@dsh-enhanced/plugin-control-plane 0.1.66 → 0.1.68

package/lib/store.js

@@ -9,13 +9,13 @@ import { discover, parseCatalog } from './catalog.js';
 import { parseApprovalReceipt } from './approval.js';
 import { parseSourcePublishReconciliationReceipt, parseSourcePublishReconciliationRequest, parseSourceReleaseAuthorization, parseSourceReleaseReceipt, parseSourceReleaseRequest, parseVerifiedSourceReleaseAuthorization } from './release.js';
 import { controlPlaneOperationReceiptDigest, controlPlaneSchemaVersion, openControlPlaneDatabase, openControlPlaneDatabaseReadOnly } from './sqlite.js';
-import { validateSourceBuildConfig } from './source-build.js';
+import { isLegacyDockerSourceBuildConfig, validateLegacyDockerSourceBuildConfig, validateSourceBuildConfig } from './source-build.js';
 import { validateSourceBaselineConfig, verifySourceBaselineHistory } from './source-baseline.js';
 import { validateScopedPluginFiles } from './source-workspace.js';
 import { validateCreationCapabilitySource } from './creation-capability-source.js';
 import { validateSourceRevisionBinding } from './source-revision.js';
 import { validateSourceCreationFiles, validateSourceCreationGrant, normalizeSourceCreationGrant } from './source-creation.js';
-import { anySourceGrowthRunDigest as sourceGrowthRunDigest, isSourceOwnerContinuation, validateAnySourceGrowthRunBinding, validatePluginRevisionRegressionCertificate, validatePluginRevisionVerificationCertificate, validatePluginCreationVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
+import { anySourceGrowthRunDigest as sourceGrowthRunDigest, growthObjectDigest, isSourceOwnerContinuation, isPluginRevisionTaskSource, validateAnySourceGrowthRunBinding, validatePluginRevisionRegressionCertificate, validatePluginRevisionVerificationCertificate, validatePluginCreationVerificationCertificate, validateRevisionAcceptanceAuthorityRef } from '@dsh-enhanced/assistant-growth-contract';
 import { validateAdoptionHandoffTerms } from './adoption-handoff.js';
 import { assertForegroundDeployment, assertForegroundTask } from './foreground-deployment.js';
 import { assertTaskObservationBatch, getTaskObservationRecord, readTaskObservationContext } from './task-observation-store.js';
@@ -125,6 +125,102 @@ function canonical(value) {
 export function controlPlaneDigest(value) {
     return createHash('sha256').update(canonical(value)).digest('hex');
 }
+const OWNER_INSTRUCTION_REVIEW_FREEZE_PROTOCOL = 'plugin-control-plane/owner-instruction-review-freeze/v1';
+const OWNER_INSTRUCTION_REVIEW_BUDGET_PROTOCOL = 'plugin-control-plane/owner-instruction-review-budget/v1';
+const REVIEW_SUPPLIER_BYTES = 512;
+const REVIEW_WINDOW_MAX_MS = 86_400_000;
+function reviewPlainRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype
+        || Object.getOwnPropertySymbols(value).length !== 0) {
+        throw new ControlPlaneStoreError('invalid-input', label + ' is invalid');
+    }
+    const record = value;
+    const own = Object.keys(record);
+    if (own.length !== keys.length || !keys.every(key => Object.hasOwn(record, key))) {
+        throw new ControlPlaneStoreError('invalid-input', label + ' is invalid');
+    }
+    return record;
+}
+function reviewSupplierText(value, label) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > REVIEW_SUPPLIER_BYTES
+        || Buffer.byteLength(value, 'utf8') > REVIEW_SUPPLIER_BYTES || value.trim() !== value || /\p{Cc}/u.test(value)) {
+        throw new ControlPlaneStoreError('invalid-input', label + ' is invalid');
+    }
+    return value;
+}
+function reviewSupplierOf(value) {
+    const hasEffort = value !== null && typeof value === 'object' && !Array.isArray(value) && Object.hasOwn(value, 'reasoningEffort');
+    const item = reviewPlainRecord(value, hasEffort ? ['provider', 'model', 'reasoningEffort'] : ['provider', 'model'], 'review supplier');
+    return Object.freeze({
+        provider: reviewSupplierText(item['provider'], 'review supplier provider'),
+        model: reviewSupplierText(item['model'], 'review supplier model'),
+        ...(item['reasoningEffort'] === undefined ? {} : { reasoningEffort: reviewSupplierText(item['reasoningEffort'], 'review supplier reasoning effort') }),
+    });
