@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.53

package/lib/store.js

@@ -1,20 +1,37 @@
+import { validateLiveQualificationTerms, assertLiveQualificationBatch, parseLiveQualificationReceipt, verifyLiveQualificationReceipt } from './live-qualification.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { basename, isAbsolute } from 'node:path';
+import { createPublicKey, verify } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { basename, isAbsolute, posix, resolve, win32 } from 'node:path';
 import { discover, parseCatalog } from './catalog.js';
 import { parseApprovalReceipt } from './approval.js';
 import { parseSourcePublishReconciliationReceipt, parseSourcePublishReconciliationRequest, parseSourceReleaseAuthorization, parseSourceReleaseReceipt, parseSourceReleaseRequest, parseVerifiedSourceReleaseAuthorization } from './release.js';
-import { controlPlaneOperationReceiptDigest, controlPlaneSchemaVersion, openControlPlaneDatabase } from './sqlite.js';
+import { controlPlaneOperationReceiptDigest, controlPlaneSchemaVersion, openControlPlaneDatabase, openControlPlaneDatabaseReadOnly } from './sqlite.js';
 import { validateSourceBuildConfig } from './source-build.js';
+import { validateSourceBaselineConfig, verifySourceBaselineHistory } from './source-baseline.js';
 import { validateScopedPluginFiles } from './source-workspace.js';
+import { validateCreationCapabilitySource } from './creation-capability-source.js';
+import { validateSourceRevisionBinding } from './source-revision.js';
+import { validateSourceCreationFiles, validateSourceCreationGrant } from './source-creation.js';
+import { sourceGrowthRunDigest, validatePluginRevisionRegressionCertificate, validatePluginRevisionVerificationCertificate, validatePluginCreationVerificationCertificate, validateSourceGrowthRunBinding } from '@dsh-enhanced/assistant-growth-contract';
 import { validateAdoptionHandoffTerms } from './adoption-handoff.js';
 import { assertForegroundDeployment, assertForegroundTask } from './foreground-deployment.js';
 import { assertTaskObservationBatch, getTaskObservationRecord, readTaskObservationContext } from './task-observation-store.js';
+import { parseRuntimeEpochRequest, parseRuntimeEpochReceipt, verifyRuntimeEpochReceipt } from './runtime-epoch.js';
+import { runtimeIdentityDigest } from './foreground-deployment.js';
+import { readHostMaintenanceRecords, verifyHostMaintenanceChain, hostMaintenanceCanonical, hostMaintenanceDigest } from './host-maintenance.js';
+import { parseSourceMaintenanceRecord, sameSourceMaintenancePublicKey, sourceMaintenanceDigest, sourceBaselineChain, verifySourceMaintenanceRecords } from './source-maintenance.js';
+import { resolveTrustKey } from './trust.js';
 const KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
 const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
 const PLUGIN_NAME = /^(?=.{1,64}$)[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
 const DIGEST = /^[a-f0-9]{64}$/u;
 const COMMIT = /^[a-f0-9]{40}$/u;
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const MAX_PREPARED_ARTIFACT_BYTES = 32 * 1024 * 1024;
+const MAX_STORED_ARTIFACT_BYTES = 128 * 1024 * 1024;
+const MAX_STORED_ARTIFACTS = 256;
 const SOURCE_STATUSES = new Set(['expired', 'pending-approval', 'approved', 'running-local-checks', 'ready-for-human-review',
     'local-checks-failed', 'awaiting-pr', 'awaiting-review', 'awaiting-merge', 'awaiting-build', 'awaiting-sign', 'awaiting-publish',
     'awaiting-registry-verify', 'awaiting-catalog-admission', 'release-complete', 'release-failed', 'publish-ambiguous']);
@@ -22,9 +39,26 @@ const SOURCE_PLAN_KEYS = ['schemaVersion', 'kind', 'id', 'gapId', 'gapSnapshot',
     'expiresAt', 'digest', 'repository', 'worktree', 'baseCommit', 'name', 'generatorDigest', 'scope'];
 const ACTIVATION_PLAN_KEYS = ['schemaVersion', 'kind', 'id', 'gapId', 'gapSnapshot', 'status', 'revision', 'createdAt',
     'expiresAt', 'profile', 'candidate', 'dossier', 'installationId', 'ledger', 'target', 'executor', 'digest'];
-const ACTIVATION_STATUSES = new Set(['pending-approval', 'approved', 'staging', 'awaiting-reload', 'awaiting-readiness',
+const ACTIVATION_STATUSES = new Set(['pending-approval', 'approved', 'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks',
     'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending',
     'rollback-pending', 'activated', 'rolled-back']);
+export function validateHostDeploymentInputs(value) {
+    if (!Array.isArray(value) || value.length < 1 || value.length > 128) {
+        throw new ControlPlaneStoreError('invalid-input', 'Host deployment inputs require 1..128 relative paths');
+    }
+    const seen = new Set();
+    for (const input of value) {
+        if (typeof input !== 'string' || input.length === 0 || Buffer.byteLength(input) > 4096
+            || input !== input.normalize('NFC') || input !== input.trim() || input.includes('\\')
+            || [...input].some(character => { const point = character.codePointAt(0); return point < 32 || point === 127; })
+            || posix.isAbsolute(input) || win32.parse(input).root !== ''
+            || input.split('/').some(part => part === '' || part === '.' || part === '..')
+            || posix.normalize(input) !== input || seen.has(input)) {
+            throw new ControlPlaneStoreError('invalid-input', 'Host deployment input is not a unique normalized relative path');
+        }
+        seen.add(input);
+    }
+}
 export class ControlPlaneStoreError extends Error {
     code;
     constructor(code, message) {
@@ -33,6 +67,50 @@ export class ControlPlaneStoreError extends Error {
         this.name = 'ControlPlaneStoreError';
     }
 }
+function sourceMaintenanceGit(cwd, args) {
+    const result = spawnSync('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'protocol.allow=never',
+        '-c', 'gc.auto=0', ...args], { cwd, encoding: 'utf8', timeout: 30_000, maxBuffer: 16384,
+        env: { LANG: 'C', LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null',
+            GIT_CONFIG_SYSTEM: '/dev/null', GIT_CONFIG_COUNT: '0', GIT_ALLOW_PROTOCOL: 'file',
+            GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0', GIT_NO_LAZY_FETCH: '1' } });
+    if (result.error || result.status !== 0 || result.signal || typeof result.stdout !== 'string') {
+        throw new ControlPlaneStoreError('conflict', 'source maintenance Git evidence failed');
+    }
+    return result.stdout.trimEnd();
+}
+function sourceMaintenanceDirectRef(cwd, ref) {
+    const fields = sourceMaintenanceGit(cwd, ['for-each-ref', '--format=%(refname)%00%(objectname)%00%(symref)', ref]).split('\0');
+    if (fields.length !== 3 || fields[0] !== ref || !COMMIT.test(fields[1] ?? '') || fields[2] !== '') {
+        throw new ControlPlaneStoreError('conflict', 'source maintenance Git ref is missing or symbolic');
+    }
+    return fields[1];
+}
+function assertSourceMaintenanceGit(record, physicalHome, logicalHome, requireCurrentRefs = true) {
+    if (realpathSync(physicalHome) !== physicalHome)
+        throw new ControlPlaneStoreError('invalid-input', 'source maintenance physical Home is not canonical');
+    const project = (path) => {
+        if (!path.startsWith(`${logicalHome}/`))
+            throw new ControlPlaneStoreError('invalid-input', 'source maintenance Git path is outside Home');
+        return `${physicalHome}${path.slice(logicalHome.length)}`;
+    };
+    const repository = project(record.repository), remote = project(record.baseline.remote);
+    if (realpathSync(repository) !== repository || realpathSync(remote) !== remote
+        || sourceMaintenanceGit(repository, ['rev-parse', '--show-toplevel']) !== repository
+        || sourceMaintenanceGit(remote, ['rev-parse', '--is-bare-repository']) !== 'true') {
+        throw new ControlPlaneStoreError('conflict', 'source maintenance Git repository changed');
+    }
+    const branch = requireCurrentRefs ? sourceMaintenanceDirectRef(remote, `refs/heads/${record.baseline.targetBranch}`) : undefined;
+    const managed = requireCurrentRefs ? sourceMaintenanceDirectRef(repository, record.baseline.ref) : undefined;
+    if (requireCurrentRefs && (branch !== record.candidateTip || managed !== record.candidateTip)
+        || sourceMaintenanceGit(repository, ['rev-parse', `${record.candidateTip}^{tree}`]) !== record.sourceTree) {
+        throw new ControlPlaneStoreError('conflict', 'source maintenance candidate Git tip or tree changed');
+    }
+    for (const [earlier, later] of [[record.previousTip, record.candidateTip], [record.upstreamCommit, record.candidateTip],
+        [record.before.sourceCommit, record.previousTip], [record.after.sourceCommit, record.candidateTip],
+        [record.before.sourceCommit, record.after.sourceCommit]]) {
+        sourceMaintenanceGit(repository, ['merge-base', '--is-ancestor', earlier, later]);
+    }
+}
 function canonical(value) {
     if (Array.isArray(value))
         return `[${value.map(canonical).join(',')}]`;
@@ -73,9 +151,45 @@ function positiveInteger(value, field) {
  */
 export const MODIFY_GENERATOR_DIGEST = createHash('sha256').update('dsh-source-modify-no-generator-v1').digest('hex');
 function expectedSourceScope(name, mode) {
-    return mode === 'create'
-        ? Object.freeze(['plugins/README.md', `plugins/${name}`].sort())
-        : Object.freeze([`plugins/${name}`]);
+    return mode === 'prepared-create' || mode === 'prepared-revise'
+        ? Object.freeze(['plugins/README.md', `plugins/${name}`, 'pnpm-lock.yaml'].sort())
+        : mode === 'create'
+            ? Object.freeze(['plugins/README.md', `plugins/${name}`].sort())
+            : Object.freeze([`plugins/${name}`]);
+}
+function creationBindingFromStored(value) {
+    const binding = objectRecord(value, 'source creation binding');
+    exactKeys(binding, ['grant', 'generatorDigest', ...(Object.hasOwn(binding, 'growthRun') ? ['growthRun'] : [])], 'source creation binding');
+    try {
+        validateSourceCreationGrant(binding['grant']);
+    }
+    catch {
+        throw new ControlPlaneStoreError('invalid-input', 'source creation grant is invalid');
+    }
+    if (typeof binding['generatorDigest'] !== 'string' || !DIGEST.test(binding['generatorDigest'])) {
+        throw new ControlPlaneStoreError('invalid-input', 'source creation generator digest is invalid');
+    }
+    let growthRun;
+    if (Object.hasOwn(binding, 'growthRun')) {
+        try {
+            validateSourceGrowthRunBinding(binding['growthRun']);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-input', 'source creation growth run is invalid');
+        }
+        growthRun = structuredClone(binding['growthRun']);
+    }
+    return Object.freeze({ grant: Object.freeze(structuredClone(binding['grant'])), generatorDigest: binding['generatorDigest'],
+        ...(growthRun === undefined ? {} : { growthRun: Object.freeze(growthRun) }) });
+}
+function revisionBindingFromStored(value) {
+    try {
+        validateSourceRevisionBinding(value);
+    }
+    catch {
+        throw new ControlPlaneStoreError('invalid-input', 'source revision binding is invalid');
+    }
+    return Object.freeze(structuredClone(value));
 }
 function objectRecord(value, label) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
@@ -124,7 +238,8 @@ function activationSnapshotFromStored(value) {
     exactKeys(gapSnapshot, ['revision', 'inputDigest', 'roi', 'capability'], 'stored activation gap snapshot');
     const dossier = objectRecord(item['dossier'], 'stored activation dossier');
     exactKeys(dossier, ['catalogDigest', 'catalogProvenance', 'matchedCapabilities', 'authorities', 'packages',
-        ...(Object.hasOwn(dossier, 'handoff') ? ['handoff'] : [])], 'stored activation dossier');
+        ...(Object.hasOwn(dossier, 'handoff') ? ['handoff'] : []), ...(Object.hasOwn(dossier, 'liveQualification') ? ['liveQualification'] : []),
+        ...(Object.hasOwn(dossier, 'hostDeploymentInputs') ? ['hostDeploymentInputs'] : [])], 'stored activation dossier');
     const ledger = objectRecord(item['ledger'], 'stored activation ledger');
     exactKeys(ledger, ['id', 'path'], 'stored activation ledger');
     const target = objectRecord(item['target'], 'stored activation target');
@@ -157,6 +272,16 @@ function activationSnapshotFromStored(value) {
         || typeof executor['sha256'] !== 'string' || !DIGEST.test(executor['sha256'])) {
         throw new ControlPlaneStoreError('invalid-state', 'stored activation plan snapshot is corrupt');
     }
+    if (dossier['liveQualification'] !== undefined)
+        validateLiveQualificationTerms(dossier['liveQualification']);
+    if (dossier['hostDeploymentInputs'] !== undefined) {
+        try {
+            validateHostDeploymentInputs(dossier['hostDeploymentInputs']);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored Host deployment inputs are corrupt');
+        }
+    }
     if (dossier['handoff'] !== undefined) {
         try {
             validateAdoptionHandoffTerms(dossier['handoff']);
@@ -300,6 +425,141 @@ function activationCoreFiles(value, targetPath, label) {
     }
     return value;
 }
+function hostInputPins(value, inputs, targetPath, label) {
+    if (!Array.isArray(value) || value.length !== inputs.length)
+        throw new ControlPlaneStoreError('invalid-state', `${label} does not cover signed inputs`);
+    const paths = new Set();
+    for (let index = 0; index < value.length; index++) {
+        const item = value[index];
+        if (!item || typeof item !== 'object' || Array.isArray(item)
+            || Object.keys(item).sort().join('\0') !== 'input\0path\0sha256' || item.input !== inputs[index]
+            || typeof item.path !== 'string' || !isAbsolute(item.path) || resolve(item.path) !== item.path
+            || !item.path.startsWith(`${targetPath}/`) || paths.has(item.path)
+            || typeof item.sha256 !== 'string' || !DIGEST.test(item.sha256)) {
+            throw new ControlPlaneStoreError('invalid-state', `${label} contains an unbound or unsafe file pin`);
+        }
+        paths.add(item.path);
+    }
+    return value;
+}
+function hostInputWitnessFromRow(database, plan, project = true) {
+    const row = database.prepare('SELECT witness_json,witness_digest FROM activation_host_input_witnesses WHERE plan_id=?')
+        .get(plan.id);
+    if (!row)
+        return undefined;
+    if (Buffer.byteLength(row.witness_json) > 262_144)
+        throw new ControlPlaneStoreError('invalid-state', 'Host input witness exceeds storage bound');
+    let witness;
+    try {
+        witness = JSON.parse(row.witness_json);
+    }
+    catch {
+        throw new ControlPlaneStoreError('invalid-state', 'Host input witness JSON is corrupt');
+    }
+    if (!witness || typeof witness !== 'object' || Array.isArray(witness)
+        || Object.keys(witness).sort().join('\0') !== ['schemaVersion', 'kind', 'planId', 'planDigest', 'activationId', 'fence', 'createdAt',
+            'inputs', 'profileFiles', 'deploymentFiles', 'baselineDeploymentFiles', 'digest'].sort().join('\0')
+        || witness.schemaVersion !== 1 || witness.kind !== 'dsh-host-input-witness'
+        || !plan.dossier.hostDeploymentInputs || witness.planId !== plan.id || witness.planDigest !== plan.digest
+        || !plan.activation || witness.activationId !== plan.activation.id || !Number.isSafeInteger(witness.fence) || witness.fence < 1
+        || (witness.fence !== plan.activation.fence && !(['rollback-pending', 'rolled-back'].includes(plan.status) && witness.fence < plan.activation.fence))
+        || !Number.isSafeInteger(witness.createdAt) || witness.createdAt < plan.createdAt
+        || controlPlaneDigest(witness) !== row.witness_digest)
+        throw new ControlPlaneStoreError('invalid-state', 'Host input witness identity changed');
+    const { digest, ...unsigned } = witness;
+    if (digest !== controlPlaneDigest(unsigned) || !Array.isArray(witness.inputs)
+        || controlPlaneDigest(witness.inputs) !== controlPlaneDigest(plan.dossier.hostDeploymentInputs)) {
+        throw new ControlPlaneStoreError('invalid-state', 'Host input witness digest or signed input set changed');
+    }
+    const core = activationCoreFiles(witness.profileFiles, plan.target.profilePath, 'Host input witness core files');
+    if (core.some(file => file.sha256 === null))
+        throw new ControlPlaneStoreError('invalid-state', 'Host input witness has an absent core file');
+    hostInputPins(witness.deploymentFiles, witness.inputs, plan.target.profilePath, 'Host input witness deployment files');
+    if (plan.activation.targetOriginallyExisted) {
+        hostInputPins(witness.baselineDeploymentFiles, witness.inputs, plan.target.profilePath, 'Host input witness baseline files');
+    }
+    else if (!Array.isArray(witness.baselineDeploymentFiles) || witness.baselineDeploymentFiles.length !== 0) {
+        throw new ControlPlaneStoreError('invalid-state', 'absent original target has Host input baseline files');
+    }
+    if (!project)
+        return witness;
+    const latest = readHostMaintenanceContext(database, plan.id).records.at(-1);
+    if (!latest)
+        return witness;
+    const { digest: _digest, ...original } = witness;
+    const effective = { ...original, profileFiles: latest.after.profileFiles,
+        deploymentFiles: latest.after.deploymentFiles, baselineDeploymentFiles: latest.after.baselineDeploymentFiles };
+    return { ...effective, digest: controlPlaneDigest(effective) };
+}
+/** Offline update seam. Reads original history before verifying its maintenance chain. */
+export function readHostMaintenanceContext(database, planId) {
+    const row = database.prepare('SELECT * FROM activation_plans WHERE id=?').get(planId);
+    if (!row)
+        throw new ControlPlaneStoreError('not-found', 'maintenance plan absent');
+    const plan = activationFromRow(row), records = readHostMaintenanceRecords(database, planId);
+    const witness = hostInputWitnessFromRow(database, plan, false);
+    const readinessRow = database.prepare(`SELECT operation.* FROM host_attestation_operations operation
+    JOIN host_attestations attestation ON attestation.plan_id=operation.plan_id AND attestation.phase=operation.phase
+      AND attestation.receipt_digest=operation.receipt_digest
+    WHERE operation.plan_id=? AND operation.phase='readiness' AND operation.status='applied'`).get(planId);
+    const readiness = readinessRow ? hostOperationFromRow(readinessRow).receipt : undefined;
+    if (records.length) {
+        if (!witness || !readiness || readiness.outcome !== 'passed')
+            throw new ControlPlaneStoreError('invalid-state', 'maintenance lost original readiness');
+        verifyHostMaintenanceChain(records, plan, readiness, witness);
+        const checkpoint = database.prepare('SELECT baseline_json FROM activation_deployment_checkpoints WHERE plan_id=?').get(plan.id);
+        if (!checkpoint || controlPlaneDigest(JSON.parse(String(checkpoint.baseline_json))) !== controlPlaneDigest(records[0].before.profileFiles)) {
+            throw new ControlPlaneStoreError('invalid-state', 'maintenance original deployment checkpoint changed');
+        }
+    }
+    return { plan, witness, readiness, records };
+}
+/** Caller owns the stopped Home transaction; this append never rewrites historical evidence. */
+export function appendHostMaintenance(database, record) {
+    database.exec('SAVEPOINT append_host_maintenance');
+    try {
+        // Acquire the SQLite writer reservation before reading the current lineage.
+        // A savepoint composes with the installer's enclosing offline transaction.
+        database.exec('UPDATE deployment_host_maintenance SET sequence=sequence WHERE 0');
+        appendHostMaintenanceLocked(database, record);
+        database.exec('RELEASE append_host_maintenance');
+    }
+    catch (error) {
+        database.exec('ROLLBACK TO append_host_maintenance; RELEASE append_host_maintenance');
+        throw error;
+    }
+}
+function appendHostMaintenanceLocked(database, record) {
+    const context = readHostMaintenanceContext(database, record.plan.id), { plan, witness, readiness, records } = context;
+    const prior = records.find(item => item.transactionId === record.transactionId);
+    if (prior) {
+        if (hostMaintenanceDigest(prior) !== hostMaintenanceDigest(record))
+            throw new ControlPlaneStoreError('conflict', 'maintenance transaction changed');
+        return;
+    }
+    const current = readCurrentRuntimeEpochDeployment(database, plan.target.profilePath);
+    if (current.plan.id !== plan.id)
+        throw new ControlPlaneStoreError('conflict', 'maintenance deployment was superseded');
+    const watch = database.prepare('SELECT state,activation_id,fence FROM activation_watch WHERE plan_id=?').get(plan.id);
+    if (plan.status !== 'activated' || !witness || !readiness || readiness.outcome !== 'passed'
+        || watch?.state !== 'watching' || watch.activation_id !== plan.activation?.id || watch.fence !== plan.activation?.fence) {
+        throw new ControlPlaneStoreError('invalid-state', 'maintenance requires a watched successful deployment');
+    }
+    verifyHostMaintenanceChain([...records, record], plan, readiness, witness);
+    const checkpoint = database.prepare('SELECT baseline_json FROM activation_deployment_checkpoints WHERE plan_id=?').get(plan.id);
+    if (!checkpoint || controlPlaneDigest(JSON.parse(String(checkpoint.baseline_json))) !== controlPlaneDigest(witness.profileFiles)) {
+        throw new ControlPlaneStoreError('invalid-state', 'maintenance original deployment checkpoint changed');
+    }
+    database.prepare('INSERT INTO deployment_host_maintenance VALUES (?,?,?,?,?)')
