@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/sqlite.js

@@ -2,7 +2,41 @@ import { createHash } from 'node:crypto';
 import { closeSync, constants, existsSync, lstatSync, mkdirSync, openSync } from 'node:fs';
 import { dirname, isAbsolute } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-export const controlPlaneSchemaVersion = 11;
+export const controlPlaneSchemaVersion = 23;
+const adoptionHandoffsSchema = `CREATE TABLE IF NOT EXISTS adoption_handoffs (
+ plan_id TEXT PRIMARY KEY REFERENCES activation_plans(id) ON DELETE RESTRICT, plan_digest TEXT NOT NULL CHECK(length(plan_digest)=64), coordinator_id TEXT NOT NULL,
+ created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER, CHECK(expires_at > created_at)
+) STRICT, WITHOUT ROWID;`;
+const hostAttestationDispatchesSchema = `CREATE TABLE IF NOT EXISTS host_attestation_dispatches (
+  operation_id TEXT PRIMARY KEY REFERENCES host_attestation_operations(operation_id) ON DELETE RESTRICT,
+  status TEXT NOT NULL CHECK(status IN ('claimed','completed')),
+  claimed_at INTEGER NOT NULL, completed_at INTEGER,
+  CHECK((status = 'claimed' AND completed_at IS NULL) OR (status = 'completed' AND completed_at IS NOT NULL AND completed_at >= claimed_at))
+) STRICT, WITHOUT ROWID;`;
+const taskObservationsSchema = `CREATE TABLE IF NOT EXISTS task_observation_batches (
+  id TEXT PRIMARY KEY, lane TEXT NOT NULL, plan_id TEXT NOT NULL REFERENCES activation_plans(id) ON DELETE RESTRICT,
+  batch_json TEXT NOT NULL CHECK(json_valid(batch_json) AND json_type(batch_json) = 'object'),
+  batch_digest TEXT NOT NULL CHECK(length(batch_digest) = 64),
+  state TEXT NOT NULL CHECK(state IN ('pending','signed','applied','stale')),
+  receipt_json TEXT CHECK(receipt_json IS NULL OR (json_valid(receipt_json) AND json_type(receipt_json) = 'object')),
+  receipt_digest TEXT CHECK(receipt_digest IS NULL OR length(receipt_digest) = 64),
+  created_at INTEGER NOT NULL
+) STRICT, WITHOUT ROWID;
+CREATE INDEX IF NOT EXISTS task_observation_batches_lane ON task_observation_batches(lane, created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS task_observation_batches_open_lane ON task_observation_batches(lane) WHERE state IN ('pending','signed');`;
+const foregroundDeploymentsSchema = `CREATE TABLE IF NOT EXISTS foreground_deployments (
+  inbox_id TEXT PRIMARY KEY,
+  plan_id TEXT NOT NULL REFERENCES activation_plans(id) ON DELETE RESTRICT,
+  record_json TEXT NOT NULL CHECK(json_valid(record_json) AND json_type(record_json) = 'object'),
+  record_digest TEXT NOT NULL CHECK(length(record_digest) = 64)
+) STRICT, WITHOUT ROWID;`;
+const sourceAdoptionsSchema = `CREATE TABLE IF NOT EXISTS source_adoptions (
+  source_plan_id TEXT PRIMARY KEY REFERENCES source_plans(id) ON DELETE RESTRICT,
+  activation_plan_id TEXT NOT NULL UNIQUE REFERENCES activation_plans(id) ON DELETE RESTRICT,
+  binding_json TEXT NOT NULL CHECK(json_valid(binding_json) AND json_type(binding_json) = 'object'),
+  binding_digest TEXT NOT NULL CHECK(length(binding_digest) = 64),
+  created_at INTEGER NOT NULL
+) STRICT, WITHOUT ROWID;`;
 export function controlPlaneOperationReceiptDigest(idempotencyKey, operation, inputDigest, resultJson, createdAt) {
     return createHash('sha256').update(JSON.stringify([idempotencyKey, operation, inputDigest, resultJson, createdAt])).digest('hex');
 }
@@ -64,6 +98,13 @@ function createCurrent(database) {
       updated_at INTEGER NOT NULL
     ) STRICT;
 
+    CREATE TABLE owner_task_failure_gaps (
+      gap_id TEXT PRIMARY KEY REFERENCES capability_gaps(id) ON DELETE RESTRICT,
+      reference_json TEXT NOT NULL CHECK(json_valid(reference_json) AND json_type(reference_json) = 'object'),
+      reference_digest TEXT NOT NULL CHECK(length(reference_digest) = 64)
+    ) STRICT, WITHOUT ROWID;
+
+
     CREATE TABLE activation_plans (
       id TEXT PRIMARY KEY,
       plan_digest TEXT NOT NULL UNIQUE CHECK(length(plan_digest) = 64),
@@ -96,6 +137,9 @@ function createCurrent(database) {
       activation_fence INTEGER NOT NULL DEFAULT 0 CHECK(activation_fence >= 0),
       activation_lease_until INTEGER,
       activation_target_existed INTEGER CHECK(activation_target_existed IN (0, 1)),
+      activation_target_baseline_json TEXT CHECK(activation_target_baseline_json IS NULL OR (json_valid(activation_target_baseline_json) AND json_type(activation_target_baseline_json) = 'array')),
+      host_recovery_required INTEGER NOT NULL DEFAULT 0 CHECK(host_recovery_required IN (0, 1)),
+      rollback_profile_restored INTEGER NOT NULL DEFAULT 0 CHECK(rollback_profile_restored IN (0, 1)),
       failure_code TEXT,
       updated_at INTEGER NOT NULL,
       FOREIGN KEY(gap_id) REFERENCES capability_gaps(id) ON DELETE RESTRICT
@@ -119,8 +163,9 @@ function createCurrent(database) {
       plugin_name TEXT NOT NULL,
       generator_digest TEXT NOT NULL CHECK(length(generator_digest) = 64),
