@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/ledger.js

@@ -1,10 +1,12 @@
+import { markLinuxLedgerAdmissionRefusal } from './linux-repository-admission.js';
 import { validateGoalArtifactAdmission } from '@dsh-enhanced/task-acceptance-contract';
 import { chmodSync, mkdirSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
 import { dirname, isAbsolute, normalize } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { processExited, sameDaemonWitness, validateCreationWitness } from './runtime-witness.js';
 import { receiptData } from './cleanup-receipt.js';
+import { linuxExecutionContractDigest, linuxExecutionIntentDigest, linuxExecutionResourcesDigest, linuxJobResourceReservation, validateLinuxExecutionContract, validateLinuxExecutionIntent, validateLinuxExecutionResources, validateLinuxReceiptBinding, validateLinuxExecutionPartialCleanupProof } from './linux-execution-contract.js';
 import { pruneResult, validateRetention } from './storage-policy.js';
 export class IsolationLedgerError extends Error {
     code;
@@ -14,7 +16,7 @@ export class IsolationLedgerError extends Error {
         this.name = 'IsolationLedgerError';
     }
 }
-const schemaVersion = 7;
+const schemaVersion = 9;
 const outputMaximum = 1_048_576;
 const artifactMaximum = 128;
 const textMaximum = 16_384;
@@ -50,7 +52,11 @@ function artifactBinding(value) {
         fail('invalid-input', 'invalid artifact binding');
     return frozen({ admission: validateGoalArtifactAdmission(value.admission), paths: [...value.paths] });
 }
-function grantDigest(value) { return JSON.stringify(value); }
+/** Canonical freeze-order JSON of the ten-key grant document used as the grant
+ * equality proof. Despite the name it is a fingerprint, not a cryptographic
+ * hash: it is compared byte-for-byte, and the authorized backend handover
+ * rewrites the verifier grant with the exact same byte formula. */
+export function grantDigest(value) { return JSON.stringify(value); }
 function result(value, allowRetention = false) {
     if (!value || typeof value !== 'object' || !text(value.jobId) || !['succeeded', 'failed', 'cancelled', 'timed-out', 'unknown'].includes(value.status)
         || typeof value.quiescent !== 'boolean' || typeof value.stdout !== 'string' || typeof value.stderr !== 'string'
@@ -121,11 +127,27 @@ function open(path) {
       CREATE INDEX isolation_jobs_grant ON isolation_jobs(grant_id);
       CREATE INDEX isolation_jobs_recoverable ON isolation_jobs(status, updated_at);
       UPDATE schema_meta SET value='7' WHERE key='schema-version'; PRAGMA user_version=7; COMMIT;`);
+        if ([0, 1, 2, 3, 4, 5, 6, 7].includes(version))
+            database.exec(`BEGIN IMMEDIATE;
+      CREATE TABLE isolation_jobs_v8 (id TEXT PRIMARY KEY, grant_id TEXT NOT NULL, grant_revision INTEGER NOT NULL, principal_digest TEXT NOT NULL, principal_record_id TEXT NOT NULL, principal_version INTEGER NOT NULL, workspace TEXT NOT NULL, agent_preset TEXT NOT NULL, session_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, request_digest TEXT NOT NULL, container_name TEXT UNIQUE, backend_kind TEXT NOT NULL CHECK(backend_kind IN ('docker','macos-seatbelt','linux-native')), native_resource_id TEXT UNIQUE, native_nonce TEXT, deadline INTEGER NOT NULL, reserved_duration_ms INTEGER NOT NULL, reserved_memory_mib INTEGER NOT NULL DEFAULT 0, reserved_workspace_inodes INTEGER NOT NULL DEFAULT 0, reserved_storage_bytes INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL CHECK(status IN ('prepared','running','succeeded','failed','cancelled','timed-out','unknown')), version INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, result_json TEXT, dispatch_attempted INTEGER NOT NULL DEFAULT 0 CHECK(dispatch_attempted IN (0,1)), creation_witness_json TEXT, artifact_binding_json TEXT, linux_contract_json TEXT, linux_intent_json TEXT, linux_resources_json TEXT, CHECK((backend_kind='docker' AND container_name IS NOT NULL AND native_resource_id IS NULL AND native_nonce IS NULL) OR (backend_kind='macos-seatbelt' AND container_name IS NULL AND native_resource_id IS NOT NULL AND native_nonce IS NOT NULL AND reserved_memory_mib=0 AND reserved_workspace_inodes=0 AND linux_contract_json IS NULL AND linux_intent_json IS NULL AND linux_resources_json IS NULL) OR (backend_kind='linux-native' AND container_name IS NULL AND native_resource_id IS NOT NULL AND native_nonce IS NOT NULL AND reserved_memory_mib>0 AND reserved_workspace_inodes>0 AND reserved_storage_bytes>0 AND linux_contract_json IS NOT NULL)), CHECK(backend_kind='linux-native' OR (linux_contract_json IS NULL AND linux_intent_json IS NULL AND linux_resources_json IS NULL)), UNIQUE(principal_digest, principal_record_id, principal_version, workspace, agent_preset, session_id, grant_id, idempotency_key)) STRICT;
+      INSERT INTO isolation_jobs_v8 (id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,status,version,created_at,updated_at,result_json,dispatch_attempted,creation_witness_json,artifact_binding_json) SELECT id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,status,version,created_at,updated_at,result_json,dispatch_attempted,creation_witness_json,artifact_binding_json FROM isolation_jobs;
+      DROP TABLE isolation_jobs; ALTER TABLE isolation_jobs_v8 RENAME TO isolation_jobs;
+      CREATE INDEX isolation_jobs_grant ON isolation_jobs(grant_id);
+      CREATE INDEX isolation_jobs_recoverable ON isolation_jobs(status, updated_at);
+      UPDATE schema_meta SET value='8' WHERE key='schema-version'; PRAGMA user_version=8; COMMIT;`);
+        if ([0, 1, 2, 3, 4, 5, 6, 7, 8].includes(version))
+            database.exec(`BEGIN IMMEDIATE;
