@dsh-enhanced/plugin-control-plane 0.1.65 → 0.1.67

package/lib/store.js

@@ -2,6 +2,7 @@ import { validateLiveQualificationTerms, assertLiveQualificationBatch, parseLive
 import { createHash, randomUUID } from 'node:crypto';
 import { createPublicKey, verify } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
+import { types as utilTypes } from 'node:util';
 import { realpathSync } from 'node:fs';
 import { basename, isAbsolute, posix, resolve, win32 } from 'node:path';
 import { discover, parseCatalog } from './catalog.js';
@@ -13,11 +14,12 @@ import { validateSourceBaselineConfig, verifySourceBaselineHistory } from './sou
 import { validateScopedPluginFiles } from './source-workspace.js';
 import { validateCreationCapabilitySource } from './creation-capability-source.js';
 import { validateSourceRevisionBinding } from './source-revision.js';
-import { validateSourceCreationFiles, validateSourceCreationGrant } from './source-creation.js';
-import { sourceGrowthRunDigest, validatePluginRevisionRegressionCertificate, validatePluginRevisionVerificationCertificate, validatePluginCreationVerificationCertificate, validateSourceGrowthRunBinding } from '@dsh-enhanced/assistant-growth-contract';
+import { validateSourceCreationFiles, validateSourceCreationGrant, normalizeSourceCreationGrant } from './source-creation.js';
+import { anySourceGrowthRunDigest as sourceGrowthRunDigest, isSourceOwnerContinuation, validateAnySourceGrowthRunBinding, validatePluginRevisionRegressionCertificate, validatePluginRevisionVerificationCertificate, validatePluginCreationVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
 import { validateAdoptionHandoffTerms } from './adoption-handoff.js';
 import { assertForegroundDeployment, assertForegroundTask } from './foreground-deployment.js';
 import { assertTaskObservationBatch, getTaskObservationRecord, readTaskObservationContext } from './task-observation-store.js';
+import { createCreationCapabilityTrendSnapshot, listCreationCapabilityTrendSnapshots, sealCreationCapabilityTrendSnapshot } from './creation-capability-trend-snapshot.js';
 import { parseRuntimeEpochRequest, parseRuntimeEpochReceipt, verifyRuntimeEpochReceipt } from './runtime-epoch.js';
 import { runtimeIdentityDigest } from './foreground-deployment.js';
 import { readHostMaintenanceRecords, verifyHostMaintenanceChain, hostMaintenanceCanonical, hostMaintenanceDigest } from './host-maintenance.js';
@@ -123,6 +125,61 @@ function canonical(value) {
 export function controlPlaneDigest(value) {
     return createHash('sha256').update(canonical(value)).digest('hex');
 }
+/** Structural validation precedes this exact prepared-build binding check. */
+function creationVerificationMatchesPreparedEvidence(certificate, evidence) {
+    if (certificate.protocol === 'assistant-growth/creation-verification/v1') {
+        return evidence.schemaVersion === 1 && !Object.hasOwn(certificate, 'execution');
+    }
+    const execution = certificate.execution;
+    if (certificate.protocol === 'assistant-growth/creation-verification/v2') {
+        return evidence.schemaVersion === 2 && evidence.boundary === 'macos-seatbelt-single-process-v1'
+            && execution?.boundary === 'macos-seatbelt-single-process-v1'
+            && execution.runtimeDigest === evidence.runtimeDigest
+            && execution.buildEvidenceDigest === controlPlaneDigest(evidence);
+    }
+    return certificate.protocol === 'assistant-growth/creation-verification/v3'
+        && evidence.schemaVersion === 3 && evidence.boundary === 'linux-native-repository-v1'
+        && execution?.boundary === 'linux-native-process-seccomp-v1'
+        && execution.buildRuntimeDigest === evidence.runtimeDigest
+        && execution.buildEvidenceDigest === controlPlaneDigest(evidence);
+}
+/** Legacy revision v1 has no execution claim; Linux requires its own signed build provenance. */
+function revisionVerificationMatchesPreparedEvidence(certificate, evidence) {
+    if (certificate.protocol === 'assistant-growth/revision-verification/v1') {
+        return evidence.schemaVersion !== 3 && !Object.hasOwn(certificate, 'execution');
+    }
+    const execution = certificate.execution;
+    return certificate.protocol === 'assistant-growth/revision-verification/v2'
+        && evidence.schemaVersion === 3 && evidence.boundary === 'linux-native-repository-v1'
+        && execution?.boundary === 'linux-native-process-seccomp-v1'
+        && execution.buildRuntimeDigest === evidence.runtimeDigest
+        && execution.buildEvidenceDigest === controlPlaneDigest(evidence);
+}
+/** Retained certificates must refer to the exact candidate and one parent/candidate observer family. */
+function revisionRegressionMatchesCandidate(certificate, candidate, parent) {
+    if (certificate.candidateVerificationDigest !== controlPlaneDigest(candidate)
+        || controlPlaneDigest(certificate.plan) !== controlPlaneDigest(candidate.plan)
+        || controlPlaneDigest(certificate.source) !== controlPlaneDigest(candidate.source)
+        || controlPlaneDigest(certificate.parent) !== controlPlaneDigest(candidate.parent)
+        || certificate.contractDigest !== parent.contractDigest
+        || candidate.parent.planId !== parent.plan.id
+        || candidate.parent.certificateDigest !== controlPlaneDigest(parent)
+        || candidate.parent.artifactSha256 !== parent.plan.artifactSha256)
+        return false;
+    if (candidate.protocol === 'assistant-growth/revision-verification/v1') {
+        return certificate.protocol === 'assistant-growth/revision-regression/v1'
+            && !Object.hasOwn(certificate, 'execution') && parent.protocol !== 'assistant-growth/creation-verification/v3';
+    }
+    const execution = certificate.execution, candidateExecution = candidate.execution, parentExecution = parent.execution;
+    return certificate.protocol === 'assistant-growth/revision-regression/v2'
+        && parent.protocol === 'assistant-growth/creation-verification/v3'
+        && execution?.boundary === 'linux-native-process-seccomp-v1'
+        && candidateExecution?.boundary === execution.boundary && parentExecution?.boundary === execution.boundary
+        && execution.runtimeDigest === candidateExecution.runtimeDigest && execution.runtimeDigest === parentExecution.runtimeDigest
+        && execution.observerPreparationDigest === candidateExecution.observerPreparationDigest
+        && execution.observerPreparationDigest === parentExecution.observerPreparationDigest
+        && candidateExecution.buildRuntimeDigest === parentExecution.buildRuntimeDigest;
+}
 function bounded(value, field, maximum = 1_000) {
     if (typeof value !== 'string')
         throw new ControlPlaneStoreError('invalid-input', `${field} must be text`);
@@ -172,14 +229,16 @@ function creationBindingFromStored(value) {
     let growthRun;
     if (Object.hasOwn(binding, 'growthRun')) {
         try {
-            validateSourceGrowthRunBinding(binding['growthRun']);
+            validateAnySourceGrowthRunBinding(binding['growthRun']);
         }
         catch {
             throw new ControlPlaneStoreError('invalid-input', 'source creation growth run is invalid');
         }
         growthRun = structuredClone(binding['growthRun']);
     }
-    return Object.freeze({ grant: Object.freeze(structuredClone(binding['grant'])), generatorDigest: binding['generatorDigest'],
+    if (growthRun?.protocol === 'assistant-growth/source-run/v2' && binding['grant'].workItemFailures !== true)
+        throw new ControlPlaneStoreError('invalid-input', 'work item creation grant must explicitly permit work item failures');
+    return Object.freeze({ grant: Object.freeze(normalizeSourceCreationGrant(binding['grant'])), generatorDigest: binding['generatorDigest'],
         ...(growthRun === undefined ? {} : { growthRun: Object.freeze(growthRun) }) });
 }
 function revisionBindingFromStored(value) {
@@ -643,6 +702,51 @@ function activationFromRow(row) {
 }
 function preparedEvidenceFromStored(value) {
     const item = objectRecord(value, 'stored source prepared evidence');
+    if (item['schemaVersion'] === 3) {
+        exactKeys(item, ['schemaVersion', 'kind', 'boundary', 'runtimeDigest', 'executionContractDigest', 'buildScriptSha256',
+            'archive', 'receipt', 'environment', 'checks', 'pack', 'logDigest', 'durationMs', 'preparedAt'], 'stored Linux source prepared evidence');
+        const archive = objectRecord(item['archive'], 'stored Linux source archive');
+        exactKeys(archive, ['sizeBytes', 'sha256'], 'stored Linux source archive');
+        const receipt = objectRecord(item['receipt'], 'stored Linux source receipt binding');
+        exactKeys(receipt, ['requestDigest', 'nativeNonce', 'nativeResourceId', 'intentDigest', 'resourcesDigest', 'receiptDigest'], 'stored Linux source receipt binding');
+        const environment = objectRecord(item['environment'], 'stored Linux source environment');
+        exactKeys(environment, ['npmConfigIgnoreScripts', 'frozenLockfile', 'offline', 'nodeVersion', 'pnpmVersion'], 'stored Linux source environment');
+        const pack = objectRecord(item['pack'], 'stored Linux source pack');
+        exactKeys(pack, ['name', 'version', 'sizeBytes', 'sha256'], 'stored Linux source pack');
+        const digest = (value) => typeof value === 'string' && DIGEST.test(value);
+        const size = (value, maximum) => Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= maximum;
+        const storedChecks = item['checks'];
+        const checks = ['source-archive-integrity', 'frozen-offline-install', 'repository-pnpm-check', 'source-input-recheck', 'package-integrity'];
+        if (item['kind'] !== 'dsh-source-prepared-evidence' || item['boundary'] !== 'linux-native-repository-v1'
+            || !digest(item['runtimeDigest']) || !digest(item['executionContractDigest']) || !digest(item['buildScriptSha256'])
+            || !size(archive['sizeBytes'], 64 * 1024 * 1024) || !digest(archive['sha256'])
+            || !['requestDigest', 'intentDigest', 'resourcesDigest', 'receiptDigest'].every(key => digest(receipt[key]))
+            || typeof receipt['nativeNonce'] !== 'string' || !/^[a-f0-9]{32}$/u.test(receipt['nativeNonce'])
+            || typeof receipt['nativeResourceId'] !== 'string' || !/^linux-[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u.test(receipt['nativeResourceId'])
+            || environment['npmConfigIgnoreScripts'] !== true || environment['frozenLockfile'] !== true || environment['offline'] !== true
+            || !['nodeVersion', 'pnpmVersion'].every(key => typeof environment[key] === 'string' && environment[key] !== '' && environment[key].length <= 64)
+            || !Array.isArray(storedChecks) || storedChecks.length !== checks.length || checks.some((check, index) => storedChecks[index] !== check)
+            || typeof pack['name'] !== 'string' || pack['name'] === '' || pack['name'].length > 214
+            || typeof pack['version'] !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._+=-]{0,63}$/u.test(pack['version'])
+            || !size(pack['sizeBytes'], MAX_PREPARED_ARTIFACT_BYTES) || !digest(pack['sha256']) || !digest(item['logDigest'])
+            || !Number.isSafeInteger(item['durationMs']) || Number(item['durationMs']) < 0
+            || !Number.isSafeInteger(item['preparedAt']) || Number(item['preparedAt']) < 0) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored Linux source prepared evidence is corrupt');
+        }
+        // Pure structural validation keeps the independent authority runtime free of
+        // an isolation executor import. The runner verifies the private receipt.