+        .run(plan.id, record.sequence, record.transactionId, JSON.stringify(record), hostMaintenanceDigest(record));
+}
+function effectiveActivationFromRow(database, row) {
+    const plan = activationFromRow(row);
+    if (!database.prepare('SELECT 1 FROM deployment_host_maintenance WHERE plan_id=? LIMIT 1').get(plan.id))
+        return plan;
+    const latest = readHostMaintenanceContext(database, plan.id).records.at(-1);
+    return latest && plan.activation ? { ...plan, activation: { ...plan.activation, targetBaselineFiles: latest.after.baselineFiles } } : plan;
+}
 function activationFromRow(row) {
     const candidate = parseCatalog({ schemaVersion: 1, entries: [JSON.parse(row.candidate_json)] }).entries[0];
     const gapSnapshot = JSON.parse(row.gap_snapshot_json);
@@ -307,6 +567,16 @@ function activationFromRow(row) {
     if (candidate === undefined || !DIGEST.test(row.plan_digest) || !UUID.test(row.installation_id)
         || !DIGEST.test(gapSnapshot.inputDigest) || !DIGEST.test(dossier.catalogDigest))
         throw new ControlPlaneStoreError('invalid-state', 'stored activation plan is corrupt');
+    if (dossier.liveQualification !== undefined)
+        validateLiveQualificationTerms(dossier.liveQualification);
+    if (dossier.hostDeploymentInputs !== undefined) {
+        try {
+            validateHostDeploymentInputs(dossier.hostDeploymentInputs);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored Host deployment inputs are corrupt');
+        }
+    }
     if (dossier.handoff !== undefined) {
         try {
             validateAdoptionHandoffTerms(dossier.handoff);
@@ -373,6 +643,29 @@ function activationFromRow(row) {
 }
 function preparedEvidenceFromStored(value) {
     const item = objectRecord(value, 'stored source prepared evidence');
+    if (item['schemaVersion'] === 2) {
+        exactKeys(item, ['schemaVersion', 'kind', 'boundary', 'runtimeDigest', 'fixedCompilerSha256', 'checks', 'pack', 'preparedAt'], 'stored native source prepared evidence');
+        const pack = objectRecord(item['pack'], 'stored native source pack');
+        exactKeys(pack, ['name', 'version', 'sizeBytes', 'sha256'], 'stored native source pack');
+        const checks = item['checks'];
+        if (item['kind'] !== 'dsh-source-prepared-evidence' || item['boundary'] !== 'macos-seatbelt-single-process-v1'
+            || !DIGEST.test(String(item['runtimeDigest'])) || !DIGEST.test(String(item['fixedCompilerSha256']))
+            || !Array.isArray(checks) || checks.length !== 3 || checks[0] !== 'semantic-typecheck'
+            || checks[1] !== 'js-declaration-emit' || checks[2] !== 'host-safe-pack'
+            || typeof pack['name'] !== 'string' || pack['name'] === '' || pack['name'].length > 214
+            || typeof pack['version'] !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+=-]{0,63}$/u.test(pack['version'])
+            || !Number.isSafeInteger(pack['sizeBytes']) || Number(pack['sizeBytes']) < 1 || Number(pack['sizeBytes']) > 512 * 1024
+            || !DIGEST.test(String(pack['sha256']))
+            || !Number.isSafeInteger(item['preparedAt']) || Number(item['preparedAt']) < 0) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored native source prepared evidence is corrupt');
+        }
+        return Object.freeze({ schemaVersion: 2, kind: 'dsh-source-prepared-evidence',
+            boundary: 'macos-seatbelt-single-process-v1', runtimeDigest: String(item['runtimeDigest']),
+            fixedCompilerSha256: String(item['fixedCompilerSha256']),
+            checks: Object.freeze(['semantic-typecheck', 'js-declaration-emit', 'host-safe-pack']),
+            pack: Object.freeze({ name: String(pack['name']), version: String(pack['version']),
+                sizeBytes: Number(pack['sizeBytes']), sha256: String(pack['sha256']) }), preparedAt: Number(item['preparedAt']) });
+    }
     exactKeys(item, ['schemaVersion', 'kind', 'environment', 'commands', 'pack', 'preparedAt'], 'stored source prepared evidence');
     const environment = objectRecord(item['environment'], 'stored source prepared evidence environment');
     exactKeys(environment, ['npmConfigIgnoreScripts', 'frozenLockfile', 'offline', 'nodeVersion', 'pnpmVersion'], 'stored source prepared evidence environment');
@@ -388,15 +681,18 @@ function preparedEvidenceFromStored(value) {
     const commands = item['commands'].map((entry, index) => {
         const command = objectRecord(entry, `stored source prepared evidence command ${index}`);
         exactKeys(command, ['command', 'args', 'exitCode', 'durationMs', 'logDigest'], `stored source prepared evidence command ${index}`);
+        const args = command['args'];
+        const scriptIndex = command['command'] === 'docker' && Array.isArray(args) && args.at(-2) === '-ceu'
+            ? args.length - 1 : -1;
         if (typeof command['command'] !== 'string' || command['command'] === '' || command['command'].length > 64
-            || !Array.isArray(command['args']) || command['args'].length > 64
-            || command['args'].some(arg => typeof arg !== 'string' || arg.length > 4096)
+            || !Array.isArray(args) || args.length > 96
+            || args.some((arg, argIndex) => typeof arg !== 'string' || arg.length > (argIndex === scriptIndex ? 32_768 : 4096))
             || command['exitCode'] !== 0
             || !Number.isSafeInteger(command['durationMs']) || Number(command['durationMs']) < 0
             || !DIGEST.test(String(command['logDigest']))) {
             throw new ControlPlaneStoreError('invalid-state', `stored source prepared evidence command ${index} is corrupt`);
         }
-        return Object.freeze({ command: String(command['command']), args: Object.freeze([...command['args']]),
+        return Object.freeze({ command: String(command['command']), args: Object.freeze([...args]),
             exitCode: 0, durationMs: Number(command['durationMs']), logDigest: String(command['logDigest']) });
     });
     const pack = objectRecord(item['pack'], 'stored source prepared evidence pack');
@@ -415,8 +711,21 @@ function preparedEvidenceFromStored(value) {
             sizeBytes: Number(pack['sizeBytes']), sha256: String(pack['sha256']) }),
         preparedAt: Number(item['preparedAt']) });
 }
+function preparedArtifactBytesFromRow(row, pack) {
+    if (row.pack_sha256 !== pack.sha256 || !Number.isSafeInteger(row.size_bytes)
+        || row.size_bytes < 1 || row.size_bytes > MAX_PREPARED_ARTIFACT_BYTES
+        || row.size_bytes !== pack.sizeBytes || !(row.bytes instanceof Uint8Array)
+        || !Number.isSafeInteger(row.created_at) || row.created_at < 0) {
+        throw new ControlPlaneStoreError('invalid-state', 'stored prepared source artifact metadata is corrupt');
+    }
+    const bytes = Buffer.from(row.bytes);
+    if (bytes.length !== row.size_bytes || createHash('sha256').update(bytes).digest('hex') !== pack.sha256) {
+        throw new ControlPlaneStoreError('invalid-state', 'stored prepared source artifact bytes are corrupt');
+    }
+    return bytes;
+}
 function sourceFromRow(row) {
-    if (row.mode !== 'create' && row.mode !== 'modify') {
+    if (row.mode !== 'create' && row.mode !== 'modify' && row.mode !== 'prepared-create' && row.mode !== 'prepared-revise') {
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan has an unknown mode');
     }
     const gapSnapshot = JSON.parse(row.gap_snapshot_json);
@@ -439,9 +748,23 @@ function sourceFromRow(row) {
             throw new ControlPlaneStoreError('invalid-state', 'stored source prepared evidence is corrupt');
         }
     }
-    if ((row.mode === 'modify') !== (preparedEvidence !== undefined)
-        || (row.mode === 'modify' && (row.checked_tree_digest === null || row.checked_patch_digest === null || row.checked_at === null))
-        || (row.mode === 'modify' && ['running-local-checks', 'local-checks-failed'].includes(row.status))) {
+    let creation;
+    if (row.creation_json !== null) {
+        try {
+            creation = creationBindingFromStored(JSON.parse(row.creation_json));
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored source creation binding is corrupt');
+        }
+    }
+    const revision = row.revision_json === null ? undefined : revisionBindingFromStored(JSON.parse(row.revision_json));
+    const prepared = row.mode === 'modify' || row.mode === 'prepared-create' || row.mode === 'prepared-revise';
+    if (prepared !== (preparedEvidence !== undefined) || (row.mode === 'modify' && preparedEvidence?.schemaVersion !== 1)
+        || (row.mode === 'prepared-create') !== (creation !== undefined) || (row.mode === 'prepared-revise') !== (revision !== undefined)
+        || ((row.mode === 'prepared-create' || row.mode === 'prepared-revise') && (!['pending-approval', 'expired'].includes(row.status) || (creation ?? revision)?.generatorDigest !== row.generator_digest
+            || row.approval_json !== null || row.release_authorization_json !== null || row.release_id !== null))
+        || (prepared && (row.checked_tree_digest === null || row.checked_patch_digest === null || row.checked_at === null))
+        || (prepared && ['running-local-checks', 'local-checks-failed'].includes(row.status))) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan mode does not match its evidence or status');
     }
     let approval;
@@ -463,8 +786,8 @@ function sourceFromRow(row) {
             || !Number.isSafeInteger(sourceCheck.checkedAt) || sourceCheck.checkedAt < 0))) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source check evidence is corrupt');
     }
-    const digestBinding = row.mode === 'modify'
-        ? { ...immutable, mode: row.mode, sourceCheck, preparedEvidence }
+    const digestBinding = prepared
+        ? { ...immutable, mode: row.mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), sourceCheck, preparedEvidence }
         : immutable;
     if (controlPlaneDigest(digestBinding) !== row.plan_digest) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan is corrupt or digest-mismatched');
@@ -493,7 +816,7 @@ function sourceFromRow(row) {
         && (row.release_id === null || releaseAuthorization === undefined || sourceCheck === undefined))) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source release state is incomplete');
     }
-    return { ...immutable, mode: row.mode, digest: row.plan_digest, status: row.status, revision: row.revision,
+    return { ...immutable, mode: row.mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), digest: row.plan_digest, status: row.status, revision: row.revision,
         ...(approval === undefined ? {} : { approval }),
         ...(sourceCheck === undefined ? {} : { sourceCheck }),
         ...(preparedEvidence === undefined ? {} : { preparedEvidence }),
@@ -507,14 +830,14 @@ function sourceSnapshotFromStored(value) {
     // `mode` was introduced in schema v13; receipt rows written by older binaries
     // omit it and are backfilled to 'create'. `preparedEvidence` exists only on
     // 'modify' plans.
-    const optional = ['approval', 'sourceCheck', 'preparedEvidence', 'releaseAuthorization', 'release']
+    const optional = ['approval', 'sourceCheck', 'preparedEvidence', 'creation', 'sourceRevision', 'releaseAuthorization', 'release']
         .filter(key => Object.hasOwn(item, key));
     exactKeys(item, [...SOURCE_PLAN_KEYS, 'mode', ...optional], 'stored source plan snapshot');
     const rawMode = item['mode'];
     const mode = rawMode === undefined
         ? 'create'
-        : rawMode === 'create' || rawMode === 'modify' ? rawMode : 'create';
-    const modeValid = rawMode === undefined || rawMode === 'create' || rawMode === 'modify';
+        : rawMode === 'create' || rawMode === 'modify' || rawMode === 'prepared-create' || rawMode === 'prepared-revise' ? rawMode : 'create';
+    const modeValid = rawMode === undefined || rawMode === 'create' || rawMode === 'modify' || rawMode === 'prepared-create' || rawMode === 'prepared-revise';
     const gapSnapshot = objectRecord(item['gapSnapshot'], 'stored source gap snapshot');
     exactKeys(gapSnapshot, ['revision', 'inputDigest', 'roi', 'capability'], 'stored source gap snapshot');
     if (item['schemaVersion'] !== 1 || item['kind'] !== 'source' || typeof item['id'] !== 'string'
@@ -527,8 +850,9 @@ function sourceSnapshotFromStored(value) {
         || typeof item['name'] !== 'string' || !PLUGIN_NAME.test(item['name']) || typeof item['generatorDigest'] !== 'string'
         || !DIGEST.test(item['generatorDigest']) || !Array.isArray(item['scope'])
         || controlPlaneDigest(item['scope']) !== controlPlaneDigest(expectedSourceScope(item['name'], mode))
-        || (mode === 'modify' && item['preparedEvidence'] === undefined)
-        || (mode === 'create' && item['preparedEvidence'] !== undefined)
+        || ((mode === 'modify' || mode === 'prepared-create' || mode === 'prepared-revise') !== (item['preparedEvidence'] !== undefined))
+        || ((mode === 'prepared-create') !== (item['creation'] !== undefined))
+        || ((mode === 'prepared-revise') !== (item['sourceRevision'] !== undefined))
         || !Number.isSafeInteger(gapSnapshot['revision']) || Number(gapSnapshot['revision']) < 1
         || typeof gapSnapshot['inputDigest'] !== 'string' || !DIGEST.test(gapSnapshot['inputDigest'])
         || typeof gapSnapshot['roi'] !== 'number' || !Number.isFinite(gapSnapshot['roi']) || typeof gapSnapshot['capability'] !== 'string') {
@@ -538,6 +862,10 @@ function sourceSnapshotFromStored(value) {
         repository: item['repository'], worktree: item['worktree'], baseCommit: item['baseCommit'], name: item['name'],
         generatorDigest: item['generatorDigest'], scope: item['scope'], createdAt: item['createdAt'], expiresAt: item['expiresAt'] };
     const preparedEvidence = item['preparedEvidence'] === undefined ? undefined : preparedEvidenceFromStored(item['preparedEvidence']);
+    const creation = item['creation'] === undefined ? undefined : creationBindingFromStored(item['creation']);
+    const revision = item['sourceRevision'] === undefined ? undefined : revisionBindingFromStored(item['sourceRevision']);
+    if ((mode === 'prepared-create' || mode === 'prepared-revise') && (creation ?? revision)?.generatorDigest !== item['generatorDigest'])
+        throw new ControlPlaneStoreError('invalid-state', 'stored source creation generator changed');
     const approval = item['approval'] === undefined ? undefined : verifiedApprovalFromStored(item['approval'], item['id'], item['digest'], Number(item['createdAt']), Number(item['expiresAt']));
     let sourceCheck;
     if (item['sourceCheck'] !== undefined) {
@@ -550,7 +878,8 @@ function sourceSnapshotFromStored(value) {
         }
         sourceCheck = check;
     }
-    const digestBinding = mode === 'modify' ? { ...immutable, mode, sourceCheck, preparedEvidence } : immutable;
+    const digestBinding = mode === 'modify' || mode === 'prepared-create' || mode === 'prepared-revise'
+        ? { ...immutable, mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), sourceCheck, preparedEvidence } : immutable;
     if (controlPlaneDigest(digestBinding) !== item['digest'])
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan snapshot digest is corrupt');
     let releaseAuthorization;
@@ -591,18 +920,19 @@ function sourceSnapshotFromStored(value) {
     // running-local-checks / local-checks-failed states.
     const postCheckStates = ['ready-for-human-review', 'release-complete',
         'release-failed', 'publish-ambiguous'];
-    const requiresCheck = mode === 'modify'
+    const requiresCheck = mode === 'modify' || mode === 'prepared-create' || mode === 'prepared-revise'
         || expectedSourceRelease(status) !== undefined || postCheckStates.includes(status);
     const requiresRelease = expectedSourceRelease(status) !== undefined || ['release-complete', 'release-failed', 'publish-ambiguous'].includes(status);
-    if ((mode === 'modify' && (['running-local-checks', 'local-checks-failed'].includes(status) || sourceCheck === undefined))
+    if (((mode === 'modify' || mode === 'prepared-create' || mode === 'prepared-revise') && (['running-local-checks', 'local-checks-failed'].includes(status) || sourceCheck === undefined))
+        || ((mode === 'prepared-create' || mode === 'prepared-revise') && (!['pending-approval', 'expired'].includes(status) || approval !== undefined || releaseAuthorization !== undefined || release !== undefined))
         || (status !== 'expired' && requiresApproval !== (approval !== undefined))
-        || (status === 'expired' && mode !== 'modify')
+        || (status === 'expired' && mode !== 'modify' && mode !== 'prepared-create' && mode !== 'prepared-revise')
         || requiresCheck !== (sourceCheck !== undefined)
         || requiresRelease !== (releaseAuthorization !== undefined && release !== undefined)
         || (!requiresRelease && (releaseAuthorization !== undefined || release !== undefined))) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan snapshot fields do not match its status');
     }
-    return { ...immutable, mode, digest: item['digest'], status: item['status'], revision: Number(item['revision']),
+    return { ...immutable, mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), digest: item['digest'], status: item['status'], revision: Number(item['revision']),
         ...(approval === undefined ? {} : { approval }), ...(sourceCheck === undefined ? {} : { sourceCheck }),
         ...(preparedEvidence === undefined ? {} : { preparedEvidence }),
         ...(releaseAuthorization === undefined ? {} : { releaseAuthorization }),
@@ -782,8 +1112,11 @@ function releaseArtifact(evidence) {
 }
 function sourceJobIntentFromStored(value) {
     const intent = objectRecord(value, 'source job intent');
+    const native = typeof intent['build'] === 'object' && intent['build'] !== null
+        && intent['build']['backend'] === 'macos-seatbelt';
     exactKeys(intent, ['authority', 'owner', 'ownerDigest', 'trustDigest', 'repository', 'name', 'gapId', 'gapRevision', 'gapDigest',
-        'baseCommit', 'files', 'ttlMs', 'build', 'worktree', 'containerName'], 'source job intent');
+        'baseCommit', 'files', 'ttlMs', 'build', 'worktree', native ? 'nativeResource' : 'containerName', ...(Object.hasOwn(intent, 'baseline') ? ['baseline'] : []),
+        ...(Object.hasOwn(intent, 'mode') ? ['mode'] : []), ...(Object.hasOwn(intent, 'creation') ? ['creation'] : []), ...(Object.hasOwn(intent, 'revision') ? ['revision'] : [])], 'source job intent');
     const authority = objectRecord(intent['authority'], 'source job authority');
     exactKeys(authority, ['id', 'digest', 'expiresAt', 'maxSubmissions'], 'source job authority');
     const owner = objectRecord(intent['owner'], 'source job owner');
@@ -805,9 +1138,21 @@ function sourceJobIntentFromStored(value) {
         || typeof intent['baseCommit'] !== 'string' || !COMMIT.test(intent['baseCommit'])
         || !Array.isArray(intent['files']) || intent['files'].length === 0 || intent['files'].length > 64
         || !Number.isSafeInteger(intent['ttlMs']) || Number(intent['ttlMs']) < 60_000 || Number(intent['ttlMs']) > 86_400_000
-        || typeof intent['containerName'] !== 'string' || !/^dsh-source-job-[a-f0-9]{64}$/u.test(intent['containerName'])) {
+        || (!native && (typeof intent['containerName'] !== 'string' || !/^dsh-source-job-[a-f0-9]{64}$/u.test(intent['containerName'])))
+        || (native && (intent['mode'] !== 'create' && intent['mode'] !== 'revise-created'))
+        || (intent['mode'] !== undefined && intent['mode'] !== 'create' && intent['mode'] !== 'revise-created')
+        || (intent['mode'] === 'create') !== Object.hasOwn(intent, 'creation')
+        || (intent['mode'] === 'revise-created') !== Object.hasOwn(intent, 'revision')) {
         throw new ControlPlaneStoreError('invalid-input', 'source job intent is invalid');
     }
+    if (native) {
+        const resource = objectRecord(intent['nativeResource'], 'native source job resource');
+        exactKeys(resource, ['backend', 'key'], 'native source job resource');
+        if (resource['backend'] !== 'macos-seatbelt' || typeof resource['key'] !== 'string'
+            || !/^source-job-[a-f0-9]{64}$/u.test(resource['key'])) {
+            throw new ControlPlaneStoreError('invalid-input', 'native source job resource is invalid');
+        }
+    }
     if (Number(owner['principalVersion']) < 1 || Number(owner['bindingVersion']) < 1 || Number(owner['generation']) < 1) {
         throw new ControlPlaneStoreError('invalid-input', 'source job owner version is invalid');
     }
@@ -826,17 +1171,35 @@ function sourceJobIntentFromStored(value) {
     if (new Set(files.map(file => file.path)).size !== files.length)
         throw new ControlPlaneStoreError('invalid-input', 'source job files are duplicated');
     try {
-        validateScopedPluginFiles(files);
+        if (intent['mode'] === 'create' || intent['mode'] === 'revise-created')
+            validateSourceCreationFiles(files);
+        else
+            validateScopedPluginFiles(files);
     }
     catch {
         throw new ControlPlaneStoreError('invalid-input', 'source job files are invalid');
     }
+    const creation = intent['mode'] === 'create' ? creationBindingFromStored(intent['creation']) : undefined;
+    const revision = intent['mode'] === 'revise-created' ? revisionBindingFromStored(intent['revision']) : undefined;
+    if (revision !== undefined && !intent['name'].startsWith(revision.grant.namePrefix))
+        throw new ControlPlaneStoreError('invalid-input', 'source job plugin name is outside its revision grant');
+    if (creation !== undefined && !intent['name'].startsWith(creation.grant.namePrefix)) {
+        throw new ControlPlaneStoreError('invalid-input', 'source job plugin name is outside its creation grant');
+    }
     try {
         validateSourceBuildConfig(intent['build']);
     }
     catch {
         throw new ControlPlaneStoreError('invalid-input', 'source job build configuration is invalid');
     }
+    if (Object.hasOwn(intent, 'baseline')) {
+        try {
+            validateSourceBaselineConfig(intent['baseline']);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-input', 'source job baseline configuration is invalid');
+        }
+    }
     return Object.freeze({ authority: Object.freeze({ id: authority['id'], digest: authority['digest'], expiresAt: Number(authority['expiresAt']), maxSubmissions: Number(authority['maxSubmissions']) }),
         owner: Object.freeze({ receiptVersion: 2, authorityId: owner['authorityId'], authorityHash: owner['authorityHash'],
             principalId: owner['principalId'], principalRecordId: owner['principalRecordId'], principalVersion: Number(owner['principalVersion']),
@@ -844,7 +1207,13 @@ function sourceJobIntentFromStored(value) {
         ownerDigest: intent['ownerDigest'], trustDigest: intent['trustDigest'], repository: intent['repository'],
         name: intent['name'], gapId: intent['gapId'], gapRevision: Number(intent['gapRevision']), gapDigest: intent['gapDigest'],
         baseCommit: intent['baseCommit'], files: Object.freeze(files), ttlMs: Number(intent['ttlMs']), build: intent['build'],
-        worktree: intent['worktree'], containerName: intent['containerName'] });
+        worktree: intent['worktree'],
+        ...(native ? { nativeResource: Object.freeze({ backend: 'macos-seatbelt',
+                key: intent['nativeResource'].key }) }
+            : { containerName: intent['containerName'] }),
+        ...(creation === undefined ? {} : { mode: 'create', creation }),
+        ...(revision === undefined ? {} : { mode: 'revise-created', revision }),
+        ...(Object.hasOwn(intent, 'baseline') ? { baseline: Object.freeze(intent['baseline']) } : {}) });
 }
 function exactInputRecord(value, label) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
@@ -923,10 +1292,14 @@ function sourceJobFromRow(row) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source job intent is corrupt');
     }
     if (!DIGEST.test(row.intent_digest) || controlPlaneDigest(intent) !== row.intent_digest || row.authority_id !== intent.authority.id
+        || ('backend' in intent.build ? intent.nativeResource?.key !== row.id : intent.containerName !== `dsh-${row.id}`)
         || row.expires_at !== intent.authority.expiresAt || !KEY.test(row.idempotency_key) || !Number.isSafeInteger(row.revision) || row.revision < 1
         || !Number.isSafeInteger(row.created_at) || !Number.isSafeInteger(row.updated_at) || row.updated_at < row.created_at
         || !['queued', 'running', 'prepared', 'failed', 'unknown'].includes(row.status)
         || (row.definition_hash !== null && !DIGEST.test(row.definition_hash)) || (row.occurrence_id !== null && !KEY.test(row.occurrence_id))
+        || (row.dispatch_at !== null && (!Number.isSafeInteger(row.dispatch_at) || row.dispatch_at < row.created_at))
+        || (row.previous_definition_hash !== null && !DIGEST.test(row.previous_definition_hash))
+        || (row.previous_definition_version !== null && (!Number.isSafeInteger(row.previous_definition_version) || row.previous_definition_version < 1))
         || (row.plan_id !== null && !/^source-[a-f0-9-]{36}$/u.test(row.plan_id)) || (row.failure_code !== null && !KEY.test(row.failure_code))) {
         throw new ControlPlaneStoreError('invalid-state', 'stored source job is corrupt');
     }
@@ -936,11 +1309,17 @@ function sourceJobFromRow(row) {
         || (row.status === 'prepared' && (row.definition_hash === null || row.occurrence_id === null || row.plan_id === null || row.failure_code !== null))
         || (row.status === 'unknown' && (row.definition_hash === null || row.occurrence_id === null || row.plan_id !== null || row.failure_code === null))
         || (row.status === 'failed' && (row.plan_id !== null || row.failure_code === null))
-        || (!active && row.status !== 'prepared' && row.plan_id !== null))
+        || (!active && row.status !== 'prepared' && row.plan_id !== null)
+        || (row.previous_definition_hash === null) !== (row.previous_definition_version === null)
+        || (row.previous_definition_hash !== null && (row.status !== 'queued' || row.definition_hash !== null || row.dispatch_at === null)))
         throw new ControlPlaneStoreError('invalid-state', 'stored source job state is corrupt');
     return Object.freeze({ id: row.id, automationId: row.automation_id, idempotencyKey: row.idempotency_key, intent, intentDigest: row.intent_digest,
         status: row.status, revision: row.revision, createdAt: row.created_at, expiresAt: row.expires_at, updatedAt: row.updated_at,
-        ...(row.definition_hash === null ? {} : { definitionHash: row.definition_hash }), ...(row.occurrence_id === null ? {} : { occurrenceId: row.occurrence_id }),
+        ...(row.definition_hash === null ? {} : { definitionHash: row.definition_hash }),
+        ...(row.dispatch_at === null ? {} : { dispatchAt: row.dispatch_at }),
+        ...(row.previous_definition_hash === null ? {} : { previousDefinitionHash: row.previous_definition_hash }),
+        ...(row.previous_definition_version === null ? {} : { previousDefinitionVersion: row.previous_definition_version }),
+        ...(row.occurrence_id === null ? {} : { occurrenceId: row.occurrence_id }),
         ...(row.plan_id === null ? {} : { planId: row.plan_id }), ...(row.failure_code === null ? {} : { failureCode: row.failure_code }) });
 }
 function readOwnerTaskFailureReference(database, gapId) {
@@ -1014,7 +1393,7 @@ export function readOwnerSourceAdoptionPlan(database, activationPlanId) {
     const row = database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(activationPlanId);
     if (!link || !row)
         throw new ControlPlaneStoreError('not-found', 'owner source adoption binding absent');
-    const plan = activationFromRow(row), { plan: sourcePlan, source } = readOwnerPreparedSourcePlan(database, link.source_plan_id);
+    const plan = effectiveActivationFromRow(database, row), { plan: sourcePlan, source } = readOwnerPreparedSourcePlan(database, link.source_plan_id);
     if (sourcePlan.status !== 'release-complete' || !sourcePlan.release || plan.gapId !== sourcePlan.gapId)
         throw new ControlPlaneStoreError('invalid-state', 'source adoption requires a completed owner release');
     const expected = adoptionBinding(sourcePlan, source, plan), released = readReleaseCandidate(database, sourcePlan);
@@ -1023,11 +1402,340 @@ export function readOwnerSourceAdoptionPlan(database, activationPlanId) {
         throw new ControlPlaneStoreError('invalid-state', 'source adoption binding changed');
     return { plan, sourcePlan, source, released };
 }
+function runtimeEpochFromRow(row) {
+    const request = parseRuntimeEpochRequest(JSON.parse(row.request_json));
+    if (request.operationId !== row.operation_id || request.plan.id !== row.plan_id || request.sequence !== row.sequence
+        || request.runtimeIdentityDigest !== row.runtime_digest || controlPlaneDigest(request) !== row.request_digest
+        || request.requestedAt !== row.created_at || (row.status === 'applied') !== (row.receipt_json !== null)) {
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch journal binding changed');
+    }
+    return { request, status: row.status, ...(row.receipt_json === null ? {} : { receipt: parseRuntimeEpochReceipt(JSON.parse(row.receipt_json)) }) };
+}
+/** Historical adoption remains immutable; only a currently watched deployment can acquire another runtime proof. */
+export function readCurrentRuntimeEpochDeployment(database, profilePath) {
+    const unsettled = database.prepare(`SELECT 1 FROM activation_plans WHERE target_path=? AND status IN (
+    'staging','awaiting-reload','awaiting-readiness','awaiting-live-tasks','awaiting-effect-blocked-replay','awaiting-shadow',
+    'awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending') LIMIT 1`).get(profilePath);
+    const latest = database.prepare(`SELECT checkpoint.plan_id,checkpoint.exposure_order,checkpoint.successful_order
+    FROM activation_deployment_checkpoints checkpoint JOIN activation_plans plan ON plan.id=checkpoint.plan_id
+    WHERE plan.target_path=? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(profilePath);
+    if (unsettled || !latest || latest.exposure_order !== latest.successful_order) {
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch requires the current successful deployment');
+    }
+    const adopted = readOwnerSourceAdoptionPlan(database, latest.plan_id), { plan } = adopted;
+    const watch = database.prepare('SELECT state,activation_id,fence,last_host_generation FROM activation_watch WHERE plan_id=?').get(plan.id);
+    if (plan.status !== 'activated' || !plan.activation || watch?.state !== 'watching'
+        || watch.activation_id !== plan.activation.id || watch.fence !== plan.activation.fence) {
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch deployment is no longer watched');
+    }
+    const terms = plan.dossier.handoff;
+    const handoffRow = database.prepare('SELECT * FROM adoption_handoffs WHERE plan_id=?').get(plan.id);
+    if (!terms || !handoffRow || handoffRow.revoked_at !== null || handoffRow.plan_digest !== plan.digest
+        || handoffRow.coordinator_id !== terms.coordinatorId)
+        throw new ControlPlaneStoreError('conflict', 'runtime epoch handoff was revoked or changed');
+    const handoff = { planId: plan.id, planDigest: plan.digest, coordinatorId: handoffRow.coordinator_id,
+        createdAt: handoffRow.created_at, expiresAt: handoffRow.expires_at };
+    const approvalRow = database.prepare('SELECT approval_receipt_json FROM activation_plans WHERE id=?').get(plan.id);
+    const approvalReceipt = parseApprovalReceipt(JSON.parse(approvalRow.approval_receipt_json));
+    if (!plan.approval || controlPlaneDigest(projectedApproval(approvalReceipt)) !== controlPlaneDigest(plan.approval)) {
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch historical approval changed');
+    }
+    const witness = hostInputWitnessFromRow(database, plan);
+    if (!witness || witness.activationId !== plan.activation.id || witness.fence !== plan.activation.fence) {
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch deployment witness changed');
+    }
+    const readinessRow = database.prepare(`SELECT operation.* FROM host_attestation_operations operation
+    JOIN host_attestations attestation ON attestation.plan_id=operation.plan_id AND attestation.phase=operation.phase
+      AND attestation.receipt_digest=operation.receipt_digest
+    WHERE operation.plan_id=? AND operation.phase='readiness' AND operation.status='applied'`).get(plan.id);
+    if (!readinessRow)
+        throw new ControlPlaneStoreError('invalid-state', 'runtime epoch lacks original applied readiness');
+    const readiness = hostOperationFromRow(readinessRow);
+    if (!readiness.receipt || readiness.receipt.outcome !== 'passed' || readiness.receipt.activationId !== plan.activation.id
+        || readiness.receipt.fence !== plan.activation.fence || readiness.receipt.hostGeneration !== watch.last_host_generation) {
+        throw new ControlPlaneStoreError('conflict', 'runtime epoch original readiness changed');
+    }
+    return { ...adopted, handoff, approvalReceipt, witness, readiness,
+        maintenance: readHostMaintenanceContext(database, plan.id).records };
+}
+/** Read-only authority seam; current request admission never extends the historical activation authorization. */
+export function readOwnerRuntimeEpochContext(database, operationId) {
+    const row = database.prepare('SELECT * FROM deployment_runtime_epochs WHERE operation_id=?').get(operationId);
+    if (!row)
+        throw new ControlPlaneStoreError('not-found', 'runtime epoch operation absent');
+    const record = runtimeEpochFromRow(row), request = record.request;
+    if (record.status !== 'claimed')
+        throw new ControlPlaneStoreError('conflict', 'runtime epoch operation is not claimed');
+    const context = readCurrentRuntimeEpochDeployment(database, request.profile.path), { plan, readiness } = context;
+    const latest = database.prepare('SELECT max(sequence) AS sequence FROM deployment_runtime_epochs WHERE plan_id=?').get(plan.id);
+    if (latest?.sequence !== request.sequence || request.plan.id !== plan.id || request.plan.digest !== plan.digest
+        || request.installationId !== plan.installationId || controlPlaneDigest(request.ledger) !== controlPlaneDigest(plan.ledger)
+        || request.profile.name !== plan.profile || request.activation.id !== plan.activation.id || request.activation.fence !== plan.activation.fence
+        || controlPlaneDigest(request.predecessor) !== controlPlaneDigest({ operationId: readiness.operationId,
+            receiptDigest: controlPlaneDigest(readiness.receipt), hostGeneration: readiness.receipt.hostGeneration })) {
+        throw new ControlPlaneStoreError('conflict', 'runtime epoch request lost current deployment admission');
+    }
+    return { ...context, request, status: 'claimed', createdAt: row.created_at };
+}
+export function readOwnerHostAttestationContext(database, operationId) {
+    if (database.prepare('PRAGMA user_version').get()?.user_version !== controlPlaneSchemaVersion
+        || typeof operationId !== 'string' || !KEY.test(operationId)) {
+        throw new ControlPlaneStoreError('invalid-state', 'Host authority database or operation identity is invalid');
+    }
+    const operationRow = database.prepare('SELECT * FROM host_attestation_operations WHERE operation_id=?')