+      CREATE TABLE isolation_jobs_v9 (id TEXT PRIMARY KEY, grant_id TEXT NOT NULL, grant_revision INTEGER NOT NULL, principal_digest TEXT NOT NULL, principal_record_id TEXT NOT NULL, principal_version INTEGER NOT NULL, workspace TEXT NOT NULL, agent_preset TEXT NOT NULL, session_id TEXT NOT NULL, idempotency_key TEXT NOT NULL, request_digest TEXT NOT NULL, container_name TEXT UNIQUE, backend_kind TEXT NOT NULL CHECK(backend_kind IN ('docker','macos-seatbelt','linux-native')), native_resource_id TEXT UNIQUE, native_nonce TEXT, deadline INTEGER NOT NULL, reserved_duration_ms INTEGER NOT NULL, reserved_memory_mib INTEGER NOT NULL DEFAULT 0, reserved_workspace_inodes INTEGER NOT NULL DEFAULT 0, reserved_storage_bytes INTEGER NOT NULL DEFAULT 0, status TEXT NOT NULL CHECK(status IN ('prepared','running','succeeded','failed','cancelled','timed-out','unknown')), version INTEGER NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, result_json TEXT, dispatch_attempted INTEGER NOT NULL DEFAULT 0 CHECK(dispatch_attempted IN (0,1)), creation_witness_json TEXT, artifact_binding_json TEXT, linux_contract_json TEXT, linux_intent_json TEXT, linux_resources_json TEXT, migrated INTEGER NOT NULL DEFAULT 0 CHECK(migrated IN (0,1)), CHECK((backend_kind='docker' AND container_name IS NOT NULL AND native_resource_id IS NULL AND native_nonce IS NULL) OR (backend_kind='macos-seatbelt' AND container_name IS NULL AND native_resource_id IS NOT NULL AND native_nonce IS NOT NULL AND reserved_memory_mib=0 AND reserved_workspace_inodes=0 AND linux_contract_json IS NULL AND linux_intent_json IS NULL AND linux_resources_json IS NULL) OR (backend_kind='linux-native' AND container_name IS NULL AND native_resource_id IS NOT NULL AND native_nonce IS NOT NULL AND reserved_memory_mib>0 AND reserved_workspace_inodes>0 AND reserved_storage_bytes>0 AND linux_contract_json IS NOT NULL)), CHECK(backend_kind='linux-native' OR (linux_contract_json IS NULL AND linux_intent_json IS NULL AND linux_resources_json IS NULL)), UNIQUE(principal_digest, principal_record_id, principal_version, workspace, agent_preset, session_id, grant_id, idempotency_key)) STRICT;
+      INSERT INTO isolation_jobs_v9 (id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,status,version,created_at,updated_at,result_json,dispatch_attempted,creation_witness_json,artifact_binding_json,linux_contract_json,linux_intent_json,linux_resources_json) SELECT id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,status,version,created_at,updated_at,result_json,dispatch_attempted,creation_witness_json,artifact_binding_json,linux_contract_json,linux_intent_json,linux_resources_json FROM isolation_jobs;
+      DROP TABLE isolation_jobs; ALTER TABLE isolation_jobs_v9 RENAME TO isolation_jobs;
+      CREATE INDEX isolation_jobs_grant ON isolation_jobs(grant_id);
+      CREATE INDEX isolation_jobs_recoverable ON isolation_jobs(status, updated_at);
+      UPDATE schema_meta SET value='9' WHERE key='schema-version'; PRAGMA user_version=9; COMMIT;`);
         database.exec("CREATE INDEX IF NOT EXISTS isolation_artifact_contract ON isolation_jobs(json_extract(artifact_binding_json, '$.admission.contractId')) WHERE artifact_binding_json IS NOT NULL");
-        if (![0, 1, 2, 3, 4, 5, 6, schemaVersion].includes(version))
+        if (![0, 1, 2, 3, 4, 5, 6, 7, 8, schemaVersion].includes(version))
             fail('schema');
         const marker = database.prepare("SELECT value FROM schema_meta WHERE key='schema-version'").get();
-        if (marker?.value !== '7' || database.prepare('PRAGMA user_version').get().user_version !== 7)
+        if (marker?.value !== '9' || database.prepare('PRAGMA user_version').get().user_version !== 9)
             fail('schema');
         if (path !== ':memory:')
             chmodSync(path, 0o600);
@@ -141,19 +163,29 @@ export class IsolationLedger {
     #database;
     #now;
     constructor(path, { now = Date.now } = {}) { this.#database = open(path); this.#now = now; }
-    #transaction(operation) { this.#database.exec('BEGIN IMMEDIATE'); try {
-        const value = operation();
-        this.#database.exec('COMMIT');
-        return value;
-    }
-    catch (error) {
+    #transaction(operation, rolledBack) {
+        this.#database.exec('BEGIN IMMEDIATE');
         try {
-            this.#database.exec('ROLLBACK');
+            const value = operation();
+            this.#database.exec('COMMIT');
+            return value;
         }
-        catch { }
-        ;
-        throw error;
-    } }
+        catch (error) {
+            let confirmed = false;
+            try {
+                this.#database.exec('ROLLBACK');
+                confirmed = true;
+            }
+            catch { /* Preserve the original failure. */ }
+            if (confirmed) {
+                try {
+                    rolledBack?.(error);
+                }
+                catch { /* Evidence must never change the original API error. */ }
+            }
+            throw error;
+        }
+    }
     #nowValue() { const value = this.#now(); if (!safeTime(value))
         fail('invalid-input', 'clock returned invalid time'); return value; }
     #grant(id) { return this.#database.prepare('SELECT * FROM isolation_grants WHERE id = ?').get(id); }
@@ -178,9 +210,10 @@ export class IsolationLedger {
         if (!text(row.id) || !text(row.grant_id) || !safePositive(row.grant_revision) || !text(row.session_id) || !text(row.idempotency_key) || !text(row.request_digest) || !positiveTime(row.deadline) || !safePositive(row.reserved_duration_ms) || !safeTime(row.reserved_memory_mib) || !safeTime(row.reserved_workspace_inodes) || !safeTime(row.reserved_storage_bytes) || !safePositive(row.version) || !safeTime(row.created_at) || !safeTime(row.updated_at) || row.updated_at < row.created_at || !['prepared', 'running', 'succeeded', 'failed', 'cancelled', 'timed-out', 'unknown'].includes(row.status))
             fail('schema');
         if (!((row.backend_kind === 'docker' && text(row.container_name) && row.native_resource_id === null && row.native_nonce === null)