       scope_json TEXT NOT NULL CHECK(json_valid(scope_json) AND json_type(scope_json) = 'array'),
+      mode TEXT NOT NULL DEFAULT 'create' CHECK(mode IN ('create', 'modify')),
       status TEXT NOT NULL CHECK(status IN (
-        'pending-approval', 'approved', 'running-local-checks', 'ready-for-human-review', 'local-checks-failed',
+        'expired', 'pending-approval', 'approved', 'running-local-checks', 'ready-for-human-review', 'local-checks-failed',
         'awaiting-pr', 'awaiting-review', 'awaiting-merge', 'awaiting-build', 'awaiting-sign', 'awaiting-publish',
         'awaiting-registry-verify', 'awaiting-catalog-admission', 'release-complete', 'release-failed', 'publish-ambiguous'
       )),
@@ -131,6 +176,8 @@ function createCurrent(database) {
       checked_tree_digest TEXT CHECK(checked_tree_digest IS NULL OR (length(checked_tree_digest) = 64 AND checked_tree_digest NOT GLOB '*[^a-f0-9]*')),
       checked_patch_digest TEXT CHECK(checked_patch_digest IS NULL OR (length(checked_patch_digest) = 64 AND checked_patch_digest NOT GLOB '*[^a-f0-9]*')),
       checked_at INTEGER,
+      prepared_evidence_json TEXT CHECK(prepared_evidence_json IS NULL OR
+        (json_valid(prepared_evidence_json) AND json_type(prepared_evidence_json) = 'object')),
       release_authorization_json TEXT CHECK(release_authorization_json IS NULL OR (json_valid(release_authorization_json) AND json_type(release_authorization_json) = 'object')),
       release_authorization_digest TEXT CHECK(release_authorization_digest IS NULL OR length(release_authorization_digest) = 64),
       release_id TEXT,
@@ -142,11 +189,51 @@ function createCurrent(database) {
       updated_at INTEGER NOT NULL,
       CHECK((checked_tree_digest IS NULL AND checked_patch_digest IS NULL AND checked_at IS NULL) OR
         (checked_tree_digest IS NOT NULL AND checked_patch_digest IS NOT NULL AND checked_at IS NOT NULL)),
+      CHECK(mode = 'create' OR
+        (checked_tree_digest IS NOT NULL AND checked_patch_digest IS NOT NULL AND checked_at IS NOT NULL)),
+      CHECK((mode = 'create' AND prepared_evidence_json IS NULL) OR
+        (mode = 'modify' AND prepared_evidence_json IS NOT NULL)),
       CHECK((release_authorization_json IS NULL AND release_authorization_digest IS NULL) OR
         (release_authorization_json IS NOT NULL AND release_authorization_digest IS NOT NULL)),
       FOREIGN KEY(gap_id) REFERENCES capability_gaps(id) ON DELETE RESTRICT
     ) STRICT;
 
+    CREATE TABLE IF NOT EXISTS source_job_authorities (
+      authority_id TEXT PRIMARY KEY,
+      authority_digest TEXT NOT NULL CHECK(length(authority_digest) = 64),
+      expires_at INTEGER NOT NULL,
+      max_submissions INTEGER NOT NULL CHECK(max_submissions >= 1),
+      submissions INTEGER NOT NULL CHECK(submissions >= 0 AND submissions <= max_submissions)
+    ) STRICT, WITHOUT ROWID;
+
+    CREATE TABLE IF NOT EXISTS source_jobs (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL UNIQUE,
+      authority_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      intent_json TEXT NOT NULL CHECK(json_valid(intent_json) AND json_type(intent_json) = 'object'),
+      intent_digest TEXT NOT NULL CHECK(length(intent_digest) = 64),
+      status TEXT NOT NULL CHECK(status IN ('queued', 'running', 'prepared', 'failed', 'unknown')),
+      revision INTEGER NOT NULL CHECK(revision >= 1),
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      definition_hash TEXT,
+      occurrence_id TEXT,
+      plan_id TEXT UNIQUE,
+      failure_code TEXT,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(authority_id, idempotency_key),
+      FOREIGN KEY(authority_id) REFERENCES source_job_authorities(authority_id) ON DELETE RESTRICT,
+      FOREIGN KEY(plan_id) REFERENCES source_plans(id) ON DELETE RESTRICT,
+      CHECK((status = 'queued' AND occurrence_id IS NULL AND plan_id IS NULL AND failure_code IS NULL)
+        OR (status = 'running' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NULL AND failure_code IS NULL)
+        OR (status = 'prepared' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NOT NULL AND failure_code IS NULL)
+        OR (status = 'failed' AND plan_id IS NULL AND failure_code IS NOT NULL)
+        OR (status = 'unknown' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NULL AND failure_code IS NOT NULL))
+    ) STRICT;
+    CREATE UNIQUE INDEX IF NOT EXISTS source_jobs_single_active ON source_jobs((1)) WHERE status IN ('queued', 'running', 'unknown');
+    CREATE INDEX IF NOT EXISTS source_jobs_created ON source_jobs(created_at, id);
+
     CREATE TABLE gap_plan_claims (
       gap_id TEXT PRIMARY KEY,
       plan_id TEXT NOT NULL UNIQUE,
@@ -155,9 +242,9 @@ function createCurrent(database) {
       FOREIGN KEY(gap_id) REFERENCES capability_gaps(id) ON DELETE RESTRICT
     ) STRICT, WITHOUT ROWID;
 
-    CREATE TABLE host_attestations (
