serverRuleId(mutation.ruleId);
+        if (mutation.op === 'owner-undo') {
+            return {
+                op: 'owner-undo',
+                scopeKey: this.#scopeKey(mutation.scopeKey),
+                ruleId,
+                situation: this.#situation(mutation.situation),
+                guidance: this.#bounded(mutation.guidance, 'guidance', this.#maxGuidanceBytes),
+                generation: this.#positiveVersion(mutation.generation, 'generation'),
+                expectedVersion: mutation.expectedVersion,
+                reason: this.#bounded(mutation.reason, 'reason', this.#maxDetailBytes),
+            };
+        }
         if (mutation.evaluation === undefined || mutation.baseline === undefined
             || mutation.evidence === undefined) {
             throw new EvolutionStoreError('invalid-input', 'retirement evidence snapshot must be complete');
         }
         const evaluation = this.#validateStats(mutation.evaluation, 'retirement evaluation');
         const baseline = this.#validateStats(mutation.baseline, 'retirement baseline');
-        if (evaluation.scopeKey !== baseline.scopeKey || evaluation.situation !== baseline.situation) {
+        const scopeKey = this.#scopeKey(mutation.scopeKey);
+        const situation = this.#situation(mutation.situation);
+        const guidance = this.#bounded(mutation.guidance, 'guidance', this.#maxGuidanceBytes);
+        const generation = this.#positiveVersion(mutation.generation, 'generation');
+        if (evaluation.scopeKey !== baseline.scopeKey || evaluation.situation !== baseline.situation
+            || evaluation.scopeKey !== scopeKey || evaluation.situation !== situation) {
             throw new EvolutionStoreError('invalid-input', 'retirement evaluation and baseline must match');
         }
         const evidence = this.#validateEvidenceReference(mutation.evidence, evaluation.total);
         return {
             op: 'retire',
+            scopeKey,
             ruleId,
+            situation,
+            guidance,
+            generation,
             expectedVersion: mutation.expectedVersion,
             reason: this.#bounded(mutation.reason, 'reason', this.#maxDetailBytes),
             evaluation,
@@ -922,7 +2262,7 @@ export class EvolutionStore {
     }
     #validateStoredMutation(mutation) {
         const normalized = this.#validateMutation(mutation);
-        if (normalized.op === 'retire')
+        if (normalized.op !== 'adopt')
             return normalized;
         const ruleId = mutation.op === 'adopt' && mutation.ruleId !== undefined
             ? this.#serverRuleId(mutation.ruleId)
@@ -933,7 +2273,7 @@ export class EvolutionStore {
         return { ...normalized, ruleId };
     }
     #proposalIntent(mutation) {
-        if (mutation.op === 'retire' || mutation.ruleId === undefined)
+        if (mutation.op !== 'adopt' || mutation.ruleId === undefined)
             return mutation;
         const { ruleId: _ruleId, ...intent } = mutation;
         return intent;
@@ -946,6 +2286,12 @@ export class EvolutionStore {
         }
         return ruleId;
     }
+    #positiveVersion(value, field) {
+        if (!Number.isSafeInteger(value) || value < 1 || value > 1_000_000_000) {
+            throw new EvolutionStoreError('invalid-input', `${field} must be a positive safe integer`);
+        }
+        return value;
+    }
     #optionalServerRuleId(value) {
         const normalized = value.normalize('NFC').trim();
         const pattern = /^rule-[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
@@ -980,10 +2326,51 @@ export class EvolutionStore {
         if (new Set(sampleEpisodeIds).size !== sampleEpisodeIds.length) {
             throw new EvolutionStoreError('invalid-input', 'evidence sample IDs must be unique');
         }
+        const window = input.window;
+        if (window !== undefined)
+            this.#requireWindow(window);
+        const hasScopeWatermark = input.scopeWatermark !== undefined;
+        const hasTaskRevisions = input.taskRevisions !== undefined;
+        if (hasScopeWatermark !== hasTaskRevisions) {
+            throw new EvolutionStoreError('invalid-input', 'evidence scope watermark and task revisions must be frozen together');
+        }
+        let scopeWatermark;
+        let taskRevisions;
+        if (hasScopeWatermark && hasTaskRevisions) {
+            scopeWatermark = this.#positiveVersion(input.scopeWatermark, 'evidence scopeWatermark');
+            if (!Array.isArray(input.taskRevisions) || input.taskRevisions.length !== input.total) {
+                throw new EvolutionStoreError('invalid-input', 'evidence task revisions must cover the complete evidence window');
+            }
+            const seen = new Set();
+            taskRevisions = Object.freeze(input.taskRevisions.map((entry, index) => {
+                if (typeof entry !== 'object' || entry === null || Array.isArray(entry)
+                    || (entry.subjectKind !== 'automation-run' && entry.subjectKind !== 'outcome')
+                    || entry.disposition !== 'upsert'
+                    || !/^[a-f0-9]{64}$/u.test(entry.digest)) {
+                    throw new EvolutionStoreError('invalid-input', `evidence task revision ${index} is invalid`);
+                }
+                const subjectRef = this.#opaque(entry.subjectRef, 'task subjectRef', 1_000);
+                const identity = JSON.stringify([entry.subjectKind, subjectRef]);
+                if (seen.has(identity)) {
+                    throw new EvolutionStoreError('invalid-input', 'evidence task revisions contain a duplicate');
+                }
+                seen.add(identity);
+                return Object.freeze({
+                    subjectKind: entry.subjectKind,
+                    subjectRef,
+                    version: this.#positiveVersion(entry.version, 'task revision version'),
+                    digest: entry.digest,
+                    disposition: 'upsert',
+                });
+            }));
+        }
         return Object.freeze({
             sampleEpisodeIds: Object.freeze(sampleEpisodeIds),
             digest: input.digest,
             total: input.total,
+            ...(window === undefined ? {} : { window }),
+            ...(scopeWatermark === undefined ? {} : { scopeWatermark }),
+            ...(taskRevisions === undefined ? {} : { taskRevisions }),
         });
     }
     #validateCreationIntent(input, expected) {
@@ -1011,12 +2398,11 @@ export class EvolutionStore {
             if (input.dispatch.principal !== expected.principal) {
                 throw new EvolutionStoreError('invalid-input', 'Policy dispatch is bound to another principal');
             }
-            intent.dispatch = {
-                sourceId: this.#rawBounded(input.dispatch.sourceId, 'dispatch sourceId', 500),
-                bindingId: this.#rawBounded(input.dispatch.bindingId, 'dispatch bindingId', 500),
-                workspace: this.#rawBounded(input.dispatch.workspace, 'dispatch workspace', 4_096),
-                principal: this.#rawBounded(input.dispatch.principal, 'dispatch principal', 500),
-            };
+            this.#rawBounded(input.dispatch.sourceId, 'dispatch sourceId', 500);
+            this.#rawBounded(input.dispatch.bindingId, 'dispatch bindingId', 500);
+            this.#rawBounded(input.dispatch.workspace, 'dispatch workspace', 4_096);
+            this.#rawBounded(input.dispatch.principal, 'dispatch principal', 500);
+            intent.dispatch = approvalDispatch(JSON.parse(JSON.stringify(input.dispatch)), 'invalid-input', false);
         }
         return intent;
     }