-            || (row.backend_kind === 'macos-seatbelt' && row.container_name === null && text(row.native_resource_id) && text(row.native_nonce) && row.reserved_memory_mib === 0 && row.reserved_workspace_inodes === 0)))
+            || (row.backend_kind === 'macos-seatbelt' && row.container_name === null && text(row.native_resource_id) && text(row.native_nonce) && row.reserved_memory_mib === 0 && row.reserved_workspace_inodes === 0)
+            || (row.backend_kind === 'linux-native' && row.container_name === null && row.native_resource_id === `linux-${row.id}` && /^[a-f0-9]{32}$/u.test(row.native_nonce ?? '') && row.reserved_memory_mib > 0 && row.reserved_workspace_inodes > 0 && row.reserved_storage_bytes > 0)))
             fail('schema');
-        if (![0, 1].includes(row.dispatch_attempted))
+        if (![0, 1].includes(row.dispatch_attempted) || ![0, 1].includes(row.migrated))
             fail('schema');
         let witness;
         if (row.creation_witness_json !== null) {
@@ -202,6 +235,41 @@ export class IsolationLedger {
                 fail('schema');
             }
         }
+        let linuxContract;
+        let linuxIntent;
+        let linuxResources;
+        try {
+            if (row.backend_kind === 'linux-native') {
+                linuxContract = validateLinuxExecutionContract(JSON.parse(row.linux_contract_json));
+                if (!/^[a-f0-9]{64}$/u.test(row.request_digest) || row.reserved_duration_ms > linuxContract.limits.maxDurationMs
+                    || row.reserved_memory_mib < linuxContract.limits.memoryMiB + linuxContract.limits.workspaceMiB + linuxContract.keeperLimits.memoryMiB
+                    || row.reserved_workspace_inodes < linuxContract.limits.workspaceInodes)
+                    fail('schema');
+                if (linuxContract.schemaVersion !== 1) {
+                    const minimum = linuxJobResourceReservation(linuxContract);
+                    if (row.reserved_memory_mib < minimum.memoryMiB || row.reserved_workspace_inodes < minimum.workspaceInodes
+                        || row.reserved_storage_bytes < minimum.storageBytes)
+                        fail('schema');
+                }
+                if (row.linux_intent_json !== null) {
+                    linuxIntent = validateLinuxExecutionIntent(JSON.parse(row.linux_intent_json), linuxContract);
+                    this.#bindLinuxIntent(row, linuxIntent, linuxContract);
+                }
+                if (row.linux_resources_json !== null) {
+                    if (!linuxIntent || !row.dispatch_attempted)
+                        fail('schema');
+                    linuxResources = validateLinuxExecutionResources(JSON.parse(row.linux_resources_json), linuxIntent, linuxContract);
+                }
+                if (row.dispatch_attempted && !linuxIntent || row.status === 'running' && !linuxResources
+                    || ['running', 'succeeded'].includes(row.status) && linuxResources?.schemaVersion === 2 && !linuxResources.userNamespace)
+                    fail('schema');
+            }
+            else if (row.linux_contract_json !== null || row.linux_intent_json !== null || row.linux_resources_json !== null)
+                fail('schema');
+        }
+        catch {
+            fail('schema', 'invalid persisted Linux execution binding');
+        }
         let parsed;
         if (row.result_json !== null) {
             try {
@@ -216,7 +284,20 @@ export class IsolationLedger {
         }
         else if (row.status !== 'prepared' && row.status !== 'running')
             fail('schema');
-        return frozen({ ...(binding ? { artifactBinding: binding } : {}), id: row.id, grantId: row.grant_id, grantRevision: row.grant_revision, identity: jobIdentity, sessionId: row.session_id, idempotencyKey: row.idempotency_key, requestDigest: row.request_digest, containerName: row.container_name ?? '', backend: row.backend_kind, ...(row.native_resource_id ? { nativeResourceId: row.native_resource_id } : {}), ...(row.native_nonce ? { nativeNonce: row.native_nonce } : {}), deadline: row.deadline, reservedDurationMs: row.reserved_duration_ms, reservedMemoryMiB: row.reserved_memory_mib, reservedWorkspaceInodes: row.reserved_workspace_inodes, reservedStorageBytes: row.reserved_storage_bytes, dispatchAttempted: row.dispatch_attempted === 1, ...(witness ? { creationWitness: witness } : {}), status: row.status, version: row.version, createdAt: row.created_at, updatedAt: row.updated_at, ...(parsed ? { result: parsed } : {}) });
+        return frozen({ ...(linuxContract ? { linuxContract } : {}), ...(linuxIntent ? { linuxIntent } : {}), ...(linuxResources ? { linuxResources } : {}), ...(binding ? { artifactBinding: binding } : {}), id: row.id, grantId: row.grant_id, grantRevision: row.grant_revision, identity: jobIdentity, sessionId: row.session_id, idempotencyKey: row.idempotency_key, requestDigest: row.request_digest, containerName: row.container_name ?? '', backend: row.backend_kind, ...(row.native_resource_id ? { nativeResourceId: row.native_resource_id } : {}), ...(row.native_nonce ? { nativeNonce: row.native_nonce } : {}), deadline: row.deadline, reservedDurationMs: row.reserved_duration_ms, reservedMemoryMiB: row.reserved_memory_mib, reservedWorkspaceInodes: row.reserved_workspace_inodes, reservedStorageBytes: row.reserved_storage_bytes, dispatchAttempted: row.dispatch_attempted === 1, ...(witness ? { creationWitness: witness } : {}), status: row.status, version: row.version, createdAt: row.created_at, updatedAt: row.updated_at, ...(parsed ? { result: parsed } : {}) });
+    }
+    #bindLinuxIntent(row, intent, contract) {
+        if (intent.jobId !== row.id || intent.requestDigest !== row.request_digest || intent.nativeResourceId !== row.native_resource_id