+        return Object.freeze({ schemaVersion: 3, kind: 'dsh-source-prepared-evidence',
+            boundary: 'linux-native-repository-v1', runtimeDigest: item['runtimeDigest'],
+            executionContractDigest: item['executionContractDigest'], buildScriptSha256: item['buildScriptSha256'],
+            archive: Object.freeze({ sizeBytes: Number(archive['sizeBytes']), sha256: String(archive['sha256']) }),
+            receipt: Object.freeze({ requestDigest: String(receipt['requestDigest']), nativeNonce: String(receipt['nativeNonce']),
+                nativeResourceId: String(receipt['nativeResourceId']), intentDigest: String(receipt['intentDigest']),
+                resourcesDigest: String(receipt['resourcesDigest']), receiptDigest: String(receipt['receiptDigest']) }),
+            environment: Object.freeze({ npmConfigIgnoreScripts: true, frozenLockfile: true, offline: true,
+                nodeVersion: String(environment['nodeVersion']), pnpmVersion: String(environment['pnpmVersion']) }), checks: Object.freeze(checks),
+            pack: Object.freeze({ name: pack['name'], version: pack['version'], sizeBytes: Number(pack['sizeBytes']), sha256: pack['sha256'] }),
+            logDigest: item['logDigest'], durationMs: Number(item['durationMs']), preparedAt: Number(item['preparedAt']) });
+    }
     if (item['schemaVersion'] === 2) {
         exactKeys(item, ['schemaVersion', 'kind', 'boundary', 'runtimeDigest', 'fixedCompilerSha256', 'checks', 'pack', 'preparedAt'], 'stored native source prepared evidence');
         const pack = objectRecord(item['pack'], 'stored native source pack');
@@ -759,7 +863,7 @@ function sourceFromRow(row) {
     }
     const revision = row.revision_json === null ? undefined : revisionBindingFromStored(JSON.parse(row.revision_json));
     const prepared = row.mode === 'modify' || row.mode === 'prepared-create' || row.mode === 'prepared-revise';
-    if (prepared !== (preparedEvidence !== undefined) || (row.mode === 'modify' && preparedEvidence?.schemaVersion !== 1)
+    if (prepared !== (preparedEvidence !== undefined) || (row.mode === 'modify' && preparedEvidence?.schemaVersion === 2)
         || (row.mode === 'prepared-create') !== (creation !== undefined) || (row.mode === 'prepared-revise') !== (revision !== undefined)
         || ((row.mode === 'prepared-create' || row.mode === 'prepared-revise') && (!['pending-approval', 'expired'].includes(row.status) || (creation ?? revision)?.generatorDigest !== row.generator_digest
             || row.approval_json !== null || row.release_authorization_json !== null || row.release_id !== null))
@@ -1110,10 +1214,23 @@ function releaseArtifact(evidence) {
         provenanceSha256: evidence.provenanceSha256, mergedCommit: evidence.mergedCommit, dshBaseline: evidence.dshBaseline,
         capabilities: evidence.capabilities, authorities: evidence.authorities, requires: evidence.requires };
 }
+function sourceBuildEvidenceSchema(build) {
+    if (!('backend' in build))
+        return 1;
+    if (build.backend === 'macos-seatbelt')
+        return 2;
+    if (build.backend === 'linux-native')
+        return 3;
+    throw new ControlPlaneStoreError('invalid-state', 'source job build backend is unknown');
+}
 function sourceJobIntentFromStored(value) {
     const intent = objectRecord(value, 'source job intent');
-    const native = typeof intent['build'] === 'object' && intent['build'] !== null
-        && intent['build']['backend'] === 'macos-seatbelt';
+    const build = objectRecord(intent['build'], 'source job build');
+    const backend = build['backend'];
+    if (Object.hasOwn(build, 'backend') && backend !== 'macos-seatbelt' && backend !== 'linux-native') {
+        throw new ControlPlaneStoreError('invalid-input', 'source job build backend is unknown');
+    }
+    const native = backend === 'macos-seatbelt' || backend === 'linux-native';
     exactKeys(intent, ['authority', 'owner', 'ownerDigest', 'trustDigest', 'repository', 'name', 'gapId', 'gapRevision', 'gapDigest',
         'baseCommit', 'files', 'ttlMs', 'build', 'worktree', native ? 'nativeResource' : 'containerName', ...(Object.hasOwn(intent, 'baseline') ? ['baseline'] : []),
         ...(Object.hasOwn(intent, 'mode') ? ['mode'] : []), ...(Object.hasOwn(intent, 'creation') ? ['creation'] : []), ...(Object.hasOwn(intent, 'revision') ? ['revision'] : [])], 'source job intent');
@@ -1139,7 +1256,7 @@ function sourceJobIntentFromStored(value) {
         || !Array.isArray(intent['files']) || intent['files'].length === 0 || intent['files'].length > 64
         || !Number.isSafeInteger(intent['ttlMs']) || Number(intent['ttlMs']) < 60_000 || Number(intent['ttlMs']) > 86_400_000
         || (!native && (typeof intent['containerName'] !== 'string' || !/^dsh-source-job-[a-f0-9]{64}$/u.test(intent['containerName'])))
-        || (native && (intent['mode'] !== 'create' && intent['mode'] !== 'revise-created'))
+        || (backend === 'macos-seatbelt' && (intent['mode'] !== 'create' && intent['mode'] !== 'revise-created'))
         || (intent['mode'] !== undefined && intent['mode'] !== 'create' && intent['mode'] !== 'revise-created')
         || (intent['mode'] === 'create') !== Object.hasOwn(intent, 'creation')
         || (intent['mode'] === 'revise-created') !== Object.hasOwn(intent, 'revision')) {
@@ -1148,7 +1265,7 @@ function sourceJobIntentFromStored(value) {
     if (native) {
         const resource = objectRecord(intent['nativeResource'], 'native source job resource');
         exactKeys(resource, ['backend', 'key'], 'native source job resource');
-        if (resource['backend'] !== 'macos-seatbelt' || typeof resource['key'] !== 'string'
+        if (resource['backend'] !== backend || typeof resource['key'] !== 'string'
             || !/^source-job-[a-f0-9]{64}$/u.test(resource['key'])) {
             throw new ControlPlaneStoreError('invalid-input', 'native source job resource is invalid');
         }
@@ -1208,7 +1325,7 @@ function sourceJobIntentFromStored(value) {
         name: intent['name'], gapId: intent['gapId'], gapRevision: Number(intent['gapRevision']), gapDigest: intent['gapDigest'],
         baseCommit: intent['baseCommit'], files: Object.freeze(files), ttlMs: Number(intent['ttlMs']), build: intent['build'],
         worktree: intent['worktree'],
-        ...(native ? { nativeResource: Object.freeze({ backend: 'macos-seatbelt',
+        ...(native ? { nativeResource: Object.freeze({ backend,
                 key: intent['nativeResource'].key }) }
             : { containerName: intent['containerName'] }),
         ...(creation === undefined ? {} : { mode: 'create', creation }),
@@ -1236,6 +1353,21 @@ function ownerTaskFailureReferenceFromStored(value, errorCode = 'invalid-input')
     try {
         const reference = errorCode === 'invalid-input' ? exactInputRecord(value, 'owner task failure reference') : objectRecord(value, 'owner task failure reference');
         const keys = errorCode === 'invalid-input' ? exactInputKeys : exactKeys;
+        if (reference['schemaVersion'] === 2) {
+            keys(reference, ['schemaVersion', 'sourceProtocol', 'owner', 'outcomeId', 'projection', 'sourceDigest', 'presentationDigest', 'context'], 'work item failure reference');
+            const projection = errorCode === 'invalid-input' ? exactInputRecord(reference['projection'], 'work item projection') : objectRecord(reference['projection'], 'work item projection');
+            const context = errorCode === 'invalid-input' ? exactInputRecord(reference['context'], 'work item context') : objectRecord(reference['context'], 'work item context');
+            keys(context, ['manifestDigest', 'objectiveDigest', 'objectiveBytes'], 'work item context');
+            if (reference['sourceProtocol'] !== 'assistant-delivery/work-item-engineering-context/v1' || projection['subjectKind'] !== 'work-item'
+                || typeof reference['presentationDigest'] !== 'string' || !DIGEST.test(reference['presentationDigest'])
+                || typeof context['manifestDigest'] !== 'string' || !DIGEST.test(context['manifestDigest']) || typeof context['objectiveDigest'] !== 'string' || !DIGEST.test(context['objectiveDigest'])
+                || !Number.isSafeInteger(context['objectiveBytes']) || Number(context['objectiveBytes']) < 1 || Number(context['objectiveBytes']) > 16384)
+                throw new ControlPlaneStoreError(errorCode, 'work item failure reference is invalid');
+            const legacy = ownerTaskFailureReferenceFromStored({ schemaVersion: 1, owner: reference['owner'], outcomeId: reference['outcomeId'], projection: { ...projection, subjectKind: 'foreground-turn' }, sourceDigest: reference['sourceDigest'] }, errorCode);
+            return Object.freeze({ schemaVersion: 2, sourceProtocol: 'assistant-delivery/work-item-engineering-context/v1', owner: legacy.owner, outcomeId: legacy.outcomeId,
+                projection: Object.freeze({ ...legacy.projection, subjectKind: 'work-item' }), sourceDigest: legacy.sourceDigest, presentationDigest: reference['presentationDigest'],
+                context: Object.freeze({ manifestDigest: context['manifestDigest'], objectiveDigest: context['objectiveDigest'], objectiveBytes: Number(context['objectiveBytes']) }) });
+        }
         keys(reference, ['schemaVersion', 'owner', 'outcomeId', 'projection', 'sourceDigest'], 'owner task failure reference');
         const owner = errorCode === 'invalid-input' ? exactInputRecord(reference['owner'], 'owner task failure owner') : objectRecord(reference['owner'], 'owner task failure owner');
         keys(owner, ['receiptVersion', 'authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion',
@@ -1733,6 +1865,9 @@ export class ControlPlaneStore {
     #database;
     #now;
     #ownerTaskFailureGapAdmission;
+    #workItemWriter = false;
+    #workItemSavepoints = [];
+    #workItemSavepointSequence = 0;
     #foregroundDeploymentAdmission;
     #liveQualificationAdmission;
     #withLiveQualificationFence;
@@ -1804,14 +1939,41 @@ export class ControlPlaneStore {
         const reference = ownerTaskFailureReferenceFromStored(referenceInput);
         const referenceDigest = controlPlaneDigest(reference);
         const idempotencyKey = `owner-task-failure:${referenceDigest}`;
-        const normalized = { idempotencyKey, capability: 'foreground-task-repair',
-            context: 'Owner-verified foreground task failure. Private source reference retained.',
+        const normalized = { idempotencyKey, capability: reference.schemaVersion === 2 ? 'work-item-task-repair' : 'foreground-task-repair',
+            context: reference.schemaVersion === 2 ? 'Owner-verified background work-item failure. Private engineering reference retained.' : 'Owner-verified foreground task failure. Private source reference retained.',
             expectedValue: 0, frequency: 1, estimatedCost: 1, risk: 1 };
         const inputDigest = controlPlaneDigest(normalized);
         const now = this.#now();
         const id = `gap-${randomUUID()}`;
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
