@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.53

package/lib/source-jobs.js

@@ -1,11 +1,16 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { isAbsolute, join, resolve } from 'node:path';
 import { realpath } from 'node:fs/promises';
+import { SourceGrowthRunUnavailableError, isSourceOwnerContinuation, validateSourceGrowthRunBinding } from '@dsh-enhanced/assistant-growth-contract';
+import { automationDefinitionDigest } from '@dsh-enhanced/assistant-automations';
 import { controlPlaneDigest, expectedSourceRelease } from './store.js';
 import { awaitSourceSignal, inspectSourceContext } from './source-context.js';
 import { assertPluginModificationAllowed, removeSourceJobWorktree, validateScopedPluginFiles } from './source-workspace.js';
 import { assertManagedVersionPaths } from './source-versioning.js';
+import { resolveSourceBaseline, validateSourceBaselineConfig } from './source-baseline.js';
 import { removeSourceJobContainer } from './source-build.js';
+import { inspectSourceRevisionContext, validateSourceRevisionGrant } from './source-revision.js';
+import { inspectSourceCreationContext, validateSourceCreationFiles, validateSourceCreationGrant } from './source-creation.js';
 import { inheritedEnvironment } from './trust.js';
 export const SOURCE_JOB_OWNER = 'plugin-control-plane-source';
 const EXECUTOR = 'plugin-control-plane-source-check';
@@ -13,8 +18,11 @@ const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1, operation:
 const CONTINUATION_EXECUTOR = 'plugin-control-plane-source-continuations-v1';
 const CONTINUATION_CATALOG = controlPlaneDigest({ executor: CONTINUATION_EXECUTOR, version: 1, operation: 'continue-prepared-source-plan' });
 const CONTINUATION_AUTOMATION = 'source-job-prepared-continuations';
+export { SourceGrowthRunUnavailableError } from '@dsh-enhanced/assistant-growth-contract';
+class SourceGrowthNativeMismatchError extends Error {
+}
 export function validateSourceJobsConfig(value, build) {
-    const allowed = new Set(['authorityId', 'expiresAt', 'maxSubmissions', 'repository', 'ownerRouteId', 'principalId', 'workspace', 'preset', 'budgetId', 'budgetAmount']);
+    const allowed = new Set(['authorityId', 'expiresAt', 'maxSubmissions', 'allowedModes', 'repository', 'baseline', 'creation', 'revision', 'ownerRouteId', 'principalId', 'workspace', 'preset', 'budgetId', 'budgetAmount']);
     if (value === null || typeof value !== 'object' || Array.isArray(value) || build === undefined
         || Object.keys(value).some(key => !allowed.has(key))
         || ![value.authorityId, value.ownerRouteId, value.principalId, value.repository, value.workspace, value.preset].every(text => typeof text === 'string' && text !== '' && text.normalize('NFC').trim() === text && text.length <= 4096 && !/[\p{Cc}]/u.test(text))
@@ -26,9 +34,26 @@ export function validateSourceJobsConfig(value, build) {
         || !Number.isSafeInteger(value.budgetAmount) || value.budgetAmount < 1) {
         throw new Error('plugin-control-plane: invalid sourceJobs authority configuration');
     }
+    if (value.baseline !== undefined)
+        validateSourceBaselineConfig(value.baseline);
+    if (value.allowedModes !== undefined && (!Array.isArray(value.allowedModes) || value.allowedModes.length < 1
+        || value.allowedModes.length > 3 || new Set(value.allowedModes).size !== value.allowedModes.length
+        || value.allowedModes.some(mode => !['create', 'modify', 'revise-created'].includes(mode)))) {
+        throw new Error('plugin-control-plane: invalid sourceJobs allowedModes');
+    }
+    if (value.creation !== undefined)
+        validateSourceCreationGrant(value.creation);
+    if (value.revision !== undefined)
+        validateSourceRevisionGrant(value.revision);
+    if (build !== undefined && 'backend' in build
+        && (!value.allowedModes || value.allowedModes.some(mode => mode === 'modify')
+            || value.creation === undefined && value.revision === undefined)) {
+        throw new Error('plugin-control-plane: native source jobs require finite create/revise-created grants');
+    }
 }
 function projection(job) {
     return { id: job.id, name: job.intent.name, gapId: job.intent.gapId, baseCommit: job.intent.baseCommit,
+        ...(job.intent.mode === undefined ? {} : { mode: job.intent.mode }),
         status: job.status, createdAt: job.createdAt, expiresAt: job.expiresAt,
         ...(job.planId === undefined ? {} : { planId: job.planId }), ...(job.failureCode === undefined ? {} : { failureCode: job.failureCode }) };
 }
@@ -37,6 +62,8 @@ export class SourceJobRuntime {
     options;
     abort = new AbortController();
     flights = new Set();
+    growthFlights = new Set();
+    growthControllers = new Set();
     authorityDigest;
     unregister;
     unregisterContinuation;
@@ -59,7 +86,15 @@ export class SourceJobRuntime {
         const executor = {
             descriptor: { executorId: EXECUTOR, contractVersion: 1, catalogDigest: CATALOG },
             accepts: spec => spec.executorId === EXECUTOR && spec.executorContractVersion === 1 && spec.catalogDigest === CATALOG && spec.runbookId === EXECUTOR && spec.runbookVersion === 1,
-            execute: input => this.track(this.execute(input)),
+            execute: input => {
+                const job = this.options.store.getSourceJobByAutomation(input.automationId);
+                const flight = this.track(this.execute(input));
+                if ((job?.intent.creation?.growthRun ?? job?.intent.revision?.growthRun) !== undefined) {
+                    this.growthFlights.add(flight);
+                    void flight.then(() => this.growthFlights.delete(flight), () => this.growthFlights.delete(flight));
+                }
+                return flight;
+            },
         };
         try {
             this.unregister = this.options.ports.automations.registerHostExecutor(executor);
@@ -90,23 +125,57 @@ export class SourceJobRuntime {
             catch { /* original error wins */ }
             throw error;
         }
+        this.reconcileQueued();
+    }
+    /** Nudge the existing native one-shot registrations after a Host provider appears. */
+    reconcileQueued() {
+        if (!this.active)
+            return;
         // Reconcile only queued intents. A previous claim is unknown and never replayed.