+            || intent.nativeNonce !== row.native_nonce || intent.deadline !== row.deadline || row.reserved_duration_ms > contract.limits.maxDurationMs
+            || row.reserved_memory_mib < contract.limits.memoryMiB + contract.limits.workspaceMiB + contract.keeperLimits.memoryMiB
+            || row.reserved_workspace_inodes < contract.limits.workspaceInodes)
+            fail('invalid-input', 'Linux intent differs from job reservation');
+        if (contract.schemaVersion !== 1) {
+            const minimum = linuxJobResourceReservation(contract);
+            if (row.reserved_memory_mib < minimum.memoryMiB || row.reserved_workspace_inodes < minimum.workspaceInodes
+                || row.reserved_storage_bytes < minimum.storageBytes)
+                fail('invalid-input', 'Linux repository intent exceeds job reservation');
+        }
     }
     syncGrants(grants, authority) {
         if (!Array.isArray(grants))
@@ -254,7 +335,29 @@ export class IsolationLedger {
         });
     }
     prepare(input) {
-        if (!input || typeof input !== 'object' || ![6, 7, 8, 9, 10, 11, 12].includes(Object.keys(input).length) || !onlyKeys(input, ['identity', 'sessionId', 'grantId', 'idempotencyKey', 'requestDigest', 'durationMs', 'maxActiveJobs', 'authority', 'resourceReservation', 'storageBudget', 'artifactBinding', 'backend']) || !text(input.sessionId) || !text(input.grantId) || !text(input.idempotencyKey) || !text(input.requestDigest) || !safePositive(input.durationMs) || (input.maxActiveJobs !== undefined && !safePositive(input.maxActiveJobs)) || (input.backend !== undefined && input.backend !== 'docker' && input.backend !== 'macos-seatbelt') || (input.backend === 'macos-seatbelt' && input.resourceReservation !== undefined))
+        if (!input || typeof input !== 'object' || ![6, 7, 8, 9, 10, 11, 12, 13].includes(Object.keys(input).length) || !onlyKeys(input, ['identity', 'sessionId', 'grantId', 'idempotencyKey', 'requestDigest', 'durationMs', 'maxActiveJobs', 'authority', 'resourceReservation', 'storageBudget', 'artifactBinding', 'backend', 'linuxContract']) || !text(input.sessionId) || !text(input.grantId) || !text(input.idempotencyKey) || !text(input.requestDigest) || !safePositive(input.durationMs) || (input.maxActiveJobs !== undefined && !safePositive(input.maxActiveJobs)) || (input.backend !== undefined && input.backend !== 'docker' && input.backend !== 'macos-seatbelt' && input.backend !== 'linux-native') || (input.backend === 'macos-seatbelt' && input.resourceReservation !== undefined))
+            fail('invalid-input');
+        let linuxContract;
+        if (input.backend === 'linux-native') {
+            try {
+                linuxContract = validateLinuxExecutionContract(input.linuxContract);
+            }
+            catch {
+                fail('invalid-input', 'Linux contract required');
+            }
+            if (!/^[a-f0-9]{64}$/u.test(input.requestDigest) || !input.resourceReservation || !input.storageBudget
+                || input.durationMs > linuxContract.limits.maxDurationMs
+                || input.resourceReservation.memoryMiB < linuxContract.limits.memoryMiB + linuxContract.limits.workspaceMiB + linuxContract.keeperLimits.memoryMiB
+                || input.resourceReservation.workspaceInodes < linuxContract.limits.workspaceInodes)
+                fail('invalid-input', 'Linux resources must be reserved');
+            if (linuxContract.schemaVersion !== 1) {
+                const minimum = linuxJobResourceReservation(linuxContract);
+                if (input.resourceReservation.memoryMiB < minimum.memoryMiB || input.resourceReservation.workspaceInodes < minimum.workspaceInodes
+                    || input.storageBudget.reservedBytes < minimum.storageBytes)
+                    fail('invalid-input', 'Linux repository resources must be reserved');
+            }
+        }
+        else if (input.linuxContract !== undefined)
             fail('invalid-input');
         const binding = input.artifactBinding === undefined ? undefined : artifactBinding(input.artifactBinding);
         const reservation = input.resourceReservation === undefined ? undefined : input.resourceReservation;
@@ -265,66 +368,151 @@ export class IsolationLedger {
             fail('invalid-input', 'invalid storage budget');
         const who = identity(input.identity);
         const controller = this.#authority(input.authority);
+        if (input.backend === 'linux-native' && !controller)
+            fail('invalid-input', 'Linux writes require controller authority');
+        let refusal, insertAttempted = false;
+        function refuse(code, message) { refusal = new IsolationLedgerError(code, message); throw refusal; }
         return this.#transaction(() => {
             const now = this.#nowValue();
             this.#requireController(controller, now);
             const existing = this.#database.prepare('SELECT * FROM isolation_jobs WHERE principal_digest=? AND principal_record_id=? AND principal_version=? AND workspace=? AND agent_preset=? AND session_id=? AND grant_id=? AND idempotency_key=?').get(who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, input.sessionId, input.grantId, input.idempotencyKey);
             if (existing) {
                 const job = this.#decodeJob(existing);
-                if (job.requestDigest !== input.requestDigest || job.backend !== (input.backend ?? 'docker'))
+                if (job.requestDigest !== input.requestDigest || job.backend !== (input.backend ?? 'docker') || (linuxContract && linuxExecutionContractDigest(job.linuxContract) !== linuxExecutionContractDigest(linuxContract)))
                     fail('conflict', 'idempotency key has a different request or backend');
                 return { job, created: false };
             }