+            if (reference.schemaVersion === 2) {
+                // /new changes only a route generation. Preserve the first frozen owner
+                // bytes for the same authenticated source rather than minting another gap.
+                const stable = (value) => {
+                    const { bindingVersion: _bindingVersion, generation: _generation, ...owner } = value.owner;
+                    return controlPlaneDigest({ ...value, owner });
+                };
+                const candidates = this.#database.prepare(`SELECT gap_id FROM owner_task_failure_gaps
+          WHERE json_extract(reference_json, '$.schemaVersion') = 2
+            AND json_extract(reference_json, '$.sourceDigest') = ?
+            AND json_extract(reference_json, '$.outcomeId') = ?
+            AND json_extract(reference_json, '$.projection.subjectRef') = ? LIMIT 1001`)
+                    .all(reference.sourceDigest, reference.outcomeId, reference.projection.subjectRef);
+                if (candidates.length > 1000)
+                    throw new ControlPlaneStoreError('conflict', 'work item failure historical lookup exceeds bound');
+                const matches = candidates.filter(row => { const prior = this.getOwnerTaskFailureReference(row.gap_id); return prior?.schemaVersion === 2 && stable(prior) === stable(reference); });
+                if (matches.length > 1)
+                    throw new ControlPlaneStoreError('conflict', 'work item failure source has ambiguous historical gaps');
+                if (matches[0]) {
+                    const original = this.getOwnerTaskFailureReference(matches[0].gap_id);
+                    if (!isSourceOwnerContinuation(reference.owner, original.owner))
+                        throw new ControlPlaneStoreError('conflict', 'work item failure owner generation regressed');
+                    const gap = this.getGap(matches[0].gap_id);
+                    this.#commitMutation();
+                    return gap;
+                }
+            }
             const prior = this.#database.prepare('SELECT * FROM capability_gaps WHERE idempotency_key = ?').get(idempotencyKey);
             if (prior !== undefined) {
                 if (prior.input_digest !== inputDigest)
@@ -1820,7 +1982,7 @@ export class ControlPlaneStore {
                 if (stored === undefined || controlPlaneDigest(stored) !== referenceDigest) {
                     throw new ControlPlaneStoreError('invalid-state', 'owner task failure gap sidecar is corrupt');
                 }
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return gapFromRow(prior);
             }
             this.#database.prepare(`INSERT INTO capability_gaps (id, idempotency_key, input_digest, capability, context,
@@ -1829,14 +1991,70 @@ export class ControlPlaneStore {
             this.#database.prepare(`INSERT INTO owner_task_failure_gaps (gap_id, reference_json, reference_digest)
         VALUES (?, ?, ?)`).run(id, JSON.stringify(reference), referenceDigest);
             const gap = this.getGap(id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return gap;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
+    #assertWorkItemSynchronous(result) {
+        const refuse = () => { throw new ControlPlaneStoreError('invalid-input', 'owner task failure gap admission must be synchronous'); };
+        if (result === null || (typeof result !== 'object' && typeof result !== 'function'))
+            return;
+        if (utilTypes.isProxy(result))
+            refuse();
+        if (utilTypes.isPromise(result)) {
+            // Best effort only for ordinary native Promises. Do not execute an own
+            // constructor or subclass species while refusing an asynchronous callback.
+            if (Object.getPrototypeOf(result) === Promise.prototype && !Object.hasOwn(result, 'constructor')) {
+                try {
+                    void Promise.prototype.then.call(result, undefined, () => undefined);
+                }
+                catch { /* synchronous refusal remains authoritative */ }
+            }
+            refuse();
+        }
+        let prototype = result;
+        for (let depth = 0; prototype !== null && depth < 64; depth++) {
+            if (utilTypes.isProxy(prototype) || Object.getOwnPropertyDescriptor(prototype, 'then'))
+                refuse();
+            prototype = Object.getPrototypeOf(prototype);
+        }
+        if (prototype !== null)
+            refuse();
+    }
+    #beginMutation() {
+        if (!this.#workItemWriter) {
+            this.#database.exec('BEGIN IMMEDIATE');
+            return;
+        }
+        const name = `cp_work_item_${++this.#workItemSavepointSequence}`;
+        this.#database.exec(`SAVEPOINT ${name}`);
+        this.#workItemSavepoints.push(name);
+    }
+    #commitMutation() {
+        if (!this.#workItemWriter) {
+            this.#database.exec('COMMIT');
+            return;
+        }
+        const name = this.#workItemSavepoints.pop();
+        if (!name)
+            throw new ControlPlaneStoreError('invalid-state', 'work item nested writer is unbalanced');
+        this.#database.exec(`RELEASE SAVEPOINT ${name}`);
+    }
+    #rollbackMutation() {
+        if (!this.#workItemWriter) {
+            this.#database.exec('ROLLBACK');
+            return;
+        }
+        const name = this.#workItemSavepoints.pop();
+        if (name) {
+            this.#database.exec(`ROLLBACK TO SAVEPOINT ${name}`);
+            this.#database.exec(`RELEASE SAVEPOINT ${name}`);
+        }
+    }
     getOwnerTaskFailureReference(gapId) {
         return readOwnerTaskFailureReference(this.#database, gapId);
     }
@@ -1846,22 +2064,48 @@ export class ControlPlaneStore {
         if (typeof gapId !== 'string' || !KEY.test(gapId) || typeof callback !== 'function') {
             throw new ControlPlaneStoreError('invalid-input', 'owner task failure gap admission is invalid');
         }
-        if (callback.constructor.name === 'AsyncFunction')
-            throw new ControlPlaneStoreError('invalid-input', 'owner task failure gap admission must be synchronous');
         if (this.#ownerTaskFailureGapAdmission !== undefined)
             throw new ControlPlaneStoreError('conflict', 'owner task failure gap admission is already active');
-        if (this.getOwnerTaskFailureReference(gapId) === undefined)
+        const reference = this.getOwnerTaskFailureReference(gapId);
+        if (reference === undefined)
             throw new ControlPlaneStoreError('not-found', 'owner task failure gap is absent');
+        const workItem = reference.schemaVersion === 2;
+        if (workItem ? utilTypes.isProxy(callback) || utilTypes.isAsyncFunction(callback) : callback.constructor.name === 'AsyncFunction')
+            throw new ControlPlaneStoreError('invalid-input', 'owner task failure gap admission must be synchronous');
+        if (workItem) {
+            if (this.#database.isTransaction)
+                throw new ControlPlaneStoreError('conflict', 'work item writer must be entered before CP mutation');
+            this.#database.exec('BEGIN IMMEDIATE');
+            this.#workItemWriter = true;
+        }
         this.#ownerTaskFailureGapAdmission = gapId;
         try {
+            if (workItem && controlPlaneDigest(this.getOwnerTaskFailureReference(gapId)) !== controlPlaneDigest(reference))
+                throw new ControlPlaneStoreError('conflict', 'work item reference changed at writer boundary');
             const result = callback();
-            if (typeof result?.then === 'function') {
+            if (workItem)
+                this.#assertWorkItemSynchronous(result);
+            else if (typeof result?.then === 'function') {
                 throw new ControlPlaneStoreError('invalid-input', 'owner task failure gap admission must be synchronous');
             }
+            if (workItem) {
+                if (this.#workItemSavepoints.length)
+                    throw new ControlPlaneStoreError('invalid-state', 'work item nested writer was not retired');
+                this.#database.exec('COMMIT');
+            }
             return result;
         }
+        catch (error) {
+            if (workItem && this.#database.isTransaction)
+                this.#database.exec('ROLLBACK');
+            throw error;
+        }
         finally {
             this.#ownerTaskFailureGapAdmission = undefined;
+            if (workItem) {
+                this.#workItemWriter = false;
+                this.#workItemSavepoints = [];
+            }
         }
     }
     #assertOwnerTaskFailureGapAdmission(gapId) {
@@ -1916,16 +2160,16 @@ export class ControlPlaneStore {
         return this.#withActivationSource(planId, () => {
             const own = !this.#database.isTransaction;
             if (own)
-                this.#database.exec('BEGIN IMMEDIATE');
+                this.#beginMutation();
             try {
                 const result = this.#withActivationSource(planId, callback, recovery);
                 if (own)
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                 return result;
             }
             catch (error) {
                 if (own)
-                    this.#database.exec('ROLLBACK');
+                    this.#rollbackMutation();
                 throw error;
             }
         }, recovery);
@@ -2004,11 +2248,11 @@ export class ControlPlaneStore {
             target: input.target, executor: input.executor,
             createdAt: now, expiresAt };
         const planDigest = controlPlaneDigest(immutable);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const raced = this.#activationPlanReceiptByKey(idempotencyKey, 'create-activation-plan', inputDigest);
             if (raced !== undefined) {
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return raced;
             }
             const currentGap = this.getGap(gap.id);
@@ -2031,11 +2275,11 @@ export class ControlPlaneStore {
             }
             const receipt = { idempotencyKey, operation: 'create-activation-plan', inputDigest, result: plan, createdAt: now };
             this.#insertReceipt(receipt);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return receipt;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2071,7 +2315,7 @@ export class ControlPlaneStore {
         if (this.#adoptionCoordinatorId !== undefined)
             throw new ControlPlaneStoreError('invalid-state', 'adoption coordinator cannot prepare a target handoff');
         return this.#withActivationSource(input.planId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.assertOwnerActivationSource(input.planId);
                 const plan = this.getPlan(input.planId), terms = plan.dossier.handoff;
@@ -2092,7 +2336,7 @@ export class ControlPlaneStore {
                     if (prior.planDigest !== plan.digest || prior.coordinatorId !== terms.coordinatorId) {
                         throw new ControlPlaneStoreError('invalid-state', 'stored adoption handoff is corrupt');
                     }
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return prior;
                 }