         for (let job of this.options.store.listSourceJobs(100)) {
             if (job.status !== 'queued')
                 continue;
             try {
                 job = this.refreshQueued(job);
-                if (job.status === 'queued') {
-                    this.assertOwner(job);
+                if (job.status === 'queued')
                     this.schedule(job);
-                }
             }
-            catch {
+            catch (error) {
+                if (error instanceof SourceGrowthRunUnavailableError)
+                    continue;
                 const current = this.options.store.getSourceJob(job.id);
+                // A persisted rearm is an in-progress cross-ledger handoff. Retain it
+                // for exact native receipt replay after a crash or transient fault.
+                if (current?.previousDefinitionHash !== undefined && !(error instanceof SourceGrowthNativeMismatchError))
+                    continue;
                 if (current?.status === 'queued')
                     this.options.store.settleSourceJob({ id: current.id, revision: current.revision, status: 'failed', failureCode: 'source-job-reconcile-rejected' });
             }
         }
+        this.reconcileContinuations();
+    }
+    /** Provider removal revokes in-flight authority without replaying a claimed job. */
+    growthProviderDisposed() {
+        for (const controller of this.growthControllers)
+            controller.abort(new Error('source growth run producer disposed'));
+        this.options.store.interruptGrowthSourceJobs();
+        if (!this.active)
+            return Promise.allSettled(this.growthFlights).then(() => undefined);
+        for (const job of this.options.store.listSourceJobs(100)) {
+            if (job.status !== 'queued' || (job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) === undefined || job.definitionHash === undefined)
+                continue;
+            try {
+                const health = this.options.ports.automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+                if (health.definitionHash !== job.definitionHash)
+                    continue;
+                if (health.automationStatus === 'active')
+                    this.options.ports.automations.pauseSystemOwned({ owner: SOURCE_JOB_OWNER,
+                        operationId: `${job.id}:growth-provider-pause:v${health.definitionVersion}`, automationId: job.automationId,
+                        definitionHash: job.definitionHash, expectedVersion: health.definitionVersion });
+            }
+            catch { /* claim guard remains authoritative */ }
+        }
+        return Promise.allSettled(this.growthFlights).then(() => undefined);
     }
     async continuePrepared(job, signal) {
         if (!job.planId || !this.options.store.getOwnerTaskFailureReference(job.intent.gapId))
@@ -122,6 +191,7 @@ export class SourceJobRuntime {
         }
     }
     async continuePreparedLocked(job, signal) {
+        this.assertMode(job.intent.mode);
         if (!job.planId || !this.options.store.getOwnerTaskFailureReference(job.intent.gapId))
             return;
         const planId = job.planId;
@@ -130,6 +200,8 @@ export class SourceJobRuntime {
             throw new Error('source job continuation changed');
         job = current;
         const initial = this.options.store.getSourcePlan(planId);
+        if (initial.mode !== 'modify' && initial.mode !== 'prepared-create' && initial.mode !== 'prepared-revise')
+            return;
         // An ordinary grant or plan must not be advanced after expiry. Adoption has
         // its own durable post-release path and is deliberately retained below.
         if (initial.expiresAt <= Date.now() && initial.status !== 'release-complete')
@@ -142,6 +214,35 @@ export class SourceJobRuntime {
             signal.throwIfAborted();
             this.assertOwner(job);
         };
+        if (initial.mode === 'prepared-revise') {
+            if (job.intent.mode !== 'revise-created' || !job.intent.revision?.growthRun.revisionAcceptance || !initial.sourceRevision?.growthRun.revisionAcceptance)
+                return;
+            await assertCurrent();
+            if (this.options.store.getRevisionVerificationStatus(planId) === undefined && this.options.verifyPreparedRevision)
+                await this.options.verifyPreparedRevision(job, signal);
+            if (this.options.store.getRevisionVerificationStatus(planId) === 'verified'
+                && this.options.store.getRevisionRegressionStatus(planId) === undefined
+                && job.intent.revision.growthRun.revisionRegressionAcceptance && this.options.verifyPreparedRevisionRegression) {
+                await assertCurrent();
+                await this.options.verifyPreparedRevisionRegression(job, signal);
+            }
+            return;
+        }
+        if (initial.mode === 'prepared-create') {
+            if (job.intent.mode !== 'create'
+                || !job.intent.creation?.growthRun?.creationAcceptance || !initial.creation?.growthRun?.creationAcceptance)
+                return;
+            await assertCurrent();
+            if (this.options.store.getCreationVerificationStatus(planId) === undefined && this.options.verifyPreparedCreation) {
+                await this.options.verifyPreparedCreation(job, signal);
+            }
+            if (this.options.store.getCreationVerificationStatus(planId) === 'verified'
+                && this.options.creationAdoptionEligible?.(planId) && this.options.adoptVerifiedCreation) {
+                await assertCurrent();
+                await this.options.adoptVerifiedCreation(job, signal);
+            }
+            return;
+        }
         if (this.options.adoptReleased && this.options.store.getSourcePlan(planId).status === 'release-complete') {
             await this.options.adoptReleased(job, signal, assertCurrent);
             return;
@@ -219,34 +320,100 @@ export class SourceJobRuntime {
             throw new Error('source job task provenance service unavailable');
         return this.options.withGapSourceFence(gapId, owner, callback);
     }
+    modeAllowed(mode) {