             const current = this.#grant(input.grantId);
             if (!current || current.revoked || current.expires_at <= now || current.principal_digest !== who.principalDigest || current.principal_record_id !== who.principalRecordId || current.principal_version !== who.principalVersion || current.workspace !== who.workspace || current.agent_preset !== who.agentPreset)
-                fail('unauthorized');
+                refuse('unauthorized');
             if (input.maxActiveJobs !== undefined) {
-                const active = this.#database.prepare("SELECT COUNT(*) AS count FROM isolation_jobs WHERE status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)").get();
-                if (!safeTime(active.count) || active.count >= input.maxActiveJobs)
+                const active = this.#database.prepare("SELECT COUNT(*) AS count FROM isolation_jobs WHERE migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0))").get();
+                if (!safeTime(active.count))
                     fail('unauthorized', 'active isolation job limit reached');
+                if (active.count >= input.maxActiveJobs)
+                    refuse('unauthorized', 'active isolation job limit reached');
             }
             const usage = this.#database.prepare('SELECT COUNT(*) AS runs, COALESCE(SUM(reserved_duration_ms), 0) AS duration FROM isolation_jobs WHERE grant_id=?').get(input.grantId);
-            if (!safeTime(usage.runs) || !safeTime(usage.duration) || usage.runs >= current.max_runs || input.durationMs > current.max_total_duration_ms || usage.duration > current.max_total_duration_ms - input.durationMs)
+            if (!safeTime(usage.runs) || !safeTime(usage.duration))
                 fail('unauthorized', 'grant budget exhausted');
+            if (usage.runs >= current.max_runs || input.durationMs > current.max_total_duration_ms || usage.duration > current.max_total_duration_ms - input.durationMs)
+                refuse('unauthorized', 'grant budget exhausted');
             if (reservation) {
-                const occupied = "status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)";
+                const occupied = "migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0))";
                 const legacy = this.#database.prepare(`SELECT COUNT(*) AS count FROM isolation_jobs WHERE (${occupied}) AND (reserved_memory_mib = 0 OR reserved_workspace_inodes = 0)`).get();
-                if (!safeTime(legacy.count) || legacy.count > 0)
+                if (!safeTime(legacy.count))
                     fail('unauthorized', 'active legacy job has no resource reservation');
+                if (legacy.count > 0)
+                    refuse('unauthorized', 'active legacy job has no resource reservation');
                 const resources = this.#database.prepare(`SELECT COALESCE(SUM(reserved_memory_mib), 0) AS memory, COALESCE(SUM(reserved_workspace_inodes), 0) AS inodes FROM isolation_jobs WHERE ${occupied}`).get();
-                if (!safeTime(resources.memory) || !safeTime(resources.inodes) || resources.memory > reservation.maxMemoryMiB - reservation.memoryMiB || resources.inodes > reservation.maxWorkspaceInodes - reservation.workspaceInodes)
+                if (!safeTime(resources.memory) || !safeTime(resources.inodes))
                     fail('unauthorized', 'isolation resource pool exhausted');
+                if (resources.memory > reservation.maxMemoryMiB - reservation.memoryMiB || resources.inodes > reservation.maxWorkspaceInodes - reservation.workspaceInodes)
+                    refuse('unauthorized', 'isolation resource pool exhausted');
             }
             if (storage) {
                 const observation = storage.observation;
                 if (!observation)
-                    fail('unauthorized', 'storage observation unavailable');
+                    refuse('unauthorized', 'storage observation unavailable');
                 if (observation.observedAt > now || now - observation.observedAt > 5_000)
-                    fail('invalid-input', 'storage observation is stale');
+                    refuse('invalid-input', 'storage observation is stale');
                 const records = this.#database.prepare('SELECT COUNT(*) AS count FROM isolation_jobs').get();
-                if (!safeTime(records.count) || records.count >= storage.maxJobRecords)
+                if (!safeTime(records.count))
                     fail('unauthorized', 'isolation job record limit reached');
-                const occupied = "status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)";
+                if (records.count >= storage.maxJobRecords)
+                    refuse('unauthorized', 'isolation job record limit reached');
+                const occupied = "migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0))";
                 const legacy = this.#database.prepare(`SELECT COUNT(*) AS count FROM isolation_jobs WHERE (${occupied}) AND reserved_storage_bytes = 0`).get();
-                if (!safeTime(legacy.count) || legacy.count > 0)
+                if (!safeTime(legacy.count))
                     fail('unauthorized', 'active legacy job has no storage reservation');
+                if (legacy.count > 0)
+                    refuse('unauthorized', 'active legacy job has no storage reservation');
                 const reservations = this.#database.prepare(`SELECT COALESCE(SUM(reserved_storage_bytes), 0) AS bytes FROM isolation_jobs WHERE ${occupied}`).get();
                 if (!safeTime(reservations.bytes))
                     fail('schema');
                 const reserved = reservations.bytes + storage.reservedBytes;
                 // SQLite reusable pages cannot cover staging growth outside the database.
                 // Keep the whole future allocation even when that double-counts reusable space.