                 const now = this.#now(), expiresAt = Math.min(now + terms.maximumWindowMs, plan.expiresAt, plan.approval.expiresAt);
@@ -2101,11 +2345,11 @@ export class ControlPlaneStore {
                 this.#database.prepare('INSERT INTO adoption_handoffs (plan_id,plan_digest,coordinator_id,created_at,expires_at,revoked_at) VALUES (?,?,?,?,?,NULL)')
                     .run(plan.id, plan.digest, terms.coordinatorId, now, expiresAt);
                 const handoff = this.getAdoptionHandoff(plan.id);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return handoff;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -2147,6 +2391,14 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('conflict', 'adoption handoff is inactive');
     }
     assertAdoptionHandoff(planId) { this.#assertAdoptionHandoff(planId, this.#adoptionCoordinatorId); }
+    inspectSourceJobQuota(input) {
+        const a = input.authority, c = input.creation;
+        const row = this.#database.prepare('SELECT * FROM source_job_authorities WHERE authority_id=?').get(a.id);
+        const grant = this.#database.prepare('SELECT * FROM source_creation_grants WHERE grant_id=?').get(c.id);
+        if (row && (row.authority_digest !== a.digest || row.expires_at !== a.expiresAt || row.max_submissions !== a.maxSubmissions) || grant && (grant.grant_digest !== controlPlaneDigest(c) || grant.expires_at !== c.expiresAt || grant.max_creates !== c.maxCreates))
+            throw new ControlPlaneStoreError('conflict', 'source job quota authority changed');
+        return { sourceSubmissions: Math.max(0, a.maxSubmissions - (row?.submissions ?? 0)), creates: Math.max(0, c.maxCreates - (grant?.creates ?? 0)) };
+    }
     enqueueSourceJob(input) {
         if (!/^source-job-[a-f0-9]{64}$/u.test(input.id) || input.automationId !== input.id) {
             throw new ControlPlaneStoreError('invalid-input', 'source job identity is invalid');
@@ -2175,7 +2427,7 @@ export class ControlPlaneStore {
         const growthRun = intent.creation?.growthRun ?? intent.revision?.growthRun;
         if (growthRun !== undefined && (now >= growthRun.generationDeadlineAt || now >= growthRun.expiresAt))
             throw new ControlPlaneStoreError('expired', 'source growth generation window is expired');
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const prior = this.#database.prepare('SELECT * FROM source_jobs WHERE authority_id = ? AND idempotency_key = ?')
                 .get(intent.authority.id, idempotencyKey);
@@ -2184,7 +2436,7 @@ export class ControlPlaneStore {
                 if (record.intentDigest !== intentDigest || record.id !== input.id || record.automationId !== input.automationId) {
                     throw new ControlPlaneStoreError('conflict', 'source job idempotency key was reused with different input');
                 }
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return record;
             }
             if (intent.baseline !== undefined) {
@@ -2260,11 +2512,11 @@ export class ControlPlaneStore {
             const record = this.getSourceJob(input.id);
             if (record === undefined)
                 throw new ControlPlaneStoreError('invalid-state', 'inserted source job could not be read');
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return record;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2284,7 +2536,7 @@ export class ControlPlaneStore {
       created_at DESC, id DESC LIMIT ?`).all(limit).map(sourceJobFromRow);
     }
     /** Prepared owner continuations have a bounded recovery query, independent of job history. */
-    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false, includeCreation = false, includeCreationAdoption = false, includeRevision = false, includeRegression = false) {
+    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false, includeCreation = false, includeCreationAdoption = false, includeRevision = false, includeRegression = false, includeRevisionAdoption = false) {
         return this.#database.prepare(`SELECT j.* FROM source_jobs j JOIN source_plans p ON p.id = j.plan_id
       JOIN owner_task_failure_gaps g ON g.gap_id = p.gap_id
       LEFT JOIN source_adoptions a ON a.source_plan_id = p.id
@@ -2304,9 +2556,13 @@ export class ControlPlaneStore {
         OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
           AND json_type(j.intent_json, '$.revision.growthRun.revisionRegressionAcceptance') IS NOT NULL
           AND EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id AND v.status='verified')
-          AND NOT EXISTS (SELECT 1 FROM source_revision_regressions v WHERE v.plan_id=p.id)))
+          AND NOT EXISTS (SELECT 1 FROM source_revision_regressions v WHERE v.plan_id=p.id))
+        OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
+          AND EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id AND v.status='verified')
+          AND (json_type(j.intent_json, '$.revision.growthRun.revisionRegressionAcceptance') IS NULL
+            OR EXISTS (SELECT 1 FROM source_revision_regressions r WHERE r.plan_id=p.id AND r.status='verified'))))
         AND (p.expires_at > ? OR ap.status IN ('staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'))
-      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, includeCreation ? 1 : 0, includeCreationAdoption ? 1 : 0, includeRevision ? 1 : 0, includeRegression ? 1 : 0, this.#now()).map(sourceJobFromRow);
+      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, includeCreation ? 1 : 0, includeCreationAdoption ? 1 : 0, includeRevision ? 1 : 0, includeRegression ? 1 : 0, includeRevisionAdoption ? 1 : 0, this.#now()).map(sourceJobFromRow);
     }
     bindSourceJobDefinition(input) {
         if (!Number.isSafeInteger(input.revision) || input.revision < 1 || !DIGEST.test(input.definitionHash))
@@ -2411,9 +2667,9 @@ export class ControlPlaneStore {
                 throw new ControlPlaneStoreError('invalid-input', 'modify source plan prepared digests are invalid');
             }
             preparedEvidence = preparedEvidenceFromStored(input.prepared.evidence);
-            if ((mode === 'modify' && preparedEvidence.schemaVersion !== 1)
-                || (preparedEvidence.schemaVersion === 2 && input.sourceJob === undefined)) {
-                throw new ControlPlaneStoreError('invalid-input', 'native source evidence requires a durable created plugin job');
+            if ((mode === 'modify' && preparedEvidence.schemaVersion === 2)
+                || (preparedEvidence.schemaVersion !== 1 && input.sourceJob === undefined)) {
+                throw new ControlPlaneStoreError('invalid-input', 'native source evidence requires a matching durable source job');
             }
         }
         else if (input.prepared !== undefined) {
@@ -2482,7 +2738,7 @@ export class ControlPlaneStore {
             ? { ...immutable, mode, ...(creation === undefined ? {} : { creation }), ...(revision === undefined ? {} : { sourceRevision: revision }), sourceCheck: { treeDigest: input.prepared.treeDigest, patchDigest: input.prepared.patchDigest,
                     checkedAt: input.prepared.checkedAt }, preparedEvidence }
             : immutable);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const currentGap = this.getGap(gap.id);
             if (currentGap.revision !== gap.revision || currentGap.inputDigest !== gap.inputDigest || currentGap.status !== 'open'
@@ -2497,7 +2753,7 @@ export class ControlPlaneStore {
                     || sourceJob.intent.baseCommit !== input.baseCommit || sourceJob.intent.name !== name
                     || sourceJob.intent.repository !== input.repository || sourceJob.intent.worktree !== input.worktree || sourceJob.intent.ttlMs !== input.ttlMs
                     || (mode === 'prepared-create') !== (sourceJob.intent.mode === 'create')
-                    || (preparedEvidence !== undefined && ('backend' in sourceJob.intent.build) !== (preparedEvidence.schemaVersion === 2))
+                    || (preparedEvidence !== undefined && preparedEvidence.schemaVersion !== sourceBuildEvidenceSchema(sourceJob.intent.build))
                     || (mode === 'prepared-create' && controlPlaneDigest(sourceJob.intent.creation) !== controlPlaneDigest(creation))
                     || (mode === 'prepared-revise') !== (sourceJob.intent.mode === 'revise-created')
                     || (mode === 'prepared-revise' && controlPlaneDigest(sourceJob.intent.revision) !== controlPlaneDigest(revision))) {
@@ -2560,11 +2816,11 @@ export class ControlPlaneStore {
             const plan = this.getSourcePlan(id);
             const receipt = { idempotencyKey: key, operation: 'create-source-plan', inputDigest, result: plan, createdAt: now };
             this.#insertReceipt(receipt);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return receipt;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2614,6 +2870,7 @@ export class ControlPlaneStore {
             || job.intent.creation.generatorDigest !== plan.generatorDigest
             || job.intent.repository !== plan.repository || job.intent.worktree !== plan.worktree
             || job.intent.baseCommit !== plan.baseCommit || job.intent.name !== plan.name
+            || plan.preparedEvidence.schemaVersion !== sourceBuildEvidenceSchema(job.intent.build)
             || plan.expiresAt !== plan.createdAt + job.intent.ttlMs) {
             throw new ControlPlaneStoreError('invalid-state', 'prepared creation source job binding is corrupt');
         }
@@ -2659,6 +2916,7 @@ export class ControlPlaneStore {
             || job.intent.revision.generatorDigest !== plan.generatorDigest
             || job.intent.repository !== plan.repository || job.intent.worktree !== plan.worktree
             || job.intent.baseCommit !== plan.baseCommit || job.intent.name !== plan.name
+            || plan.preparedEvidence.schemaVersion !== sourceBuildEvidenceSchema(job.intent.build)
             || plan.expiresAt !== plan.createdAt + job.intent.ttlMs) {
             throw new ControlPlaneStoreError('invalid-state', 'prepared revision source job binding is corrupt');
         }
@@ -2693,6 +2951,7 @@ export class ControlPlaneStore {
         const job = this.getPreparedSourceJob(plan.id);
         const reference = this.getOwnerTaskFailureReference(plan.gapId);
         if (!reference || !plan.sourceCheck || !plan.preparedEvidence || !plan.creation?.growthRun
+            || !creationVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)
             || !job.intent.creation?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
             || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
             || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
@@ -2709,7 +2968,7 @@ export class ControlPlaneStore {
         }
         this.readPreparedSourceArtifact(plan.id);
         const serialized = JSON.stringify(certificate), certificateDigest = controlPlaneDigest(certificate);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const previous = this.#database.prepare('SELECT status,certificate_digest FROM source_creation_verifications WHERE plan_id=?')