+        return this.options.config.allowedModes?.includes(mode ?? 'modify') ?? true;
+    }
+    assertMode(mode) {
+        if (!this.modeAllowed(mode))
+            throw new Error('source job mode is not authorized');
+    }
     assertOwner(job) {
-        if (!this.available() || job.expiresAt <= Date.now() || job.intent.authority.digest !== this.authorityDigest
-            || job.intent.authority.id !== this.options.config.authorityId || controlPlaneDigest(this.receipt()) !== job.intent.ownerDigest)
+        this.assertMode(job.intent.mode);
+        const current = this.receipt();
+        const taskBacked = this.options.store.getOwnerTaskFailureReference(job.intent.gapId) !== undefined;
+        if (!this.available() || job.expiresAt <= Date.now() || (job.intent.mode === 'create' && (!this.options.config.creation || !job.intent.creation
+            || job.intent.creation.grant.expiresAt <= Date.now() || controlPlaneDigest(job.intent.creation.grant) !== controlPlaneDigest(this.options.config.creation)))
+            || (job.intent.mode === 'revise-created' && (!this.options.config.revision || !job.intent.revision
+                || job.intent.revision.grant.expiresAt <= Date.now() || controlPlaneDigest(job.intent.revision.grant) !== controlPlaneDigest(this.options.config.revision)))
+            || job.intent.authority.digest !== this.authorityDigest
+            || job.intent.authority.id !== this.options.config.authorityId
+            || controlPlaneDigest(job.intent.owner) !== job.intent.ownerDigest
+            || (taskBacked ? !isSourceOwnerContinuation(current, job.intent.owner)
+                : controlPlaneDigest(current) !== job.intent.ownerDigest))
             throw new Error('source job authority changed or expired');
-        this.withGapSource(job.intent.gapId, job.intent.owner, () => { });
+        if (job.intent.revision) {
+            const parent = this.options.inspectRevisionParent?.(job.intent.revision.parent.planId);
+            if (!parent || parent.name !== job.intent.name || controlPlaneDigest(parent.parent) !== controlPlaneDigest(job.intent.revision.parent))
+                throw new Error('source revision parent changed');
+        }
+        this.withGapSource(job.intent.gapId, job.intent.owner, () => this.assertGrowthRun((job.intent.creation?.growthRun ?? job.intent.revision?.growthRun), job.intent.mode, job.intent.gapId, job.intent.owner, false));
+    }
+    assertGrowthRun(growthRun, mode, gapId, owner, generation) {
+        const taskBacked = this.options.store.getOwnerTaskFailureReference(gapId) !== undefined;
+        if ((mode !== 'create' && mode !== 'revise-created') || !taskBacked) {
+            if (growthRun !== undefined)
+                throw new Error('source growth run is outside a task-backed creation');
+            return;
+        }
+        if (growthRun === undefined)
+            throw new Error('task-backed creation requires a frozen source growth run');
+        validateSourceGrowthRunBinding(growthRun);
+        if (!this.options.assertGrowthRun)
+            throw new SourceGrowthRunUnavailableError('source growth run producer unavailable');
+        this.options.assertGrowthRun(growthRun, gapId, owner, generation);
     }
     enqueue(input) {
-        validateScopedPluginFiles(input.files);
-        if (this.options.build.versioning === 'patch')
-            assertManagedVersionPaths(input.files);
+        this.assertMode(input.mode);
+        if (input.mode !== 'create' && input.mode !== 'revise-created' && input.growthRun !== undefined)
+            throw new Error('modify source job cannot carry a growth run');
+        if (input.mode === 'create' || input.mode === 'revise-created')
+            validateSourceCreationFiles(input.files);
+        else {
+            if (input.mode !== undefined)
+                throw new Error('invalid source job mode');
+            validateScopedPluginFiles(input.files);
+            if (this.options.build.versioning === 'patch')
+                assertManagedVersionPaths(input.files);
+        }
+        if ((input.mode === 'revise-created') !== (typeof input.parentPlanId === 'string' && input.parentPlanId.length > 0))
+            throw new Error('source revision parent is missing or outside revision mode');
         return this.track(this.enqueueOwned({ ...input, files: structuredClone(input.files), owner: structuredClone(input.owner) }));
     }
     async enqueueOwned(input) {
+        this.assertMode(input.mode);
         const signal = AbortSignal.any([input.signal, this.abort.signal, AbortSignal.timeout(15_000)]);
         const assertCurrent = async () => { signal.throwIfAborted(); await awaitSourceSignal(signal, input.assertCurrent); this.withGapSource(input.gapId, this.assertCaller(input.owner), () => { }); if (!this.available())
             throw new Error('source job authority unavailable'); signal.throwIfAborted(); };
         await assertCurrent();
-        validateScopedPluginFiles(input.files);
-        if (this.options.build.versioning === 'patch')
-            assertManagedVersionPaths(input.files);
-        assertPluginModificationAllowed(input.name);
+        if (input.mode === 'create' || input.mode === 'revise-created')
+            validateSourceCreationFiles(input.files);
+        else {
+            validateScopedPluginFiles(input.files);
+            if (this.options.build.versioning === 'patch')
+                assertManagedVersionPaths(input.files);
+            assertPluginModificationAllowed(input.name);
+        }
         if (typeof input.idempotencyKey !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u.test(input.idempotencyKey)
             || !Number.isSafeInteger(input.ttlMs) || input.ttlMs < 900_000 || input.ttlMs > 86_400_000)
             throw new Error('invalid source job request');
         const config = this.options.config;
+        if (input.mode === 'create' && (config.creation === undefined || config.creation.expiresAt <= Date.now()))
+            throw new Error('source creation grant unavailable or expired');
+        if (input.mode === 'revise-created' && (config.revision === undefined || config.revision.expiresAt <= Date.now()))