+}
+export function validateOwnerInstructionReviewWindow(value) {
+    const item = reviewPlainRecord(value, ['verificationMs', 'regressionMs', 'adoptionMs'], 'owner instruction review window');
+    const window = { verificationMs: item['verificationMs'], regressionMs: item['regressionMs'], adoptionMs: item['adoptionMs'] };
+    for (const [key, item] of Object.entries(window)) {
+        if (!Number.isSafeInteger(item) || item < 0 || item > REVIEW_WINDOW_MAX_MS) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction review window ' + key + ' is invalid');
+        }
+    }
+    return Object.freeze(window);
+}
+function reviewBudgetOf(value) {
+    const item = reviewPlainRecord(value, ['protocol', 'authority', 'verifierKeyDigest', 'window'], 'owner instruction review budget');
+    if (item['protocol'] !== OWNER_INSTRUCTION_REVIEW_BUDGET_PROTOCOL || typeof item['verifierKeyDigest'] !== 'string'
+        || !/^[a-f0-9]{64}$/u.test(item['verifierKeyDigest'])) {
+        throw new ControlPlaneStoreError('invalid-input', 'owner instruction review budget is invalid');
+    }
+    const authority = structuredClone(item['authority']);
+    try {
+        validateRevisionAcceptanceAuthorityRef(authority);
+    }
+    catch {
+        throw new ControlPlaneStoreError('invalid-input', 'owner instruction review authority is invalid');
+    }
+    return Object.freeze({ protocol: OWNER_INSTRUCTION_REVIEW_BUDGET_PROTOCOL, authority: Object.freeze(authority),
+        verifierKeyDigest: item['verifierKeyDigest'], window: validateOwnerInstructionReviewWindow(item['window']) });
+}
+function ownerInstructionReviewFreezePayload(supplier, budget) {
+    return { protocol: OWNER_INSTRUCTION_REVIEW_FREEZE_PROTOCOL,
+        supplier: Object.freeze({ ...supplier }), budget };
+}
+/** Validates one stored freeze, including its self-digest. */
+export function validateOwnerInstructionReviewFreeze(value) {
+    const item = reviewPlainRecord(value, ['protocol', 'supplier', 'budget', 'digest'], 'owner instruction review freeze');
+    if (item['protocol'] !== OWNER_INSTRUCTION_REVIEW_FREEZE_PROTOCOL || typeof item['digest'] !== 'string'
+        || !/^[a-f0-9]{64}$/u.test(item['digest'])) {
+        throw new ControlPlaneStoreError('invalid-input', 'owner instruction review freeze is invalid');
+    }
+    const supplier = reviewSupplierOf(item['supplier']);
+    const budget = reviewBudgetOf(item['budget']);
+    if (controlPlaneDigest(ownerInstructionReviewFreezePayload(supplier, budget)) !== item['digest']) {
+        throw new ControlPlaneStoreError('invalid-input', 'owner instruction review freeze digest differs');
+    }
+}
+/** Builds the immutable review freeze written with a new owner instruction. */
+export function createOwnerInstructionReviewFreeze(input) {
+    if (!input || typeof input !== 'object')
+        throw new ControlPlaneStoreError('invalid-input', 'owner instruction review freeze is invalid');
+    const supplier = reviewSupplierOf(input.supplier);
+    const budget = reviewBudgetOf(input.budget);
+    const unsigned = ownerInstructionReviewFreezePayload(supplier, budget);
+    const freeze = Object.freeze({ ...unsigned, digest: controlPlaneDigest(unsigned) });
+    validateOwnerInstructionReviewFreeze(freeze);
+    return freeze;
+}
+/** True only when a stored freeze is structurally valid and self-consistent. */
+export function ownerInstructionReviewFreezeMatches(value) {
+    try {
+        validateOwnerInstructionReviewFreeze(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Structural validation precedes this exact prepared-build binding check. */
 function creationVerificationMatchesPreparedEvidence(certificate, evidence) {
     if (certificate.protocol === 'assistant-growth/creation-verification/v1') {
@@ -145,6 +241,10 @@ function creationVerificationMatchesPreparedEvidence(certificate, evidence) {
 }
 /** Legacy revision v1 has no execution claim; Linux requires its own signed build provenance. */
 function revisionVerificationMatchesPreparedEvidence(certificate, evidence) {
+    // v3 binds review evidence through the signed plan and instruction. It
+    // carries no native execution provenance and cannot authorize adoption.