                 .get(plan.id);
@@ -2719,10 +2978,10 @@ export class ControlPlaneStore {
             else
                 this.#database.prepare(`UPDATE source_creation_verifications SET status='verified',certificate_json=?,certificate_digest=?,updated_at=?
         WHERE plan_id=? AND status='claimed'`).run(serialized, certificateDigest, this.#now(), plan.id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2743,6 +3002,11 @@ export class ControlPlaneStore {
         if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
             throw new ControlPlaneStoreError('invalid-state', 'stored creation verification certificate digest changed');
         }
+        const plan = this.getSourcePlan(planId);
+        if (certificate.plan.digest !== plan.digest || !plan.preparedEvidence
+            || !creationVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored creation verification certificate does not match exact prepared source');
+        }
         return certificate;
     }
     getCreationVerificationStatus(planId) {
@@ -2769,7 +3033,7 @@ export class ControlPlaneStore {
         if (!pinned || this.#now() >= pinned.expiresAt) {
             throw new ControlPlaneStoreError('invalid-state', 'creation verification requires a current pre-author policy binding');
         }
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const count = this.#database.prepare('SELECT count(*) AS n FROM source_creation_verifications').get();
             if (count.n >= 256)
@@ -2778,10 +3042,10 @@ export class ControlPlaneStore {
             this.#database.prepare(`INSERT INTO source_creation_verifications
         (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
                 .run(planId, now, now);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2802,6 +3066,7 @@ export class ControlPlaneStore {
         const reference = this.getOwnerTaskFailureReference(plan.gapId);
         validateCreationCapabilitySource(source, certificate);
         if (!reference || controlPlaneDigest(plan.sourceRevision?.parent) !== controlPlaneDigest(certificate.parent) || !plan.sourceCheck || !plan.preparedEvidence || !plan.sourceRevision?.growthRun
+            || !revisionVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)
             || !job.intent.revision?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
             || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
             || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
@@ -2823,7 +3088,7 @@ export class ControlPlaneStore {
         if (Buffer.byteLength(sourceJson) > 2_097_152)
             throw new ControlPlaneStoreError('invalid-input', 'revision source archive exceeds bound');
         const serialized = JSON.stringify(certificate), certificateDigest = controlPlaneDigest(certificate);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const previous = this.#database.prepare('SELECT status,certificate_digest FROM source_revision_verifications WHERE plan_id=?')
                 .get(plan.id);
@@ -2838,10 +3103,10 @@ export class ControlPlaneStore {
                 throw new ControlPlaneStoreError('conflict', 'revision source archive changed');
             if (!oldSource)
                 this.#database.prepare('INSERT INTO source_revision_sources VALUES(?,?)').run(plan.id, sourceJson);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2862,6 +3127,19 @@ export class ControlPlaneStore {
         if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
             throw new ControlPlaneStoreError('invalid-state', 'stored revision verification certificate digest changed');
         }
+        // Check retained immutable metadata without reopening expired build/grant authority.
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-revise' || !plan.sourceRevision || !plan.sourceCheck
+            || certificate.plan.digest !== plan.digest || certificate.plan.name !== plan.name
+            || certificate.plan.generatorDigest !== plan.generatorDigest
+            || certificate.plan.sourceTreeDigest !== plan.sourceCheck.treeDigest
+            || certificate.plan.sourcePatchDigest !== plan.sourceCheck.patchDigest
+            || controlPlaneDigest(certificate.parent) !== controlPlaneDigest(plan.sourceRevision.parent)
+            || !plan.preparedEvidence || certificate.plan.artifactSha256 !== plan.preparedEvidence.pack.sha256
+            || certificate.plan.artifactBytes !== plan.preparedEvidence.pack.sizeBytes
+            || !revisionVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision verification certificate does not match exact prepared source');
+        }
         return certificate;
     }
     getRevisionVerificationStatus(planId) {
@@ -2888,7 +3166,7 @@ export class ControlPlaneStore {
         if (!pinned || this.#now() >= pinned.expiresAt) {
             throw new ControlPlaneStoreError('invalid-state', 'revision verification requires a current pre-author policy binding');
         }
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const count = this.#database.prepare('SELECT count(*) AS n FROM source_revision_verifications').get();
             if (count.n >= 256)
@@ -2897,10 +3175,10 @@ export class ControlPlaneStore {
             this.#database.prepare(`INSERT INTO source_revision_verifications
         (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
                 .run(planId, now, now);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2926,6 +3204,7 @@ export class ControlPlaneStore {
         const previousJobs = new Set([...(parent?.observations ?? []), ...(candidate?.observations ?? [])].map(item => item.jobId));
         if (certificate.verifiedAt > this.#now() || certificate.expiresAt <= this.#now()
             || !candidate || !parent || !source || !reference || !run?.revisionRegressionAcceptance
+            || !revisionRegressionMatchesCandidate(certificate, candidate, parent)
             || !job.intent.revision?.growthRun.revisionRegressionAcceptance
             || controlPlaneDigest(certificate.plan) !== controlPlaneDigest(candidate.plan)
             || controlPlaneDigest(certificate.source) !== controlPlaneDigest(candidate.source)
@@ -2951,7 +3230,7 @@ export class ControlPlaneStore {
         }
         this.readPreparedSourceArtifact(plan.id);
         const serialized = JSON.stringify(certificate), digest = controlPlaneDigest(certificate);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const old = this.#database.prepare('SELECT status,certificate_digest FROM source_revision_regressions WHERE plan_id=?')
                 .get(plan.id);
@@ -2961,10 +3240,10 @@ export class ControlPlaneStore {
             else
                 this.#database.prepare(`UPDATE source_revision_regressions SET status='verified',certificate_json=?,certificate_digest=?,updated_at=?
         WHERE plan_id=? AND status='claimed'`).run(serialized, digest, this.#now(), plan.id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -2985,6 +3264,10 @@ export class ControlPlaneStore {
         if (certificate.plan.id !== planId || controlPlaneDigest(certificate) !== row.certificate_digest) {
             throw new ControlPlaneStoreError('invalid-state', 'stored revision regression certificate digest changed');
         }
+        const candidate = this.getRevisionVerification(planId), parent = this.getCreationVerification(certificate.parent.planId);
+        if (!candidate || !parent || !revisionRegressionMatchesCandidate(certificate, candidate, parent)) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored revision regression certificate does not match exact candidate execution');
+        }
         return certificate;
     }
     getRevisionRegressionStatus(planId) {
@@ -3011,7 +3294,7 @@ export class ControlPlaneStore {
         if (!pinned || this.#now() >= pinned.expiresAt) {
             throw new ControlPlaneStoreError('invalid-state', 'revision regression requires a current pre-author policy binding');
         }
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const count = this.#database.prepare('SELECT count(*) AS n FROM source_revision_regressions').get();
             if (count.n >= 256)
@@ -3020,10 +3303,10 @@ export class ControlPlaneStore {
             this.#database.prepare(`INSERT INTO source_revision_regressions
         (plan_id,status,certificate_json,certificate_digest,reason,created_at,updated_at) VALUES (?,'claimed',NULL,NULL,NULL,?,?)`)
                 .run(planId, now, now);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3054,7 +3337,7 @@ export class ControlPlaneStore {
     deleteExpiredPreparedSourceArtifacts(now) {
         if (!Number.isSafeInteger(now) || now < 0)
             throw new ControlPlaneStoreError('invalid-input', 'artifact expiry time is invalid');
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const references = this.#database.prepare('SELECT plan_id, pack_sha256 FROM source_prepared_artifact_refs')
                 .all();
@@ -3076,11 +3359,11 @@ export class ControlPlaneStore {
                     .run(artifact.pack_sha256);
                 deleted += Number(result.changes);
             }
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return deleted;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3341,7 +3624,7 @@ export class ControlPlaneStore {
                 throw new ControlPlaneStoreError('invalid-state', 'expired source receipt is missing');
             return receipt.result;
         }
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const retired = this.#database.prepare(`UPDATE source_plans SET status = 'expired', revision = revision + 1, updated_at = ?