+            throw new Error('source revision grant unavailable or expired');
         if (input.repository !== config.repository || await realpath(input.repository) !== config.repository)
             throw new Error('source job repository mismatch');
-        const owner = this.assertCaller(input.owner);
+        const currentOwner = this.assertCaller(input.owner);
+        const reference = this.options.store.getOwnerTaskFailureReference(input.gapId);
+        if (input.mode === 'revise-created' && !reference)
+            throw new Error('revision requires an authenticated owner task failure');
+        const owner = reference?.owner ?? currentOwner;
+        if (reference && !isSourceOwnerContinuation(currentOwner, owner))
+            throw new Error('source job task owner changed');
+        this.withGapSource(input.gapId, currentOwner, () => this.assertGrowthRun(input.growthRun, input.mode, input.gapId, owner, true));
+        const parent = input.mode === 'revise-created' ? this.options.inspectRevisionParent?.(input.parentPlanId) : undefined;
+        if (input.mode === 'revise-created' && (!parent || parent.name !== input.name))
+            throw new Error('adopted revision parent unavailable or mismatched');
         const trust = await awaitSourceSignal(signal, this.options.trust);
         for (const outstanding of this.options.store.listSourceJobs(1))
             this.refreshQueued(outstanding);
@@ -256,6 +423,12 @@ export class SourceJobRuntime {
         if (prior !== undefined) {
             const frozen = prior.intent;
             if (frozen.authority.digest !== this.authorityDigest || frozen.ownerDigest !== controlPlaneDigest(owner) || frozen.trustDigest !== controlPlaneDigest(trust)
+                || frozen.mode !== input.mode || (input.mode === 'create' && (controlPlaneDigest(frozen.creation?.grant) !== controlPlaneDigest(config.creation)
+                || (frozen.creation?.growthRun === undefined) !== (input.growthRun === undefined)
+                || (input.growthRun !== undefined && controlPlaneDigest(frozen.creation?.growthRun) !== controlPlaneDigest(input.growthRun))))
+                || (input.mode === 'revise-created' && (controlPlaneDigest(frozen.revision?.grant) !== controlPlaneDigest(config.revision)
+                    || controlPlaneDigest(frozen.revision?.parent) !== controlPlaneDigest(parent.parent)
+                    || controlPlaneDigest(frozen.revision?.growthRun) !== controlPlaneDigest(input.growthRun)))
                 || frozen.repository !== input.repository || frozen.name !== input.name || frozen.gapId !== input.gapId || frozen.baseCommit !== input.expectedBaseCommit
                 || frozen.ttlMs !== input.ttlMs || controlPlaneDigest(frozen.files) !== controlPlaneDigest(input.files))
                 throw new Error('source job idempotency conflict');
@@ -267,17 +440,39 @@ export class SourceJobRuntime {
         const gap = this.options.store.getGap(input.gapId);
         if (gap.status !== 'open' || gap.candidateId !== undefined)
             throw new Error('source job gap is not open');
-        const source = await inspectSourceContext({ repository: config.repository, name: input.name, paths: [], baseCommit: input.expectedBaseCommit, environment: inheritedEnvironment(trust), signal, assertCurrent });
+        const environment = inheritedEnvironment(trust);
+        const baselineCommit = config.baseline === undefined ? undefined : await resolveSourceBaseline({ repository: config.repository,
+            config: config.baseline, environment, signal, assertCurrent, trust,
+            readHistory: () => this.options.store.getSourceBaselineHistory(config.repository),
+            readMaintenance: () => this.options.store.getSourceMaintenanceRecords(config.repository) });
+        const context = { repository: config.repository, name: input.name, paths: [], baseCommit: input.expectedBaseCommit,
+            ...(baselineCommit === undefined ? {} : { baselineCommit }), environment, signal, assertCurrent };
+        const source = input.mode === 'create'
+            ? await inspectSourceCreationContext({ ...context, grant: config.creation })
+            : input.mode === 'revise-created'
+                ? await inspectSourceRevisionContext({ ...context, grant: config.revision, parent: parent.parent, parentSource: parent.source, parentCertificate: parent.certificate })
+                : await inspectSourceContext(context);
         const intent = {
             authority: { id: config.authorityId, digest: this.authorityDigest, expiresAt: config.expiresAt, maxSubmissions: config.maxSubmissions },
             owner, ownerDigest: controlPlaneDigest(owner), trustDigest: controlPlaneDigest(trust), repository: config.repository, name: input.name,
+            ...(config.baseline === undefined ? {} : { baseline: structuredClone(config.baseline) }),
+            ...(input.mode === 'create' ? { mode: 'create', creation: { grant: structuredClone(config.creation), generatorDigest: source.generatorDigest,
+                    ...(input.growthRun === undefined ? {} : { growthRun: structuredClone(input.growthRun) }) } } : {}),
+            ...(input.mode === 'revise-created' ? { mode: 'revise-created', revision: { grant: structuredClone(config.revision),
+                    generatorDigest: source.generatorDigest, parent: structuredClone(parent.parent), growthRun: structuredClone(input.growthRun) } } : {}),
             gapId: gap.id, gapRevision: gap.revision, gapDigest: controlPlaneDigest(gap), baseCommit: source.baseCommit,
             files: structuredClone(input.files), ttlMs: input.ttlMs, build: structuredClone(this.options.build),
-            worktree: join(this.options.statePath, 'source-worktrees', `worktree-job-${token}`), containerName: `dsh-source-job-${token}`,
+            worktree: join(this.options.statePath, 'source-worktrees', `worktree-job-${token}`),
+            ...('backend' in this.options.build
+                ? { nativeResource: { backend: 'macos-seatbelt', key: id } }
+                : { containerName: `dsh-source-job-${token}` }),
         };
         await assertCurrent();
         // Synchronous acceptance and registration: no Agent signal is persisted.