+    CREATE TABLE IF NOT EXISTS host_attestations (
       plan_id TEXT NOT NULL,
-      phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health')),
+      phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health', 'rollback')),
       receipt_id TEXT NOT NULL UNIQUE,
       receipt_digest TEXT NOT NULL CHECK(length(receipt_digest) = 64),
       receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json) AND json_type(receipt_json) = 'object'),
@@ -167,9 +254,9 @@ function createCurrent(database) {
       FOREIGN KEY(plan_id) REFERENCES activation_plans(id) ON DELETE RESTRICT
     ) STRICT, WITHOUT ROWID;
 
-    CREATE TABLE host_attestation_operations (
+    CREATE TABLE IF NOT EXISTS host_attestation_operations (
       plan_id TEXT NOT NULL,
-      phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health')),
+      phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health', 'rollback')),
       operation_id TEXT NOT NULL UNIQUE,
       binding_digest TEXT NOT NULL CHECK(length(binding_digest) = 64),
       request_digest TEXT NOT NULL CHECK(length(request_digest) = 64),
@@ -210,6 +297,26 @@ function createCurrent(database) {
       FOREIGN KEY(plan_id) REFERENCES source_plans(id) ON DELETE RESTRICT
     ) STRICT, WITHOUT ROWID;
 
+    -- A release adapter can mutate an external registry.  Its durable dispatch
+    -- claim is deliberately separate from the signed receipt: after a crash
+    -- between dispatch and receipt persistence, the outcome is unknown and
+    -- must be reconciled rather than executed again.
+    CREATE TABLE source_release_dispatches (
+      operation_id TEXT PRIMARY KEY REFERENCES source_release_operations(operation_id) ON DELETE RESTRICT,
+      status TEXT NOT NULL CHECK(status IN ('claimed', 'completed')),
+      claimed_at INTEGER NOT NULL,
+      completed_at INTEGER,
+      CHECK((status = 'claimed' AND completed_at IS NULL) OR
+        (status = 'completed' AND completed_at IS NOT NULL AND completed_at >= claimed_at))
+    ) STRICT, WITHOUT ROWID;
+
+    CREATE TABLE host_attestation_dispatches (
+      operation_id TEXT PRIMARY KEY REFERENCES host_attestation_operations(operation_id) ON DELETE RESTRICT,
+      status TEXT NOT NULL CHECK(status IN ('claimed', 'completed')),
+      claimed_at INTEGER NOT NULL, completed_at INTEGER,
+      CHECK((status = 'claimed' AND completed_at IS NULL) OR (status = 'completed' AND completed_at IS NOT NULL AND completed_at >= claimed_at))
+    ) STRICT, WITHOUT ROWID;
+
     CREATE TABLE operation_receipts (
       idempotency_key TEXT PRIMARY KEY,
       operation TEXT NOT NULL,
@@ -252,7 +359,75 @@ function createCurrent(database) {
     ) STRICT, WITHOUT ROWID;
     CREATE INDEX source_publish_reconciliations_release ON source_publish_reconciliations(plan_id, release_fence, created_at);
 
-    PRAGMA user_version = 11;
+    -- Post-activation quality watch for a promoted plugin cohort. A watch is an
+    -- independent lifecycle from the activation state machine: the activated
+    -- state has no exit and its backup/stage are physically removed, so
+    -- post-promotion quality is tracked here against the exact immutable
+    -- package@version+integrity rather than by trying to re-open an activation.
+    CREATE TABLE activation_watch (
+      plan_id TEXT PRIMARY KEY,
+      package_name TEXT NOT NULL,
+      package_version TEXT NOT NULL,
+      package_integrity TEXT NOT NULL,
+      activation_id TEXT NOT NULL,
+      fence INTEGER NOT NULL CHECK(fence >= 1),
+      state TEXT NOT NULL CHECK(state IN ('watching', 'closed-regressed', 'closed-retracted')),
+      revision INTEGER NOT NULL CHECK(revision >= 1),
+      last_host_generation INTEGER NOT NULL DEFAULT 0 CHECK(last_host_generation >= 0),
+      healthy_observations INTEGER NOT NULL DEFAULT 0 CHECK(healthy_observations >= 0),
+      close_disposition TEXT CHECK(close_disposition IS NULL OR close_disposition IN ('regressed', 'retracted')),
+      close_at INTEGER,
+      close_evidence_id TEXT,
+      close_signature_digest TEXT CHECK(close_signature_digest IS NULL OR length(close_signature_digest) = 64),
+      started_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      CHECK(
+        (state = 'watching' AND close_disposition IS NULL AND close_at IS NULL AND close_evidence_id IS NULL AND close_signature_digest IS NULL) OR
+        (state IN ('closed-regressed', 'closed-retracted') AND close_disposition IS NOT NULL AND close_at IS NOT NULL
+          AND close_evidence_id IS NOT NULL AND close_signature_digest IS NOT NULL)
+      ),
+      FOREIGN KEY(plan_id) REFERENCES activation_plans(id) ON DELETE RESTRICT
+    ) STRICT, WITHOUT ROWID;
+
+    -- Append-only signed observations. Positive healthy rows are kept as
+    -- evidence but never close a watch; only a regressed Host observation or an
+    -- owner retraction transitions the watch to a terminal state.