+        .get(operationId);
+    if (!operationRow)
+        throw new ControlPlaneStoreError('not-found', 'Host authority operation is absent');
+    const parsed = hostOperationFromRow(operationRow);
+    if (!isBoundHostRequest(parsed.request) || parsed.status !== 'pending' || parsed.receipt !== undefined
+        || operationRow.completed_at !== null || operationRow.applied_at !== null) {
+        throw new ControlPlaneStoreError('invalid-state', 'Host authority requires an uncompleted schema-2 operation');
+    }
+    const operation = parsed;
+    const { plan, sourcePlan, source, released } = readOwnerSourceAdoptionPlan(database, operation.planId);
+    const request = operation.request, activation = plan.activation, expected = expectedAttestation[plan.status];
+    if (!activation || expected?.phase !== operation.phase || request.phase !== operation.phase
+        || request.operationId !== operation.operationId || request.plan.id !== plan.id || request.plan.digest !== plan.digest
+        || request.installationId !== plan.installationId || controlPlaneDigest(request.ledger) !== controlPlaneDigest(plan.ledger)
+        || request.profile.name !== plan.profile || request.profile.path !== plan.target.profilePath
+        || request.activation.id !== activation.id || request.activation.fence !== activation.fence
+        || request.requestedAt !== operation.createdAt || request.receiptTtlMs < 1_000 || request.receiptTtlMs > 300_000) {
+        throw new ControlPlaneStoreError('conflict', 'Host authority operation lost its current plan binding');
+    }
+    const dispatchRow = database.prepare('SELECT * FROM host_attestation_dispatches WHERE operation_id=?')
+        .get(operationId);
+    if (!dispatchRow || dispatchRow.status !== 'claimed' || dispatchRow.completed_at !== null
+        || !Number.isSafeInteger(dispatchRow.claimed_at) || dispatchRow.claimed_at < operation.createdAt) {
+        throw new ControlPlaneStoreError('conflict', 'Host authority operation was not durably claimed');
+    }
+    const handoffRow = database.prepare('SELECT * FROM adoption_handoffs WHERE plan_id=?').get(plan.id);
+    const terms = plan.dossier.handoff;
+    if (!handoffRow || !terms || handoffRow.plan_digest !== plan.digest || handoffRow.coordinator_id !== terms.coordinatorId
+        || !Number.isSafeInteger(handoffRow.created_at) || handoffRow.created_at < plan.createdAt
+        || handoffRow.expires_at !== Math.min(handoffRow.created_at + terms.maximumWindowMs, plan.expiresAt, plan.approval?.expiresAt ?? 0)) {
+        throw new ControlPlaneStoreError('invalid-state', 'Host authority handoff is not bound to the owner plan');
+    }
+    validateAdoptionHandoffTerms(terms);
+    const handoff = { planId: plan.id, planDigest: plan.digest, coordinatorId: terms.coordinatorId,
+        createdAt: handoffRow.created_at, expiresAt: handoffRow.expires_at,
+        ...(handoffRow.revoked_at === null ? {} : { revokedAt: handoffRow.revoked_at }) };
+    const planRow = database.prepare('SELECT approval_receipt_json FROM activation_plans WHERE id=?').get(plan.id);
+    let approvalReceipt;
+    try {
+        approvalReceipt = parseApprovalReceipt(JSON.parse(planRow.approval_receipt_json ?? 'null'));
+    }
+    catch {
+        throw new ControlPlaneStoreError('invalid-state', 'Host authority approval receipt is corrupt');
+    }
+    if (!plan.approval || controlPlaneDigest(projectedApproval(approvalReceipt)) !== controlPlaneDigest(plan.approval)) {
+        throw new ControlPlaneStoreError('invalid-state', 'Host authority approval projection changed');
+    }
+    const rollback = operation.phase === 'rollback';
+    const now = Date.now();
+    if (!rollback && (now >= plan.expiresAt || now >= plan.approval.expiresAt || now >= handoff.expiresAt
+        || handoff.revokedAt !== undefined))
+        throw new ControlPlaneStoreError('expired', 'Host authority forward authorization expired');
+    const witness = hostInputWitnessFromRow(database, plan);
+    if (!witness || witness.activationId !== activation.id || (!rollback && witness.fence !== activation.fence)) {
+        throw new ControlPlaneStoreError('conflict', 'Host authority lacks exact deployment witness');
+    }
+    if (rollback) {
+        if (!activation.hostRecoveryRequired || !activation.rollbackProfileRestored || activation.targetBaselineFiles === undefined
+            || request.requirements.kind !== 'rollback'
+            || controlPlaneDigest(request.requirements.baselineFiles) !== controlPlaneDigest(activation.targetBaselineFiles)
+            || request.requirements.action !== (activation.targetOriginallyExisted ? 'restore' : 'stop')) {
+            throw new ControlPlaneStoreError('conflict', 'Host rollback lacks a durable physical recovery obligation');
+        }
+        const checkpoint = database.prepare('SELECT exposure_order,successful_order FROM activation_deployment_checkpoints WHERE plan_id=?')
+            .get(plan.id);
+        const postActivated = ['post-activation-regressed', 'post-activation-retracted', 'live-qualification-invalidated']
+            .includes(activation.failureCode ?? '');
+        if (postActivated && (!checkpoint || checkpoint.exposure_order !== checkpoint.successful_order)) {
+            throw new ControlPlaneStoreError('conflict', 'post-activation rollback lacks a successful deployment checkpoint');
+        }
+        if (postActivated) {
+            const readinessRow = database.prepare(`SELECT o.* FROM host_attestation_operations o
+        JOIN host_attestations a ON a.plan_id=o.plan_id AND a.phase=o.phase AND a.receipt_digest=o.receipt_digest
+        WHERE o.plan_id=? AND o.phase='readiness' AND o.status='applied'`).get(plan.id);
+            const readiness = readinessRow && hostOperationFromRow(readinessRow);
+            if (!readiness?.receipt || readiness.receipt.outcome !== 'passed'
+                || readiness.request.activation.id !== activation.id || readiness.request.activation.fence !== witness.fence
+                || readiness.receipt.activationId !== activation.id || readiness.receipt.fence !== witness.fence) {
+                throw new ControlPlaneStoreError('conflict', 'post-activation rollback lacks original applied readiness');
+            }
+        }
+        const active = database.prepare(`SELECT 1 FROM activation_plans WHERE target_path=? AND id<>? AND status IN
+      ('staging','awaiting-reload','awaiting-readiness','awaiting-live-tasks','awaiting-effect-blocked-replay','awaiting-shadow',
+       'awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending') LIMIT 1`)
+            .get(plan.target.profilePath, plan.id);
+        const superseded = checkpoint && database.prepare(`SELECT 1 FROM activation_deployment_checkpoints AS c
+      JOIN activation_plans AS p ON p.id=c.plan_id WHERE p.target_path=? AND c.successful_order IS NOT NULL
+      AND c.exposure_order>? LIMIT 1`).get(plan.target.profilePath, checkpoint.exposure_order);
+        if (active || superseded)
+            throw new ControlPlaneStoreError('conflict', 'Host rollback target has a newer owner');
+    }
+    const latestRow = database.prepare(`SELECT max(generation) AS generation FROM (
+    SELECT max(a.host_generation) AS generation FROM host_attestations a JOIN activation_plans p ON p.id=a.plan_id WHERE p.installation_id=?
+    UNION ALL SELECT max(w.last_host_generation) AS generation FROM activation_watch w JOIN activation_plans p ON p.id=w.plan_id WHERE p.installation_id=?)`)
+        .get(plan.installationId, plan.installationId);
+    const latest = latestRow.generation ?? 0;
+    if ((operation.phase === 'reload' && (request.predecessor !== null || request.requirements.kind !== 'reload'
+        || request.requirements.previousHostGeneration !== latest))
+        || (rollback && (request.requirements.kind !== 'rollback' || request.requirements.previousHostGeneration !== latest))) {
+        throw new ControlPlaneStoreError('conflict', 'Host authority generation changed after operation reservation');
+    }
+    if (operation.phase !== 'reload') {
+        const predecessor = request.predecessor;
+        const priorPhase = rollback ? undefined : predecessorPhase[operation.phase];
+        const priorRows = database.prepare(`SELECT o.* FROM host_attestation_operations AS o
+      JOIN host_attestations AS a ON a.plan_id=o.plan_id AND a.phase=o.phase AND a.receipt_digest=o.receipt_digest
+      WHERE o.plan_id=? AND o.status='applied' ${priorPhase === undefined ? '' : 'AND o.phase=?'}
+      ORDER BY o.applied_at DESC,
+        CASE o.phase WHEN 'reload' THEN 1 WHEN 'readiness' THEN 2 WHEN 'effect-blocked-replay' THEN 3
+          WHEN 'shadow' THEN 4 WHEN 'canary' THEN 5 WHEN 'soak' THEN 6 WHEN 'health' THEN 7 WHEN 'rollback' THEN 8 END DESC`)
+            .all(...(priorPhase === undefined ? [plan.id] : [plan.id, priorPhase]));
+        let actual = null;
+        for (const priorRow of priorRows) {
+            const prior = hostOperationFromRow(priorRow), receipt = prior.receipt;
+            if (!receipt || priorRow.receipt_digest === null || prior.request.activation.id !== activation.id
+                || receipt.activationId !== activation.id
+                || (!rollback && (prior.request.activation.fence !== activation.fence || receipt.fence !== activation.fence))
+                || (rollback && (prior.request.activation.fence >= activation.fence || receipt.fence >= activation.fence)))
+                continue;
+            actual = { operationId: prior.operationId, receiptId: receipt.receiptId, phase: prior.phase,
+                receiptDigest: priorRow.receipt_digest, hostGeneration: receipt.hostGeneration };
+            break;
+        }
+        if (controlPlaneDigest(actual) !== controlPlaneDigest(predecessor)) {
+            throw new ControlPlaneStoreError('conflict', 'Host authority predecessor is no longer current');
+        }
+        if (predecessor !== null) {
+            const prior = database.prepare(`SELECT o.*, a.host_generation AS applied_generation FROM host_attestation_operations o
+        JOIN host_attestations a ON a.plan_id=o.plan_id AND a.phase=o.phase AND a.receipt_digest=o.receipt_digest
+        WHERE o.operation_id=? AND o.plan_id=? AND o.status='applied'`).get(predecessor.operationId, plan.id);
+            if (!prior)
+                throw new ControlPlaneStoreError('conflict', 'Host authority predecessor is not applied');
+            const predecessorOperation = hostOperationFromRow(prior);
+            if (!predecessorOperation.receipt || predecessorOperation.receipt.receiptId !== predecessor.receiptId
+                || predecessorOperation.phase !== predecessor.phase || prior.receipt_digest !== predecessor.receiptDigest
+                || prior.applied_generation !== predecessor.hostGeneration
+                || predecessorOperation.request.activation.id !== activation.id
+                || (!rollback && (predecessor.phase !== predecessorPhase[operation.phase] || predecessor.hostGeneration !== latest
+                    || predecessorOperation.receipt.outcome !== 'passed'))
+                || (rollback && predecessorOperation.request.activation.fence >= activation.fence && witness.fence < activation.fence)) {
+                throw new ControlPlaneStoreError('conflict', 'Host authority predecessor binding changed');
+            }
+        }
+        else if (!rollback)
+            throw new ControlPlaneStoreError('conflict', 'Host authority normal phase lacks predecessor');
+    }
+    return { plan, sourcePlan, source, released, handoff, approvalReceipt, operation,
+        dispatch: { status: 'claimed', claimedAt: dispatchRow.claimed_at }, witness };
+}
+function liveQualificationRecord(db, id) {
+    const row = db.prepare('SELECT * FROM live_qualification_batches WHERE id=?').get(id);
+    if (!row)
+        return undefined;
+    if (Buffer.byteLength(row.batch_json) > 262_144)
+        throw new ControlPlaneStoreError('invalid-state', 'live qualification batch too large');
+    const batch = JSON.parse(row.batch_json);
+    assertLiveQualificationBatch(batch);
+    const receipt = row.receipt_json === null ? undefined : parseLiveQualificationReceipt(JSON.parse(row.receipt_json));
+    if (row.id !== batch.id || row.plan_id !== batch.planId || row.batch_digest !== controlPlaneDigest(batch)
+        || (receipt && (row.receipt_digest !== controlPlaneDigest(receipt) || receipt.batchId !== batch.id || receipt.batchDigest !== batch.digest))
+        || (row.state === 'applied' && !receipt))
+        throw new ControlPlaneStoreError('invalid-state', 'live qualification journal changed');
+    return { batch, state: row.state, ...(receipt ? { receipt } : {}) };
+}
+function liveQualificationReadiness(db, plan) {
+    const row = db.prepare(`SELECT operation.* FROM host_attestation_operations operation
+    JOIN host_attestations attestation ON attestation.plan_id=operation.plan_id AND attestation.phase=operation.phase
+      AND attestation.receipt_digest=operation.receipt_digest
+    WHERE operation.plan_id=? AND operation.phase='readiness' AND operation.status='applied'`).get(plan.id);
+    if (!row)
+        throw new ControlPlaneStoreError('invalid-state', 'live qualification lacks applied readiness');
+    const operation = hostOperationFromRow(row), receipt = operation.receipt;
+    const generation = db.prepare('SELECT MAX(host_generation) AS generation FROM host_attestations WHERE plan_id IN (SELECT id FROM activation_plans WHERE installation_id=?)').get(plan.installationId);
+    if (!receipt || receipt.outcome !== 'passed' || operation.request.schemaVersion !== 2
+        || receipt.planDigest !== plan.digest || receipt.activationId !== plan.activation?.id || receipt.fence !== plan.activation?.fence
+        || receipt.hostGeneration !== generation.generation || operation.request.activation.fence !== receipt.fence) {
+        throw new ControlPlaneStoreError('conflict', 'live qualification readiness generation changed');
+    }
+    return operation;
+}
+function liveQualificationWindow(db, plan) {
+    const row = db.prepare('SELECT * FROM live_qualification_windows WHERE plan_id=?').get(plan.id);
+    const terms = plan.dossier.liveQualification;
+    if (!terms || !row || row.activation_id !== plan.activation?.id || row.fence !== plan.activation?.fence
+        || row.deadline_at <= row.started_at || row.deadline_at > row.started_at + terms.maximumWindowMs
+        || row.deadline_at > plan.expiresAt || row.deadline_at > (plan.approval?.expiresAt ?? 0)) {
+        throw new ControlPlaneStoreError('invalid-state', 'live qualification window changed');
+    }
+    const readiness = liveQualificationReadiness(db, plan);
+    return { startedAt: row.started_at, deadlineAt: row.deadline_at,
+        readinessDigest: controlPlaneDigest(readiness.receipt), hostGeneration: readiness.receipt.hostGeneration };
+}
+/** Independent signers use this read-only seam, never a migrating Store. */
+export function readLiveQualificationContext(db, id) {
+    if (Number(db.prepare('PRAGMA user_version').get()?.user_version) !== controlPlaneSchemaVersion)
+        throw new ControlPlaneStoreError('invalid-state', 'live qualification schema differs');
+    const record = liveQualificationRecord(db, id);
+    if (!record)
+        throw new ControlPlaneStoreError('not-found', 'live qualification batch absent');
+    const { batch } = record;
+    const { plan, source } = readOwnerSourceAdoptionPlan(db, batch.planId);
+    const window = liveQualificationWindow(db, plan);
+    if (!['awaiting-live-tasks', 'commit-pending', 'activated'].includes(plan.status)
+        || !plan.dossier.liveQualification || batch.planDigest !== plan.digest || batch.installationId !== plan.installationId
+        || batch.profilePath !== plan.target.profilePath || batch.activationId !== plan.activation?.id || batch.fence !== plan.activation?.fence
+        || controlPlaneDigest(batch.terms) !== controlPlaneDigest(plan.dossier.liveQualification)
+        || ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset'].some(key => batch.owner[key] !== source.owner[key])
+        || batch.startedAt !== window.startedAt || batch.deadlineAt !== window.deadlineAt
+        || batch.readinessDigest !== window.readinessDigest || batch.hostGeneration !== window.hostGeneration
+        || db.prepare('SELECT 1 FROM live_qualification_invalidations WHERE plan_id=?').get(plan.id)) {
+        throw new ControlPlaneStoreError('conflict', 'live qualification deployment or owner changed');
+    }
+    const competing = db.prepare(`SELECT 1 FROM activation_plans WHERE target_path=? AND id<>? AND status IN
+    ('staging','awaiting-reload','awaiting-readiness','awaiting-live-tasks','awaiting-effect-blocked-replay','awaiting-shadow',
+     'awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending')`).get(plan.target.profilePath, plan.id);
+    if (competing)
+        throw new ControlPlaneStoreError('conflict', 'live qualification target superseded');
+    if (plan.status === 'activated') {
+        const latest = db.prepare(`SELECT checkpoint.plan_id FROM activation_deployment_checkpoints checkpoint
+      JOIN activation_plans candidate ON candidate.id=checkpoint.plan_id WHERE candidate.target_path=? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(plan.target.profilePath);
+        if (latest?.plan_id !== plan.id)
+            throw new ControlPlaneStoreError('conflict', 'live qualification deployment superseded');
+    }
+    const deployments = batch.votes.map(vote => {
+        const row = db.prepare('SELECT record_json,record_digest,plan_id FROM foreground_deployments WHERE inbox_id=?').get(vote.inboxId);
+        if (!row || row.plan_id !== plan.id || Buffer.byteLength(row.record_json) > 262_144)
+            throw new ControlPlaneStoreError('invalid-state', 'live task witness absent');
+        const deployment = JSON.parse(row.record_json);
+        assertForegroundDeployment(deployment);
+        if (controlPlaneDigest(deployment) !== row.record_digest || row.record_digest !== vote.deploymentDigest
+            || deployment.state !== 'observed' || !deployment.execution || !deployment.execution.quiescent
+            || deployment.execution.status !== 'succeeded' || deployment.execution.modelSelectionState !== 'frozen' || !deployment.execution.modelSelection
+            || deployment.task.inboxId !== vote.inboxId || deployment.execution.completedAt !== vote.completedAt
+            || deployment.task.dispatchedAt < window.startedAt || deployment.task.dispatchedAt >= window.deadlineAt
+            || vote.completedAt >= window.deadlineAt || deployment.task.owner.principalRecordId !== batch.owner.principalRecordId
+            || deployment.task.owner.principalVersion !== batch.owner.principalVersion || deployment.task.scope.workspace !== batch.owner.workspace
+            || deployment.task.scope.preset !== batch.owner.agentPreset || deployment.readiness.planDigest !== plan.digest
+            || deployment.readiness.planId !== plan.id || deployment.readiness.fence !== batch.fence
+            || deployment.readiness.hostGeneration !== batch.hostGeneration || deployment.readiness.receiptDigest !== batch.readinessDigest
+            || controlPlaneDigest(deployment.readiness.exact) !== controlPlaneDigest({ package: plan.candidate.package, version: plan.candidate.version, integrity: plan.candidate.integrity })) {
+            throw new ControlPlaneStoreError('conflict', 'live task witness differs');
+        }
+        return deployment;
+    });
+    return { record, plan, source, deployments };
+}
 export class ControlPlaneStore {
     #database;
     #now;
     #ownerTaskFailureGapAdmission;
     #foregroundDeploymentAdmission;
+    #liveQualificationAdmission;
+    #withLiveQualificationFence;
     #withOwnerActivationFence;
     #adoptionCoordinatorId;
     constructor(options) {
@@ -1036,8 +1744,9 @@ export class ControlPlaneStore {
         }
         if (options.adoptionCoordinatorId && options.withOwnerActivationFence)
             throw new ControlPlaneStoreError('invalid-input', 'adoption coordinator cannot hold owner fence');
-        this.#database = openControlPlaneDatabase(options.path);
+        this.#database = options.readOnly === true ? openControlPlaneDatabaseReadOnly(options.path) : openControlPlaneDatabase(options.path);
         this.#now = options.now ?? Date.now;
+        this.#withLiveQualificationFence = options.withLiveQualificationFence;
         this.#withOwnerActivationFence = options.withOwnerActivationFence;
         this.#adoptionCoordinatorId = options.adoptionCoordinatorId;
     }
@@ -1177,7 +1886,7 @@ export class ControlPlaneStore {
                 this.#assertAdoptionHandoffBinding(planId, this.#adoptionCoordinatorId);
                 return callback();
             }
-            if (!['approved', 'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay',
+            if (!['approved', 'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay',
                 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health'].includes(plan.status)) {
                 throw new ControlPlaneStoreError('invalid-state', 'adoption coordinator cannot advance this activation state');
             }
@@ -1190,6 +1899,10 @@ export class ControlPlaneStore {
             const current = this.getPlan(planId);
             if (current.status === 'commit-pending' && current.dossier.handoff !== undefined)
                 this.#assertAdoptionHandoff(planId);
+            if (current.status === 'commit-pending' && current.dossier.liveQualification) {
+                this.#assertLiveQualificationCommit(planId);
+                return callback();
+            }
             return callback();
         };
         if (this.#ownerTaskFailureGapAdmission === plan.gapId)
@@ -1240,9 +1953,17 @@ export class ControlPlaneStore {
         const requestBinding = { operation: 'create-activation-plan', gapId: input.gapId, candidate, catalog: input.catalog,
             matchedCapabilities, profile, target: input.target, installationId: input.installationId,
             ledger: input.ledger, executor: input.executor, ttlMs: input.ttlMs,
-            ...(input.sourcePlanId === undefined ? {} : { sourcePlanId: input.sourcePlanId }), ...(input.handoff === undefined ? {} : { handoff: input.handoff }) };
+            ...(input.sourcePlanId === undefined ? {} : { sourcePlanId: input.sourcePlanId }), ...(input.handoff === undefined ? {} : { handoff: input.handoff }), ...(input.liveQualification === undefined ? {} : { liveQualification: input.liveQualification }),
+            ...(input.hostDeploymentInputs === undefined ? {} : { hostDeploymentInputs: input.hostDeploymentInputs }) };
         this.#assertOwnerTaskFailureGapAdmission(input.gapId);
         const source = input.sourcePlanId === undefined ? undefined : readOwnerPreparedSourcePlan(this.#database, input.sourcePlanId);
+        if (input.liveQualification !== undefined) {
+            validateLiveQualificationTerms(input.liveQualification);
+            if (!source || !input.handoff)
+                throw new ControlPlaneStoreError('invalid-input', 'bounded-live adoption requires an exact owner release and external coordinator');
+        }
+        if (input.hostDeploymentInputs !== undefined)
+            validateHostDeploymentInputs(input.hostDeploymentInputs);
         if (input.handoff !== undefined) {
             validateAdoptionHandoffTerms(input.handoff);
             if (!source)
@@ -1272,7 +1993,9 @@ export class ControlPlaneStore {
         const gapSnapshot = Object.freeze({ revision: gap.revision, inputDigest: gap.inputDigest, roi: gap.roi, capability: gap.capability });
         const dossier = Object.freeze({ catalogDigest: input.catalog.digest, catalogProvenance: input.catalog.provenance,
             matchedCapabilities: Object.freeze(matchedCapabilities), authorities: Object.freeze([...candidate.authorities]), packages,
-            ...(input.handoff === undefined ? {} : { handoff: Object.freeze({ ...input.handoff }) }) });
+            ...(input.handoff === undefined ? {} : { handoff: Object.freeze({ ...input.handoff }) }),
+            ...(input.liveQualification === undefined ? {} : { liveQualification: Object.freeze({ ...input.liveQualification }) }),
+            ...(input.hostDeploymentInputs === undefined ? {} : { hostDeploymentInputs: Object.freeze([...input.hostDeploymentInputs]) }) });
         const now = this.#now();
         const id = `plugin-${randomUUID()}`;
         const expiresAt = now + input.ttlMs;
@@ -1320,7 +2043,11 @@ export class ControlPlaneStore {
         const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(id);
         if (row === undefined)
             throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-        return activationFromRow(row);
+        return effectiveActivationFromRow(this.#database, row);
+    }
+    currentPlanExecutor(planId) {
+        const context = readHostMaintenanceContext(this.#database, planId);
+        return context.records.at(-1)?.after.executor ?? context.plan.executor;
     }
     findSourceAdoption(sourcePlanId) {
         const row = this.#database.prepare('SELECT activation_plan_id FROM source_adoptions WHERE source_plan_id = ?').get(sourcePlanId);
@@ -1431,11 +2158,23 @@ export class ControlPlaneStore {
         const intentDigest = controlPlaneDigest(intent);
         const now = this.#now();
         this.#assertOwnerTaskFailureGapAdmission(intent.gapId);
-        if (intent.containerName !== `dsh-${input.id}` || basename(intent.worktree) !== `worktree-job-${input.id.slice('source-job-'.length)}`) {
+        if (intent.mode === 'create' && this.getOwnerTaskFailureReference(intent.gapId) !== undefined
+            && intent.creation?.growthRun === undefined) {
+            throw new ControlPlaneStoreError('invalid-input', 'task-backed creation requires a frozen source growth run');
+        }
+        if (('backend' in intent.build ? intent.nativeResource?.key !== input.id : intent.containerName !== `dsh-${input.id}`)
+            || basename(intent.worktree) !== `worktree-job-${input.id.slice('source-job-'.length)}`) {
             throw new ControlPlaneStoreError('invalid-input', 'source job resource identity is invalid');
         }
         if (now >= intent.authority.expiresAt)
             throw new ControlPlaneStoreError('expired', 'source job authority is expired');
+        if (intent.creation !== undefined && now >= intent.creation.grant.expiresAt)
+            throw new ControlPlaneStoreError('expired', 'source creation grant is expired');
+        if (intent.revision !== undefined && (this.getOwnerTaskFailureReference(intent.gapId) === undefined || now >= intent.revision.grant.expiresAt))
+            throw new ControlPlaneStoreError('expired', 'revision grant or owner task is unavailable');
+        const growthRun = intent.creation?.growthRun ?? intent.revision?.growthRun;
+        if (growthRun !== undefined && (now >= growthRun.generationDeadlineAt || now >= growthRun.expiresAt))
+            throw new ControlPlaneStoreError('expired', 'source growth generation window is expired');
         this.#database.exec('BEGIN IMMEDIATE');
         try {
             const prior = this.#database.prepare('SELECT * FROM source_jobs WHERE authority_id = ? AND idempotency_key = ?')