-        const job = this.withGapSource(gap.id, owner, () => this.options.store.enqueueSourceJob({ id, automationId: id, idempotencyKey: input.idempotencyKey, intent }));
+        const job = this.withGapSource(gap.id, owner, () => {
+            this.assertGrowthRun(input.growthRun, input.mode, gap.id, owner, true);
+            return this.options.store.enqueueSourceJob({ id, automationId: id, idempotencyKey: input.idempotencyKey, intent });
+        });
         if (job.status === 'queued')
             this.scheduleOrFail(job);
         return projection(this.options.store.getSourceJob(id));
@@ -285,8 +480,8 @@ export class SourceJobRuntime {
     inspect(input) {
         const owner = this.assertCaller(input.owner);
         const job = this.options.store.getSourceJob(input.id);
-        // A new session binding may inspect/clean this owner's old job. Execution
-        // still requires the complete frozen receipt in assertOwner; never replay.
+        // Inspection and cleanup may cross a session binding. A task-backed job
+        // retains its frozen owner digest and may continue under the same owner.
         if (job === undefined || job.intent.owner.authorityId !== owner.authorityId
             || job.intent.owner.principalId !== owner.principalId || job.intent.owner.principalRecordId !== owner.principalRecordId
             || job.intent.owner.principalVersion !== owner.principalVersion || job.intent.owner.workspace !== owner.workspace
@@ -298,16 +493,25 @@ export class SourceJobRuntime {
     refreshQueued(job) {
         if (job.status !== 'queued')
             return job;
+        if (!this.modeAllowed(job.intent.mode))
+            return this.options.store.settleSourceJob({ id: job.id, revision: job.revision,
+                status: 'failed', failureCode: 'source-job-mode-revoked' });
         let code;
-        try {
-            this.withGapSource(job.intent.gapId, job.intent.owner, () => { });
-        }
-        catch {
-            code = 'source-job-task-source-changed';
+        let providerUnavailable = false;
+        if (job.intent.mode === 'create' && this.options.store.getOwnerTaskFailureReference(job.intent.gapId) !== undefined
+            && (job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) === undefined)
+            code = 'source-job-growth-run-missing';
+        else {
+            try {
+                this.withGapSource(job.intent.gapId, job.intent.owner, () => { providerUnavailable = this.growthProducerUnavailable(job); });
+            }
+            catch {
+                code = 'source-job-task-source-changed';
+            }
         }
         if (job.expiresAt <= Date.now())
             code = 'source-job-expired';
-        else if (job.definitionHash !== undefined) {
+        else if (code === undefined && job.definitionHash !== undefined && !providerUnavailable && (job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) === undefined) {
             const health = this.options.ports.automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
             const run = health.latestTerminalRuns.production;
             if (run !== undefined && run.createdAt >= job.createdAt && run.immutableContext.state === 'verified'
@@ -319,9 +523,20 @@ export class SourceJobRuntime {
         // loses its claim. No resubmission or second native occurrence is created.
         return code === undefined ? job : this.options.store.settleSourceJob({ id: job.id, revision: job.revision, status: 'failed', failureCode: code });
     }
+    growthProducerUnavailable(job) {
+        try {
+            this.assertGrowthRun((job.intent.creation?.growthRun ?? job.intent.revision?.growthRun), job.intent.mode, job.intent.gapId, job.intent.owner, false);
+            return false;
+        }
+        catch (error) {
+            if (error instanceof SourceGrowthRunUnavailableError)
+                return true;
+            throw error;
+        }
+    }
     definition(job) {
         const config = this.options.config;
-        return { name: `Source check: ${job.intent.name}`, schedule: { kind: 'at', at: new Date(job.createdAt + 1000).toISOString() },
+        return { name: `Source check: ${job.intent.name}`, schedule: { kind: 'at', at: new Date(job.dispatchAt ?? job.createdAt + 1000).toISOString() },
             workspace: config.workspace, agentPreset: config.preset, timeoutMs: job.intent.build.timeoutMs + 120_000 + (this.options.advanceReleased ? this.options.releaseTimeoutMs ?? 40_000 : 0) + (this.options.adoptReleased ? this.options.adoptionTimeoutMs ?? 60_000 : 0),
             misfire: { kind: 'latest' }, overlap: 'skip', retrySafety: 'never', maxRetries: 0, principal: config.principalId,
             ...(config.budgetId === undefined ? {} : { budgetId: config.budgetId, budgetAmount: config.budgetAmount }),
@@ -332,27 +547,87 @@ export class SourceJobRuntime {
     schedule(job) {
         this.assertOwner(job);
         const automations = this.options.ports.automations;
+        if (job.definitionHash !== undefined && (job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) !== undefined && job.occurrenceId === undefined) {
+            const health = automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+            if (health.definitionHash !== job.definitionHash)
+                throw new Error('source job native definition changed before rearm');
+            const dueAt = job.dispatchAt ?? job.createdAt + 1000;
+            const terminal = health.latestTerminalRuns.production;
+            if ((health.automationStatus === 'paused' && dueAt <= Date.now())
+                || (terminal !== undefined && terminal.immutableContext.state === 'verified'
+                    && terminal.immutableContext.definitionHash === job.definitionHash && terminal.createdAt >= job.createdAt)) {
+                job = this.withGapSource(job.intent.gapId, job.intent.owner, () => {
+                    this.assertGrowthRun(job.intent.creation?.growthRun ?? job.intent.revision?.growthRun, job.intent.mode, job.intent.gapId, job.intent.owner, false);
+                    return this.options.store.rearmQueuedGrowthSourceJob({ id: job.id, revision: job.revision,
+                        priorDefinitionHash: job.definitionHash, priorDefinitionVersion: health.definitionVersion, dispatchAt: Date.now() + 1000 });
+                });
+            }
+        }
         const definition = this.definition(job);
+        const expectedHash = automationDefinitionDigest(definition);
+        if (job.previousDefinitionHash !== undefined) {
+            if (typeof automations.reconcileSystemExact !== 'function')