         WHERE id = ? AND revision = ? AND ((mode = 'modify' AND status IN ('pending-approval', 'approved'))
@@ -3358,11 +3641,11 @@ export class ControlPlaneStore {
             const result = this.getSourcePlan(plan.id);
             this.#insertReceipt({ idempotencyKey: `source-expired:${plan.id}`, operation: 'source-expired',
                 inputDigest: expiryDigest, result, createdAt: input.now });
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return result;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3420,7 +3703,7 @@ export class ControlPlaneStore {
                 throw new ControlPlaneStoreError(verified.decision === 'approved' ? 'expired' : 'invalid-state', 'plan approval is not currently applicable');
             const table = kind === 'activation' ? 'activation_plans' : 'source_plans';
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const statement = this.#database.prepare(`UPDATE ${table} SET status = 'approved', revision = revision + 1, approval_json = ?,
           ${kind === 'activation' ? 'approval_receipt_json = ?,' : ''} updated_at = ?
@@ -3433,11 +3716,11 @@ export class ControlPlaneStore {
                 const output = kind === 'activation' ? this.getPlan(plan.id) : this.getSourcePlan(plan.id);
                 const receipt = { idempotencyKey: input.idempotencyKey, operation: 'approve-plan', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(receipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return receipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -3448,7 +3731,7 @@ export class ControlPlaneStore {
         if (input.leaseMs < 5_000 || input.leaseMs > 300_000)
             throw new ControlPlaneStoreError('invalid-input', 'leaseMs is invalid');
         this.assertOwnerActivationSource(input.planId);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
             if (row === undefined)
@@ -3493,12 +3776,12 @@ export class ControlPlaneStore {
                 if (Number(result.changes) !== 1)
                     throw new ControlPlaneStoreError('conflict', 'activation plan changed while being claimed');
                 const claimed = this.getPlan(plan.id);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return claimed;
             });
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3516,7 +3799,7 @@ export class ControlPlaneStore {
     recordActivationTargetBaseline(input) {
         return this.#withActivationSource(input.planId, () => {
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.assertOwnerActivationSource(input.planId);
                 const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
@@ -3540,11 +3823,11 @@ export class ControlPlaneStore {
             WHERE id = ? AND revision = ? AND activation_fence = ? AND activation_target_existed IS NULL AND activation_target_baseline_json IS NULL`).run(input.existed ? 1 : 0, baseline, now, plan.id, plan.revision, input.fence);
                 }
                 const result = this.getPlan(plan.id);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return result;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -3558,7 +3841,7 @@ export class ControlPlaneStore {
     recordActivationInstalledBaseline(input) {
         return this.#withActivationSource(input.planId, () => {
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.assertOwnerActivationSource(input.planId);
                 const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
@@ -3599,11 +3882,11 @@ export class ControlPlaneStore {
             successful_order, recorded_at, succeeded_at) VALUES (?, ?, ?, NULL, ?, NULL)`).run(plan.id, baseline, sequence.next_exposure_order, now);
                 }
                 const output = this.getPlan(plan.id);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return output;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -3626,7 +3909,7 @@ export class ControlPlaneStore {
     /** Move a signed closed deployment watch into the existing physical rollback lifecycle. */
     beginPostActivationRollback(input) {
         const now = this.#now();
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const row = this.#database.prepare('SELECT * FROM activation_plans WHERE id = ?').get(input.planId);
             if (row === undefined)
@@ -3637,7 +3920,7 @@ export class ControlPlaneStore {
             // A restart or retry must retain the original rollback identity and never
             // manufacture another rollback from a now-closed watch.
             if ((plan.status === 'rollback-pending' || plan.status === 'rolled-back') && this.#hasPostActivationRollbackProvenance(plan)) {
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return plan;
             }
             if (plan.status !== 'activated' || plan.activation === undefined) {
@@ -3675,11 +3958,11 @@ export class ControlPlaneStore {
             if (Number(updated.changes) !== 1)
                 throw new ControlPlaneStoreError('conflict', 'post-activation rollback lost its activation CAS');
             const output = this.getPlan(plan.id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return output;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3800,7 +4083,7 @@ export class ControlPlaneStore {
     async withActivationFileSystemGuard(input, action) {
         positiveInteger(input.leaseMs, 'leaseMs');
         try {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
         }
         catch {
             throw new ControlPlaneStoreError('conflict', 'activation filesystem mutex is held');
@@ -3825,30 +4108,30 @@ export class ControlPlaneStore {
                 assertOwner(false);
                 const finished = this.#now();
                 this.#database.prepare('UPDATE activation_plans SET activation_lease_until = ?, updated_at = ? WHERE id = ?').run(finished + input.leaseMs, finished, input.planId);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return result;
             });
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
     /** Serialize lock-file lifecycle operations even after a plan became terminal. */
     async withExclusiveWrite(action) {
         try {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
         }
         catch {
             throw new ControlPlaneStoreError('conflict', 'control-plane mutex is held');
         }
         try {
             const result = await action();
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return result;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -3987,7 +4270,7 @@ export class ControlPlaneStore {
       ORDER BY epoch.created_at,epoch.operation_id LIMIT 100`).all(coordinatorId, this.#now()).map(runtimeEpochFromRow);
     }
     claimRuntimeEpoch(operationId, coordinatorId) {
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const record = this.getRuntimeEpoch(operationId);
             if (!['pending', 'claimed'].includes(record.status) || this.#now() >= record.request.requestedAt + record.request.receiptTtlMs) {
@@ -3998,17 +4281,17 @@ export class ControlPlaneStore {
             if (context.handoff.coordinatorId !== coordinatorId || (this.#adoptionCoordinatorId !== undefined && this.#adoptionCoordinatorId !== coordinatorId)) {
                 throw new ControlPlaneStoreError('conflict', 'runtime epoch coordinator changed');
             }
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return { ...record, status: 'claimed' };
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
     applyRuntimeEpoch(receiptInput, trust) {
         const receipt = parseRuntimeEpochReceipt(receiptInput);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const context = readOwnerRuntimeEpochContext(this.#database, receipt.operationId);
             if (this.#now() >= context.request.requestedAt + context.request.receiptTtlMs)
@@ -4022,18 +4305,18 @@ export class ControlPlaneStore {
             this.#database.prepare("UPDATE deployment_runtime_epochs SET status='applied',receipt_json=? WHERE operation_id=? AND status='claimed'")
                 .run(JSON.stringify(receipt), receipt.operationId);
             const result = this.getRuntimeEpoch(receipt.operationId);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return result;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
     prepareHostAttestationOperation(input) {
         return this.#withActivationSource(input.planId, () => {
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.assertOwnerActivationSource(input.planId);
                 const plan = this.getPlan(input.planId);
@@ -4085,18 +4368,18 @@ export class ControlPlaneStore {
                     }
                     if (prior.bindingDigest !== bindingDigest)
                         throw new ControlPlaneStoreError('conflict', 'durable Host operation payload changed for the same phase');
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return prior;
                 }
                 this.#database.prepare(`INSERT INTO host_attestation_operations (plan_id, phase, operation_id, binding_digest,
           request_digest, request_json, status, receipt_digest, receipt_json, created_at, completed_at, applied_at)
           VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, NULL, ?, NULL, NULL)`).run(plan.id, expected.phase, operationId, bindingDigest, controlPlaneDigest(request), JSON.stringify(request), now);
                 const operation = this.getHostAttestationOperation(operationId);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operation;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -4143,7 +4426,7 @@ export class ControlPlaneStore {
         if (operation.phase === 'rollback' && input.receipt.outcome !== 'passed')
             throw new ControlPlaneStoreError('conflict', 'failed physical rollback receipt cannot settle recovery');
         const commit = () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 if (input.requireCurrentSource)
                     this.assertOwnerActivationSource(plan.id);
@@ -4157,7 +4440,7 @@ export class ControlPlaneStore {
                     if (controlPlaneDigest(currentOperation.receipt) !== controlPlaneDigest(input.receipt)) {
                         throw new ControlPlaneStoreError('conflict', 'Host attestation receipt changed after completion');
                     }
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return currentOperation.receipt;
                 }
                 const dispatch = this.getHostAttestationDispatchStatus(operation.operationId);
@@ -4172,11 +4455,11 @@ export class ControlPlaneStore {
                     if (Number(completed.changes) !== 1)
                         throw new ControlPlaneStoreError('conflict', 'Host attestation dispatch completion lost its claim');
                 }
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return input.receipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         };
@@ -4228,7 +4511,7 @@ export class ControlPlaneStore {
     }
     putLiveQualification(batch) {
         assertLiveQualificationBatch(batch);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const plan = this.getPlan(batch.planId);
             if (plan.status !== 'awaiting-live-tasks' || this.#now() >= batch.deadlineAt || this.#now() >= batch.expiresAt)
@@ -4242,10 +4525,10 @@ export class ControlPlaneStore {
                 this.#database.prepare(`INSERT INTO live_qualification_batches
         (id,lane,plan_id,batch_json,batch_digest,state,created_at) VALUES (?,?,?,?,?,'pending',?)`).run(batch.id, batch.lane, batch.planId, JSON.stringify(batch), controlPlaneDigest(batch), this.#now());
             readLiveQualificationContext(this.#database, batch.id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -4258,13 +4541,13 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('not-found', 'live qualification batch absent');
         const receipt = verifyLiveQualificationReceipt(input.receipt, record.batch, input.publicKeyPem, this.#now());
         return input.withSourceFence(() => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getLiveQualification(record.batch.id);
                 if (current.state === 'applied') {
                     if (controlPlaneDigest(current.receipt) !== controlPlaneDigest(receipt))
                         throw new ControlPlaneStoreError('conflict', 'qualification receipt changed');
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return this.getPlan(record.batch.planId);
                 }
                 this.assertCurrentLiveQualification(record.batch.id);
@@ -4277,11 +4560,11 @@ export class ControlPlaneStore {
                     throw new ControlPlaneStoreError('conflict', 'qualification lost plan CAS');
                 this.#database.prepare("UPDATE live_qualification_batches SET state='applied',receipt_json=?,receipt_digest=? WHERE id=? AND state IN ('pending','signed')")
                     .run(JSON.stringify(receipt), controlPlaneDigest(receipt), record.batch.id);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return this.getPlan(plan.id);
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -4289,7 +4572,7 @@ export class ControlPlaneStore {
     /** Negative-only Host seam. The signed terms permit conservative removal of unconfirmable qualification. */
     invalidateLiveQualification(input) {
         const reason = bounded(input.reason, 'qualification invalidation reason', 160);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const plan = this.getPlan(input.planId), record = this.getLiveQualification(input.batchId);
             if (!record || record.batch.planId !== plan.id || record.state !== 'applied' || record.receipt?.disposition !== 'qualified'
@@ -4297,7 +4580,7 @@ export class ControlPlaneStore {
                 throw new ControlPlaneStoreError('conflict', 'qualification invalidation lacks exact accepted evidence');
             }
             if (plan.status === 'rollback-pending' || plan.status === 'rolled-back') {
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return plan;
             }
             if (!['commit-pending', 'activated'].includes(plan.status) || record.batch.fence !== plan.activation.fence)
@@ -4321,11 +4604,11 @@ export class ControlPlaneStore {
             this.#database.prepare(`UPDATE activation_plans SET status='rollback-pending',revision=revision+1,
         activation_lease_until=NULL,rollback_profile_restored=0,failure_code='live-qualification-invalidated',updated_at=?