+    CREATE TABLE activation_watch_evidence (
+      observation_id TEXT PRIMARY KEY,
+      plan_id TEXT NOT NULL,
+      disposition TEXT NOT NULL CHECK(disposition IN ('regressed', 'healthy', 'retracted')),
+      receipt_digest TEXT NOT NULL CHECK(length(receipt_digest) = 64),
+      signature_digest TEXT NOT NULL CHECK(length(signature_digest) = 64),
+      receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json) AND json_type(receipt_json) = 'object'),
+      host_generation INTEGER NOT NULL DEFAULT 0 CHECK(host_generation >= 0),
+      failures INTEGER NOT NULL DEFAULT 0 CHECK(failures >= 0),
+      checks INTEGER NOT NULL DEFAULT 0 CHECK(checks >= 0),
+      created_at INTEGER NOT NULL,
+      FOREIGN KEY(plan_id) REFERENCES activation_watch(plan_id) ON DELETE RESTRICT
+    ) STRICT, WITHOUT ROWID;
+    CREATE INDEX activation_watch_evidence_plan ON activation_watch_evidence(plan_id, created_at);
+
+    -- Core-file pins captured immediately before terminal promotion.  They are
+    -- deliberately outside the immutable activation dossier: they describe the
+    -- Host-visible deployment and give a post-promotion rollback an ABA-safe
+    -- ordering without rewriting the approved plan.
+    CREATE TABLE activation_deployment_checkpoints (
+      plan_id TEXT PRIMARY KEY REFERENCES activation_plans(id) ON DELETE RESTRICT,
+      baseline_json TEXT NOT NULL CHECK(json_valid(baseline_json) AND json_type(baseline_json) = 'array'),
+      exposure_order INTEGER NOT NULL UNIQUE CHECK(exposure_order >= 1),
+      successful_order INTEGER UNIQUE CHECK(successful_order IS NULL OR successful_order = exposure_order),
+      recorded_at INTEGER NOT NULL,
+      succeeded_at INTEGER
+    ) STRICT, WITHOUT ROWID;
+    CREATE INDEX activation_deployment_checkpoints_success ON activation_deployment_checkpoints(successful_order)
+      WHERE successful_order IS NOT NULL;
+    CREATE TABLE activation_deployment_sequence (
+      singleton INTEGER PRIMARY KEY CHECK(singleton = 1),
+      next_exposure_order INTEGER NOT NULL CHECK(next_exposure_order >= 1)
+    ) STRICT, WITHOUT ROWID;
+    INSERT INTO activation_deployment_sequence (singleton, next_exposure_order) VALUES (1, 1);
+
+    PRAGMA user_version = 18;
   `);
 }
 function migrateV1(database) {
@@ -666,6 +841,290 @@ function migrateV10ToV11(database) {
         throw error;
     }
 }
+function migrateV11ToV12(database) {
+    // IF NOT EXISTS makes the migration idempotent when a database was created with
+    // the current schema and its user_version was rolled back to exercise the full
+    // migration chain (the v6/v8 fixtures do this). A real v11 database can never
+    // contain these table names, so the guard cannot mask a structurally different
+    // legacy table in production.
+    database.exec('BEGIN IMMEDIATE');
+    try {
+        database.exec(`
+      CREATE TABLE IF NOT EXISTS activation_watch (
+        plan_id TEXT PRIMARY KEY,
+        package_name TEXT NOT NULL,
+        package_version TEXT NOT NULL,
+        package_integrity TEXT NOT NULL,
+        activation_id TEXT NOT NULL,
+        fence INTEGER NOT NULL CHECK(fence >= 1),
+        state TEXT NOT NULL CHECK(state IN ('watching', 'closed-regressed', 'closed-retracted')),
+        revision INTEGER NOT NULL CHECK(revision >= 1),
+        last_host_generation INTEGER NOT NULL DEFAULT 0 CHECK(last_host_generation >= 0),
+        healthy_observations INTEGER NOT NULL DEFAULT 0 CHECK(healthy_observations >= 0),
+        close_disposition TEXT CHECK(close_disposition IS NULL OR close_disposition IN ('regressed', 'retracted')),
+        close_at INTEGER,
+        close_evidence_id TEXT,
+        close_signature_digest TEXT CHECK(close_signature_digest IS NULL OR length(close_signature_digest) = 64),
+        started_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        CHECK(
+          (state = 'watching' AND close_disposition IS NULL AND close_at IS NULL AND close_evidence_id IS NULL AND close_signature_digest IS NULL) OR
+          (state IN ('closed-regressed', 'closed-retracted') AND close_disposition IS NOT NULL AND close_at IS NOT NULL
+            AND close_evidence_id IS NOT NULL AND close_signature_digest IS NOT NULL)
+        ),
+        FOREIGN KEY(plan_id) REFERENCES activation_plans(id) ON DELETE RESTRICT
+      ) STRICT, WITHOUT ROWID;
+
+      CREATE TABLE IF NOT EXISTS activation_watch_evidence (
+        observation_id TEXT PRIMARY KEY,
+        plan_id TEXT NOT NULL,
+        disposition TEXT NOT NULL CHECK(disposition IN ('regressed', 'healthy', 'retracted')),
+        receipt_digest TEXT NOT NULL CHECK(length(receipt_digest) = 64),
+        signature_digest TEXT NOT NULL CHECK(length(signature_digest) = 64),
+        receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json) AND json_type(receipt_json) = 'object'),
+        host_generation INTEGER NOT NULL DEFAULT 0 CHECK(host_generation >= 0),
+        failures INTEGER NOT NULL DEFAULT 0 CHECK(failures >= 0),
+        checks INTEGER NOT NULL DEFAULT 0 CHECK(checks >= 0),
+        created_at INTEGER NOT NULL,
+        FOREIGN KEY(plan_id) REFERENCES activation_watch(plan_id) ON DELETE RESTRICT
+      ) STRICT, WITHOUT ROWID;
+      CREATE INDEX IF NOT EXISTS activation_watch_evidence_plan ON activation_watch_evidence(plan_id, created_at);
+    `);
+        // Backfill watches for plans already promoted before the watch lifecycle existed.