+                throw new SourceGrowthRunUnavailableError('exact native source rearm unavailable');
+            const health = automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+            const activation = automations.inspectSystemOwnedActivation({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+            if (activation?.activationNonce !== job.intentDigest || activation.ownerRouteId !== this.options.config.ownerRouteId
+                || !((health.definitionHash === job.previousDefinitionHash && health.definitionVersion === job.previousDefinitionVersion)
+                    || (health.definitionHash === expectedHash && health.definitionVersion === job.previousDefinitionVersion + 1))) {
+                throw new SourceGrowthNativeMismatchError('source job native rearm lineage changed');
+            }
+            automations.reconcileSystemExact({ owner: SOURCE_JOB_OWNER, automationId: job.automationId,
+                idempotencyKey: `${job.id}:rearm:${job.dispatchAt}`, desiredStatus: 'active', definition,
+                expectedDefinitionHash: job.previousDefinitionHash, expectedVersion: job.previousDefinitionVersion });
+            const activated = automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+            if (activated.definitionHash !== expectedHash || activated.definitionVersion !== job.previousDefinitionVersion + 1
+                || activated.automationStatus !== 'active')
+                throw new SourceGrowthNativeMismatchError('source job exact native rearm was not active');
+            this.assertOwner(job);
+            this.options.store.bindSourceJobDefinition({ id: job.id, revision: job.revision, definitionHash: expectedHash });
+            return;
+        }
         if (job.definitionHash === undefined) {
-            automations.reconcileSystem({ owner: SOURCE_JOB_OWNER, automationId: job.automationId, idempotencyKey: `${job.id}:prepare`, desiredStatus: 'paused', definition });
+            const prior = job.previousDefinitionHash;
+            const existing = (() => {
+                try {
+                    return automations.inspectSystemOwnedActivation({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            if (existing !== undefined && (existing.activationNonce !== job.intentDigest || existing.ownerRouteId !== this.options.config.ownerRouteId
+                || (existing.definitionHash !== expectedHash && existing.definitionHash !== prior))) {
+                throw new Error('source job native definition differs from persisted rearm');
+            }
+            automations.reconcileSystem({ owner: SOURCE_JOB_OWNER, automationId: job.automationId,
+                idempotencyKey: `${job.id}:prepare:${job.dispatchAt ?? job.createdAt + 1000}`, desiredStatus: 'paused', definition });
             const registered = automations.inspectSystemOwnedActivation({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
-            if (registered === undefined || registered.activationNonce !== job.intentDigest || registered.ownerRouteId !== this.options.config.ownerRouteId)
+            if (registered === undefined || registered.activationNonce !== job.intentDigest || registered.ownerRouteId !== this.options.config.ownerRouteId
+                || registered.definitionHash !== expectedHash)
                 throw new Error('source job registration binding mismatch');
             job = this.options.store.bindSourceJobDefinition({ id: job.id, revision: job.revision, definitionHash: registered.definitionHash });
         }
         const current = automations.inspectSystemOwnedActivation({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
         if (current === undefined || current.definitionHash !== job.definitionHash || current.activationNonce !== job.intentDigest || current.ownerRouteId !== this.options.config.ownerRouteId)
             throw new Error('source job automation changed');
-        automations.reconcileSystem({ owner: SOURCE_JOB_OWNER, automationId: job.automationId, idempotencyKey: `${job.id}:activate`, desiredStatus: 'active', definition });
+        const health = automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+        if (health.definitionHash !== job.definitionHash)
+            throw new Error('source job native definition changed');
+        automations.reconcileSystem({ owner: SOURCE_JOB_OWNER, automationId: job.automationId,
+            idempotencyKey: `${job.id}:activate:v${health.definitionVersion}`, desiredStatus: 'active', definition });
+        const activated = automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+        if (activated.definitionHash !== job.definitionHash || activated.automationStatus !== 'active')
+            throw new Error('source job native activation did not become active');
     }
     hasContinuations() {
-        return !!(this.options.approvePrepared || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased);
+        return !!(this.options.approvePrepared || this.options.verifyPreparedRevisionRegression || this.options.verifyPreparedRevision || this.options.verifyPreparedCreation || this.options.adoptVerifiedCreation || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased);
     }
     continuationJobs() {
         if (!this.hasContinuations())
             return [];
-        return this.options.store.listPreparedSourceApprovalJobs(this.options.releasePrepared !== undefined, this.options.advanceReleased !== undefined, this.options.adoptReleased !== undefined)
-            .filter(job => this.eligibleContinuation(job));
+        return this.options.store.listPreparedSourceApprovalJobs(this.options.releasePrepared !== undefined, this.options.advanceReleased !== undefined, this.options.adoptReleased !== undefined, this.options.verifyPreparedCreation !== undefined, this.options.adoptVerifiedCreation !== undefined, this.options.verifyPreparedRevision !== undefined, this.options.verifyPreparedRevisionRegression !== undefined)
+            .filter(job => this.modeAllowed(job.intent.mode) && this.eligibleContinuation(job));
     }
     /** Admission reads durable state and validates the current owner; it never invokes continuation approval or release hooks. */
     eligibleContinuation(job) {
@@ -365,8 +640,50 @@ export class SourceJobRuntime {
         catch {
             return false;
         }
+        if (plan.mode === 'prepared-revise') {
+            if (job.intent.mode !== 'revise-created' || plan.status !== 'pending-approval' || !plan.sourceRevision?.growthRun.revisionAcceptance)
+                return false;
+            const status = this.options.store.getRevisionVerificationStatus(plan.id);