@@ -1448,6 +2187,30 @@ export class ControlPlaneStore {
                 this.#database.exec('COMMIT');
                 return record;
             }
+            if (intent.baseline !== undefined) {
+                const rows = this.#database.prepare(`SELECT * FROM source_jobs WHERE json_extract(intent_json, '$.repository') = ?
+          AND json_type(intent_json, '$.baseline') IS NOT NULL AND status IN ('queued', 'running', 'unknown', 'prepared')
+          LIMIT 1001`).all(intent.repository);
+                if (rows.length > 1000)
+                    throw new ControlPlaneStoreError('invalid-state', 'managed source job cohort exceeds bound');
+                for (const row of rows) {
+                    const competing = sourceJobFromRow(row);
+                    if (competing.status !== 'prepared')
+                        throw new ControlPlaneStoreError('conflict', 'managed source job is already active for repository');
+                    const prepared = competing.planId === undefined ? undefined : this.getSourcePlan(competing.planId);
+                    // A revision rebuilds its exact retained parent in a new private tree;
+                    // it cannot advance that parent's source release or alter the baseline.
+                    if (intent.revision && prepared?.id === intent.revision.parent.planId && prepared.mode === 'prepared-create') {
+                        const certificate = this.getCreationVerification(prepared.id);
+                        if (certificate && controlPlaneDigest(certificate) === intent.revision.parent.certificateDigest
+                            && certificate.plan.artifactSha256 === intent.revision.parent.artifactSha256)
+                            continue;
+                    }
+                    if (prepared === undefined || !['release-complete', 'release-failed', 'expired', 'local-checks-failed'].includes(prepared.status)) {
+                        throw new ControlPlaneStoreError('conflict', 'managed source job is awaiting a terminal source release');
+                    }
+                }
+            }
             const authority = this.#database.prepare('SELECT * FROM source_job_authorities WHERE authority_id = ?').get(intent.authority.id);
             if (authority !== undefined && (authority.authority_digest !== intent.authority.digest || authority.expires_at !== intent.authority.expiresAt
                 || authority.max_submissions !== intent.authority.maxSubmissions)) {
@@ -1461,6 +2224,36 @@ export class ControlPlaneStore {
             }
             this.#database.prepare('UPDATE source_job_authorities SET submissions = submissions + 1 WHERE authority_id = ? AND submissions < max_submissions')
                 .run(intent.authority.id);
+            if (intent.creation !== undefined) {
+                const grant = intent.creation.grant, digest = controlPlaneDigest(grant);
+                const previous = this.#database.prepare('SELECT * FROM source_creation_grants WHERE grant_id = ?').get(grant.id);
+                if (previous !== undefined && (previous.grant_digest !== digest || previous.expires_at !== grant.expiresAt
+                    || previous.max_creates !== grant.maxCreates))
+                    throw new ControlPlaneStoreError('conflict', 'source creation grant definition is immutable');
+                if (previous !== undefined && previous.creates >= previous.max_creates)
+                    throw new ControlPlaneStoreError('invalid-state', 'source creation grant quota is exhausted');
+                if (previous === undefined)
+                    this.#database.prepare(`INSERT INTO source_creation_grants
+          (grant_id, grant_digest, expires_at, max_creates, creates) VALUES (?, ?, ?, ?, 0)`)
+                        .run(grant.id, digest, grant.expiresAt, grant.maxCreates);
+                const quota = this.#database.prepare('UPDATE source_creation_grants SET creates = creates + 1 WHERE grant_id = ? AND creates < max_creates').run(grant.id);
+                if (Number(quota.changes) !== 1)
+                    throw new ControlPlaneStoreError('conflict', 'source creation grant quota changed');
+            }
+            if (intent.revision !== undefined) {
+                const grant = intent.revision.grant, digest = controlPlaneDigest(grant);
+                const previous = this.#database.prepare('SELECT * FROM source_revision_grants WHERE grant_id=?').get(grant.id);
+                if (previous && (previous.grant_digest !== digest || previous.expires_at !== grant.expiresAt || previous.max_revisions !== grant.maxRevisions)) {
+                    throw new ControlPlaneStoreError('conflict', 'source revision grant definition is immutable');
+                }
+                if (previous && previous.revisions >= previous.max_revisions)
+                    throw new ControlPlaneStoreError('invalid-state', 'source revision grant quota is exhausted');
+                if (!previous)
+                    this.#database.prepare('INSERT INTO source_revision_grants VALUES(?,?,?,?,0)').run(grant.id, digest, grant.expiresAt, grant.maxRevisions);
+                const quota = this.#database.prepare('UPDATE source_revision_grants SET revisions=revisions+1 WHERE grant_id=? AND revisions<max_revisions').run(grant.id);
+                if (Number(quota.changes) !== 1)
+                    throw new ControlPlaneStoreError('conflict', 'source revision grant quota changed');
+            }
             this.#database.prepare(`INSERT INTO source_jobs (id, automation_id, authority_id, idempotency_key, intent_json, intent_digest,
         status, revision, created_at, expires_at, definition_hash, occurrence_id, plan_id, failure_code, updated_at)
         VALUES (?, ?, ?, ?, ?, ?, 'queued', 1, ?, ?, NULL, NULL, NULL, NULL, ?)`).run(input.id, input.automationId, intent.authority.id, idempotencyKey, JSON.stringify(intent), intentDigest, now, intent.authority.expiresAt, now);
@@ -1491,34 +2284,67 @@ export class ControlPlaneStore {
       created_at DESC, id DESC LIMIT ?`).all(limit).map(sourceJobFromRow);
     }
     /** Prepared owner continuations have a bounded recovery query, independent of job history. */
-    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false) {
+    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false, includeCreation = false, includeCreationAdoption = false, includeRevision = false, includeRegression = false) {
         return this.#database.prepare(`SELECT j.* FROM source_jobs j JOIN source_plans p ON p.id = j.plan_id
       JOIN owner_task_failure_gaps g ON g.gap_id = p.gap_id
       LEFT JOIN source_adoptions a ON a.source_plan_id = p.id
       LEFT JOIN activation_plans ap ON ap.id = a.activation_plan_id
-      WHERE j.status = 'prepared' AND (p.status = 'pending-approval' OR (? = 1 AND p.status IN ('approved', 'ready-for-human-review'))
+      WHERE j.status = 'prepared' AND ((p.mode = 'modify' AND (p.status = 'pending-approval' OR (? = 1 AND p.status IN ('approved', 'ready-for-human-review'))
         OR (? = 1 AND p.status IN ('awaiting-pr', 'awaiting-review', 'awaiting-merge', 'awaiting-build', 'awaiting-sign', 'awaiting-publish',
           'awaiting-registry-verify', 'awaiting-catalog-admission'))
-        OR (? = 1 AND p.status = 'release-complete' AND (ap.id IS NULL OR ap.status NOT IN ('activated', 'rolled-back', 'rejected')))) AND (p.expires_at > ? OR ap.status IN ('staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'))
-      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, this.#now()).map(sourceJobFromRow);
+        OR (? = 1 AND p.status = 'release-complete' AND (ap.id IS NULL OR ap.status NOT IN ('activated', 'rolled-back', 'rejected')))))
+        OR (? = 1 AND p.mode = 'prepared-create' AND p.status = 'pending-approval'
+          AND json_type(j.intent_json, '$.creation.growthRun.creationAcceptance') IS NOT NULL
+          AND NOT EXISTS (SELECT 1 FROM source_creation_verifications v WHERE v.plan_id = p.id))
+        OR (? = 1 AND p.mode = 'prepared-create' AND p.status = 'pending-approval'
+          AND EXISTS (SELECT 1 FROM source_creation_verifications v WHERE v.plan_id = p.id AND v.status = 'verified'))
+        OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
+          AND json_type(j.intent_json, '$.revision.growthRun.revisionAcceptance') IS NOT NULL
+          AND NOT EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id))
+        OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
+          AND json_type(j.intent_json, '$.revision.growthRun.revisionRegressionAcceptance') IS NOT NULL
+          AND EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id AND v.status='verified')
+          AND NOT EXISTS (SELECT 1 FROM source_revision_regressions v WHERE v.plan_id=p.id)))
+        AND (p.expires_at > ? OR ap.status IN ('staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'))
+      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, includeCreation ? 1 : 0, includeCreationAdoption ? 1 : 0, includeRevision ? 1 : 0, includeRegression ? 1 : 0, this.#now()).map(sourceJobFromRow);
     }
     bindSourceJobDefinition(input) {
         if (!Number.isSafeInteger(input.revision) || input.revision < 1 || !DIGEST.test(input.definitionHash))
             throw new ControlPlaneStoreError('invalid-input', 'source job definition binding is invalid');
         const now = this.#now();
-        const result = this.#database.prepare(`UPDATE source_jobs SET definition_hash = ?, revision = revision + 1, updated_at = ?
+        const result = this.#database.prepare(`UPDATE source_jobs SET definition_hash = ?, previous_definition_hash = NULL,
+      previous_definition_version = NULL, revision = revision + 1, updated_at = ?
       WHERE id = ? AND revision = ? AND status = 'queued' AND definition_hash IS NULL AND expires_at > ?`).run(input.definitionHash, now, input.id, input.revision, now);
         if (Number(result.changes) !== 1)
             throw new ControlPlaneStoreError('conflict', 'source job definition binding lost its queued CAS');
         return this.getSourceJob(input.id);
     }
+    /** Persist the only safe rearm: same queued job, with no claimed occurrence. */
+    rearmQueuedGrowthSourceJob(input) {
+        if (!Number.isSafeInteger(input.revision) || input.revision < 1 || !DIGEST.test(input.priorDefinitionHash)
+            || !Number.isSafeInteger(input.priorDefinitionVersion) || input.priorDefinitionVersion < 1
+            || !Number.isSafeInteger(input.dispatchAt) || input.dispatchAt <= this.#now()) {
+            throw new ControlPlaneStoreError('invalid-input', 'source growth rearm request is invalid');
+        }
+        const now = this.#now();
+        const result = this.#database.prepare(`UPDATE source_jobs SET dispatch_at = ?, previous_definition_hash = definition_hash,
+      previous_definition_version = ?,
+      definition_hash = NULL, revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ? AND status = 'queued'
+      AND occurrence_id IS NULL AND definition_hash = ? AND expires_at > ? AND (json_type(intent_json, '$.creation.growthRun') IS NOT NULL OR json_type(intent_json, '$.revision.growthRun') IS NOT NULL)`).run(input.dispatchAt, input.priorDefinitionVersion, now, input.id, input.revision, input.priorDefinitionHash, now);
+        if (Number(result.changes) !== 1)
+            throw new ControlPlaneStoreError('conflict', 'source growth rearm lost its queued CAS');
+        return this.getSourceJob(input.id);
+    }
     claimSourceJob(input) {
         if (!Number.isSafeInteger(input.revision) || input.revision < 1 || !DIGEST.test(input.definitionHash) || !KEY.test(input.occurrenceId)) {
             throw new ControlPlaneStoreError('invalid-input', 'source job claim is invalid');
         }
         const now = this.#now();
         const result = this.#database.prepare(`UPDATE source_jobs SET status = 'running', occurrence_id = ?, revision = revision + 1, updated_at = ?
-      WHERE id = ? AND revision = ? AND status = 'queued' AND definition_hash = ? AND occurrence_id IS NULL AND expires_at > ?`).run(input.occurrenceId, now, input.id, input.revision, input.definitionHash, now);
+      WHERE id = ? AND revision = ? AND status = 'queued' AND definition_hash = ? AND occurrence_id IS NULL AND expires_at > ?
+      AND (json_type(intent_json, '$.creation') IS NULL OR json_extract(intent_json, '$.creation.grant.expiresAt') > ?)
+      AND (json_type(intent_json, '$.revision') IS NULL OR json_extract(intent_json, '$.revision.grant.expiresAt') > ?)`)
+            .run(input.occurrenceId, now, input.id, input.revision, input.definitionHash, now, now, now);
         if (Number(result.changes) !== 1)
             throw new ControlPlaneStoreError('conflict', 'source job claim lost its queued CAS');
         return this.getSourceJob(input.id);
@@ -1528,7 +2354,8 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('invalid-input', 'source job settlement is invalid');
         const permitted = input.status === 'unknown' ? "status = 'running'" : "status IN ('queued', 'running', 'unknown')";
         const now = this.#now();
-        const result = this.#database.prepare(`UPDATE source_jobs SET status = ?, failure_code = ?, revision = revision + 1, updated_at = ?
+        const result = this.#database.prepare(`UPDATE source_jobs SET status = ?, failure_code = ?,
+      previous_definition_hash = NULL, previous_definition_version = NULL, revision = revision + 1, updated_at = ?
       WHERE id = ? AND revision = ? AND ${permitted}`).run(input.status, input.failureCode, now, input.id, input.revision);
         if (Number(result.changes) !== 1)
             throw new ControlPlaneStoreError('conflict', 'source job settlement lost its state CAS');
@@ -1540,10 +2367,22 @@ export class ControlPlaneStore {
       revision = revision + 1, updated_at = ? WHERE status = 'running'`).run(now);
         return Number(result.changes);
     }
+    /** Revoke claimed task-created jobs when their Host run producer disappears. */
+    interruptGrowthSourceJobs() {
+        const now = this.#now();
+        const result = this.#database.prepare(`UPDATE source_jobs SET status = 'unknown', failure_code = 'source-growth-provider-disposed',
+      revision = revision + 1, updated_at = ? WHERE status = 'running'
+      AND (json_type(intent_json, '$.creation.growthRun') IS NOT NULL OR json_type(intent_json, '$.revision.growthRun') IS NOT NULL)`).run(now);
+        return Number(result.changes);
+    }
     createSourcePlan(input) {
         const mode = input.mode ?? 'create';
-        if (input.sourceJob !== undefined && mode !== 'modify')
-            throw new ControlPlaneStoreError('invalid-input', 'source jobs only complete checked modify plans');
+        if (mode !== 'create' && mode !== 'modify' && mode !== 'prepared-create' && mode !== 'prepared-revise')
+            throw new ControlPlaneStoreError('invalid-input', 'source plan mode is invalid');
+        if (input.sourceJob !== undefined && mode === 'create')
+            throw new ControlPlaneStoreError('invalid-input', 'source jobs only complete checked modify or prepared-create plans');
+        if ((mode === 'prepared-create' || mode === 'prepared-revise') && input.sourceJob === undefined)
+            throw new ControlPlaneStoreError('invalid-input', 'prepared creation requires a running source job');
         const key = bounded(input.idempotencyKey, 'idempotencyKey', 160);
         const name = bounded(input.name, 'name', 64);
         if (!KEY.test(key) || !PLUGIN_NAME.test(name) || !COMMIT.test(input.baseCommit) || !DIGEST.test(input.generatorDigest)
@@ -1552,20 +2391,48 @@ export class ControlPlaneStore {
         if (mode === 'modify' && input.generatorDigest !== MODIFY_GENERATOR_DIGEST) {
             throw new ControlPlaneStoreError('invalid-input', 'modify source plans must bind the modify generator constant');
         }
+        const creation = input.creation === undefined ? undefined : creationBindingFromStored(input.creation);
+        if ((mode === 'prepared-create') !== (creation !== undefined)
+            || (creation !== undefined && (creation.generatorDigest !== input.generatorDigest || !name.startsWith(creation.grant.namePrefix)))) {
+            throw new ControlPlaneStoreError('invalid-input', 'prepared source creation binding is invalid');
+        }
+        const revision = input.revision === undefined ? undefined : revisionBindingFromStored(input.revision);
+        if ((mode === 'prepared-revise') !== (revision !== undefined)
+            || (revision !== undefined && (revision.generatorDigest !== input.generatorDigest || !name.startsWith(revision.grant.namePrefix)))) {
+            throw new ControlPlaneStoreError('invalid-input', 'prepared source revision binding is invalid');
+        }
         let preparedEvidence;
-        if (mode === 'modify') {
+        if (mode === 'modify' || mode === 'prepared-create' || mode === 'prepared-revise') {
             if (input.prepared === undefined) {
-                throw new ControlPlaneStoreError('invalid-input', 'modify source plan requires prepared check evidence');
+                throw new ControlPlaneStoreError('invalid-input', 'prepared source plan requires check evidence');
             }
             if (!DIGEST.test(input.prepared.treeDigest) || !DIGEST.test(input.prepared.patchDigest)
                 || !Number.isSafeInteger(input.prepared.checkedAt) || input.prepared.checkedAt < 0) {
                 throw new ControlPlaneStoreError('invalid-input', 'modify source plan prepared digests are invalid');
             }
             preparedEvidence = preparedEvidenceFromStored(input.prepared.evidence);
+            if ((mode === 'modify' && preparedEvidence.schemaVersion !== 1)
+                || (preparedEvidence.schemaVersion === 2 && input.sourceJob === undefined)) {
+                throw new ControlPlaneStoreError('invalid-input', 'native source evidence requires a durable created plugin job');
+            }
         }
         else if (input.prepared !== undefined) {
             throw new ControlPlaneStoreError('invalid-input', 'create source plans cannot carry prepared evidence');
         }
+        let preparedArtifact;
+        if (input.preparedArtifact !== undefined) {
+            if (mode !== 'prepared-create' && mode !== 'prepared-revise' || input.sourceJob === undefined || !Buffer.isBuffer(input.preparedArtifact)
+                || preparedEvidence === undefined || input.preparedArtifact.length < 1
+                || input.preparedArtifact.length > MAX_PREPARED_ARTIFACT_BYTES
+                || input.preparedArtifact.length !== preparedEvidence.pack.sizeBytes
+                || createHash('sha256').update(input.preparedArtifact).digest('hex') !== preparedEvidence.pack.sha256) {
+                throw new ControlPlaneStoreError('invalid-input', 'prepared source artifact differs from checked package evidence');
+            }
+            if (this.getOwnerTaskFailureReference(input.gapId) === undefined) {
+                throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact requires an owner task failure gap');
+            }
+            preparedArtifact = Buffer.from(input.preparedArtifact);
+        }
         positiveInteger(input.ttlMs, 'ttlMs');
         if (input.ttlMs < 60_000 || input.ttlMs > 86_400_000)
             throw new ControlPlaneStoreError('invalid-input', 'ttlMs is invalid');
@@ -1582,11 +2449,24 @@ export class ControlPlaneStore {
         this.#assertOwnerTaskFailureGapAdmission(input.gapId);
         const sourceJobBinding = input.sourceJob === undefined ? undefined : { jobId: input.sourceJob.jobId, jobRevision: input.sourceJob.jobRevision,
             occurrenceId: input.sourceJob.occurrenceId };
-        const inputDigest = controlPlaneDigest({ ...(mode === 'modify' ? { ...requestBinding, mode, prepared: input.prepared } : requestBinding),
-            ...(sourceJobBinding === undefined ? {} : { sourceJob: sourceJobBinding }) });
+        const inputDigest = controlPlaneDigest({ ...(mode === 'create' ? requestBinding : { ...requestBinding, mode,
+                ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { revision }), prepared: input.prepared }),
+            ...(sourceJobBinding === undefined ? {} : { sourceJob: sourceJobBinding }),
+            ...(preparedArtifact === undefined ? {} : { preparedArtifactSha256: preparedEvidence.pack.sha256 }) });
         const prior = this.#sourcePlanReceiptByKey(key, 'create-source-plan', inputDigest);
-        if (prior !== undefined)
+        if (prior !== undefined) {
+            if (preparedArtifact !== undefined) {
+                const reference = this.#database.prepare('SELECT pack_sha256 FROM source_prepared_artifact_refs WHERE plan_id = ?')
+                    .get(prior.result.id);
+                const row = this.#database.prepare('SELECT * FROM source_prepared_artifacts WHERE pack_sha256 = ?')