+        // The exact target is reconstructed from the immutable candidate snapshot pinned
+        // in the plan row (candidate_json), never from a mutable current catalog.
+        const activated = database.prepare(`SELECT id, candidate_json, activation_id, activation_fence, updated_at
+      FROM activation_plans WHERE status = 'activated'`).all();
+        const insert = database.prepare(`INSERT INTO activation_watch (plan_id, package_name, package_version, package_integrity,
+      activation_id, fence, state, revision, last_host_generation, healthy_observations, started_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, 'watching', 1, 0, 0, ?, ?)`);
+        for (const row of activated) {
+            const candidate = JSON.parse(row.candidate_json);
+            if (typeof candidate.package !== 'string' || typeof candidate.version !== 'string' || typeof candidate.integrity !== 'string'
+                || typeof row.activation_id !== 'string' || row.activation_fence < 1) {
+                throw new ControlPlaneDatabaseError('unsafe-file', 'legacy activated plan has an invalid immutable candidate binding');
+            }
+            insert.run(row.id, candidate.package, candidate.version, candidate.integrity, row.activation_id, row.activation_fence, row.updated_at, row.updated_at);
+        }
+        database.exec('PRAGMA user_version = 12; COMMIT');
+    }
+    catch (error) {
+        database.exec('ROLLBACK');
+        throw error;
+    }
+}
+function migrateV12ToV13(database) {
+    // Add the 'modify' source-plan mode: a growth executor may prepare a patch for
+    // an *existing* plugin in an isolated worktree and attach its frozen-build
+    // evidence while the plan is still pending owner approval. SQLite cannot widen
+    // a CHECK in place, so rebuild source_plans and copy every column verbatim;
+    // every pre-existing row is backfilled to mode='create' with no prepared
+    // evidence. Existing rows are all create-mode and retain their immutable
+    // digest. Build the replacement under a temporary name before dropping the
+    // parent, then rename it into place: renaming the old parent would rewrite
+    // dependent foreign-key declarations to the temporary name.
+    database.exec(`
+    PRAGMA foreign_keys = OFF;
+    BEGIN IMMEDIATE;
+    CREATE TABLE source_plans_v13 (
+      id TEXT PRIMARY KEY,
+      plan_digest TEXT NOT NULL UNIQUE CHECK(length(plan_digest) = 64),
+      gap_id TEXT NOT NULL,
+      gap_snapshot_json TEXT NOT NULL CHECK(json_valid(gap_snapshot_json) AND json_type(gap_snapshot_json) = 'object'),
+      repository TEXT NOT NULL,
+      worktree TEXT NOT NULL,
+      base_commit TEXT NOT NULL CHECK(length(base_commit) = 40),
+      plugin_name TEXT NOT NULL,
+      generator_digest TEXT NOT NULL CHECK(length(generator_digest) = 64),
+      scope_json TEXT NOT NULL CHECK(json_valid(scope_json) AND json_type(scope_json) = 'array'),
+      mode TEXT NOT NULL DEFAULT 'create' CHECK(mode IN ('create', 'modify')),
+      status TEXT NOT NULL CHECK(status IN (
+        'expired', 'pending-approval', 'approved', 'running-local-checks', 'ready-for-human-review', 'local-checks-failed',
+        'awaiting-pr', 'awaiting-review', 'awaiting-merge', 'awaiting-build', 'awaiting-sign', 'awaiting-publish',
+        'awaiting-registry-verify', 'awaiting-catalog-admission', 'release-complete', 'release-failed', 'publish-ambiguous'
+      )),
+      revision INTEGER NOT NULL CHECK(revision >= 1),
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL CHECK(expires_at > created_at),
+      approval_json TEXT CHECK(approval_json IS NULL OR json_valid(approval_json)),
+      checked_tree_digest TEXT CHECK(checked_tree_digest IS NULL OR (length(checked_tree_digest) = 64 AND checked_tree_digest NOT GLOB '*[^a-f0-9]*')),
+      checked_patch_digest TEXT CHECK(checked_patch_digest IS NULL OR (length(checked_patch_digest) = 64 AND checked_patch_digest NOT GLOB '*[^a-f0-9]*')),
+      checked_at INTEGER,
+      prepared_evidence_json TEXT CHECK(prepared_evidence_json IS NULL OR
+        (json_valid(prepared_evidence_json) AND json_type(prepared_evidence_json) = 'object')),
+      release_authorization_json TEXT CHECK(release_authorization_json IS NULL OR (json_valid(release_authorization_json) AND json_type(release_authorization_json) = 'object')),
+      release_authorization_digest TEXT CHECK(release_authorization_digest IS NULL OR length(release_authorization_digest) = 64),
+      release_id TEXT,
+      release_fence INTEGER NOT NULL DEFAULT 0 CHECK(release_fence >= 0),
+      release_failure_phase TEXT CHECK(release_failure_phase IS NULL OR release_failure_phase IN (
+        'pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'
+      )),
+      release_failure_code TEXT,
+      updated_at INTEGER NOT NULL,
+      CHECK((checked_tree_digest IS NULL AND checked_patch_digest IS NULL AND checked_at IS NULL) OR
+        (checked_tree_digest IS NOT NULL AND checked_patch_digest IS NOT NULL AND checked_at IS NOT NULL)),
+      CHECK(mode = 'create' OR