+            const verify = status === undefined && this.options.verifyPreparedRevision !== undefined;
+            const regression = status === 'verified' && plan.sourceRevision.growthRun.revisionRegressionAcceptance !== undefined
+                && this.options.store.getRevisionRegressionStatus(plan.id) === undefined && this.options.verifyPreparedRevisionRegression !== undefined;
+            if (!verify && !regression)
+                return false;
+            try {
+                this.assertOwner(job);
+            }
+            catch {
+                return false;
+            }
+            return plan.expiresAt > Date.now();
+        }
+        if (plan.mode === 'prepared-create') {
+            if (job.intent.mode !== 'create' || plan.status !== 'pending-approval'
+                || !job.intent.creation?.growthRun?.creationAcceptance || !plan.creation?.growthRun?.creationAcceptance)
+                return false;
+            const verification = this.options.store.getCreationVerificationStatus(plan.id);
+            const verify = verification === undefined && this.options.verifyPreparedCreation !== undefined;
+            const adopt = verification === 'verified' && this.options.adoptVerifiedCreation !== undefined
+                && this.options.creationAdoptionEligible?.(plan.id) === true;
+            if (!verify && !adopt)
+                return false;
+            if (job.intent.authority.digest !== this.authorityDigest || job.intent.authority.id !== this.options.config.authorityId)
+                return false;
+            try {
+                this.assertOwner(job);
+                this.withGapSource(job.intent.gapId, job.intent.owner, () => {
+                    this.assertGrowthRun(job.intent.creation?.growthRun, job.intent.mode, job.intent.gapId, job.intent.owner, false);
+                });
+            }
+            catch {
+                return false;
+            }
+            return plan.expiresAt > Date.now();
+        }
+        if (plan.mode !== 'modify' || job.intent.mode === 'create')
+            return false;
         const adoption = plan.status === 'release-complete' ? this.options.store.findSourceAdoption(plan.id) : undefined;
-        const recovery = adoption !== undefined && ((adoption.status === 'approved' && adoption.dossier.handoff !== undefined) || ['staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'].includes(adoption.status));
+        const recovery = adoption !== undefined && ((adoption.status === 'approved' && adoption.dossier.handoff !== undefined) || ['staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'].includes(adoption.status));
         if (recovery)
             return this.options.adoptReleased !== undefined;
         if (job.intent.authority.digest !== this.authorityDigest || job.intent.authority.id !== this.options.config.authorityId)
@@ -390,12 +707,12 @@ export class SourceJobRuntime {
     continuationTimeoutMs() {
         const release = this.options.releaseTimeoutMs ?? 40_000, adoption = this.options.adoptionTimeoutMs ?? 60_000;
         const needed = (this.options.adoptReleased ? adoption : 0) + (this.options.advanceReleased ? release + 40_000 : this.options.releasePrepared ? 40_000 : 10_000);
-        return Math.max(10_000, needed);
+        return Math.max(this.options.verifyPreparedCreation ? 1_800_000 : 10_000, needed);
     }
     continuationSignalTimeoutMs(job) {
         if (job.planId) {
             const plan = this.options.store.getSourcePlan(job.planId), adoption = plan.status === 'release-complete' ? this.options.store.findSourceAdoption(plan.id) : undefined;
-            if (adoption && ((adoption.status === 'approved' && adoption.dossier.handoff !== undefined) || ['staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'].includes(adoption.status)))
+            if (adoption && ((adoption.status === 'approved' && adoption.dossier.handoff !== undefined) || ['staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'].includes(adoption.status)))
                 return this.continuationTimeoutMs();
         }
         return Math.max(1, Math.min(this.continuationTimeoutMs(), this.options.config.expiresAt - Date.now()));
@@ -461,8 +778,12 @@ export class SourceJobRuntime {
         try {
             this.schedule(job);
         }
-        catch {
+        catch (error) {
+            if (error instanceof SourceGrowthRunUnavailableError)
+                return;
             const current = this.options.store.getSourceJob(job.id);
+            if (current?.previousDefinitionHash !== undefined && !(error instanceof SourceGrowthNativeMismatchError))
+                return;
             if (current?.status === 'queued')
                 this.options.store.settleSourceJob({ id: current.id, revision: current.revision, status: 'failed', failureCode: 'source-job-registration-rejected' });
         }
@@ -472,8 +793,45 @@ export class SourceJobRuntime {
         const failure = (unknown) => ({ outcome: unknown ? 'unknown' : 'failed', failureClass: unknown ? 'unknown' : 'configuration', failurePhase: 'host-execution', failureCode: 'source-job-rejected', sideEffectState: unknown ? 'unknown' : 'none', retryability: unknown ? 'unsafe' : 'after-intervention' });
         if (job === undefined || job.status !== 'queued')
             return failure(job?.status === 'unknown' || job?.status === 'running');
+        // A stale occurrence from before a persisted rearm can never claim this
+        // job. It has acquired no source resource, so leave the queued CAS intact.
+        if ((job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) !== undefined && input.definitionHash !== job.definitionHash) {
+            const expectedPending = job.previousDefinitionHash === undefined ? undefined : automationDefinitionDigest(this.definition(job));
+            if (expectedPending === input.definitionHash && input.executionMode === 'production'
+                && input.activationNonce === job.intentDigest && input.catalogDigest === CATALOG
+                && input.ownerRouteId === job.intent.owner.authorityId && input.principal === job.intent.owner.principalId
+                && input.targetScope.workspace === job.intent.owner.workspace && input.targetScope.preset === job.intent.owner.agentPreset) {
+                try {
+                    // The new native occurrence reached us before its cross-ledger DB
+                    // acknowledgement. It has not claimed source resources. Bind the
+                    // exact native receipt, then persist another one-shot before this
+                    // occurrence can be considered consumed.