+                    .get(preparedEvidence.pack.sha256);
+                if (reference?.pack_sha256 !== preparedEvidence.pack.sha256 || row === undefined
+                    || !preparedArtifactBytesFromRow(row, preparedEvidence.pack).equals(preparedArtifact)) {
+                    throw new ControlPlaneStoreError('invalid-state', 'idempotent prepared source artifact is missing or changed');
+                }
+            }
             return prior;
+        }
         const gap = this.getGap(input.gapId);
         if (gap.status !== 'open' || gap.candidateId !== undefined) {
             throw new ControlPlaneStoreError('invalid-state', 'only an unreserved open gap can create a source plan');
@@ -1598,8 +2478,8 @@ export class ControlPlaneStore {
         const immutable = { schemaVersion: 1, kind: 'source', id, gapId: gap.id, gapSnapshot,
             repository: input.repository, worktree: input.worktree, baseCommit: input.baseCommit, name,
             generatorDigest: input.generatorDigest, scope, createdAt: now, expiresAt };
-        const digest = controlPlaneDigest(mode === 'modify'
-            ? { ...immutable, mode, sourceCheck: { treeDigest: input.prepared.treeDigest, patchDigest: input.prepared.patchDigest,
+        const digest = controlPlaneDigest(mode !== 'create'
+            ? { ...immutable, mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), sourceCheck: { treeDigest: input.prepared.treeDigest, patchDigest: input.prepared.patchDigest,
                     checkedAt: input.prepared.checkedAt }, preparedEvidence }
             : immutable);
         this.#database.exec('BEGIN IMMEDIATE');
@@ -1615,11 +2495,43 @@ export class ControlPlaneStore {
                     || sourceJob.occurrenceId !== sourceJobBinding.occurrenceId || sourceJob.intent.gapId !== gap.id
                     || sourceJob.intent.gapRevision !== currentGap.revision || sourceJob.intent.gapDigest !== controlPlaneDigest(currentGap)
                     || sourceJob.intent.baseCommit !== input.baseCommit || sourceJob.intent.name !== name
-                    || sourceJob.intent.repository !== input.repository || sourceJob.intent.worktree !== input.worktree || sourceJob.intent.ttlMs !== input.ttlMs) {
+                    || sourceJob.intent.repository !== input.repository || sourceJob.intent.worktree !== input.worktree || sourceJob.intent.ttlMs !== input.ttlMs
+                    || (mode === 'prepared-create') !== (sourceJob.intent.mode === 'create')
+                    || (preparedEvidence !== undefined && ('backend' in sourceJob.intent.build) !== (preparedEvidence.schemaVersion === 2))
+                    || (mode === 'prepared-create' && controlPlaneDigest(sourceJob.intent.creation) !== controlPlaneDigest(creation))
+                    || (mode === 'prepared-revise') !== (sourceJob.intent.mode === 'revise-created')
+                    || (mode === 'prepared-revise' && controlPlaneDigest(sourceJob.intent.revision) !== controlPlaneDigest(revision))) {
                     throw new ControlPlaneStoreError('conflict', 'source job completion lost its immutable running binding');
                 }
-                if (now >= sourceJob.expiresAt)
+                if (now >= sourceJob.expiresAt || (creation !== undefined && now >= creation.grant.expiresAt) || (revision !== undefined && now >= revision.grant.expiresAt))
                     throw new ControlPlaneStoreError('expired', 'source job authority is expired');
+                if (mode === 'prepared-create' && this.getOwnerTaskFailureReference(input.gapId) !== undefined
+                    && (!creation?.growthRun || now >= creation.growthRun.expiresAt)) {
+                    throw new ControlPlaneStoreError('expired', 'task-backed creation growth run is absent or expired');
+                }
+            }
+            if (revision !== undefined && (this.getOwnerTaskFailureReference(input.gapId) === undefined || now >= revision.growthRun.expiresAt)) {
+                throw new ControlPlaneStoreError('expired', 'revision requires a current owner task and frozen growth run');
+            }
+            if (preparedArtifact !== undefined) {
+                const pack = preparedEvidence.pack;
+                const existing = this.#database.prepare('SELECT * FROM source_prepared_artifacts WHERE pack_sha256 = ?')
+                    .get(pack.sha256);
+                if (existing !== undefined) {
+                    if (!preparedArtifactBytesFromRow(existing, pack).equals(preparedArtifact)) {
+                        throw new ControlPlaneStoreError('invalid-state', 'stored prepared source artifact differs from checked bytes');
+                    }
+                }
+                else {
+                    const totals = this.#database.prepare('SELECT count(*) AS count, coalesce(sum(size_bytes), 0) AS total FROM source_prepared_artifacts')
+                        .get();
+                    if (!Number.isSafeInteger(totals.count) || !Number.isSafeInteger(totals.total)
+                        || totals.count >= MAX_STORED_ARTIFACTS || totals.total > MAX_STORED_ARTIFACT_BYTES - preparedArtifact.length) {
+                        throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact storage quota is exhausted');
+                    }
+                    this.#database.prepare('INSERT INTO source_prepared_artifacts (pack_sha256, size_bytes, bytes, created_at) VALUES (?, ?, ?, ?)')
+                        .run(pack.sha256, preparedArtifact.length, preparedArtifact, now);
+                }
             }
             this.#database.prepare('INSERT INTO gap_plan_claims (gap_id, plan_id, plan_kind, claimed_at) VALUES (?, ?, ?, ?)').run(gap.id, id, 'source', now);
             // 'modify' rows carry their checked digests and frozen-build evidence from
@@ -1627,8 +2539,12 @@ export class ControlPlaneStore {
             // post-approval scaffold run finishes.
             this.#database.prepare(`INSERT INTO source_plans (id, plan_digest, gap_id, gap_snapshot_json, repository, worktree,
         base_commit, plugin_name, generator_digest, scope_json, mode, status, revision, created_at, expires_at,
-        approval_json, checked_tree_digest, checked_patch_digest, checked_at, prepared_evidence_json, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending-approval', 1, ?, ?, NULL, ?, ?, ?, ?, ?)`).run(id, digest, gap.id, JSON.stringify(gapSnapshot), input.repository, input.worktree, input.baseCommit, name, input.generatorDigest, JSON.stringify(scope), mode, now, expiresAt, input.prepared?.treeDigest ?? null, input.prepared?.patchDigest ?? null, input.prepared?.checkedAt ?? null, preparedEvidence === undefined ? null : JSON.stringify(preparedEvidence), now);
+        approval_json, checked_tree_digest, checked_patch_digest, checked_at, prepared_evidence_json, creation_json, revision_json, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending-approval', 1, ?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`).run(id, digest, gap.id, JSON.stringify(gapSnapshot), input.repository, input.worktree, input.baseCommit, name, input.generatorDigest, JSON.stringify(scope), mode, now, expiresAt, input.prepared?.treeDigest ?? null, input.prepared?.patchDigest ?? null, input.prepared?.checkedAt ?? null, preparedEvidence === undefined ? null : JSON.stringify(preparedEvidence), creation === undefined ? null : JSON.stringify(creation), revision === undefined ? null : JSON.stringify(revision), now);
+            if (preparedArtifact !== undefined) {
+                this.#database.prepare('INSERT INTO source_prepared_artifact_refs (plan_id, pack_sha256) VALUES (?, ?)')
+                    .run(id, preparedEvidence.pack.sha256);
+            }
             const matched = this.#database.prepare(`UPDATE capability_gaps SET status = 'matched', revision = revision + 1, updated_at = ? WHERE id = ? AND revision = ?`).run(now, gap.id, gap.revision);
             if (Number(matched.changes) !== 1)
                 throw new ControlPlaneStoreError('conflict', 'capability gap changed while source plan was created');
@@ -1658,6 +2574,735 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('not-found', 'source plan not found');
         return sourceFromRow(row);
     }
+    /** Exact durable source job for a currently admitted prepared creation. */
+    getPreparedSourceJob(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-create' || plan.status !== 'pending-approval'
+            || plan.creation === undefined || plan.preparedEvidence === undefined
+            || this.#now() >= plan.expiresAt || this.#now() >= plan.creation.grant.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared creation requires a current pending plan');
+        }
+        const owner = this.getOwnerTaskFailureReference(plan.gapId);
+        if (owner === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared creation requires an owner task failure gap');
+        this.#assertOwnerTaskFailureGapAdmission(plan.gapId);
+        return this.getRetainedPreparedCreation(planId).job;
+    }
+    /** Read-only exact historical binding for an already signed adoption. Caller must hold the current owner fence. */
+    getRetainedPreparedCreation(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-create' || !['pending-approval', 'expired'].includes(plan.status)
+            || plan.creation === undefined || plan.preparedEvidence === undefined || plan.sourceCheck === undefined) {
+            throw new ControlPlaneStoreError('invalid-state', 'retained creation requires exact prepared evidence');
+        }
+        const owner = this.getOwnerTaskFailureReference(plan.gapId);
+        if (owner === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'retained creation requires an owner task failure gap');
+        const row = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ?')
+            .get(plan.id);
+        if (row === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared creation has no source job');
+        const job = sourceJobFromRow(row);
+        const gap = this.getGap(plan.gapId);
+        if (job.status !== 'prepared' || job.planId !== plan.id || job.intent.mode !== 'create'
+            || job.intent.creation === undefined || job.intent.gapId !== plan.gapId
+            || job.intent.gapRevision !== plan.gapSnapshot.revision
+            || gap.inputDigest !== plan.gapSnapshot.inputDigest
+            || job.intent.ownerDigest !== controlPlaneDigest(owner.owner)
+            || controlPlaneDigest(job.intent.owner) !== job.intent.ownerDigest
+            || controlPlaneDigest(job.intent.creation) !== controlPlaneDigest(plan.creation)
+            || job.intent.creation.generatorDigest !== plan.generatorDigest
+            || job.intent.repository !== plan.repository || job.intent.worktree !== plan.worktree
+            || job.intent.baseCommit !== plan.baseCommit || job.intent.name !== plan.name
+            || plan.expiresAt !== plan.createdAt + job.intent.ttlMs) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared creation source job binding is corrupt');
+        }
+        return { plan, job, reference: owner };
+    }
+    /** Exact durable source job for a currently admitted prepared revision. */
+    getPreparedRevisionJob(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-revise' || plan.status !== 'pending-approval'
+            || plan.sourceRevision === undefined || plan.preparedEvidence === undefined
+            || this.#now() >= plan.expiresAt || this.#now() >= plan.sourceRevision.grant.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared revision requires a current pending plan');
+        }
+        const owner = this.getOwnerTaskFailureReference(plan.gapId);
+        if (owner === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared revision requires an owner task failure gap');
+        this.#assertOwnerTaskFailureGapAdmission(plan.gapId);
+        return this.getRetainedPreparedRevision(planId).job;
+    }
+    /** Read-only exact historical binding for an already signed adoption. Caller must hold the current owner fence. */
+    getRetainedPreparedRevision(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-revise' || !['pending-approval', 'expired'].includes(plan.status)
+            || plan.sourceRevision === undefined || plan.preparedEvidence === undefined || plan.sourceCheck === undefined) {
+            throw new ControlPlaneStoreError('invalid-state', 'retained revision requires exact prepared evidence');
+        }
+        const owner = this.getOwnerTaskFailureReference(plan.gapId);
+        if (owner === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'retained revision requires an owner task failure gap');
+        const row = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ?')
+            .get(plan.id);
+        if (row === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared revision has no source job');
+        const job = sourceJobFromRow(row);
+        const gap = this.getGap(plan.gapId);
+        if (job.status !== 'prepared' || job.planId !== plan.id || job.intent.mode !== 'revise-created'
+            || job.intent.revision === undefined || job.intent.gapId !== plan.gapId
+            || job.intent.gapRevision !== plan.gapSnapshot.revision
+            || gap.inputDigest !== plan.gapSnapshot.inputDigest
+            || job.intent.ownerDigest !== controlPlaneDigest(owner.owner)
+            || controlPlaneDigest(job.intent.owner) !== job.intent.ownerDigest
+            || controlPlaneDigest(job.intent.revision) !== controlPlaneDigest(plan.sourceRevision)
+            || job.intent.revision.generatorDigest !== plan.generatorDigest
+            || job.intent.repository !== plan.repository || job.intent.worktree !== plan.worktree
+            || job.intent.baseCommit !== plan.baseCommit || job.intent.name !== plan.name
+            || plan.expiresAt !== plan.createdAt + job.intent.ttlMs) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared revision source job binding is corrupt');
+        }
+        return { plan, job, reference: owner };
+    }
+    /** Host-only package bytes for an owner-admitted, still-pending created plugin. */
+    readPreparedSourceArtifact(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-create' && plan.mode !== 'prepared-revise' || plan.status !== 'pending-approval'
+            || plan.preparedEvidence === undefined || this.#now() >= plan.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact requires a current pending creation plan');
+        }
+        if (plan.mode === 'prepared-revise')
+            this.getPreparedRevisionJob(planId);
+        else
+            this.getPreparedSourceJob(planId);
+        const pack = plan.preparedEvidence.pack;
+        const reference = this.#database.prepare('SELECT pack_sha256 FROM source_prepared_artifact_refs WHERE plan_id = ?')
+            .get(plan.id);
+        if (reference?.pack_sha256 !== pack.sha256)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact reference is missing or corrupt');
+        const row = this.#database.prepare('SELECT * FROM source_prepared_artifacts WHERE pack_sha256 = ?')
+            .get(pack.sha256);
+        if (row === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact is missing');
+        return preparedArtifactBytesFromRow(row, pack);
+    }
+    /** One immutable, independently signed result per exact prepared creation. */
+    recordCreationVerification(certificate) {
+        validatePluginCreationVerificationCertificate(certificate);
+        const plan = this.getSourcePlan(certificate.plan.id);
+        const job = this.getPreparedSourceJob(plan.id);
+        const reference = this.getOwnerTaskFailureReference(plan.gapId);
+        if (!reference || !plan.sourceCheck || !plan.preparedEvidence || !plan.creation?.growthRun
+            || !job.intent.creation?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
+            || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
+            || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
+            || plan.preparedEvidence.pack.sha256 !== certificate.plan.artifactSha256
+            || plan.preparedEvidence.pack.sizeBytes !== certificate.plan.artifactBytes
+            || plan.generatorDigest !== certificate.plan.generatorDigest
+            || controlPlaneDigest(reference) !== certificate.source.referenceDigest
+            || controlPlaneDigest(reference.owner) !== certificate.source.ownerDigest
+            || sourceGrowthRunDigest(plan.creation.growthRun) !== certificate.source.growthRunDigest
+            || sourceGrowthRunDigest(job.intent.creation.growthRun) !== certificate.source.growthRunDigest
+            || controlPlaneDigest(plan.creation.growthRun.model) !== controlPlaneDigest(certificate.model)
+            || certificate.expiresAt > Math.min(plan.expiresAt, plan.creation.grant.expiresAt, plan.creation.growthRun.expiresAt, certificate.authority.expiresAt)) {
+            throw new ControlPlaneStoreError('invalid-input', 'creation verification certificate does not match exact prepared source');
+        }
+        this.readPreparedSourceArtifact(plan.id);
+        const serialized = JSON.stringify(certificate), certificateDigest = controlPlaneDigest(certificate);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const previous = this.#database.prepare('SELECT status,certificate_digest FROM source_creation_verifications WHERE plan_id=?')
+                .get(plan.id);
+            if (previous?.status === 'verified' && previous.certificate_digest === certificateDigest) { /* idempotent */ }
+            else if (previous?.status !== 'claimed')
+                throw new ControlPlaneStoreError('conflict', 'creation verification was not claimed or already settled');
+            else
+                this.#database.prepare(`UPDATE source_creation_verifications SET status='verified',certificate_json=?,certificate_digest=?,updated_at=?
+        WHERE plan_id=? AND status='claimed'`).run(serialized, certificateDigest, this.#now(), plan.id);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    getCreationVerification(planId) {
+        const row = this.#database.prepare('SELECT status,certificate_json,certificate_digest FROM source_creation_verifications WHERE plan_id=?')
+            .get(planId);
+        if (!row || row.status !== 'verified')
+            return undefined;
+        let certificate;
+        try {
+            const parsed = JSON.parse(row.certificate_json);
+            validatePluginCreationVerificationCertificate(parsed);
+            certificate = parsed;
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored creation verification certificate is corrupt');
+        }
+        if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored creation verification certificate digest changed');
+        }
+        return certificate;
+    }
+    getCreationVerificationStatus(planId) {
+        const row = this.#database.prepare('SELECT status FROM source_creation_verifications WHERE plan_id=?')
+            .get(planId);
+        return row?.status;
+    }
+    /** Content-free diagnostic projection; caller must hold current owner/source fence. */
+    inspectCreationVerificationRecord(planId) {
+        const row = this.#database.prepare('SELECT status,reason,updated_at FROM source_creation_verifications WHERE plan_id=?')
+            .get(planId);
+        if (!row)
+            return undefined;
+        if (!['claimed', 'verified', 'unknown', 'rejected'].includes(row.status)
+            || !Number.isSafeInteger(row.updated_at) || row.updated_at < 1
+            || (row.reason !== null && !/^[a-z][a-z0-9-]{0,79}$/u.test(row.reason))) {
+            throw new ControlPlaneStoreError('invalid-state', 'creation verification diagnostic record is corrupt');
+        }
+        return { status: row.status, ...(row.reason === null ? {} : { reason: row.reason }), updatedAt: row.updated_at };
+    }
+    claimCreationVerification(planId) {
+        const job = this.getPreparedSourceJob(planId);
+        const pinned = job.intent.creation?.growthRun?.creationAcceptance;
+        if (!pinned || this.#now() >= pinned.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'creation verification requires a current pre-author policy binding');
+        }
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const count = this.#database.prepare('SELECT count(*) AS n FROM source_creation_verifications').get();
+            if (count.n >= 256)
+                throw new ControlPlaneStoreError('conflict', 'creation verification record limit reached');
+            const now = this.#now();
+            this.#database.prepare(`INSERT INTO source_creation_verifications
+        (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
+                .run(planId, now, now);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    settleCreationVerification(planId, status, reason) {
+        if (typeof reason !== 'string' || !/^[a-z][a-z0-9-]{0,79}$/u.test(reason)) {
+            throw new ControlPlaneStoreError('invalid-input', 'creation verification reason is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_creation_verifications SET status=?,reason=?,updated_at=?
+      WHERE plan_id=? AND status='claimed'`).run(status, reason, this.#now(), planId);
+        if (Number(result.changes) !== 1)
+            throw new ControlPlaneStoreError('conflict', 'creation verification claim is not current');
+    }
+    /** One immutable, independently signed result per exact prepared revision. */
+    recordRevisionVerification(certificate, source) {
+        validatePluginRevisionVerificationCertificate(certificate);
+        const plan = this.getSourcePlan(certificate.plan.id);
+        const job = this.getPreparedRevisionJob(plan.id);
+        const reference = this.getOwnerTaskFailureReference(plan.gapId);
+        validateCreationCapabilitySource(source, certificate);
+        if (!reference || controlPlaneDigest(plan.sourceRevision?.parent) !== controlPlaneDigest(certificate.parent) || !plan.sourceCheck || !plan.preparedEvidence || !plan.sourceRevision?.growthRun
+            || !job.intent.revision?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
+            || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
+            || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
+            || plan.preparedEvidence.pack.sha256 !== certificate.plan.artifactSha256
+            || plan.preparedEvidence.pack.sizeBytes !== certificate.plan.artifactBytes
+            || plan.generatorDigest !== certificate.plan.generatorDigest
+            || controlPlaneDigest(reference) !== certificate.source.referenceDigest
+            || controlPlaneDigest(reference.owner) !== certificate.source.ownerDigest
+            || sourceGrowthRunDigest(plan.sourceRevision.growthRun) !== certificate.source.growthRunDigest
+            || sourceGrowthRunDigest(job.intent.revision.growthRun) !== certificate.source.growthRunDigest
+            || controlPlaneDigest(plan.sourceRevision.growthRun.model) !== controlPlaneDigest(certificate.model)
+            || certificate.expiresAt > Math.min(plan.expiresAt, plan.sourceRevision.grant.expiresAt, plan.sourceRevision.growthRun.expiresAt, certificate.authority.expiresAt)) {
+            throw new ControlPlaneStoreError('invalid-input', 'revision verification certificate does not match exact prepared source');
+        }
+        this.readPreparedSourceArtifact(plan.id);
+        if (source.baseCommit !== plan.baseCommit || controlPlaneDigest(source.scope) !== controlPlaneDigest(plan.scope))
+            throw new ControlPlaneStoreError('invalid-input', 'revision source archive base or scope changed');
+        const sourceJson = JSON.stringify(source);
+        if (Buffer.byteLength(sourceJson) > 2_097_152)
+            throw new ControlPlaneStoreError('invalid-input', 'revision source archive exceeds bound');
+        const serialized = JSON.stringify(certificate), certificateDigest = controlPlaneDigest(certificate);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const previous = this.#database.prepare('SELECT status,certificate_digest FROM source_revision_verifications WHERE plan_id=?')
+                .get(plan.id);
+            if (previous?.status === 'verified' && previous.certificate_digest === certificateDigest) { /* idempotent */ }
+            else if (previous?.status !== 'claimed')
+                throw new ControlPlaneStoreError('conflict', 'revision verification was not claimed or already settled');
+            else
+                this.#database.prepare(`UPDATE source_revision_verifications SET status='verified',certificate_json=?,certificate_digest=?,updated_at=?
+        WHERE plan_id=? AND status='claimed'`).run(serialized, certificateDigest, this.#now(), plan.id);
+            const oldSource = this.#database.prepare('SELECT source_json FROM source_revision_sources WHERE plan_id=?').get(plan.id);
+            if (oldSource && oldSource.source_json !== sourceJson)
+                throw new ControlPlaneStoreError('conflict', 'revision source archive changed');
+            if (!oldSource)
+                this.#database.prepare('INSERT INTO source_revision_sources VALUES(?,?)').run(plan.id, sourceJson);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    getRevisionVerification(planId) {
+        const row = this.#database.prepare('SELECT status,certificate_json,certificate_digest FROM source_revision_verifications WHERE plan_id=?')
+            .get(planId);
+        if (!row || row.status !== 'verified')
+            return undefined;
+        let certificate;
+        try {
+            const parsed = JSON.parse(row.certificate_json);
+            validatePluginRevisionVerificationCertificate(parsed);
+            certificate = parsed;
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision verification certificate is corrupt');
+        }
+        if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision verification certificate digest changed');
+        }
+        return certificate;
+    }
+    getRevisionVerificationStatus(planId) {
+        const row = this.#database.prepare('SELECT status FROM source_revision_verifications WHERE plan_id=?')
+            .get(planId);
+        return row?.status;
+    }
+    /** Content-free diagnostic projection; caller must hold current owner/source fence. */
+    inspectRevisionVerificationRecord(planId) {
+        const row = this.#database.prepare('SELECT status,reason,updated_at FROM source_revision_verifications WHERE plan_id=?')
+            .get(planId);
+        if (!row)
+            return undefined;
+        if (!['claimed', 'verified', 'unknown', 'rejected'].includes(row.status)
+            || !Number.isSafeInteger(row.updated_at) || row.updated_at < 1
+            || (row.reason !== null && !/^[a-z][a-z0-9-]{0,79}$/u.test(row.reason))) {
+            throw new ControlPlaneStoreError('invalid-state', 'revision verification diagnostic record is corrupt');
+        }
+        return { status: row.status, ...(row.reason === null ? {} : { reason: row.reason }), updatedAt: row.updated_at };
+    }
+    claimRevisionVerification(planId) {
+        const job = this.getPreparedRevisionJob(planId);
+        const pinned = job.intent.revision?.growthRun?.revisionAcceptance;
+        if (!pinned || this.#now() >= pinned.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'revision verification requires a current pre-author policy binding');
+        }
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const count = this.#database.prepare('SELECT count(*) AS n FROM source_revision_verifications').get();
+            if (count.n >= 256)
+                throw new ControlPlaneStoreError('conflict', 'revision verification record limit reached');
+            const now = this.#now();
+            this.#database.prepare(`INSERT INTO source_revision_verifications
+        (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
+                .run(planId, now, now);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    settleRevisionVerification(planId, status, reason) {
+        if (typeof reason !== 'string' || !/^[a-z][a-z0-9-]{0,79}$/u.test(reason)) {
+            throw new ControlPlaneStoreError('invalid-input', 'revision verification reason is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_revision_verifications SET status=?,reason=?,updated_at=?