-                if (!safeTime(reserved) || observation.bytes > storage.maxStateBytes || reserved > storage.maxStateBytes - observation.bytes)
+                if (!safeTime(reserved))
                     fail('unauthorized', 'isolation storage budget exhausted');
+                if (observation.bytes > storage.maxStateBytes || reserved > storage.maxStateBytes - observation.bytes)
+                    refuse('unauthorized', 'isolation storage budget exhausted');
             }
             const id = randomUUID();
             const deadline = Math.min(now + input.durationMs, current.expires_at);
-            const native = input.backend === 'macos-seatbelt';
-            this.#database.prepare("INSERT INTO isolation_jobs(id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,dispatch_attempted,status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0, 'prepared',1,?,?)").run(id, input.grantId, current.revision, who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, input.sessionId, input.idempotencyKey, input.requestDigest, native ? null : `dsh-isolation-${id}`, native ? 'macos-seatbelt' : 'docker', native ? `native-${id}` : null, native ? randomUUID() : null, deadline, input.durationMs, reservation?.memoryMiB ?? 0, reservation?.workspaceInodes ?? 0, storage?.reservedBytes ?? 0, now, now);
+            const native = input.backend === 'macos-seatbelt' || input.backend === 'linux-native';
+            insertAttempted = true;
+            this.#database.prepare("INSERT INTO isolation_jobs(id,grant_id,grant_revision,principal_digest,principal_record_id,principal_version,workspace,agent_preset,session_id,idempotency_key,request_digest,container_name,backend_kind,native_resource_id,native_nonce,deadline,reserved_duration_ms,reserved_memory_mib,reserved_workspace_inodes,reserved_storage_bytes,linux_contract_json,dispatch_attempted,status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0, 'prepared',1,?,?)").run(id, input.grantId, current.revision, who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, input.sessionId, input.idempotencyKey, input.requestDigest, native ? null : `dsh-isolation-${id}`, input.backend ?? 'docker', native ? `${input.backend === 'linux-native' ? 'linux' : 'native'}-${id}` : null, input.backend === 'linux-native' ? randomBytes(16).toString('hex') : native ? randomUUID() : null, deadline, input.durationMs, reservation?.memoryMiB ?? 0, reservation?.workspaceInodes ?? 0, storage?.reservedBytes ?? 0, linuxContract ? JSON.stringify(linuxContract) : null, now, now);
             if (binding)
                 this.#database.prepare('UPDATE isolation_jobs SET artifact_binding_json=? WHERE id=?').run(JSON.stringify(binding), id);
             this.#audit(now, 'job-prepared', id, input.grantId, `revision:${current.revision}${reservation ? `;reservation:memoryMiB:${reservation.memoryMiB},workspaceInodes:${reservation.workspaceInodes}` : ''}${storage ? `;storageBytes:${storage.reservedBytes}` : ''}`);
             return { job: this.#job(id), created: true };
+        }, error => {
+            if (input.backend === 'linux-native' && controller && !insertAttempted && error === refusal) {
+                markLinuxLedgerAdmissionRefusal(refusal, { ledger: this, key: input.idempotencyKey, requestDigest: input.requestDigest, authority: controller });
+            }
+        });
+    }
+    markLinuxCreateIntent(jobId, expectedVersion, intent, authority) {
+        if (!text(jobId) || !safePositive(expectedVersion))
+            fail('invalid-input');
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const now = this.#nowValue();
+            this.#requireController(controller, now);
+            const job = this.#job(jobId);
+            if (!job)
+                fail('not-found');
+            if (job.version !== expectedVersion)
+                fail('conflict');
+            if (job.backend !== 'linux-native' || job.status !== 'prepared' || job.dispatchAttempted || job.linuxIntent || !this.usable(jobId))
+                fail('invalid-state');
+            let checked;
+            try {
+                checked = validateLinuxExecutionIntent(intent, job.linuxContract);
+            }
+            catch {
+                fail('invalid-input');
+            }
+            const row = this.#database.prepare('SELECT * FROM isolation_jobs WHERE id=?').get(jobId);
+            this.#bindLinuxIntent(row, checked, job.linuxContract);
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET linux_intent_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status='prepared' AND dispatch_attempted=0 AND linux_intent_json IS NULL").run(JSON.stringify(checked), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-create-intent', jobId, job.grantId, linuxExecutionIntentDigest(checked));
+            return this.#job(jobId);
+        });
+    }
+    recordLinuxResources(jobId, expectedVersion, resources, authority) {
+        if (!text(jobId) || !safePositive(expectedVersion))
+            fail('invalid-input');
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const now = this.#nowValue();
+            this.#requireController(controller, now);
+            const job = this.#job(jobId);
+            if (!job)
+                fail('not-found');
+            if (job.version !== expectedVersion)
+                fail('conflict');
+            if (job.backend !== 'linux-native' || job.status !== 'prepared' || !job.dispatchAttempted || !job.linuxIntent || job.linuxResources)
+                fail('invalid-state');
+            let checked;
+            try {
+                checked = validateLinuxExecutionResources(resources, job.linuxIntent, job.linuxContract);
+            }
+            catch {
+                fail('invalid-input');
+            }
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET linux_resources_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status='prepared' AND dispatch_attempted=1 AND linux_resources_json IS NULL").run(JSON.stringify(checked), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-resources-created', jobId, job.grantId, linuxExecutionResourcesDigest(checked));
+            return this.#job(jobId);
         });
     }
     /** Commit the crash boundary before a supervisor can receive create authority. */
@@ -342,7 +530,7 @@ export class IsolationLedger {
                 fail('not-found');
             if (job.version !== expectedVersion)
                 fail('conflict');
-            if (job.status !== 'prepared' || job.dispatchAttempted || !this.usable(jobId))
+            if (job.status !== 'prepared' || job.dispatchAttempted || !this.usable(jobId) || job.backend === 'linux-native' && !job.linuxIntent)
                 fail('invalid-state');
             const changed = this.#database.prepare("UPDATE isolation_jobs SET dispatch_attempted=1, version=version+1, updated_at=? WHERE id=? AND version=? AND status='prepared' AND dispatch_attempted=0").run(now, jobId, expectedVersion);