+        (checked_tree_digest IS NOT NULL AND checked_patch_digest IS NOT NULL AND checked_at IS NOT NULL)),
+      CHECK((mode = 'create' AND prepared_evidence_json IS NULL) OR
+        (mode = 'modify' AND prepared_evidence_json IS NOT NULL)),
+      CHECK((release_authorization_json IS NULL AND release_authorization_digest IS NULL) OR
+        (release_authorization_json IS NOT NULL AND release_authorization_digest IS NOT NULL)),
+      FOREIGN KEY(gap_id) REFERENCES capability_gaps(id) ON DELETE RESTRICT
+    ) STRICT;
+    INSERT INTO source_plans_v13 (id, plan_digest, gap_id, gap_snapshot_json, repository, worktree, base_commit,
+      plugin_name, generator_digest, scope_json, mode, status, revision, created_at, expires_at, approval_json,
+      checked_tree_digest, checked_patch_digest, checked_at, prepared_evidence_json,
+      release_authorization_json, release_authorization_digest, release_id, release_fence,
+      release_failure_phase, release_failure_code, updated_at)
+      SELECT id, plan_digest, gap_id, gap_snapshot_json, repository, worktree, base_commit, plugin_name,
+        generator_digest, scope_json, 'create', status, revision, created_at, expires_at, approval_json,
+        checked_tree_digest, checked_patch_digest, checked_at, NULL,
+        release_authorization_json, release_authorization_digest, release_id, release_fence,
+        release_failure_phase, release_failure_code, updated_at FROM source_plans;
+    DROP TABLE source_plans;
+    ALTER TABLE source_plans_v13 RENAME TO source_plans;
+    PRAGMA user_version = 13;
+    COMMIT;
+    PRAGMA foreign_keys = ON;
+  `);
+}
+function migrateV13ToV14(database) {
+    database.exec(`
+    BEGIN IMMEDIATE;
+    CREATE TABLE IF NOT EXISTS source_job_authorities (
+      authority_id TEXT PRIMARY KEY,
+      authority_digest TEXT NOT NULL CHECK(length(authority_digest) = 64),
+      expires_at INTEGER NOT NULL,
+      max_submissions INTEGER NOT NULL CHECK(max_submissions >= 1),
+      submissions INTEGER NOT NULL CHECK(submissions >= 0 AND submissions <= max_submissions)
+    ) STRICT, WITHOUT ROWID;
+    CREATE TABLE IF NOT EXISTS source_jobs (
+      id TEXT PRIMARY KEY,
+      automation_id TEXT NOT NULL UNIQUE,
+      authority_id TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      intent_json TEXT NOT NULL CHECK(json_valid(intent_json) AND json_type(intent_json) = 'object'),
+      intent_digest TEXT NOT NULL CHECK(length(intent_digest) = 64),
+      status TEXT NOT NULL CHECK(status IN ('queued', 'running', 'prepared', 'failed', 'unknown')),
+      revision INTEGER NOT NULL CHECK(revision >= 1),
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      definition_hash TEXT,
+      occurrence_id TEXT,
+      plan_id TEXT UNIQUE,
+      failure_code TEXT,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(authority_id, idempotency_key),
+      FOREIGN KEY(authority_id) REFERENCES source_job_authorities(authority_id) ON DELETE RESTRICT,
+      FOREIGN KEY(plan_id) REFERENCES source_plans(id) ON DELETE RESTRICT,
+      CHECK((status = 'queued' AND occurrence_id IS NULL AND plan_id IS NULL AND failure_code IS NULL)
+        OR (status = 'running' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NULL AND failure_code IS NULL)
+        OR (status = 'prepared' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NOT NULL AND failure_code IS NULL)
+        OR (status = 'failed' AND plan_id IS NULL AND failure_code IS NOT NULL)
+        OR (status = 'unknown' AND definition_hash IS NOT NULL AND occurrence_id IS NOT NULL AND plan_id IS NULL AND failure_code IS NOT NULL))
+    ) STRICT;
+    CREATE UNIQUE INDEX IF NOT EXISTS source_jobs_single_active ON source_jobs((1)) WHERE status IN ('queued', 'running', 'unknown');
+    CREATE INDEX IF NOT EXISTS source_jobs_created ON source_jobs(created_at, id);
+    PRAGMA user_version = 14;
+    COMMIT;
+  `);
+}
+function migrateV14ToV15(database) {
+    const columns = new Set(database.prepare('PRAGMA table_info(activation_plans)').all().map(row => row.name));
+    const hasRollbackPhase = database.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'host_attestations'").get()?.sql?.includes("'rollback'") === true;
+    database.exec(`
+    BEGIN IMMEDIATE;
+    ${columns.has('activation_target_baseline_json') ? '' : "ALTER TABLE activation_plans ADD COLUMN activation_target_baseline_json TEXT CHECK(activation_target_baseline_json IS NULL OR (json_valid(activation_target_baseline_json) AND json_type(activation_target_baseline_json) = 'array'));"}
+    ${columns.has('host_recovery_required') ? '' : 'ALTER TABLE activation_plans ADD COLUMN host_recovery_required INTEGER NOT NULL DEFAULT 0 CHECK(host_recovery_required IN (0, 1));'}
+    ${columns.has('rollback_profile_restored') ? '' : 'ALTER TABLE activation_plans ADD COLUMN rollback_profile_restored INTEGER NOT NULL DEFAULT 0 CHECK(rollback_profile_restored IN (0, 1));'}
+    -- Older active Host states have no trustworthy core-file baseline. Keep them
+    -- pending recovery, never manufacture a baseline from mutable files.