         WHERE id=? AND revision=? AND activation_fence=?`).run(now, plan.id, plan.revision, plan.activation.fence);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return this.getPlan(plan.id);
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -4343,7 +4626,7 @@ export class ControlPlaneStore {
     /** Same synchronous transaction owns current-profile selection and capture. */
     withForegroundDeployment(task, profilePath, callback) {
         assertForegroundTask(task);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const active = this.#database.prepare(`SELECT id FROM activation_plans WHERE target_path = ? AND status IN (
         'staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow',
@@ -4387,11 +4670,11 @@ export class ControlPlaneStore {
             const result = callback(plan, hostOperationFromRow(row));
             if (result && (typeof result === 'object' || typeof result === 'function') && 'then' in result)
                 throw new ControlPlaneStoreError('invalid-input', 'foreground capture must be synchronous');
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return result;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
         finally {
@@ -4458,7 +4741,7 @@ export class ControlPlaneStore {
     }
     putTaskObservation(batch) {
         assertTaskObservationBatch(batch);
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             if (batch.createdAt > this.#now() || batch.expiresAt <= this.#now())
                 throw new ControlPlaneStoreError('expired', 'task observation is outside its validity interval');
@@ -4466,22 +4749,39 @@ export class ControlPlaneStore {
             if (prior) {
                 if (prior.batch.digest !== batch.digest)
                     throw new ControlPlaneStoreError('conflict', 'task observation identity reused');
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return prior;
             }
             const encoded = JSON.stringify(batch);
             this.#database.prepare('INSERT INTO task_observation_batches (id,lane,plan_id,batch_json,batch_digest,state,created_at) VALUES (?,?,?,?,?,?,?)').run(batch.id, batch.lane, batch.planId, encoded, controlPlaneDigest(batch), 'pending', batch.createdAt);
             readTaskObservationContext(this.#database, batch.id);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return Object.freeze({ batch, state: 'pending' });
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
     getTaskObservation(id) { return getTaskObservationRecord(this.#database, id); }
     assertCurrentTaskObservation(id) { readTaskObservationContext(this.#database, id); }
+    /** Seal one observational trend result into the append-only snapshot ledger; same trend, same row. */
+    sealCreatedCapabilityTrendSnapshot(trend) {
+        const snapshot = createCreationCapabilityTrendSnapshot(trend);
+        this.#beginMutation();
+        try {
+            const result = sealCreationCapabilityTrendSnapshot(this.#database, snapshot, this.#now());
+            this.#commitMutation();
+            return result;
+        }
+        catch (error) {
+            this.#rollbackMutation();
+            throw error;
+        }
+    }
+    listCreatedCapabilityTrendSnapshots(query = {}) {
+        return listCreationCapabilityTrendSnapshots(this.#database, query);
+    }
     listTaskObservations(lane, limit = 100) {
         if (!KEY.test(lane) || !Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             throw new ControlPlaneStoreError('invalid-input', 'task observation list is invalid');
@@ -4640,7 +4940,7 @@ export class ControlPlaneStore {
         const claim = () => {
             const candidate = this.getHostAttestationOperation(input.operationId);
             return this.#withActivationSource(candidate.planId, () => {
-                this.#database.exec('BEGIN IMMEDIATE');
+                this.#beginMutation();
                 try {
                     this.assertOwnerActivationSource(candidate.planId);
                     const operation = this.getHostAttestationOperation(input.operationId), plan = this.getPlan(operation.planId), expected = expectedAttestation[plan.status];
@@ -4648,17 +4948,17 @@ export class ControlPlaneStore {
                         throw new ControlPlaneStoreError('conflict', 'Host attestation operation lost its plan revision/fence/phase');
                     const request = this.#assertHostAttestationChain(operation, plan);
                     if (operation.receipt) {
-                        this.#database.exec('COMMIT');
+                        this.#commitMutation();
                         return { operation, plan, request };
                     }
                     if (this.getHostAttestationDispatchStatus(operation.operationId) !== undefined)
                         throw new ControlPlaneStoreError('conflict', 'Host attestation outcome is unknown; receipt reconciliation is required');
                     this.#database.prepare("INSERT INTO host_attestation_dispatches (operation_id,status,claimed_at,completed_at) VALUES (?,'claimed',?,NULL)").run(operation.operationId, this.#now());
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return { operation, plan, request };
                 }
                 catch (error) {
-                    this.#database.exec('ROLLBACK');
+                    this.#rollbackMutation();
                     throw error;
                 }
             });
@@ -4725,7 +5025,7 @@ export class ControlPlaneStore {
                     this.#assertAdoptionHandoff(input.planId);
             }
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.#withActivationSource(input.planId, () => { }, input.to === 'rollback-pending' || input.to === 'rolled-back');
                 const result = this.#database.prepare(`UPDATE activation_plans SET status = ?, revision = revision + 1,
@@ -4744,11 +5044,11 @@ export class ControlPlaneStore {
                         this.#database.prepare(`UPDATE capability_gaps SET status = 'closed', revision = revision + 1, updated_at = ? WHERE id = ?`).run(now, plan.gapId);
                     this.#finishActivation(plan, input.fence, now);
                 }
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return plan;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         }, input.to === 'rollback-pending' || input.to === 'rolled-back');
@@ -4791,7 +5091,7 @@ export class ControlPlaneStore {
         const now = this.#now();
         const nextStatus = verified.outcome === 'passed' ? (verified.phase === 'readiness' && plan.dossier.liveQualification ? 'awaiting-live-tasks' : expected.next) : 'rollback-pending';
         return this.#withActivationSource(input.planId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 this.#withActivationSource(input.planId, () => { }, recovery);
                 const lockedOperation = this.getHostAttestationOperation(input.receipt.operationId);
@@ -4822,11 +5122,11 @@ export class ControlPlaneStore {
                     this.#finishActivation(output, input.expectedFence, now);
                 const operationReceipt = { idempotencyKey: input.idempotencyKey, operation: 'host-attestation', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(operationReceipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operationReceipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         }, recovery);
@@ -4884,7 +5184,7 @@ export class ControlPlaneStore {
             }
         }
         const commit = () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 if (input.taskObservationId !== undefined) {
                     const context = readTaskObservationContext(this.#database, input.taskObservationId);
@@ -4922,11 +5222,11 @@ export class ControlPlaneStore {
                 }
                 const operationReceipt = { idempotencyKey: key, operation: 'post-activation-observation', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(operationReceipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operationReceipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         };
@@ -4953,7 +5253,7 @@ export class ControlPlaneStore {
         }
         const verified = await input.resolveAuthority(input.receipt).verify(input.receipt, plan, watch.exact);
         const now = this.#now();
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const current = this.#database.prepare('SELECT * FROM activation_watch WHERE plan_id = ?').get(plan.id);
             if (current.state === 'closed-retracted')
@@ -4970,11 +5270,11 @@ export class ControlPlaneStore {
             const output = this.getActivationWatch(plan.id);
             const operationReceipt = { idempotencyKey: key, operation: 'activation-retraction', inputDigest, result: output, createdAt: now };
             this.#insertReceipt(operationReceipt);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return operationReceipt;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -5060,7 +5360,7 @@ export class ControlPlaneStore {
         if (!input.succeeded && (input.checkedTreeDigest !== undefined || input.checkedPatchDigest !== undefined)) {
             throw new ControlPlaneStoreError('invalid-input', 'failed source checks cannot carry successful check evidence');
         }
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const result = this.#database.prepare(`UPDATE source_plans SET status = ?, revision = revision + 1,
         checked_tree_digest = ?, checked_patch_digest = ?, checked_at = ?, updated_at = ?