             if (changed.changes !== 1)
@@ -363,8 +551,10 @@ export class IsolationLedger {
                 fail('not-found');
             if (job.version !== expectedVersion)
                 fail('conflict', 'job version differs');
-            if (job.status !== 'prepared')
+            if (job.status !== 'prepared' || job.backend === 'linux-native' && (!controller || !job.dispatchAttempted || !job.linuxIntent || !job.linuxResources))
                 fail('invalid-state');
+            if (job.linuxResources?.schemaVersion === 2 && !job.linuxResources.userNamespace)
+                fail('invalid-state', 'Linux namespace admission is missing');
             const current = this.#grant(job.grantId);
             if (!current || current.revoked || current.revision !== job.grantRevision || current.expires_at <= now || job.deadline <= now || current.principal_digest !== job.identity.principalDigest || current.principal_record_id !== job.identity.principalRecordId || current.principal_version !== job.identity.principalVersion || current.workspace !== job.identity.workspace || current.agent_preset !== job.identity.agentPreset)
                 fail('unauthorized');
@@ -403,9 +593,11 @@ export class IsolationLedger {
                 fail('not-found');
             if (job.version !== expectedVersion)
                 fail('conflict', 'job version differs');
+            if (job.backend === 'linux-native' && !controller)
+                fail('invalid-input', 'Linux writes require controller authority');
             if (witness && !job.dispatchAttempted)
                 fail('invalid-state');
-            if (job.backend === 'macos-seatbelt' && job.dispatchAttempted && value.status !== 'unknown')
+            if (job.backend !== 'docker' && job.dispatchAttempted && value.status !== 'unknown')
                 fail('invalid-state', 'native dispatch requires a durable receipt');
             if (job.dispatchAttempted && value.status === 'unknown' && value.quiescent)
                 fail('invalid-state', 'dispatch requires independent quiescence evidence');
@@ -460,6 +652,141 @@ export class IsolationLedger {
             return this.#job(jobId);
         });
     }
+    #linuxReceiptJob(jobId, expectedVersion, input, controller) {
+        const now = this.#nowValue();
+        this.#requireController(controller, now);
+        let binding;
+        try {
+            binding = validateLinuxReceiptBinding(input);
+        }
+        catch {
+            fail('invalid-input');
+        }
+        const job = this.#job(jobId);
+        if (!job)
+            fail('not-found');
+        if (job.version !== expectedVersion)
+            fail('conflict');
+        if (job.backend !== 'linux-native' || !job.dispatchAttempted || !job.linuxIntent || !job.linuxResources
+            || job.requestDigest !== binding.requestDigest || job.nativeNonce !== binding.nativeNonce || job.nativeResourceId !== binding.nativeResourceId
+            || linuxExecutionIntentDigest(job.linuxIntent) !== binding.intentDigest || linuxExecutionResourcesDigest(job.linuxResources) !== binding.resourcesDigest)
+            fail('invalid-state', 'Linux receipt binding differs');
+        return { job, binding, now };
+    }
+    /** Only the Host can attest receipt integrity and exact kernel quiescence. */
+    settleLinuxReceipt(jobId, expectedVersion, binding, input, authority) {
+        const value = result(input);
+        if (!text(jobId) || !safePositive(expectedVersion) || value.jobId !== jobId || !value.quiescent)
+            fail('invalid-input');
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const { job, binding: checked, now } = this.#linuxReceiptJob(jobId, expectedVersion, binding, controller);
+            if (!['prepared', 'running'].includes(job.status))
+                fail('invalid-state', 'existing unknown requires reconciliation');
+            if (value.status === 'succeeded' && job.linuxResources?.schemaVersion === 2 && !job.linuxResources.userNamespace)
+                fail('invalid-state', 'Linux namespace admission is missing');
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET status=?, result_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status IN ('prepared','running')").run(value.status, JSON.stringify(value), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-receipt-settled', jobId, job.grantId, JSON.stringify(checked));
+            return this.#job(jobId);
+        });
+    }
+    settleLinuxReconciledUnknown(jobId, expectedVersion, binding, authority) {
+        if (!text(jobId) || !safePositive(expectedVersion))
+            fail('invalid-input');
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const { job, binding: checked, now } = this.#linuxReceiptJob(jobId, expectedVersion, binding, controller);
+            if (job.status !== 'unknown' || !job.result || job.result.quiescent)
+                fail('invalid-state');
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET result_json=?, version=version+1, updated_at=? WHERE id=? AND version=? AND status='unknown'").run(JSON.stringify({ ...job.result, quiescent: true }), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-unknown-quiesced', jobId, job.grantId, JSON.stringify(checked));
+            return this.#job(jobId);
+        });
+    }
+    /** Recover a lost resources acknowledgement; never reopens start admission. */
+    recordLinuxRecoveredResources(jobId, expectedVersion, resources, authority) {
+        if (!text(jobId) || !safePositive(expectedVersion))
+            fail('invalid-input');
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const now = this.#nowValue();
+            this.#requireController(controller, now);
+            const job = this.#job(jobId);
+            if (!job)
+                fail('not-found');
+            if (job.version !== expectedVersion)
+                fail('conflict');
+            if (job.backend !== 'linux-native' || !job.dispatchAttempted || job.status !== 'unknown' || job.result?.quiescent !== false
+                || !job.linuxIntent || !job.linuxContract || job.linuxResources)
+                fail('invalid-state');
+            let checked;
+            try {
+                checked = validateLinuxExecutionResources(resources, job.linuxIntent, job.linuxContract);
+            }
+            catch {
+                fail('invalid-input');
+            }
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET linux_resources_json=?,version=version+1,updated_at=? WHERE id=? AND version=? AND status='unknown' AND linux_resources_json IS NULL").run(JSON.stringify(checked), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-resources-recovered', jobId, job.grantId, linuxExecutionResourcesDigest(checked));
+            return this.#job(jobId);
+        });
+    }
+    /** Exact pre-start absence proof releases capacity, never the original outcome or budget. */