+    UPDATE activation_plans SET host_recovery_required = 1
+      WHERE status IN ('awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending');
+    ${hasRollbackPhase ? '' : 'ALTER TABLE host_attestations RENAME TO host_attestations_v14;'}
+    CREATE TABLE IF NOT EXISTS host_attestations (
+      plan_id TEXT NOT NULL, phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health', 'rollback')),
+      receipt_id TEXT NOT NULL UNIQUE, receipt_digest TEXT NOT NULL CHECK(length(receipt_digest) = 64),
+      receipt_json TEXT NOT NULL CHECK(json_valid(receipt_json) AND json_type(receipt_json) = 'object'), host_generation INTEGER NOT NULL CHECK(host_generation >= 1),
+      created_at INTEGER NOT NULL, PRIMARY KEY(plan_id, phase), FOREIGN KEY(plan_id) REFERENCES activation_plans(id) ON DELETE RESTRICT
+    ) STRICT, WITHOUT ROWID;
+    ${hasRollbackPhase ? '' : 'INSERT INTO host_attestations SELECT * FROM host_attestations_v14; DROP TABLE host_attestations_v14;'}
+    ${hasRollbackPhase ? '' : 'ALTER TABLE host_attestation_operations RENAME TO host_attestation_operations_v14;'}
+    CREATE TABLE IF NOT EXISTS host_attestation_operations (
+      plan_id TEXT NOT NULL, phase TEXT NOT NULL CHECK(phase IN ('reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health', 'rollback')),
+      operation_id TEXT NOT NULL UNIQUE, binding_digest TEXT NOT NULL CHECK(length(binding_digest) = 64), request_digest TEXT NOT NULL CHECK(length(request_digest) = 64),
+      request_json TEXT NOT NULL CHECK(json_valid(request_json) AND json_type(request_json) = 'object'), status TEXT NOT NULL CHECK(status IN ('pending', 'completed', 'applied')),
+      receipt_digest TEXT CHECK(receipt_digest IS NULL OR length(receipt_digest) = 64), receipt_json TEXT CHECK(receipt_json IS NULL OR (json_valid(receipt_json) AND json_type(receipt_json) = 'object')),
+      created_at INTEGER NOT NULL, completed_at INTEGER, applied_at INTEGER, PRIMARY KEY(plan_id, phase), FOREIGN KEY(plan_id) REFERENCES activation_plans(id) ON DELETE RESTRICT
+    ) STRICT, WITHOUT ROWID;
+    ${hasRollbackPhase ? '' : 'INSERT INTO host_attestation_operations SELECT * FROM host_attestation_operations_v14; DROP TABLE host_attestation_operations_v14;'}
+    PRAGMA user_version = 15;
+    COMMIT;
+  `);
+}
+function migrateV15ToV16(database) {
+    database.exec(`
+    BEGIN IMMEDIATE;
+    CREATE TABLE IF NOT EXISTS owner_task_failure_gaps (
+      gap_id TEXT PRIMARY KEY REFERENCES capability_gaps(id) ON DELETE RESTRICT,
+      reference_json TEXT NOT NULL CHECK(json_valid(reference_json) AND json_type(reference_json) = 'object'),
+      reference_digest TEXT NOT NULL CHECK(length(reference_digest) = 64)
+    ) STRICT, WITHOUT ROWID;
+    PRAGMA user_version = 16;
+    COMMIT;
+  `);
+}
+function migrateV16ToV17(database) {
+    database.exec(`
+    BEGIN IMMEDIATE;
+    CREATE TABLE IF NOT EXISTS activation_deployment_checkpoints (
+      plan_id TEXT PRIMARY KEY REFERENCES activation_plans(id) ON DELETE RESTRICT,
+      baseline_json TEXT NOT NULL CHECK(json_valid(baseline_json) AND json_type(baseline_json) = 'array'),
+      exposure_order INTEGER NOT NULL UNIQUE CHECK(exposure_order >= 1),
+      successful_order INTEGER UNIQUE CHECK(successful_order IS NULL OR successful_order = exposure_order),
+      recorded_at INTEGER NOT NULL,
+      succeeded_at INTEGER
+    ) STRICT, WITHOUT ROWID;
+    CREATE INDEX IF NOT EXISTS activation_deployment_checkpoints_success ON activation_deployment_checkpoints(successful_order)
+      WHERE successful_order IS NOT NULL;
+    CREATE TABLE IF NOT EXISTS activation_deployment_sequence (
+      singleton INTEGER PRIMARY KEY CHECK(singleton = 1),
+      next_exposure_order INTEGER NOT NULL CHECK(next_exposure_order >= 1)
+    ) STRICT, WITHOUT ROWID;
+    INSERT OR IGNORE INTO activation_deployment_sequence (singleton, next_exposure_order) VALUES (1, 1);
+    -- Historical promotions did not retain a verified installed core-file pin.