+      WHERE plan_id=? AND status='claimed'`).run(status, reason, this.#now(), planId);
+        if (Number(result.changes) !== 1)
+            throw new ControlPlaneStoreError('conflict', 'revision verification claim is not current');
+    }
+    /** Purpose-separated paired held-out proof; never changes plan or adoption state. */
+    recordRevisionRegression(certificate) {
+        validatePluginRevisionRegressionCertificate(certificate);
+        const plan = this.getSourcePlan(certificate.plan.id);
+        const job = this.getPreparedRevisionJob(plan.id);
+        const candidate = this.getRevisionVerification(plan.id);
+        const parent = this.getCreationVerification(certificate.parent.planId);
+        const source = this.readRevisionSource(plan.id);
+        const reference = this.getOwnerTaskFailureReference(plan.gapId);
+        const run = plan.sourceRevision?.growthRun;
+        const previousJobs = new Set([...(parent?.observations ?? []), ...(candidate?.observations ?? [])].map(item => item.jobId));
+        if (certificate.verifiedAt > this.#now() || certificate.expiresAt <= this.#now()
+            || !candidate || !parent || !source || !reference || !run?.revisionRegressionAcceptance
+            || !job.intent.revision?.growthRun.revisionRegressionAcceptance
+            || controlPlaneDigest(certificate.plan) !== controlPlaneDigest(candidate.plan)
+            || controlPlaneDigest(certificate.source) !== controlPlaneDigest(candidate.source)
+            || controlPlaneDigest(certificate.parent) !== controlPlaneDigest(candidate.parent)
+            || certificate.candidateVerificationDigest !== controlPlaneDigest(candidate)
+            || certificate.sourceDigest !== source.digest
+            || certificate.contractDigest !== parent.contractDigest
+            || certificate.schemaDigest !== candidate.schemaDigest
+            || controlPlaneDigest(certificate.environment) !== controlPlaneDigest(candidate.environment)
+            || controlPlaneDigest(certificate.environment) !== controlPlaneDigest(parent.environment)
+            || controlPlaneDigest(certificate.model) !== controlPlaneDigest(run.model)
+            || controlPlaneDigest(certificate.authority) !== controlPlaneDigest(run.revisionRegressionAcceptance)
+            || controlPlaneDigest(certificate.authority) !== controlPlaneDigest(job.intent.revision.growthRun.revisionRegressionAcceptance)
+            || certificate.source.referenceDigest !== controlPlaneDigest(reference)
+            || certificate.source.ownerDigest !== controlPlaneDigest(reference.owner)
+            || certificate.source.growthRunDigest !== sourceGrowthRunDigest(run)
+            || sourceGrowthRunDigest(run) !== sourceGrowthRunDigest(job.intent.revision.growthRun)
+            || certificate.observations.length !== parent.observations.length
+            || certificate.observations.some((item, index) => item.caseId !== parent.observations[index]?.caseId
+                || previousJobs.has(item.parent.jobId) || previousJobs.has(item.candidate.jobId))
+            || certificate.expiresAt > Math.min(candidate.expiresAt, plan.expiresAt, run.expiresAt, plan.sourceRevision.grant.expiresAt, certificate.authority.expiresAt)) {
+            throw new ControlPlaneStoreError('invalid-input', 'regression certificate does not match exact parent and candidate');
+        }
+        this.readPreparedSourceArtifact(plan.id);
+        const serialized = JSON.stringify(certificate), digest = controlPlaneDigest(certificate);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const old = this.#database.prepare('SELECT status,certificate_digest FROM source_revision_regressions WHERE plan_id=?')
+                .get(plan.id);
+            if (old?.status === 'verified' && old.certificate_digest === digest) { /* immutable idempotent result */ }
+            else if (old?.status !== 'claimed')
+                throw new ControlPlaneStoreError('conflict', 'regression was not claimed or is settled');
+            else
+                this.#database.prepare(`UPDATE source_revision_regressions SET status='verified',certificate_json=?,certificate_digest=?,updated_at=?
+        WHERE plan_id=? AND status='claimed'`).run(serialized, digest, this.#now(), plan.id);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    getRevisionRegression(planId) {
+        const row = this.#database.prepare('SELECT status,certificate_json,certificate_digest FROM source_revision_regressions WHERE plan_id=?')
+            .get(planId);
+        if (!row || row.status !== 'verified')
+            return undefined;
+        let certificate;
+        try {
+            const parsed = JSON.parse(row.certificate_json);
+            validatePluginRevisionRegressionCertificate(parsed);
+            certificate = parsed;
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision regression certificate is corrupt');
+        }
+        if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision regression certificate digest changed');
+        }
+        return certificate;
+    }
+    getRevisionRegressionStatus(planId) {
+        const row = this.#database.prepare('SELECT status FROM source_revision_regressions WHERE plan_id=?')
+            .get(planId);
+        return row?.status;
+    }
+    /** Content-free diagnostic projection; caller must hold current owner/source fence. */
+    inspectRevisionRegressionRecord(planId) {
+        const row = this.#database.prepare('SELECT status,reason,updated_at FROM source_revision_regressions WHERE plan_id=?')
+            .get(planId);
+        if (!row)
+            return undefined;
+        if (!['claimed', 'verified', 'unknown', 'rejected'].includes(row.status)
+            || !Number.isSafeInteger(row.updated_at) || row.updated_at < 1
+            || (row.reason !== null && !/^[a-z][a-z0-9-]{0,79}$/u.test(row.reason))) {
+            throw new ControlPlaneStoreError('invalid-state', 'revision regression diagnostic record is corrupt');
+        }
+        return { status: row.status, ...(row.reason === null ? {} : { reason: row.reason }), updatedAt: row.updated_at };
+    }
+    claimRevisionRegression(planId) {
+        const job = this.getPreparedRevisionJob(planId);
+        const pinned = job.intent.revision?.growthRun?.revisionRegressionAcceptance;
+        if (!pinned || this.#now() >= pinned.expiresAt) {
+            throw new ControlPlaneStoreError('invalid-state', 'revision regression requires a current pre-author policy binding');
+        }
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const count = this.#database.prepare('SELECT count(*) AS n FROM source_revision_regressions').get();
+            if (count.n >= 256)
+                throw new ControlPlaneStoreError('conflict', 'revision regression record limit reached');
+            const now = this.#now();
+            this.#database.prepare(`INSERT INTO source_revision_regressions
+        (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
+                .run(planId, now, now);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    settleRevisionRegression(planId, status, reason) {
+        if (typeof reason !== 'string' || !/^[a-z][a-z0-9-]{0,79}$/u.test(reason)) {
+            throw new ControlPlaneStoreError('invalid-input', 'revision regression reason is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_revision_regressions SET status=?,reason=?,updated_at=?
+      WHERE plan_id=? AND status='claimed'`).run(status, reason, this.#now(), planId);
+        if (Number(result.changes) !== 1)
+            throw new ControlPlaneStoreError('conflict', 'revision regression claim is not current');
+    }
+    readRevisionSource(planId) {
+        const certificate = this.getRevisionVerification(planId);
+        if (!certificate)
+            return undefined;
+        const row = this.#database.prepare('SELECT source_json FROM source_revision_sources WHERE plan_id=?').get(planId);
+        if (!row || Buffer.byteLength(row.source_json) > 2_097_152)
+            throw new ControlPlaneStoreError('invalid-state', 'revision source archive is absent or oversized');
+        const source = JSON.parse(row.source_json);
+        validateCreationCapabilitySource(source, certificate);
+        const plan = this.getSourcePlan(planId);
+        if (source.baseCommit !== plan.baseCommit || controlPlaneDigest(source.scope) !== controlPlaneDigest(plan.scope))
+            throw new ControlPlaneStoreError('invalid-state', 'revision source archive scope changed');
+        return source;
+    }
+    /** Reclaim only orphaned bytes or bytes referenced solely by expired plans. */
+    deleteExpiredPreparedSourceArtifacts(now) {
+        if (!Number.isSafeInteger(now) || now < 0)
+            throw new ControlPlaneStoreError('invalid-input', 'artifact expiry time is invalid');
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const references = this.#database.prepare('SELECT plan_id, pack_sha256 FROM source_prepared_artifact_refs')
+                .all();
+            for (const reference of references) {
+                const plan = this.getSourcePlan(reference.plan_id);
+                if (plan.mode !== 'prepared-create' && plan.mode !== 'prepared-revise' || plan.preparedEvidence?.pack.sha256 !== reference.pack_sha256) {
+                    throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact reference is corrupt');
+                }
+                if (plan.status === 'expired' && plan.expiresAt < now) {
+                    this.#database.prepare('DELETE FROM source_prepared_artifact_refs WHERE plan_id = ?').run(plan.id);
+                }
+            }
+            const artifacts = this.#database.prepare(`SELECT a.pack_sha256 FROM source_prepared_artifacts a
+        WHERE NOT EXISTS (SELECT 1 FROM source_prepared_artifact_refs r WHERE r.pack_sha256 = a.pack_sha256)`)
+                .all();
+            let deleted = 0;
+            for (const artifact of artifacts) {
+                const result = this.#database.prepare('DELETE FROM source_prepared_artifacts WHERE pack_sha256 = ?')
+                    .run(artifact.pack_sha256);
+                deleted += Number(result.changes);
+            }
+            this.#database.exec('COMMIT');
+            return deleted;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Durable, structurally bound applied merge history; receipt signatures are checked by the baseline resolver. */
+    getSourceBaselineHistory(repository) {
+        if (!isAbsolute(repository) || resolve(repository) !== repository)
+            throw new ControlPlaneStoreError('invalid-input', 'source repository path is invalid');
+        // A SAVEPOINT provides one SQLite read snapshot, and also works inside the
+        // start-release BEGIN IMMEDIATE writer without nesting another BEGIN.
+        this.#database.exec('SAVEPOINT source_baseline_history');
+        try {
+            const history = this.#readSourceBaselineHistory(repository);
+            this.#database.exec('RELEASE source_baseline_history');
+            return history;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK TO source_baseline_history');
+            this.#database.exec('RELEASE source_baseline_history');
+            throw error;
+        }
+    }
+    /** Must run inside an open read transaction/SAVEPOINT so the caller sees one snapshot. */
+    #readSourceBaselineHistory(repository) {
+        const rows = this.#database.prepare(`SELECT * FROM source_plans WHERE repository = ?
+      AND (release_id IS NOT NULL OR status IN ('release-complete','release-failed'))
+      ORDER BY created_at, id LIMIT 1001`).all(repository);
+        if (rows.length > 1000)
+            throw new ControlPlaneStoreError('invalid-state', 'source release history exceeds bound');
+        const history = [];
+        for (const row of rows) {
+            const plan = sourceFromRow(row);
+            if (plan.release === undefined)
+                throw new ControlPlaneStoreError('invalid-state', 'started source release lacks release identity');
+            if (plan.status !== 'release-complete' && plan.status !== 'release-failed') {
+                throw new ControlPlaneStoreError('conflict', 'source repository has an unfinished release');
+            }
+            const merges = this.#database.prepare(`SELECT * FROM source_release_operations WHERE plan_id = ? AND phase = 'merge'
+        AND status = 'applied' LIMIT 2`).all(plan.id);
+            if (plan.status === 'release-failed') {
+                if (merges.length !== 0)
+                    throw new ControlPlaneStoreError('conflict', 'failed source release has unresolved applied remote merge');
+                continue;
+            }
+            if (merges.length !== 1)
+                throw new ControlPlaneStoreError('invalid-state', 'completed source release lacks one applied merge');
+            const operation = sourceReleaseOperationFromRow(merges[0]);
+            const receipt = operation.receipt;
+            if (operation.status !== 'applied' || operation.phase !== 'merge' || operation.request.phase !== 'merge' || operation.planId !== plan.id
+                || operation.request.plan.digest !== plan.digest || operation.request.plan.revision > plan.revision
+                || operation.request.release.id !== plan.release.id || operation.request.release.fence !== plan.release.fence
+                || receipt?.outcome !== 'passed' || receipt.evidence.kind !== 'merge'
+                || receipt.planDigest !== plan.digest || receipt.evidence.targetBranch !== plan.releaseAuthorization?.releasePolicy.targetBranch
+                || receipt.evidence.reviewedHeadCommit !== operation.request.input.headCommit
+                || receipt.evidence.reviewEvidenceDigest !== operation.request.input.reviewEvidenceDigest
+                || receipt.evidence.reviewId !== operation.request.input.reviewId
+                || receipt.evidence.prId !== operation.request.input.prId) {
+                throw new ControlPlaneStoreError('invalid-state', 'completed source release merge is not bound to current release');
+            }
+            history.push({ plan, operation });
+        }
+        return history;
+    }
+    /** Release edges and maintenance edges in one SQLite snapshot, for preflight consumers that must compare both. */
+    readSourceMaintenanceState(repository) {
+        if (!isAbsolute(repository) || resolve(repository) !== repository)
+            throw new ControlPlaneStoreError('invalid-input', 'source repository path is invalid');
+        this.#database.exec('SAVEPOINT source_maintenance_state');
+        try {
+            const unsettledJob = this.#database.prepare(`SELECT id FROM source_jobs WHERE json_extract(intent_json,'$.repository')=?
+        AND status IN ('queued','running','unknown') LIMIT 1`).get(repository);
+            const unsettledPlan = this.#database.prepare(`SELECT id FROM source_plans WHERE repository=?
+        AND status NOT IN ('expired','local-checks-failed','release-failed','release-complete') LIMIT 1`).get(repository);
+            if (unsettledJob || unsettledPlan)
+                throw new ControlPlaneStoreError('conflict', 'source maintenance has unsettled source work');
+            const history = this.#readSourceBaselineHistory(repository);
+            const records = this.getSourceMaintenanceRecords(repository);
+            this.#database.exec('RELEASE source_maintenance_state');
+            return { history, records };
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK TO source_maintenance_state');
+            this.#database.exec('RELEASE source_maintenance_state');
+            throw error;
+        }
+    }
+    getSourceMaintenanceRecords(repository) {
+        if (!isAbsolute(repository) || resolve(repository) !== repository)
+            throw new ControlPlaneStoreError('invalid-input', 'source repository path is invalid');
+        const rows = this.#database.prepare('SELECT sequence,host_plan_id,record_json,record_digest FROM source_maintenance WHERE repository=? ORDER BY sequence LIMIT 257')
+            .all(repository);
+        if (rows.length > 256)
+            throw new ControlPlaneStoreError('invalid-state', 'source maintenance history exceeds bound');
+        return rows.map((row, index) => {
+            const record = parseSourceMaintenanceRecord(JSON.parse(row.record_json));
+            if (record.repository !== repository || record.sequence !== index + 1 || record.sequence !== row.sequence
+                || record.host?.planId !== (row.host_plan_id ?? undefined)
+                || sourceMaintenanceDigest(record) !== row.record_digest) {
+                throw new ControlPlaneStoreError('invalid-state', 'source maintenance stored record changed');
+            }
+            return record;
+        });
+    }
+    /** Offline owner transaction only. No service/model-facing signing path exists. */
+    async appendSourceMaintenance(recordInput, input) {
+        const record = parseSourceMaintenanceRecord(recordInput), { trust, baseline } = input;
+        validateSourceBaselineConfig(baseline);
+        const key = resolveTrustKey(trust, 'host-attestation', record.authority, record.keyId);
+        if (record.installationId !== trust.installationId || controlPlaneDigest(record.ledger) !== controlPlaneDigest(trust.ledger)
+            || record.repository !== recordInput.repository || controlPlaneDigest(record.baseline) !== controlPlaneDigest(baseline)
+            || !sameSourceMaintenancePublicKey(record.publicKeyPem, key.publicKeyPem) || record.issuedAt > this.#now()) {
+            throw new ControlPlaneStoreError('invalid-input', 'source maintenance owner binding changed');
+        }
+        const verifiedHistory = this.getSourceBaselineHistory(record.repository);
+        const verifiedMaintenance = this.getSourceMaintenanceRecords(record.repository);
+        const authorityDigest = controlPlaneDigest({ trust, baseline });
+        await verifySourceBaselineHistory({ repository: record.repository, config: baseline, trust,
+            history: verifiedHistory, maintenance: verifiedMaintenance, signal: new AbortController().signal });
+        const verifiedSnapshot = controlPlaneDigest({ history: verifiedHistory, maintenance: verifiedMaintenance });
+        this.#database.exec('SAVEPOINT append_source_maintenance');
+        try {
+            this.#database.exec('UPDATE source_maintenance SET sequence=sequence WHERE 0');
+            const records = this.getSourceMaintenanceRecords(record.repository);
+            const history = this.getSourceBaselineHistory(record.repository);
+            if (controlPlaneDigest({ trust, baseline }) !== authorityDigest) {
+                throw new ControlPlaneStoreError('conflict', 'source maintenance trust or baseline changed before append');
+            }
+            if (controlPlaneDigest({ history, maintenance: records }) !== verifiedSnapshot) {
+                throw new ControlPlaneStoreError('conflict', 'source maintenance signed history changed before append');
+            }
+            const priorTransaction = records.find(item => item.transactionId === record.transactionId);
+            if (priorTransaction) {
+                if (sourceMaintenanceDigest(priorTransaction) !== sourceMaintenanceDigest(record)) {
+                    throw new ControlPlaneStoreError('conflict', 'source maintenance transaction changed');
+                }
+                this.#database.exec('RELEASE append_source_maintenance');
+                return;
+            }
+            verifySourceMaintenanceRecords([...records, record], { installationId: trust.installationId,
+                ledger: trust.ledger, repository: record.repository, baseline, hostIdentity: key });
+            const unsettledJob = this.#database.prepare(`SELECT id FROM source_jobs WHERE json_extract(intent_json,'$.repository')=?
+        AND status IN ('queued','running','unknown') LIMIT 1`).get(record.repository);
+            const unsettledPlan = this.#database.prepare(`SELECT id FROM source_plans WHERE repository=?
+        AND status NOT IN ('expired','local-checks-failed','release-failed','release-complete') LIMIT 1`).get(record.repository);
+            if (unsettledJob || unsettledPlan)
+                throw new ControlPlaneStoreError('conflict', 'source maintenance has unsettled source work');
+            const activationState = this.readSourceMaintenanceActivationState(trust.dshHome);
+            if (activationState.kind === 'unsettled') {
+                throw new ControlPlaneStoreError('conflict', 'source maintenance activation is unsettled');
+            }
+            if (activationState.kind === 'watched') {
+                const context = readCurrentRuntimeEpochDeployment(this.#database, this.getPlan(activationState.planId).target.profilePath);
+                const { plan, readiness } = context, receipt = readiness.receipt;
+                if (!record.host || record.host.planId !== plan.id || record.host.planDigest !== plan.digest
+                    || record.host.readinessOperationId !== readiness.operationId || !receipt
+                    || record.host.readinessReceiptDigest !== hostMaintenanceDigest(receipt)
+                    || receipt.authority !== record.authority || receipt.keyId !== record.keyId) {
+                    throw new ControlPlaneStoreError('conflict', 'source maintenance watched Host anchor changed');
+                }
+                const { signature, ...unsigned } = receipt;
+                if (!verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), createPublicKey(key.publicKeyPem), Buffer.from(signature, 'base64'))) {
+                    throw new ControlPlaneStoreError('conflict', 'source maintenance original Host receipt signature changed');
+                }
+            }
+            else if (record.host !== null)
+                throw new ControlPlaneStoreError('conflict', 'source maintenance has no watched Host anchor');
+            const current = sourceBaselineChain(baseline, history, records).at(-1);
+            if (record.previousTip !== current)
+                throw new ControlPlaneStoreError('conflict', 'source maintenance previous tip is stale');
+            sourceBaselineChain(baseline, history, [...records, record]);
+            assertSourceMaintenanceGit(record, input.physicalHome ?? trust.dshHome, trust.dshHome);
+            this.#database.prepare('INSERT INTO source_maintenance VALUES (?,?,?,?,?,?)').run(record.repository, record.sequence, record.transactionId, record.host?.planId ?? null, JSON.stringify(record), sourceMaintenanceDigest(record));
+            this.#database.exec('RELEASE append_source_maintenance');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK TO append_source_maintenance; RELEASE append_source_maintenance');
+            throw error;
+        }
+    }
+    /** Seed a previously owner-signed pre-adoption sidecar into a new ledger. */
+    async importSourceMaintenanceRecords(recordInputs, input) {
+        if (recordInputs.length === 0 || recordInputs.length > 256)
+            throw new ControlPlaneStoreError('invalid-input', 'source maintenance import is empty or unbounded');
+        const { trust, baseline } = input;
+        validateSourceBaselineConfig(baseline);
+        const records = recordInputs.map(parseSourceMaintenanceRecord), first = records[0];
+        const key = resolveTrustKey(trust, 'host-attestation', first.authority, first.keyId);
+        verifySourceMaintenanceRecords(records, { installationId: trust.installationId, ledger: trust.ledger,
+            repository: first.repository, baseline, hostIdentity: key });
+        if (records.some(record => record.host !== null))
+            throw new ControlPlaneStoreError('invalid-input', 'pre-adoption source history carries a deployment anchor');
+        sourceBaselineChain(baseline, [], records);
+        const authorityDigest = controlPlaneDigest({ trust, baseline, records });
+        this.#database.exec('SAVEPOINT import_source_maintenance');
+        try {
+            this.#database.exec('UPDATE source_maintenance SET sequence=sequence WHERE 0');
+            if (controlPlaneDigest({ trust, baseline, records }) !== authorityDigest)
+                throw new ControlPlaneStoreError('conflict', 'source import authority changed');
+            const present = this.getSourceMaintenanceRecords(first.repository);
+            if (present.length > records.length || present.some((record, index) => sourceMaintenanceDigest(record) !== sourceMaintenanceDigest(records[index]))) {
+                throw new ControlPlaneStoreError('conflict', 'source import differs from existing ledger history');
+            }
+            if (this.getSourceBaselineHistory(first.repository).length)
+                throw new ControlPlaneStoreError('conflict', 'source import cannot cross a published release');
+            const anyJob = this.#database.prepare(`SELECT id FROM source_jobs WHERE json_extract(intent_json,'$.repository')=? LIMIT 1`)
+                .get(first.repository);
+            const anyPlan = this.#database.prepare('SELECT id FROM source_plans WHERE repository=? LIMIT 1').get(first.repository);
+            const anyActivation = this.#database.prepare('SELECT id FROM activation_plans WHERE dsh_home=? LIMIT 1').get(trust.dshHome);
+            if (anyJob || anyPlan || anyActivation)
+                throw new ControlPlaneStoreError('conflict', 'source import requires an empty owner ledger');
+            for (let index = 0; index < records.length; index++) {
+                assertSourceMaintenanceGit(records[index], input.physicalHome ?? trust.dshHome, trust.dshHome, index === records.length - 1);
+            }
+            for (const record of records.slice(present.length)) {
+                this.#database.prepare('INSERT INTO source_maintenance VALUES (?,?,?,?,?,?)').run(record.repository, record.sequence, record.transactionId, null, JSON.stringify(record), sourceMaintenanceDigest(record));
+            }
+            this.#database.exec('RELEASE import_source_maintenance');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK TO import_source_maintenance; RELEASE import_source_maintenance');
+            throw error;
+        }
+    }
     /**
      * Enumerate 'modify' plans for isolated-worktree garbage collection. Only
      * modify plans own control-plane-created worktrees under the state root;
@@ -1671,14 +3316,24 @@ export class ControlPlaneStore {
                 .all(filter.expiredBefore);
         return rows.map(sourceFromRow);
     }
+    /** Isolated worktrees owned by the background prepared flows, including owner-granted creation. */
+    listPreparedSourcePlans(filter) {
+        const rows = filter?.expiredBefore === undefined
+            ? this.#database.prepare(`SELECT * FROM source_plans WHERE mode IN ('modify', 'prepared-create', 'prepared-revise') ORDER BY created_at, id`)
+                .all()
+            : this.#database.prepare(`SELECT * FROM source_plans WHERE mode IN ('modify', 'prepared-create', 'prepared-revise') AND expires_at < ? ORDER BY created_at, id`)
+                .all(filter.expiredBefore);
+        return rows.map(sourceFromRow);
+    }
     /** Retire an expired prepared plan before removing its worktree. The CAS
      * fences owner approval/review, and releases only this plan's gap claim. */
     expirePreparedSourcePlan(input) {
         if (!Number.isSafeInteger(input.now) || input.now < 0)
             throw new ControlPlaneStoreError('invalid-input', 'expiry time is invalid');
         const plan = this.getSourcePlan(input.planId);
-        if (plan.mode !== 'modify')
-            throw new ControlPlaneStoreError('invalid-state', 'only prepared modify plans may expire here');
+        if (plan.mode !== 'modify' && plan.mode !== 'prepared-create' && plan.mode !== 'prepared-revise') {
+            throw new ControlPlaneStoreError('invalid-state', 'only prepared source plans may expire here');
+        }
         const expiryDigest = controlPlaneDigest({ planId: plan.id, planDigest: plan.digest, expiresAt: plan.expiresAt });
         if (plan.status === 'expired') {
             const receipt = this.#sourcePlanReceipt(`source-expired:${plan.id}`, 'source-expired', expiryDigest, plan.id);
@@ -1689,7 +3344,8 @@ export class ControlPlaneStore {
         this.#database.exec('BEGIN IMMEDIATE');
         try {
             const retired = this.#database.prepare(`UPDATE source_plans SET status = 'expired', revision = revision + 1, updated_at = ?