+    settleLinuxPrestartCleanup(jobId, expectedVersion, proof, authority) {
+        if (!text(jobId) || !safePositive(expectedVersion))
+            fail('invalid-input');
+        let checked;
+        try {
+            checked = validateLinuxExecutionPartialCleanupProof(proof);
+        }
+        catch {
+            fail('invalid-input');
+        }
+        const controller = this.#authority(authority);
+        if (!controller)
+            fail('invalid-input');
+        return this.#transaction(() => {
+            const now = this.#nowValue();
+            this.#requireController(controller, now);
+            const job = this.#job(jobId);
+            if (!job)
+                fail('not-found');
+            if (job.version !== expectedVersion)
+                fail('conflict');
+            if (job.backend !== 'linux-native' || !job.dispatchAttempted || !job.linuxIntent || job.linuxResources
+                || !['prepared', 'unknown'].includes(job.status) || job.result?.quiescent === true
+                || checked.jobId !== job.id || checked.requestDigest !== job.requestDigest || checked.nativeNonce !== job.nativeNonce
+                || checked.nativeResourceId !== job.nativeResourceId || checked.intentDigest !== linuxExecutionIntentDigest(job.linuxIntent)
+                || checked.observedAt < job.createdAt || checked.observedAt > now)
+                fail('invalid-state');
+            const value = job.result ? { ...job.result, quiescent: true }
+                : { jobId, status: 'unknown', quiescent: true, stdout: '', stderr: '', artifacts: [], reason: 'linux-prestart-cleanup-confirmed' };
+            const changed = this.#database.prepare("UPDATE isolation_jobs SET status='unknown',result_json=?,version=version+1,updated_at=? WHERE id=? AND version=? AND status IN ('prepared','unknown')").run(JSON.stringify(value), now, jobId, expectedVersion);
+            if (changed.changes !== 1)
+                fail('conflict');
+            this.#audit(now, 'linux-prestart-quiesced', jobId, job.grantId, JSON.stringify(checked));
+            return this.#job(jobId);
+        });
+    }
+    findJobByKey(value, sessionId, grantId, key) {
+        const who = identity(value);
+        if (!text(sessionId) || !text(grantId) || !text(key))
+            fail('invalid-input');
+        const row = this.#database.prepare('SELECT * FROM isolation_jobs WHERE principal_digest=? AND principal_record_id=? AND principal_version=? AND workspace=? AND agent_preset=? AND session_id=? AND grant_id=? AND idempotency_key=?').get(who.principalDigest, who.principalRecordId, who.principalVersion, who.workspace, who.agentPreset, sessionId, grantId, key);
+        return row ? this.#decodeJob(row) : undefined;
+    }
     findNativeVerifierJob(principalDigest, stateRoot, key) {
         if (!text(principalDigest) || !text(stateRoot) || !text(key))
             fail('invalid-input');
@@ -575,11 +902,11 @@ export class IsolationLedger {
         return false; const row = this.#database.prepare('SELECT owner_id, fence, expires_at FROM isolation_controller WHERE singleton=1').get(); return !!row && row.owner_id === controller.ownerId && row.fence === controller.fence && safeTime(row.expires_at) && row.expires_at > this.#nowValue(); }
     get(jobId) { if (!text(jobId))
         fail('invalid-input'); return this.#job(jobId); }
-    recoverable(afterId = '') { return this.#database.prepare("SELECT * FROM isolation_jobs WHERE id > ? AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)) ORDER BY id ASC LIMIT 1000").all(afterId).map(row => this.#decodeJob(row)).filter(job => job.status === 'prepared' || job.status === 'running' || job.result?.quiescent === false); }
-    retentionCandidates(cutoff, afterId = '', limit = 16) {
-        if (!safeTime(cutoff) || typeof afterId !== 'string' || afterId.length > textMaximum || !safePositive(limit) || limit > 1_000)
+    recoverable(afterId = '') { return this.#database.prepare("SELECT * FROM isolation_jobs WHERE id > ? AND migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)) ORDER BY id ASC LIMIT 1000").all(afterId).map(row => this.#decodeJob(row)).filter(job => job.status === 'prepared' || job.status === 'running' || job.result?.quiescent === false); }
+    retentionCandidates(cutoff, afterId = '', limit = 16, includeCompactedNative = false) {
+        if (typeof includeCompactedNative !== 'boolean' || !safeTime(cutoff) || typeof afterId !== 'string' || afterId.length > textMaximum || !safePositive(limit) || limit > 1_000)
             fail('invalid-input');
-        const rows = this.#database.prepare("SELECT id, version FROM isolation_jobs WHERE id > ? AND updated_at <= ? AND status IN ('succeeded','failed','cancelled','timed-out') AND result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 1 AND json_extract(result_json, '$.retention') IS NULL ORDER BY id ASC LIMIT ?").all(afterId, cutoff, limit);
+        const rows = this.#database.prepare("SELECT id, version FROM isolation_jobs WHERE id > ? AND status IN ('succeeded','failed','cancelled','timed-out') AND result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 1 AND ((updated_at <= ? AND json_extract(result_json, '$.retention') IS NULL) OR (? = 1 AND backend_kind = 'linux-native' AND json_extract(result_json, '$.retention.kind') = 'pruned')) ORDER BY id ASC LIMIT ?").all(afterId, cutoff, includeCompactedNative ? 1 : 0, limit);
         if (!rows.every(row => text(row.id) && safePositive(row.version)))
             fail('schema');
         return rows.map(row => frozen({ id: row.id, version: row.version }));
@@ -615,7 +942,7 @@ export class IsolationLedger {
         });
     }
     storageStats() {
-        const counts = this.#database.prepare("SELECT COUNT(*) AS jobRecords, COALESCE(SUM(CASE WHEN status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0) THEN reserved_storage_bytes ELSE 0 END), 0) AS activeReservedBytes, COUNT(CASE WHEN (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)) AND reserved_storage_bytes = 0 THEN 1 END) AS legacyActiveJobs FROM isolation_jobs").get();
+        const counts = this.#database.prepare("SELECT COUNT(*) AS jobRecords, COALESCE(SUM(CASE WHEN migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)) THEN reserved_storage_bytes ELSE 0 END), 0) AS activeReservedBytes, COUNT(CASE WHEN migrated=0 AND (status IN ('prepared','running') OR (result_json IS NOT NULL AND json_extract(result_json, '$.quiescent') = 0)) AND reserved_storage_bytes = 0 THEN 1 END) AS legacyActiveJobs FROM isolation_jobs").get();
         const pages = this.#database.prepare('PRAGMA page_size').get();
         const free = this.#database.prepare('PRAGMA freelist_count').get();
         if (!safeTime(counts.jobRecords) || !safeTime(counts.activeReservedBytes) || !safeTime(counts.legacyActiveJobs) || !safePositive(pages.page_size) || !safeTime(free.freelist_count) || free.freelist_count > Math.floor(Number.MAX_SAFE_INTEGER / pages.page_size))