+                    this.schedule(job);
+                    const rebound = this.options.store.getSourceJob(job.id);
+                    if (rebound?.status === 'queued' && rebound.definitionHash === input.definitionHash && rebound.occurrenceId === undefined) {
+                        const health = this.options.ports.automations.inspectSystemOwned({ owner: SOURCE_JOB_OWNER, automationId: job.automationId });
+                        if (health.definitionHash !== rebound.definitionHash)
+                            throw new Error('source job premature occurrence native binding changed');
+                        const pending = this.withGapSource(rebound.intent.gapId, rebound.intent.owner, () => {
+                            this.assertGrowthRun(rebound.intent.creation?.growthRun ?? rebound.intent.revision?.growthRun, rebound.intent.mode, rebound.intent.gapId, rebound.intent.owner, false);
+                            return this.options.store.rearmQueuedGrowthSourceJob({ id: rebound.id, revision: rebound.revision,
+                                priorDefinitionHash: rebound.definitionHash, priorDefinitionVersion: health.definitionVersion, dispatchAt: Date.now() + 1000 });
+                        });
+                        this.schedule(pending);
+                    }
+                }
+                catch { /* persisted queued state remains fail-closed for exact recovery */ }
+            }
+            return failure(false);
+        }
         let claimed = false;
-        const signal = AbortSignal.any([input.signal, this.abort.signal, AbortSignal.timeout(Math.max(1, Math.min(job.intent.build.timeoutMs + 120_000 + (this.options.advanceReleased ? this.options.releaseTimeoutMs ?? 40_000 : 0) + (this.options.adoptReleased ? this.options.adoptionTimeoutMs ?? 60_000 : 0), job.expiresAt - Date.now())))]);
+        const growthController = (job.intent.creation?.growthRun ?? job.intent.revision?.growthRun) === undefined ? undefined : new AbortController();
+        if (growthController)
+            this.growthControllers.add(growthController);
+        const signal = AbortSignal.any([input.signal, this.abort.signal,
+            ...(growthController ? [growthController.signal] : []),
+            AbortSignal.timeout(Math.max(1, Math.min(job.intent.build.timeoutMs + 120_000 + (this.options.verifyPreparedCreation ? 1_800_000 : 0)
+                + (this.options.advanceReleased ? this.options.releaseTimeoutMs ?? 40_000 : 0) + (this.options.adoptReleased ? this.options.adoptionTimeoutMs ?? 60_000 : 0), job.expiresAt - Date.now())))]);
         try {
             this.assertOwner(job);
             signal.throwIfAborted();
@@ -499,7 +857,9 @@ export class SourceJobRuntime {
             await this.options.prepare(owned, signal, assertCurrent);
             if (this.options.store.getSourceJob(owned.id)?.status !== 'prepared')
                 throw new Error('source job completion was not committed');
-            if ((this.options.approvePrepared || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased) && this.options.store.getOwnerTaskFailureReference(owned.intent.gapId)) {
+            if ((owned.intent.mode === 'create' ? this.options.verifyPreparedCreation !== undefined
+                : owned.intent.mode === 'revise-created' ? this.options.verifyPreparedRevision !== undefined : !!(this.options.approvePrepared || this.options.releasePrepared || this.options.advanceReleased || this.options.adoptReleased))
+                && this.options.store.getOwnerTaskFailureReference(owned.intent.gapId)) {
                 this.reconcileContinuations();
                 this.assertOwner(owned);
                 await this.continuePrepared(this.options.store.getSourceJob(owned.id), signal);
@@ -507,13 +867,22 @@ export class SourceJobRuntime {
             }
             return { outcome: 'succeeded', failureClass: 'none', failurePhase: 'none', failureCode: 'none', sideEffectState: 'possible', retryability: 'unsafe' };
         }
-        catch {
+        catch (error) {
             const current = this.options.store.getSourceJob(job.id);
+            if (!claimed && error instanceof SourceGrowthRunUnavailableError)
+                return failure(false);
+            if (!claimed && current?.status === 'queued'
+                && (current.revision !== job.revision || current.definitionHash !== input.definitionHash))
+                return failure(false);
             if (current?.status === 'queued' || (current?.status === 'running' && current.occurrenceId === input.occurrenceId)) {
                 this.options.store.settleSourceJob({ id: current.id, revision: current.revision, status: claimed ? 'unknown' : 'failed', failureCode: claimed ? 'source-job-interrupted' : 'source-job-preflight-rejected' });
             }
             return failure(claimed);
         }
+        finally {
+            if (growthController)
+                this.growthControllers.delete(growthController);
+        }
     }
     /** Explicit Host action. Unknown keeps its capacity until exact cleanup succeeds. */
     reconcileUnknown(input) {
@@ -525,7 +894,15 @@ export class SourceJobRuntime {
             const trust = await this.options.trust();
             if (controlPlaneDigest(trust) !== job.intent.trustDigest)
                 throw new Error('source job trust changed');
-            await removeSourceJobContainer(job.intent.build, { id: job.id, containerName: job.intent.containerName });
+            if ('backend' in job.intent.build) {
+                if (job.intent.nativeResource?.backend !== 'macos-seatbelt' || job.intent.nativeResource.key !== job.id
+                    || await this.options.inspectNativeQuiescence?.(job.id) !== 'quiescent') {
+                    throw new Error('native source job has no valid durable quiescence receipt');
+                }
+            }
+            else {
+                await removeSourceJobContainer(job.intent.build, { id: job.id, containerName: job.intent.containerName });
+            }
             await removeSourceJobWorktree({ stateRoot: join(this.options.statePath, 'source-worktrees'), repository: job.intent.repository, worktree: job.intent.worktree, baseCommit: job.intent.baseCommit, environment: inheritedEnvironment(trust) });
             this.inspect(input);
             return projection(this.options.store.settleSourceJob({ id: job.id, revision: job.revision, status: 'failed', failureCode: 'source-job-resources-reconciled' }));