-        WHERE id = ? AND revision = ? AND mode = 'modify' AND status IN ('pending-approval', 'approved') AND expires_at < ?`)
+        WHERE id = ? AND revision = ? AND ((mode = 'modify' AND status IN ('pending-approval', 'approved'))
+          OR (mode IN ('prepared-create', 'prepared-revise') AND status = 'pending-approval')) AND expires_at < ?`)
                 .run(input.now, plan.id, input.expectedRevision, input.now);
             if (Number(retired.changes) !== 1)
                 throw new ControlPlaneStoreError('conflict', 'prepared plan changed or is not expired');
@@ -1714,6 +3370,9 @@ export class ControlPlaneStore {
         return this.#approvePlan('activation', input);
     }
     async approveSource(input) {
+        if (['prepared-create', 'prepared-revise'].includes(this.getSourcePlan(input.planId).mode)) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared creation requires its own owner creation authority');
+        }
         return this.#approvePlan('source', input);
     }
     async #approvePlan(kind, input) {
@@ -1794,7 +3453,7 @@ export class ControlPlaneStore {
             const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
             if (row === undefined)
                 throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-            const plan = activationFromRow(row);
+            const plan = effectiveActivationFromRow(this.#database, row);
             if (plan.revision !== input.expectedRevision)
                 throw new ControlPlaneStoreError('conflict', 'activation plan revision conflict');
             if (row.approval_receipt_json === null || plan.approval === undefined) {
@@ -1817,7 +3476,7 @@ export class ControlPlaneStore {
                     if (now > plan.expiresAt)
                         throw new ControlPlaneStoreError('expired', 'activation plan expired before its first claim');
                     const targetOwner = this.#database.prepare(`SELECT id FROM activation_plans WHERE target_path = ? AND id <> ? AND status IN (
-          'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
+          'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
           'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending') LIMIT 1`).get(plan.target.profilePath, plan.id);
                     if (targetOwner !== undefined)
                         throw new ControlPlaneStoreError('conflict', 'target profile already has an active activation');
@@ -1830,7 +3489,7 @@ export class ControlPlaneStore {
                 const activationId = row.activation_id ?? `activation-${randomUUID()}`;
                 const status = plan.status === 'approved' ? 'staging' : plan.status;
                 const result = this.#database.prepare(`UPDATE activation_plans SET status = ?, revision = revision + 1, activation_id = ?,
-        activation_fence = activation_fence + 1, activation_lease_until = ?, updated_at = ? WHERE id = ? AND revision = ?`).run(status, activationId, now + input.leaseMs, now, plan.id, input.expectedRevision);
+        activation_fence = activation_fence + ?, activation_lease_until = ?, updated_at = ? WHERE id = ? AND revision = ?`).run(status, activationId, plan.status === 'commit-pending' && plan.dossier.liveQualification ? 0 : 1, now + input.leaseMs, now, plan.id, input.expectedRevision);
                 if (Number(result.changes) !== 1)
                     throw new ControlPlaneStoreError('conflict', 'activation plan changed while being claimed');
                 const claimed = this.getPlan(plan.id);
@@ -1863,7 +3522,7 @@ export class ControlPlaneStore {
                 const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
                 if (row === undefined)
                     throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-                const plan = activationFromRow(row);
+                const plan = effectiveActivationFromRow(this.#database, row);
                 if (plan.revision !== input.expectedRevision || plan.activation?.fence !== input.fence || plan.status !== 'staging'
                     || Number(row.activation_lease_until ?? 0) < now)
                     throw new ControlPlaneStoreError('conflict', 'activation lost its claim before recording the target baseline');
@@ -1905,7 +3564,7 @@ export class ControlPlaneStore {
                 const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
                 if (row === undefined)
                     throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-                const plan = activationFromRow(row);
+                const plan = effectiveActivationFromRow(this.#database, row);
                 if (plan.revision !== input.expectedRevision || plan.activation?.fence !== input.fence || plan.status !== 'commit-pending'
                     || Number(row.activation_lease_until ?? 0) < now) {
                     throw new ControlPlaneStoreError('conflict', 'activation lost its claim before recording the installed baseline');
@@ -1961,7 +3620,8 @@ export class ControlPlaneStore {
         catch {
             throw new ControlPlaneStoreError('invalid-state', 'stored installed activation baseline is corrupt');
         }
-        return activationCoreFiles(value, plan.target.profilePath, 'stored installed activation baseline');
+        const original = activationCoreFiles(value, plan.target.profilePath, 'stored installed activation baseline');
+        return readHostMaintenanceContext(this.#database, plan.id).records.at(-1)?.after.profileFiles ?? original;
     }
     /** Move a signed closed deployment watch into the existing physical rollback lifecycle. */
     beginPostActivationRollback(input) {
@@ -1971,7 +3631,7 @@ export class ControlPlaneStore {
             const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
             if (row === undefined)
                 throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-            const plan = activationFromRow(row);
+            const plan = effectiveActivationFromRow(this.#database, row);
             if (plan.revision !== input.expectedRevision)
                 throw new ControlPlaneStoreError('conflict', 'activation plan revision conflict');
             // A restart or retry must retain the original rollback identity and never
@@ -1997,7 +3657,7 @@ export class ControlPlaneStore {
             }
             this.getActivationInstalledBaseline(plan.id);
             const active = this.#database.prepare(`SELECT id FROM activation_plans WHERE target_path = ? AND id <> ? AND status IN (
-        'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
+        'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
         'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending') LIMIT 1`)
                 .get(plan.target.profilePath, plan.id);
             if (active !== undefined)
@@ -2038,9 +3698,65 @@ export class ControlPlaneStore {
       ORDER BY older.exposure_order`).all(current.target.profilePath, current.id, checkpoint.exposure_order);
         return rows.map(activationFromRow);
     }
+    /** Freeze exact physical pins before a signed deployment becomes Host-visible. */
+    recordActivationHostInputWitness(input) {
+        return this.#withActivationWrite(input.planId, () => {
+            const plan = this.getPlan(input.planId);
+            const row = this.#database.prepare('SELECT activation_lease_until FROM activation_plans WHERE id=?').get(plan.id);
+            const inputs = plan.dossier.hostDeploymentInputs;
+            if (!inputs)
+                throw new ControlPlaneStoreError('invalid-state', 'plan has no signed Host deployment inputs');
+            if (plan.status !== 'staging' || plan.revision !== input.expectedRevision || plan.activation?.fence !== input.fence
+                || (row.activation_lease_until ?? 0) < this.#now() || plan.activation.hostRecoveryRequired
+                || plan.activation.targetOriginallyExisted === undefined || plan.activation.targetBaselineFiles === undefined) {
+                throw new ControlPlaneStoreError('conflict', 'Host input witness lost its staging claim or target baseline');
+            }
+            let profileFiles;
+            let deploymentFiles;
+            let baselineDeploymentFiles;
+            try {
+                profileFiles = activationCoreFiles(input.profileFiles, plan.target.profilePath, 'Host input witness core files');
+                if (profileFiles.some(file => file.sha256 === null))
+                    throw new Error('missing core file');
+                deploymentFiles = hostInputPins(input.deploymentFiles, inputs, plan.target.profilePath, 'Host input witness deployment files');
+                baselineDeploymentFiles = plan.activation.targetOriginallyExisted
+                    ? hostInputPins(input.baselineDeploymentFiles, inputs, plan.target.profilePath, 'Host input witness baseline files')
+                    : input.baselineDeploymentFiles.length === 0 ? [] : (() => { throw new Error('unexpected baseline files'); })();
+            }
+            catch {
+                throw new ControlPlaneStoreError('invalid-input', 'Host input witness pins do not match the signed profile deployment');
+            }
+            const existing = hostInputWitnessFromRow(this.#database, plan);
+            if (existing) {
+                if (controlPlaneDigest(existing.profileFiles) !== controlPlaneDigest(profileFiles)
+                    || controlPlaneDigest(existing.deploymentFiles) !== controlPlaneDigest(deploymentFiles)
+                    || controlPlaneDigest(existing.baselineDeploymentFiles) !== controlPlaneDigest(baselineDeploymentFiles)) {
+                    throw new ControlPlaneStoreError('conflict', 'Host input witness is immutable');
+                }
+                return plan;
+            }
+            const unsigned = { schemaVersion: 1, kind: 'dsh-host-input-witness', planId: plan.id,
+                planDigest: plan.digest, activationId: plan.activation.id, fence: input.fence, createdAt: this.#now(),
+                inputs, profileFiles, deploymentFiles, baselineDeploymentFiles };
+            const witness = { ...unsigned, digest: controlPlaneDigest(unsigned) };
+            this.#database.prepare('INSERT INTO activation_host_input_witnesses (plan_id,witness_json,witness_digest) VALUES (?,?,?)')
+                .run(plan.id, JSON.stringify(witness), controlPlaneDigest(witness));
+            return plan;
+        });
+    }
+    getActivationHostInputWitness(planId) {
+        return hostInputWitnessFromRow(this.#database, this.getPlan(planId));
+    }
     /** Freeze recovery obligation before the profile can become Host-visible. */
     markActivationHostExposure(input) {
         return this.#withActivationWrite(input.planId, () => {
+            const before = this.getPlan(input.planId);
+            if (before.dossier.hostDeploymentInputs) {
+                const witness = hostInputWitnessFromRow(this.#database, before);
+                if (!witness || witness.fence !== input.fence || before.revision !== input.expectedRevision) {
+                    throw new ControlPlaneStoreError('conflict', 'Host exposure requires an exact staged input witness');
+                }
+            }
             const now = this.#now();
             const result = this.#database.prepare(`UPDATE activation_plans SET host_recovery_required = 1, updated_at = ?
         WHERE id = ? AND revision = ? AND activation_fence = ? AND status = 'staging'
@@ -2048,7 +3764,19 @@ export class ControlPlaneStore {
           AND activation_lease_until >= ?`).run(now, input.planId, input.expectedRevision, input.fence, now);
             if (Number(result.changes) !== 1)
                 throw new ControlPlaneStoreError('conflict', 'Host exposure lost its claim or original baseline');
-            return this.getPlan(input.planId);
+            const plan = this.getPlan(input.planId);
+            if (plan.dossier.liveQualification) {
+                const handoff = this.getAdoptionHandoff(plan.id);
+                const deadline = Math.min(now + plan.dossier.liveQualification.maximumWindowMs, plan.expiresAt, plan.approval.expiresAt, handoff?.expiresAt ?? 0);
+                if (deadline <= now)
+                    throw new ControlPlaneStoreError('expired', 'live qualification authorization expired before exposure');
+                this.#database.prepare(`INSERT INTO live_qualification_windows (plan_id,activation_id,fence,started_at,deadline_at)
+          VALUES (?,?,?,?,?) ON CONFLICT(plan_id) DO NOTHING`).run(plan.id, plan.activation.id, plan.activation.fence, now, deadline);
+                const prior = this.#database.prepare('SELECT activation_id,fence FROM live_qualification_windows WHERE plan_id=?').get(plan.id);
+                if (prior?.activation_id !== plan.activation.id || prior.fence !== plan.activation.fence)
+                    throw new ControlPlaneStoreError('conflict', 'live qualification exposure cannot be replayed');
+            }
+            return plan;
         });
     }
     markRollbackProfileRestored(input) {
@@ -2082,7 +3810,7 @@ export class ControlPlaneStore {
                 const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
                 if (row === undefined)
                     throw new ControlPlaneStoreError('not-found', 'activation plan not found');
-                const plan = activationFromRow(row);
+                const plan = effectiveActivationFromRow(this.#database, row);
                 if (plan.revision !== input.expectedRevision || plan.activation?.fence !== input.fence || plan.status !== input.status
                     || (requireLiveLease && Number(row.activation_lease_until ?? 0) < this.#now()))
                     throw new ControlPlaneStoreError('conflict', 'activation no longer owns the filesystem fence');
@@ -2131,6 +3859,177 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('conflict', 'activation no longer owns the exact revision/fence/status');
         return plan;
     }
+    currentRuntimeEpochDeployment(profilePath) {
+        return readCurrentRuntimeEpochDeployment(this.#database, profilePath);
+    }
+    /**
+     * Classify activation state for a Home in one read snapshot, using the exact
+     * watch/plan queries that gate {@link appendSourceMaintenance}. Preflight
+     * producers use it to distinguish a genuinely unanchored ledger (`none`) from
+     * a watched deployment that must bind its readiness receipt (`watched`) and
+     * from any conflict that must abort rather than silently degrade (`unsettled`).
+     */
+    readSourceMaintenanceActivationState(dshHome) {
+        if (!isAbsolute(dshHome) || resolve(dshHome) !== dshHome) {
+            throw new ControlPlaneStoreError('invalid-input', 'source maintenance Home path is invalid');
+        }
+        this.#database.exec('SAVEPOINT source_maintenance_activation_state');
+        try {
+            const watching = this.#database.prepare(`SELECT plan.id FROM activation_plans plan JOIN activation_watch watch ON watch.plan_id=plan.id
+        WHERE plan.dsh_home=? AND watch.state='watching' LIMIT 2`).all(dshHome);
+            const active = this.#database.prepare(`SELECT id FROM activation_plans WHERE dsh_home=?
+        AND status NOT IN ('rolled-back','activated') LIMIT 1`).get(dshHome);
+            const activated = this.#database.prepare(`SELECT plan.id,plan.target_path,watch.state,
+        checkpoint.exposure_order,checkpoint.successful_order FROM activation_plans plan
+        LEFT JOIN activation_watch watch ON watch.plan_id=plan.id
+        LEFT JOIN activation_deployment_checkpoints checkpoint ON checkpoint.plan_id=plan.id
+        WHERE plan.dsh_home=? AND plan.status='activated' LIMIT 1001`).all(dshHome);
+            if (activated.length > 1000)
+                throw new ControlPlaneStoreError('invalid-state', 'source maintenance activation history exceeds bound');
+            let result = watching.length > 1 || active || watching.length === 0 && activated.length !== 0
+                || watching.length === 1 && !activated.some(row => row.id === watching[0].id)
+                ? { kind: 'unsettled' }
+                : watching.length === 1
+                    ? { kind: 'watched', planId: watching[0].id }
+                    : { kind: 'none' };
+            if (result.kind === 'watched') {
+                const plan = this.getPlan(result.planId), watch = this.getActivationWatch(result.planId);
+                const assertBinding = (candidate, boundWatch) => {
+                    if (boundWatch.activationId !== candidate.activation?.id || boundWatch.fence !== candidate.activation.fence
+                        || boundWatch.exact.package !== candidate.candidate.package || boundWatch.exact.version !== candidate.candidate.version
+                        || boundWatch.exact.integrity !== candidate.candidate.integrity) {
+                        throw new ControlPlaneStoreError('invalid-state', 'source maintenance activation watch binding is corrupt');
+                    }
+                };
+                assertBinding(plan, watch);
+                const current = activated.find(row => row.id === plan.id);
+                const latest = this.#database.prepare(`SELECT checkpoint.plan_id FROM activation_deployment_checkpoints checkpoint
+          JOIN activation_plans plan ON plan.id=checkpoint.plan_id WHERE plan.target_path=?
+          ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(plan.target.profilePath);
+                if (current.exposure_order === null || current.successful_order !== current.exposure_order || latest?.plan_id !== plan.id) {
+                    result = { kind: 'unsettled' };
+                }
+                else
+                    for (const older of activated) {
+                        if (older.id === plan.id)
+                            continue;
+                        // Closed watches retain activated status after a successor takes over.
+                        // Only a proved older success on this same profile is retired history.
+                        if (older.target_path !== plan.target.profilePath || !['closed-regressed', 'closed-retracted'].includes(older.state ?? '')
+                            || older.exposure_order === null || older.successful_order !== older.exposure_order
+                            || older.exposure_order >= current.exposure_order) {
+                            result = { kind: 'unsettled' };
+                            break;
+                        }
+                        assertBinding(this.getPlan(older.id), this.getActivationWatch(older.id));
+                    }
+            }
+            this.#database.exec('RELEASE source_maintenance_activation_state');
+            return result;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK TO source_maintenance_activation_state; RELEASE source_maintenance_activation_state');
+            throw error;
+        }
+    }
+    prepareRuntimeEpoch(input) {
+        const runtimeDigest = runtimeIdentityDigest(input.runtime);
+        if (input.runtime.observedAt > this.#now() || input.runtime.observedAt < this.#now() - 30_000
+            || input.runtime.entries.some(entry => !entry.active))
+            throw new ControlPlaneStoreError('invalid-input', 'runtime epoch needs a fresh active runtime');
+        const current = readCurrentRuntimeEpochDeployment(this.#database, input.runtime.profilePath);
+        return this.#withActivationWrite(current.plan.id, () => {
+            const context = readCurrentRuntimeEpochDeployment(this.#database, input.runtime.profilePath), { plan, readiness } = context;
+            const previous = this.#database.prepare(`SELECT * FROM deployment_runtime_epochs WHERE plan_id=? ORDER BY sequence DESC LIMIT 1`)
+                .get(plan.id);
+            if (previous) {
+                const record = runtimeEpochFromRow(previous);
+                if (record.request.runtimeIdentityDigest === runtimeDigest && controlPlaneDigest(record.request.issuer) === controlPlaneDigest(input.issuer)
+                    && record.status !== 'stale'
+                    && (record.status === 'applied' || this.#now() < record.request.requestedAt + record.request.receiptTtlMs)) {
+                    return record;
+                }
+                // An expired read-only observation may be replaced, never relabelled or replayed as a new proof.
+                this.#database.prepare("UPDATE deployment_runtime_epochs SET status='stale' WHERE plan_id=? AND status IN ('pending','claimed')").run(plan.id);
+            }
+            const sequence = Number(this.#database.prepare('SELECT max(sequence) AS sequence FROM deployment_runtime_epochs WHERE plan_id=?').get(plan.id)?.sequence ?? 0) + 1;
+            const request = parseRuntimeEpochRequest({ schemaVersion: 1, kind: 'dsh-runtime-epoch-request', operationId: `runtime-epoch-${randomUUID()}`,
+                requestedAt: this.#now(), receiptTtlMs: input.receiptTtlMs, installationId: plan.installationId, ledger: plan.ledger,
+                plan: { id: plan.id, digest: plan.digest }, activation: { id: plan.activation.id, fence: plan.activation.fence },
+                profile: { name: plan.profile, path: plan.target.profilePath }, issuer: input.issuer, predecessor: {
+                    operationId: readiness.operationId, receiptDigest: controlPlaneDigest(readiness.receipt), hostGeneration: readiness.receipt.hostGeneration
+                },
+                sequence, runtimeIdentityDigest: runtimeDigest });
+            this.#database.prepare(`INSERT INTO deployment_runtime_epochs VALUES (?,?,?,?,?,?,'pending',NULL,?)`).run(request.operationId, plan.id, sequence, runtimeDigest, JSON.stringify(request), controlPlaneDigest(request), request.requestedAt);
+            return { request, status: 'pending' };
+        });
+    }
+    getRuntimeEpoch(operationId) {
+        const row = this.#database.prepare('SELECT * FROM deployment_runtime_epochs WHERE operation_id=?').get(operationId);
+        if (!row)
+            throw new ControlPlaneStoreError('not-found', 'runtime epoch absent');
+        return runtimeEpochFromRow(row);
+    }
+    latestAppliedRuntimeEpoch(planId) {
+        const row = this.#database.prepare(`SELECT * FROM deployment_runtime_epochs WHERE plan_id=? ORDER BY sequence DESC LIMIT 1`)
+            .get(planId);
+        if (row && row.status !== 'applied')
+            throw new ControlPlaneStoreError('conflict', 'current runtime epoch is not independently verified');
+        return row && runtimeEpochFromRow(row);
+    }
+    pendingRuntimeEpochs(coordinatorId) {
+        return this.#database.prepare(`SELECT epoch.* FROM deployment_runtime_epochs epoch
+      JOIN adoption_handoffs handoff ON handoff.plan_id=epoch.plan_id
+      JOIN activation_plans plan ON plan.id=epoch.plan_id
+      WHERE handoff.coordinator_id=? AND handoff.revoked_at IS NULL AND plan.status='activated'
+        AND epoch.status IN ('pending','claimed') AND epoch.created_at + json_extract(epoch.request_json,'$.receiptTtlMs') > ?
+        AND epoch.sequence=(SELECT max(other.sequence) FROM deployment_runtime_epochs other WHERE other.plan_id=epoch.plan_id)
+      ORDER BY epoch.created_at,epoch.operation_id LIMIT 100`).all(coordinatorId, this.#now()).map(runtimeEpochFromRow);
+    }
+    claimRuntimeEpoch(operationId, coordinatorId) {
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const record = this.getRuntimeEpoch(operationId);
+            if (!['pending', 'claimed'].includes(record.status) || this.#now() >= record.request.requestedAt + record.request.receiptTtlMs) {
+                throw new ControlPlaneStoreError('expired', 'runtime epoch request is not live');
+            }
+            this.#database.prepare("UPDATE deployment_runtime_epochs SET status='claimed' WHERE operation_id=?").run(operationId);
+            const context = readOwnerRuntimeEpochContext(this.#database, operationId);
+            if (context.handoff.coordinatorId !== coordinatorId || (this.#adoptionCoordinatorId !== undefined && this.#adoptionCoordinatorId !== coordinatorId)) {
+                throw new ControlPlaneStoreError('conflict', 'runtime epoch coordinator changed');
+            }
+            this.#database.exec('COMMIT');
+            return { ...record, status: 'claimed' };
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    applyRuntimeEpoch(receiptInput, trust) {
+        const receipt = parseRuntimeEpochReceipt(receiptInput);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const context = readOwnerRuntimeEpochContext(this.#database, receipt.operationId);
+            if (this.#now() >= context.request.requestedAt + context.request.receiptTtlMs)
+                throw new ControlPlaneStoreError('expired', 'runtime epoch request expired before application');
+            verifyRuntimeEpochReceipt(receipt, context.request, trust, this.#now());
+            if (receipt.outcome !== 'passed' || receipt.evidence.failures !== 0)
+                throw new ControlPlaneStoreError('conflict', 'failed runtime epoch cannot be applied');
+            if (context.request.ledger.id !== trust.ledger.id || context.request.ledger.path !== trust.ledger.path) {
+                throw new ControlPlaneStoreError('conflict', 'runtime epoch trust ledger changed');
+            }
+            this.#database.prepare("UPDATE deployment_runtime_epochs SET status='applied',receipt_json=? WHERE operation_id=? AND status='claimed'")
+                .run(JSON.stringify(receipt), receipt.operationId);
+            const result = this.getRuntimeEpoch(receipt.operationId);
+            this.#database.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
     prepareHostAttestationOperation(input) {
         return this.#withActivationSource(input.planId, () => {
             const now = this.#now();
@@ -2283,25 +4182,194 @@ export class ControlPlaneStore {
         };
         return input.requireCurrentSource ? this.#withActivationSource(plan.id, commit) : commit();
     }
+    listLiveQualificationDeployments(planId, limit = 1001) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001)
+            throw new ControlPlaneStoreError('invalid-input', 'invalid live task limit');
+        const window = this.getLiveQualificationWindow(planId);
+        const committed = this.#database.prepare('SELECT started_at FROM activation_watch WHERE plan_id=?').get(planId);
+        const cutoff = Math.min(window.deadlineAt, committed ? Number(committed.started_at) : window.deadlineAt);
+        return this.#database.prepare(`SELECT inbox_id FROM foreground_deployments WHERE plan_id=?
+      AND json_extract(record_json,'$.task.dispatchedAt')>=? AND json_extract(record_json,'$.task.dispatchedAt')<?