@@ -5074,11 +5374,11 @@ export class ControlPlaneStore {
             }
             const digest = controlPlaneDigest({ planId: output.id, planDigest: output.digest, status, sourceCheck: output.sourceCheck });
             this.#insertReceipt({ idempotencyKey: `source-checks:${output.id}`, operation: 'source-local-checks', inputDigest: digest, result: output, createdAt: now });
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return output;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -5111,7 +5411,7 @@ export class ControlPlaneStore {
         }
         const commit = () => {
             this.#assertOwnerTaskFailureGapAdmission(plan.gapId);
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const result = this.#database.prepare(`UPDATE source_plans SET status = 'ready-for-human-review', revision = revision + 1, updated_at = ?
           WHERE id = ? AND revision = ? AND status = 'approved' AND mode = 'modify'
@@ -5124,11 +5424,11 @@ export class ControlPlaneStore {
                 const receipt = { idempotencyKey: `source-verify-prepared:${output.id}:${output.revision}`,
                     operation: 'source-verify-prepared', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(receipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return receipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         };
@@ -5188,7 +5488,7 @@ export class ControlPlaneStore {
             lineageDigest = controlPlaneDigest({ history: prehistory, maintenance: premaintenance, trust: input.trust, baseline: prebaseline });
         }
         return withCurrentSource(plan.gapId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const linkedRows = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ? LIMIT 2')
                     .all(plan.id);
@@ -5243,11 +5543,11 @@ export class ControlPlaneStore {
                 const output = this.getSourcePlan(plan.id);
                 const operationReceipt = { idempotencyKey: key, operation: 'start-source-release', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(operationReceipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operationReceipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -5271,7 +5571,7 @@ export class ControlPlaneStore {
         await reverifySourceReleaseAuthorization(plan.releaseAuthorization, plan, input.resolveAuthorizationAuthority);
         return withCurrentSource(plan.gapId, () => {
             const now = this.#now();
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getSourcePlan(plan.id);
                 const currentExpected = expectedSourceRelease(current.status);
@@ -5291,7 +5591,7 @@ export class ControlPlaneStore {
                     if (prior.bindingDigest !== controlPlaneDigest(releaseRequestBinding(expectedRequest))) {
                         throw new ControlPlaneStoreError('conflict', 'durable release operation payload changed for the same phase/fence');
                     }
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return prior;
                 }
                 const operationId = `release-operation-${randomUUID()}`;
@@ -5301,11 +5601,11 @@ export class ControlPlaneStore {
           operation_id, binding_digest, request_digest, request_json, status, receipt_digest, receipt_json, created_at, completed_at, applied_at)
           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', NULL, NULL, ?, NULL, NULL)`).run(current.id, expected.phase, current.release.id, current.release.fence, attempt, operationId, bindingDigest, controlPlaneDigest(request), JSON.stringify(request), now);
                 const operation = this.getSourceReleaseOperation(operationId);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operation;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -5370,13 +5670,13 @@ export class ControlPlaneStore {
         withCurrentSource(plan.gapId, () => { });
         await reverifySourceReleaseAuthorization(operation.request.authorization, plan, input.resolveAuthorizationAuthority);
         const claimed = withCurrentSource(plan.gapId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getSourcePlan(plan.id);
                 const currentOperation = this.getSourceReleaseOperation(operation.operationId);
                 assertCurrent(current, currentOperation);
                 if (currentOperation.receipt !== undefined) {
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return false;
                 }
                 const dispatch = this.#database.prepare('SELECT * FROM source_release_dispatches WHERE operation_id = ?').get(operation.operationId);
@@ -5386,11 +5686,11 @@ export class ControlPlaneStore {
                 }
                 this.#database.prepare(`INSERT INTO source_release_dispatches (operation_id, status, claimed_at, completed_at)
           VALUES (?, 'claimed', ?, NULL)`).run(operation.operationId, this.#now());
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return true;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -5399,7 +5699,7 @@ export class ControlPlaneStore {
         const receipt = await input.execute(operation.request);
         await input.resolveAuthority(receipt).verify(receipt, plan, operation.request);
         return withCurrentSource(plan.gapId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getSourcePlan(plan.id);
                 const currentOperation = this.getSourceReleaseOperation(operation.operationId);
@@ -5417,11 +5717,11 @@ export class ControlPlaneStore {
           WHERE operation_id = ? AND status = 'claimed'`).run(now, operation.operationId);
                 if (Number(completed.changes) !== 1)
                     throw new ControlPlaneStoreError('conflict', 'source release completion lost its dispatch claim');
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return receipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -5455,14 +5755,14 @@ export class ControlPlaneStore {
         await reverifySourceReleaseAuthorization(operation.request.authorization, plan, input.resolveAuthorizationAuthority);
         await input.resolveAuthority(input.receipt).verify(input.receipt, plan, operation.request);
         return withCurrentSource(plan.gapId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getSourcePlan(plan.id), currentOperation = this.getSourceReleaseOperation(operation.operationId);
                 assertCurrent(current, currentOperation);
                 if (currentOperation.receipt !== undefined) {
                     if (controlPlaneDigest(currentOperation.receipt) !== controlPlaneDigest(input.receipt))
                         throw new ControlPlaneStoreError('conflict', 'source release receipt differs from completed operation');
-                    this.#database.exec('COMMIT');
+                    this.#commitMutation();
                     return currentOperation.receipt;
                 }
                 const dispatch = this.#database.prepare('SELECT * FROM source_release_dispatches WHERE operation_id = ?').get(operation.operationId);
@@ -5479,11 +5779,11 @@ export class ControlPlaneStore {
                     if (Number(completed.changes) !== 1)
                         throw new ControlPlaneStoreError('conflict', 'source release receipt lost its dispatch claim');
                 }
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return input.receipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
@@ -5549,7 +5849,7 @@ export class ControlPlaneStore {
         }
         const now = this.#now();
         return withCurrentSource(plan.gapId, () => {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
             try {
                 const current = this.getSourcePlan(plan.id);
                 const currentExpected = expectedSourceRelease(current.status);
@@ -5589,18 +5889,18 @@ export class ControlPlaneStore {
                 }
                 const operationReceipt = { idempotencyKey: key, operation: 'source-release', inputDigest, result: output, createdAt: now };
                 this.#insertReceipt(operationReceipt);
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operationReceipt;
             }
             catch (error) {
-                this.#database.exec('ROLLBACK');
+                this.#rollbackMutation();
                 throw error;
             }
         });
     }
     async prepareSourcePublishReconciliation(input) {
         const now = this.#now();
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             const plan = this.getSourcePlan(input.planId);
             if (plan.status !== 'publish-ambiguous' || plan.revision !== input.expectedRevision || plan.release?.fence !== input.expectedFence) {
@@ -5643,18 +5943,18 @@ export class ControlPlaneStore {
                 const prior = sourcePublishReconciliationFromRow(priorRow);
                 if (prior.bindingDigest !== bindingDigest)
                     throw new ControlPlaneStoreError('conflict', 'durable publish reconciliation payload changed');
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return prior;
             }
             this.#database.prepare(`INSERT INTO source_publish_reconciliations (plan_id, release_id, release_fence, attempt, operation_id,
         binding_digest, request_digest, request_json, status, receipt_digest, receipt_json, created_at, completed_at, applied_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', NULL, NULL, ?, NULL, NULL)`).run(plan.id, plan.release.id, plan.release.fence, attempt, operationId, bindingDigest, controlPlaneDigest(parsed), JSON.stringify(parsed), now);
             const operation = this.getSourcePublishReconciliationOperation(operationId);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return operation;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -5666,7 +5966,7 @@ export class ControlPlaneStore {
     }
     async runSourcePublishReconciliation(input) {
         try {
-            this.#database.exec('BEGIN IMMEDIATE');
+            this.#beginMutation();
         }
         catch {
             throw new ControlPlaneStoreError('conflict', 'publish reconciliation single-flight is held');
@@ -5678,7 +5978,7 @@ export class ControlPlaneStore {
                 || operation.fence !== input.expectedFence)
                 throw new ControlPlaneStoreError('conflict', 'publish reconciliation lost its revision/fence');
             if (operation.receipt !== undefined) {
-                this.#database.exec('COMMIT');
+                this.#commitMutation();
                 return operation.receipt;
             }
             await reverifySourceReleaseAuthorization(operation.request.authorization, plan, input.resolveAuthorizationAuthority);
@@ -5689,11 +5989,11 @@ export class ControlPlaneStore {
         receipt_digest = ?, receipt_json = ?, completed_at = ? WHERE operation_id = ? AND status = 'pending' AND request_digest = ?`).run(controlPlaneDigest(receipt), JSON.stringify(receipt), now, operation.operationId, operation.requestDigest);
             if (Number(result.changes) !== 1)
                 throw new ControlPlaneStoreError('conflict', 'publish reconciliation completion lost single-flight');
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return receipt;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }
@@ -5726,7 +6026,7 @@ export class ControlPlaneStore {
         const verified = await input.resolveAuthority(input.receipt).verify(input.receipt, plan, operation.request);
         const outcome = verified.evidence.outcome;
         const now = this.#now();
-        this.#database.exec('BEGIN IMMEDIATE');
+        this.#beginMutation();
         try {
             let nextStatus = 'publish-ambiguous';
             let nextFence = input.expectedFence;
@@ -5759,11 +6059,11 @@ export class ControlPlaneStore {
             const output = this.getSourcePlan(plan.id);
             const operationReceipt = { idempotencyKey: input.idempotencyKey, operation: 'reconcile-source-publish', inputDigest, result: output, createdAt: now };
             this.#insertReceipt(operationReceipt);
-            this.#database.exec('COMMIT');
+            this.#commitMutation();
             return operationReceipt;
         }
         catch (error) {
-            this.#database.exec('ROLLBACK');
+            this.#rollbackMutation();
             throw error;
         }
     }