+    -- Do not invent one from mutable profile contents: they remain observable,
+    -- but cannot be physically rolled back by this new path.
+    PRAGMA user_version = 17;
+    COMMIT;
+  `);
+}
+function migrateV17ToV18(database) {
+    database.exec(`
+    PRAGMA foreign_keys = OFF;
+    BEGIN IMMEDIATE;
+    CREATE TABLE IF NOT EXISTS source_release_dispatches (
+      operation_id TEXT PRIMARY KEY REFERENCES source_release_operations(operation_id) ON DELETE RESTRICT,
+      status TEXT NOT NULL CHECK(status IN ('claimed', 'completed')),
+      claimed_at INTEGER NOT NULL,
+      completed_at INTEGER,
+      CHECK((status = 'claimed' AND completed_at IS NULL) OR
+        (status = 'completed' AND completed_at IS NOT NULL AND completed_at >= claimed_at))
+    ) STRICT, WITHOUT ROWID;
+    -- A v17 pending operation may already have reached an external adapter
+    -- before this binary could persist its signed receipt. Preserve that
+    -- uncertainty; do not infer that dispatch is safe to repeat.
+    INSERT OR IGNORE INTO source_release_dispatches (operation_id, status, claimed_at, completed_at)
+      SELECT operation_id,
+        CASE WHEN status = 'pending' THEN 'claimed' ELSE 'completed' END,
+        created_at,
+        CASE WHEN status = 'pending' THEN NULL ELSE completed_at END
+      FROM source_release_operations;
+    PRAGMA user_version = 18;
+    COMMIT;
+    PRAGMA foreign_keys = ON;
+  `);
+}
 export function openControlPlaneDatabase(path) {
     prepare(path);
     const database = new DatabaseSync(path);
@@ -697,7 +1156,50 @@ export function openControlPlaneDatabase(path) {
                 migrateV9ToV10(database);
             if (version <= 10)
                 migrateV10ToV11(database);
+            if (version <= 11)
+                migrateV11ToV12(database);
+            if (version <= 12)
+                migrateV12ToV13(database);
+            if (version <= 13)
+                migrateV13ToV14(database);
+            if (version <= 14)
+                migrateV14ToV15(database);
+            if (version <= 15)
+                migrateV15ToV16(database);
+            if (version <= 16)
+                migrateV16ToV17(database);
+            if (version <= 17)
+                migrateV17ToV18(database);
+        }
+        if (Number(database.prepare('PRAGMA user_version').get()?.user_version) < 19) {
+            database.exec(`BEGIN IMMEDIATE; ${sourceAdoptionsSchema} PRAGMA user_version = 19; COMMIT;`);
+        }
+        else
+            database.exec(sourceAdoptionsSchema);
+        if (Number(database.prepare('PRAGMA user_version').get()?.user_version) < 20) {
+            database.exec(`BEGIN IMMEDIATE; ${foregroundDeploymentsSchema} PRAGMA user_version = 20; COMMIT;`);
+        }
+        else
+            database.exec(foregroundDeploymentsSchema);
+        if (Number(database.prepare('PRAGMA user_version').get()?.user_version) < 21) {
+            database.exec(`BEGIN IMMEDIATE; ${taskObservationsSchema} PRAGMA user_version = 21; COMMIT;`);
+        }
+        else
+            database.exec(taskObservationsSchema);
+        if (Number(database.prepare('PRAGMA user_version').get()?.user_version) < 22) {
+            database.exec(`BEGIN IMMEDIATE; ${hostAttestationDispatchesSchema}
+        INSERT OR IGNORE INTO host_attestation_dispatches (operation_id,status,claimed_at,completed_at)
+          SELECT operation_id, CASE WHEN status = 'pending' THEN 'claimed' ELSE 'completed' END, created_at,
+            CASE WHEN status = 'pending' THEN NULL ELSE completed_at END FROM host_attestation_operations;
+        PRAGMA user_version = 22; COMMIT;`);
+        }
+        else
+            database.exec(hostAttestationDispatchesSchema);
+        if (Number(database.prepare('PRAGMA user_version').get()?.user_version) < 23) {
+            database.exec(`BEGIN IMMEDIATE; ${adoptionHandoffsSchema} PRAGMA user_version = 23; COMMIT;`);
         }
+        else
+            database.exec(adoptionHandoffsSchema);
         database.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;');
         return database;
     }