+      ORDER BY inbox_id LIMIT ?`).all(planId, window.startedAt, cutoff, limit)
+            .map(row => this.getForegroundDeployment(row.inbox_id));
+    }
+    listLiveQualificationPlans(profilePath, limit = 100) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
+            throw new ControlPlaneStoreError('invalid-input', 'invalid qualification limit');
+        return this.#database.prepare(`SELECT plan.* FROM activation_plans plan WHERE plan.target_path=? AND plan.status IN
+      ('awaiting-live-tasks','commit-pending','activated') AND json_type(plan.dossier_json,'$.liveQualification')='object'
+      AND (plan.status<>'activated' OR (plan.id=(SELECT checkpoint.plan_id FROM activation_deployment_checkpoints checkpoint
+        JOIN activation_plans newer ON newer.id=checkpoint.plan_id WHERE newer.target_path=plan.target_path ORDER BY checkpoint.exposure_order DESC LIMIT 1)
+        AND NOT EXISTS (SELECT 1 FROM activation_plans active WHERE active.target_path=plan.target_path AND active.id<>plan.id
+          AND active.status IN ('staging','awaiting-reload','awaiting-readiness','awaiting-live-tasks','awaiting-effect-blocked-replay',
+            'awaiting-shadow','awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending'))))
+      ORDER BY plan.created_at DESC,plan.id LIMIT ?`).all(profilePath, limit).map(activationFromRow);
+    }
+    getLiveQualificationDeadline(planId) {
+        const plan = this.getPlan(planId);
+        if (!plan.dossier.liveQualification)
+            return undefined;
+        const window = this.#database.prepare('SELECT deadline_at FROM live_qualification_windows WHERE plan_id=?').get(planId);
+        return window ? Number(window.deadline_at) : undefined;
+    }
+    getLiveQualificationWindow(planId) { return liveQualificationWindow(this.#database, this.getPlan(planId)); }
+    getLiveQualificationReadiness(planId) { return liveQualificationReadiness(this.#database, this.getPlan(planId)); }
+    getLiveQualification(id) { return liveQualificationRecord(this.#database, id); }
+    listLiveQualifications(planId, limit = 100) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
+            throw new ControlPlaneStoreError('invalid-input', 'invalid qualification record limit');
+        return this.#database.prepare('SELECT id FROM live_qualification_batches WHERE plan_id=? ORDER BY created_at DESC,id LIMIT ?').all(planId, limit).map(row => this.getLiveQualification(row.id));
+    }
+    assertCurrentLiveQualification(id) {
+        const { record, plan } = readLiveQualificationContext(this.#database, id);
+        if (record.state === 'stale' || (plan.status !== 'activated' && (this.#now() >= record.batch.deadlineAt || this.#now() >= record.batch.expiresAt))) {
+            throw new ControlPlaneStoreError('expired', 'live qualification expired or became stale');
+        }
+    }
+    putLiveQualification(batch) {
+        assertLiveQualificationBatch(batch);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const plan = this.getPlan(batch.planId);
+            if (plan.status !== 'awaiting-live-tasks' || this.#now() >= batch.deadlineAt || this.#now() >= batch.expiresAt)
+                throw new ControlPlaneStoreError('expired', 'live qualification admission ended');
+            const prior = this.getLiveQualification(batch.id);
+            if (prior) {
+                if (controlPlaneDigest(prior.batch) !== controlPlaneDigest(batch) || prior.state === 'stale')
+                    throw new ControlPlaneStoreError('conflict', 'live qualification identity reused');
+            }
+            else
+                this.#database.prepare(`INSERT INTO live_qualification_batches
+        (id,lane,plan_id,batch_json,batch_digest,state,created_at) VALUES (?,?,?,?,?,'pending',?)`).run(batch.id, batch.lane, batch.planId, JSON.stringify(batch), controlPlaneDigest(batch), this.#now());
+            readLiveQualificationContext(this.#database, batch.id);
+            this.#database.exec('COMMIT');
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    staleLiveQualification(id) {
+        this.#database.prepare("UPDATE live_qualification_batches SET state='stale' WHERE id=? AND state IN ('pending','signed')").run(id);
+    }
+    async applyLiveQualification(input) {
+        const record = this.getLiveQualification(input.receipt.batchId);
+        if (!record)
+            throw new ControlPlaneStoreError('not-found', 'live qualification batch absent');
+        const receipt = verifyLiveQualificationReceipt(input.receipt, record.batch, input.publicKeyPem, this.#now());
+        return input.withSourceFence(() => {
+            this.#database.exec('BEGIN IMMEDIATE');
+            try {
+                const current = this.getLiveQualification(record.batch.id);
+                if (current.state === 'applied') {
+                    if (controlPlaneDigest(current.receipt) !== controlPlaneDigest(receipt))
+                        throw new ControlPlaneStoreError('conflict', 'qualification receipt changed');
+                    this.#database.exec('COMMIT');
+                    return this.getPlan(record.batch.planId);
+                }
+                this.assertCurrentLiveQualification(record.batch.id);
+                const plan = this.getPlan(record.batch.planId);
+                if (plan.status !== 'awaiting-live-tasks' || this.#adoptionCoordinatorId !== undefined)
+                    throw new ControlPlaneStoreError('invalid-state', 'only target feedback runtime may qualify this deployment');
+                const updated = this.#database.prepare(`UPDATE activation_plans SET status=?,revision=revision+1,updated_at=?,failure_code=?,activation_lease_until=NULL
+          WHERE id=? AND revision=? AND activation_fence=? AND status='awaiting-live-tasks'`).run(receipt.disposition === 'qualified' ? 'commit-pending' : 'rollback-pending', this.#now(), receipt.disposition === 'qualified' ? null : 'live-qualification-failed', plan.id, plan.revision, record.batch.fence);
+                if (Number(updated.changes) !== 1)
+                    throw new ControlPlaneStoreError('conflict', 'qualification lost plan CAS');
+                this.#database.prepare("UPDATE live_qualification_batches SET state='applied',receipt_json=?,receipt_digest=? WHERE id=? AND state IN ('pending','signed')")
+                    .run(JSON.stringify(receipt), controlPlaneDigest(receipt), record.batch.id);
+                this.#database.exec('COMMIT');
+                return this.getPlan(plan.id);
+            }
+            catch (error) {
+                this.#database.exec('ROLLBACK');
+                throw error;
+            }
+        });
+    }
+    /** Negative-only Host seam. The signed terms permit conservative removal of unconfirmable qualification. */
+    invalidateLiveQualification(input) {
+        const reason = bounded(input.reason, 'qualification invalidation reason', 160);
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const plan = this.getPlan(input.planId), record = this.getLiveQualification(input.batchId);
+            if (!record || record.batch.planId !== plan.id || record.state !== 'applied' || record.receipt?.disposition !== 'qualified'
+                || record.batch.planDigest !== plan.digest || record.batch.activationId !== plan.activation?.id || !plan.dossier.liveQualification) {
+                throw new ControlPlaneStoreError('conflict', 'qualification invalidation lacks exact accepted evidence');
+            }
+            if (plan.status === 'rollback-pending' || plan.status === 'rolled-back') {
+                this.#database.exec('COMMIT');
+                return plan;
+            }
+            if (!['commit-pending', 'activated'].includes(plan.status) || record.batch.fence !== plan.activation.fence)
+                throw new ControlPlaneStoreError('conflict', 'qualification invalidation no longer targets current deployment');
+            this.assertNoClaimedHostAttestation(plan.id);
+            if (plan.status === 'activated') {
+                const latest = this.#database.prepare(`SELECT checkpoint.plan_id,checkpoint.successful_order,checkpoint.exposure_order FROM activation_deployment_checkpoints checkpoint
+          JOIN activation_plans candidate ON candidate.id=checkpoint.plan_id WHERE candidate.target_path=? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(plan.target.profilePath);
+                if (!latest || latest.plan_id !== plan.id || latest.successful_order !== latest.exposure_order || !plan.activation?.hostRecoveryRequired
+                    || !this.getActivationInstalledBaseline(plan.id))
+                    throw new ControlPlaneStoreError('conflict', 'qualification invalidation cannot restore a superseded deployment');
+            }
+            const competing = this.#database.prepare(`SELECT 1 FROM activation_plans WHERE target_path=? AND id<>? AND status IN
+        ('staging','awaiting-reload','awaiting-readiness','awaiting-live-tasks','awaiting-effect-blocked-replay','awaiting-shadow','awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending')`).get(plan.target.profilePath, plan.id);
+            if (competing)
+                throw new ControlPlaneStoreError('conflict', 'another deployment owns the profile');
+            const now = this.#now();
+            this.#database.prepare(`INSERT INTO live_qualification_invalidations
+        (plan_id,batch_id,batch_digest,receipt_digest,activation_id,fence,reason,invalidated_at) VALUES (?,?,?,?,?,?,?,?)`).run(plan.id, record.batch.id, record.batch.digest, controlPlaneDigest(record.receipt), record.batch.activationId, record.batch.fence, reason, now);
+            // A live commit worker is fenced by revision immediately; its final source guard must fail.
+            this.#database.prepare(`UPDATE activation_plans SET status='rollback-pending',revision=revision+1,
+        activation_lease_until=NULL,rollback_profile_restored=0,failure_code='live-qualification-invalidated',updated_at=?
+        WHERE id=? AND revision=? AND activation_fence=?`).run(now, plan.id, plan.revision, plan.activation.fence);
+            this.#database.exec('COMMIT');
+            return this.getPlan(plan.id);
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    #assertLiveQualificationCommit(planId) {
+        const plan = this.getPlan(planId);
+        if (!plan.dossier.liveQualification)
+            return;
+        if (!this.#withLiveQualificationFence)
+            throw new ControlPlaneStoreError('invalid-state', 'target canonical qualification fence unavailable');
+        const record = this.listLiveQualifications(planId).find(item => item.state === 'applied' && item.receipt?.disposition === 'qualified');
+        if (!record || this.#now() >= record.batch.deadlineAt || this.#now() >= record.receipt.expiresAt)
+            throw new ControlPlaneStoreError('expired', 'accepted live qualification is absent or expired');
+        this.assertCurrentLiveQualification(record.batch.id);
+    }
     /** Same synchronous transaction owns current-profile selection and capture. */
     withForegroundDeployment(task, profilePath, callback) {
         assertForegroundTask(task);
         this.#database.exec('BEGIN IMMEDIATE');
         try {
             const active = this.#database.prepare(`SELECT id FROM activation_plans WHERE target_path = ? AND status IN (
-        'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
+        'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
         'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending') LIMIT 1`).get(profilePath);
-            if (active)
-                throw new ControlPlaneStoreError('conflict', 'profile has an unsettled activation');
-            const latest = this.#database.prepare(`SELECT checkpoint.plan_id, checkpoint.exposure_order, checkpoint.successful_order
-        FROM activation_deployment_checkpoints checkpoint JOIN activation_plans plan ON plan.id = checkpoint.plan_id
-        WHERE plan.target_path = ? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(profilePath);
-            if (!latest || latest.exposure_order !== latest.successful_order)
-                throw new ControlPlaneStoreError('invalid-state', 'profile has no current successful deployment');
-            const plan = this.getPlan(latest.plan_id), watch = this.getActivationWatch(plan.id);
-            if (plan.status !== 'activated' || !plan.activation || watch.state !== 'watching'
-                || watch.activationId !== plan.activation.id || watch.fence !== plan.activation.fence || watch.startedAt > task.dispatchedAt) {
-                throw new ControlPlaneStoreError('invalid-state', 'task did not begin under a watched deployment');
+            let plan;
+            if (active) {
+                plan = this.getPlan(String(active.id));
+                if (!plan.dossier.liveQualification || !['awaiting-live-tasks', 'commit-pending'].includes(plan.status))
+                    throw new ControlPlaneStoreError('conflict', 'profile has an unsettled activation');
+                const window = this.getLiveQualificationWindow(plan.id);
+                if (task.dispatchedAt < window.startedAt || task.dispatchedAt >= window.deadlineAt || this.#now() >= window.deadlineAt) {
+                    throw new ControlPlaneStoreError('expired', 'task is outside the live qualification window');
+                }
+            }
+            else {
+                const latest = this.#database.prepare(`SELECT checkpoint.plan_id, checkpoint.exposure_order, checkpoint.successful_order
+          FROM activation_deployment_checkpoints checkpoint JOIN activation_plans plan ON plan.id = checkpoint.plan_id
+          WHERE plan.target_path = ? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(profilePath);
+                if (!latest || latest.exposure_order !== latest.successful_order)
+                    throw new ControlPlaneStoreError('invalid-state', 'profile has no current successful deployment');
+                plan = this.getPlan(latest.plan_id);
+                const watch = this.getActivationWatch(plan.id);
+                if (plan.status !== 'activated' || !plan.activation || watch.state !== 'watching'
+                    || watch.activationId !== plan.activation.id || watch.fence !== plan.activation.fence || watch.startedAt > task.dispatchedAt) {
+                    throw new ControlPlaneStoreError('invalid-state', 'task did not begin under a watched deployment');
+                }
             }
             const source = readOwnerSourceAdoptionPlan(this.#database, plan.id).source;
             const owner = source.owner;
@@ -2497,19 +4565,26 @@ export class ControlPlaneStore {
     }
     #isPostActivationRollback(plan) {
         if (plan.status !== 'rollback-pending' || plan.activation === undefined || plan.activation.failureCode === undefined
-            || !['post-activation-regressed', 'post-activation-retracted'].includes(plan.activation.failureCode))
+            || !['post-activation-regressed', 'post-activation-retracted', 'live-qualification-invalidated'].includes(plan.activation.failureCode))
             return false;
         const checkpoint = this.#database.prepare('SELECT successful_order, exposure_order FROM activation_deployment_checkpoints WHERE plan_id = ?')
             .get(plan.id);
         return checkpoint !== undefined && checkpoint.successful_order === checkpoint.exposure_order;
     }
     #hasPostActivationRollbackProvenance(plan) {
-        if (plan.activation === undefined || !['post-activation-regressed', 'post-activation-retracted'].includes(plan.activation.failureCode ?? ''))
+        if (plan.activation === undefined || !['post-activation-regressed', 'post-activation-retracted', 'live-qualification-invalidated'].includes(plan.activation.failureCode ?? ''))
             return false;
         const checkpoint = this.#database.prepare('SELECT successful_order, exposure_order FROM activation_deployment_checkpoints WHERE plan_id = ?')
             .get(plan.id);
         if (checkpoint === undefined || checkpoint.successful_order !== checkpoint.exposure_order)
             return false;
+        if (plan.activation.failureCode === 'live-qualification-invalidated') {
+            const invalidation = this.#database.prepare('SELECT * FROM live_qualification_invalidations WHERE plan_id=?').get(plan.id);
+            const accepted = invalidation && this.getLiveQualification(invalidation.batch_id);
+            return !!invalidation && accepted?.state === 'applied' && accepted.receipt?.disposition === 'qualified'
+                && invalidation.batch_digest === accepted.batch.digest && invalidation.receipt_digest === controlPlaneDigest(accepted.receipt)
+                && invalidation.activation_id === plan.activation.id && invalidation.fence === accepted.batch.fence && invalidation.fence <= plan.activation.fence;
+        }
         const watch = this.#database.prepare('SELECT activation_id, fence, state, close_signature_digest FROM activation_watch WHERE plan_id = ?').get(plan.id);
         return watch !== undefined && (watch.state === 'closed-regressed' || watch.state === 'closed-retracted')
             && watch.close_signature_digest !== null && watch.activation_id === plan.activation.id && watch.fence <= plan.activation.fence;
@@ -2614,7 +4689,7 @@ export class ControlPlaneStore {
         AND NOT EXISTS (SELECT 1 FROM host_attestation_operations operation JOIN host_attestation_dispatches dispatch
           ON dispatch.operation_id = operation.operation_id WHERE operation.plan_id = activation_plans.id
             AND dispatch.status = 'claimed')
-        AND (status IN ('awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
+        AND (status IN ('awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
           'awaiting-canary', 'awaiting-soak', 'awaiting-health')
           OR (status IN ('staging', 'commit-pending') AND COALESCE(activation_lease_until, 0) < ?))`).run(code, this.#now(), input.planId, input.expectedRevision, input.fence, this.#now());
             if (Number(result.changes) !== 1)
@@ -2623,6 +4698,18 @@ export class ControlPlaneStore {
         }, true);
     }
     advanceActivation(input) {
+        if (input.to === 'activated' && this.getPlan(input.planId).dossier.liveQualification && this.#liveQualificationAdmission !== input.planId) {
+            this.#assertLiveQualificationCommit(input.planId);
+            return this.#withLiveQualificationFence(input.planId, () => {
+                this.#liveQualificationAdmission = input.planId;
+                try {
+                    return this.withOwnerTaskFailureGapAdmission(this.getPlan(input.planId).gapId, () => this.advanceActivation(input));
+                }
+                finally {
+                    this.#liveQualificationAdmission = undefined;
+                }
+            });
+        }
         return this.#withActivationSource(input.planId, () => {
             const allowed = { staging: ['awaiting-reload', 'rollback-pending'],
                 'rollback-pending': ['rolled-back'], 'commit-pending': ['activated', 'rollback-pending'] };
@@ -2675,7 +4762,7 @@ export class ControlPlaneStore {
         if (replay !== undefined) {
             const transition = Object.values(expectedAttestation).find(item => item.phase === input.receipt.phase);
             const expectedStatus = input.receipt.outcome === 'passed' && transition !== undefined
-                ? transition.next : 'rollback-pending';
+                ? (input.receipt.phase === 'readiness' && replay.result.dossier.liveQualification ? 'awaiting-live-tasks' : transition.next) : 'rollback-pending';
             const expectedFailure = input.receipt.outcome === 'passed' ? undefined : 'host-attestation-failed';
             if (replay.result.status !== expectedStatus || replay.result.revision !== input.expectedRevision + 1
                 || replay.result.activation?.id !== input.receipt.activationId || replay.result.activation.fence !== input.expectedFence
@@ -2702,7 +4789,7 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('conflict', 'non-transition Host receipt changed generation from its predecessor');
         }
         const now = this.#now();
-        const nextStatus = verified.outcome === 'passed' ? expected.next : 'rollback-pending';
+        const nextStatus = verified.outcome === 'passed' ? (verified.phase === 'readiness' && plan.dossier.liveQualification ? 'awaiting-live-tasks' : expected.next) : 'rollback-pending';
         return this.#withActivationSource(input.planId, () => {
             this.#database.exec('BEGIN IMMEDIATE');
             try {
@@ -2938,6 +5025,8 @@ export class ControlPlaneStore {
         ON CONFLICT(plan_id) DO NOTHING`).run(plan.id, plan.candidate.package, plan.candidate.version, plan.candidate.integrity, activationId, fence, now, now);
             if (Number(result.changes) !== 1)
                 throw new ControlPlaneStoreError('invalid-state', 'activated plan has no post-activation watch');
+            if (plan.dossier.liveQualification)
+                this.#database.prepare('UPDATE activation_watch SET last_host_generation=? WHERE plan_id=?').run(this.getLiveQualificationWindow(plan.id).hostGeneration, plan.id);
         }
     }
     #reopenGapAfterActivation(plan, now) {
@@ -3085,9 +5174,64 @@ export class ControlPlaneStore {
         const now = this.#now();
         if (now > plan.expiresAt || now > verified.expiresAt)
             throw new ControlPlaneStoreError('expired', 'source release authorization is no longer applicable');
+        const prelinked = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id=? LIMIT 2')
+            .all(plan.id);
+        const prebaseline = prelinked.length === 1 ? sourceJobFromRow(prelinked[0]).intent.baseline : undefined;
+        const premaintenance = prebaseline ? this.getSourceMaintenanceRecords(plan.repository) : [];
+        let lineageDigest;
+        if (prebaseline && premaintenance.length) {
+            if (!input.trust)
+                throw new ControlPlaneStoreError('invalid-input', 'managed source maintenance requires current trust');
+            const prehistory = this.getSourceBaselineHistory(plan.repository);
+            await verifySourceBaselineHistory({ repository: plan.repository, config: prebaseline, trust: input.trust,
+                history: prehistory, maintenance: premaintenance, signal: new AbortController().signal });
+            lineageDigest = controlPlaneDigest({ history: prehistory, maintenance: premaintenance, trust: input.trust, baseline: prebaseline });
+        }
         return withCurrentSource(plan.gapId, () => {
             this.#database.exec('BEGIN IMMEDIATE');
             try {
+                const linkedRows = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ? LIMIT 2')
+                    .all(plan.id);
+                if (linkedRows.length > 1)
+                    throw new ControlPlaneStoreError('invalid-state', 'source plan has multiple source jobs');
+                const linked = linkedRows[0] === undefined ? undefined : sourceJobFromRow(linkedRows[0]);
+                const managedRows = this.#database.prepare(`SELECT * FROM source_jobs WHERE json_extract(intent_json, '$.repository') = ?
+          AND json_type(intent_json, '$.baseline') IS NOT NULL AND status IN ('queued', 'running', 'unknown', 'prepared')
+          LIMIT 1001`).all(plan.repository);
+                if (managedRows.length > 1000)
+                    throw new ControlPlaneStoreError('invalid-state', 'managed source job cohort exceeds bound');
+                for (const row of managedRows) {
+                    const managed = sourceJobFromRow(row);
+                    if (managed.planId === plan.id)
+                        continue;
+                    if (managed.status !== 'prepared' || managed.planId === undefined
+                        || !['release-complete', 'release-failed', 'expired', 'local-checks-failed'].includes(this.getSourcePlan(managed.planId).status)) {
+                        throw new ControlPlaneStoreError('conflict', 'managed source job owns this repository release');
+                    }
+                }
+                if (linked?.intent.baseline !== undefined) {
+                    if (linked.status !== 'prepared' || linked.intent.repository !== plan.repository
+                        || linked.intent.baseCommit !== plan.baseCommit) {
+                        throw new ControlPlaneStoreError('invalid-state', 'managed source release is not bound to its prepared job');
+                    }
+                    const active = this.#database.prepare(`SELECT id FROM source_plans WHERE repository = ? AND id <> ?
+            AND release_id IS NOT NULL AND status NOT IN ('release-complete', 'release-failed') LIMIT 1`)
+                        .get(plan.repository, plan.id);
+                    if (active !== undefined)
+                        throw new ControlPlaneStoreError('conflict', 'source repository has another active release');
+                    const history = this.getSourceBaselineHistory(plan.repository);
+                    const maintenance = this.getSourceMaintenanceRecords(plan.repository);
+                    if (lineageDigest !== undefined && controlPlaneDigest({ history, maintenance, trust: input.trust,
+                        baseline: linked.intent.baseline }) !== lineageDigest) {
+                        throw new ControlPlaneStoreError('conflict', 'managed source signed lineage changed before release');
+                    }
+                    if (maintenance.length && lineageDigest === undefined) {
+                        throw new ControlPlaneStoreError('conflict', 'managed source maintenance was not preverified');
+                    }
+                    const expectedCommit = sourceBaselineChain(linked.intent.baseline, history, maintenance).at(-1);
+                    if (plan.baseCommit !== expectedCommit)
+                        throw new ControlPlaneStoreError('conflict', 'managed source release base commit is stale');
+                }
                 const releaseId = `release-${randomUUID()}`;
                 const result = this.#database.prepare(`UPDATE source_plans SET status = 'awaiting-pr', revision = revision + 1,
           release_authorization_json = ?, release_authorization_digest = ?, release_id = ?, release_fence = release_fence + 1,
@@ -3785,7 +5929,7 @@ export class ControlPlaneStore {
         const row = this.#database.prepare(`SELECT
       (SELECT count(*) FROM capability_gaps WHERE status = 'open') AS gaps,
       (SELECT count(*) FROM activation_plans WHERE status = 'approved') + (SELECT count(*) FROM source_plans WHERE status = 'approved') AS ready_plans,
-      (SELECT count(*) FROM activation_plans WHERE status IN ('staging', 'awaiting-reload', 'awaiting-readiness',
+      (SELECT count(*) FROM activation_plans WHERE status IN ('staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks',
         'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending')) AS active_activations,
       (SELECT count(*) FROM activation_plans WHERE status = 'rolled-back') +
         (SELECT count(*) FROM source_plans WHERE status IN ('local-checks-failed', 'release-failed')) AS failed,
@@ -3826,15 +5970,32 @@ export class ControlPlaneStore {
         const replayBinding = { operation: 'create-source-plan', gapId: snapshot.gapId, repository: snapshot.repository,
             worktree: snapshot.worktree, baseCommit: snapshot.baseCommit, name: snapshot.name, generatorDigest: snapshot.generatorDigest,
             scope: snapshot.scope, ttlMs: snapshot.expiresAt - snapshot.createdAt };
+        const linkedRow = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ?').get(snapshot.id);
+        const linked = linkedRow === undefined ? undefined : sourceJobFromRow(linkedRow);
+        const sourceJob = linked === undefined ? undefined : { jobId: linked.id, jobRevision: linked.revision - 1,
+            occurrenceId: linked.occurrenceId };
+        const replayInput = { ...(snapshot.mode === 'create' ? replayBinding : { ...replayBinding,
+                mode: snapshot.mode, ...(snapshot.creation === undefined ? {} : { creation: snapshot.creation }),
+                ...(snapshot.sourceRevision === undefined ? {} : { revision: snapshot.sourceRevision }),
+                prepared: { treeDigest: snapshot.sourceCheck.treeDigest, patchDigest: snapshot.sourceCheck.patchDigest,
+                    checkedAt: snapshot.sourceCheck.checkedAt, evidence: snapshot.preparedEvidence } }),
+            ...(sourceJob === undefined ? {} : { sourceJob }) };
+        const replayDigest = controlPlaneDigest(replayInput);
+        const artifactReplayDigest = (snapshot.mode === 'prepared-create' || snapshot.mode === 'prepared-revise') && snapshot.preparedEvidence !== undefined
+            ? controlPlaneDigest({ ...replayInput, preparedArtifactSha256: snapshot.preparedEvidence.pack.sha256 }) : undefined;
         if (snapshot.digest !== authoritative.digest || snapshot.gapId !== authoritative.gapId
             || snapshot.revision !== 1 || snapshot.status !== 'pending-approval' || snapshot.createdAt !== receipt.createdAt
             || snapshot.approval !== undefined || snapshot.releaseAuthorization !== undefined
-            || snapshot.release !== undefined || controlPlaneDigest(snapshot.mode === 'modify' ? { ...replayBinding, mode: snapshot.mode,
-            prepared: { treeDigest: snapshot.sourceCheck.treeDigest, patchDigest: snapshot.sourceCheck.patchDigest,
-                checkedAt: snapshot.sourceCheck.checkedAt, evidence: snapshot.preparedEvidence } } : replayBinding) !== inputDigest
+            || snapshot.release !== undefined || (replayDigest !== inputDigest && artifactReplayDigest !== inputDigest)
             || (snapshot.mode === 'create' && (snapshot.sourceCheck !== undefined || snapshot.preparedEvidence !== undefined))
             || (snapshot.mode === 'modify' && (snapshot.sourceCheck === undefined || snapshot.preparedEvidence === undefined
-                || controlPlaneDigest(snapshot.sourceCheck) !== controlPlaneDigest(authoritative.sourceCheck)))) {
+                || controlPlaneDigest(snapshot.sourceCheck) !== controlPlaneDigest(authoritative.sourceCheck)))
+            || (snapshot.mode === 'prepared-create' && (snapshot.sourceCheck === undefined || snapshot.preparedEvidence === undefined
+                || snapshot.creation === undefined || linked?.intent.mode !== 'create'
+                || controlPlaneDigest(snapshot.creation) !== controlPlaneDigest(authoritative.creation)))
+            || (snapshot.mode === 'prepared-revise' && (snapshot.sourceCheck === undefined || snapshot.preparedEvidence === undefined
+                || snapshot.sourceRevision === undefined || linked?.intent.mode !== 'revise-created'
+                || controlPlaneDigest(snapshot.sourceRevision) !== controlPlaneDigest(authoritative.sourceRevision)))) {
             throw new ControlPlaneStoreError('invalid-state', 'stored source operation receipt is not bound to authoritative state');
         }
         return { ...receipt, result: snapshot };
@@ -3867,7 +6028,7 @@ export class ControlPlaneStore {
             catalog: { digest: snapshot.dossier.catalogDigest, provenance: snapshot.dossier.catalogProvenance },
             matchedCapabilities: snapshot.dossier.matchedCapabilities, profile: snapshot.profile, target: snapshot.target,
             installationId: snapshot.installationId, ledger: snapshot.ledger, executor: snapshot.executor,
-            ttlMs: snapshot.expiresAt - snapshot.createdAt, ...(adoption ? { sourcePlanId: adoption.source_plan_id } : {}), ...(snapshot.dossier.handoff === undefined ? {} : { handoff: snapshot.dossier.handoff }) };
+            ttlMs: snapshot.expiresAt - snapshot.createdAt, ...(adoption ? { sourcePlanId: adoption.source_plan_id } : {}), ...(snapshot.dossier.handoff === undefined ? {} : { handoff: snapshot.dossier.handoff }), ...(snapshot.dossier.liveQualification === undefined ? {} : { liveQualification: snapshot.dossier.liveQualification }) };
         if (snapshot.digest !== authoritative.digest || snapshot.gapId !== authoritative.gapId || snapshot.revision !== 1
             || snapshot.status !== 'pending-approval' || snapshot.createdAt !== receipt.createdAt
             || snapshot.approval !== undefined || snapshot.activation !== undefined || controlPlaneDigest(replayBinding) !== inputDigest) {