+    if (certificate.protocol === 'assistant-growth/revision-verification/v3')
+        return !Object.hasOwn(certificate, 'execution');
     if (certificate.protocol === 'assistant-growth/revision-verification/v1') {
         return evidence.schemaVersion !== 3 && !Object.hasOwn(certificate, 'execution');
     }
@@ -241,9 +341,9 @@ function creationBindingFromStored(value) {
     return Object.freeze({ grant: Object.freeze(normalizeSourceCreationGrant(binding['grant'])), generatorDigest: binding['generatorDigest'],
         ...(growthRun === undefined ? {} : { growthRun: Object.freeze(growthRun) }) });
 }
-function revisionBindingFromStored(value) {
+function revisionBindingFromStored(value, options) {
     try {
-        validateSourceRevisionBinding(value);
+        validateSourceRevisionBinding(value, options);
     }
     catch {
         throw new ControlPlaneStoreError('invalid-input', 'source revision binding is invalid');
@@ -828,7 +928,7 @@ function preparedArtifactBytesFromRow(row, pack) {
     }
     return bytes;
 }
-function sourceFromRow(row) {
+function sourceFromRow(row, allowWithoutGrowthRun = false) {
     if (row.mode !== 'create' && row.mode !== 'modify' && row.mode !== 'prepared-create' && row.mode !== 'prepared-revise') {
         throw new ControlPlaneStoreError('invalid-state', 'stored source plan has an unknown mode');
     }
@@ -861,7 +961,7 @@ function sourceFromRow(row) {
             throw new ControlPlaneStoreError('invalid-state', 'stored source creation binding is corrupt');
         }
     }
-    const revision = row.revision_json === null ? undefined : revisionBindingFromStored(JSON.parse(row.revision_json));
+    const revision = row.revision_json === null ? undefined : revisionBindingFromStored(JSON.parse(row.revision_json), { allowWithoutGrowthRun });
     const prepared = row.mode === 'modify' || row.mode === 'prepared-create' || row.mode === 'prepared-revise';
     if (prepared !== (preparedEvidence !== undefined) || (row.mode === 'modify' && preparedEvidence?.schemaVersion === 2)
         || (row.mode === 'prepared-create') !== (creation !== undefined) || (row.mode === 'prepared-revise') !== (revision !== undefined)
@@ -929,7 +1029,7 @@ function sourceFromRow(row) {
                 ...(row.release_failure_phase === null ? {} : { failurePhase: row.release_failure_phase }),
                 ...(row.release_failure_code === null ? {} : { failureCode: row.release_failure_code }), updatedAt: row.updated_at } }) };
 }
-function sourceSnapshotFromStored(value) {
+function sourceSnapshotFromStored(value, allowWithoutGrowthRun = false) {
     const item = objectRecord(value, 'stored source plan snapshot');
     // `mode` was introduced in schema v13; receipt rows written by older binaries
     // omit it and are backfilled to 'create'. `preparedEvidence` exists only on
@@ -967,7 +1067,7 @@ function sourceSnapshotFromStored(value) {
         generatorDigest: item['generatorDigest'], scope: item['scope'], createdAt: item['createdAt'], expiresAt: item['expiresAt'] };
     const preparedEvidence = item['preparedEvidence'] === undefined ? undefined : preparedEvidenceFromStored(item['preparedEvidence']);
     const creation = item['creation'] === undefined ? undefined : creationBindingFromStored(item['creation']);
-    const revision = item['sourceRevision'] === undefined ? undefined : revisionBindingFromStored(item['sourceRevision']);
+    const revision = item['sourceRevision'] === undefined ? undefined : revisionBindingFromStored(item['sourceRevision'], { allowWithoutGrowthRun });
     if ((mode === 'prepared-create' || mode === 'prepared-revise') && (creation ?? revision)?.generatorDigest !== item['generatorDigest'])
         throw new ControlPlaneStoreError('invalid-state', 'stored source creation generator changed');
     const approval = item['approval'] === undefined ? undefined : verifiedApprovalFromStored(item['approval'], item['id'], item['digest'], Number(item['createdAt']), Number(item['expiresAt']));
@@ -1233,7 +1333,8 @@ function sourceJobIntentFromStored(value) {
     const native = backend === 'macos-seatbelt' || backend === 'linux-native';
     exactKeys(intent, ['authority', 'owner', 'ownerDigest', 'trustDigest', 'repository', 'name', 'gapId', 'gapRevision', 'gapDigest',
         'baseCommit', 'files', 'ttlMs', 'build', 'worktree', native ? 'nativeResource' : 'containerName', ...(Object.hasOwn(intent, 'baseline') ? ['baseline'] : []),
-        ...(Object.hasOwn(intent, 'mode') ? ['mode'] : []), ...(Object.hasOwn(intent, 'creation') ? ['creation'] : []), ...(Object.hasOwn(intent, 'revision') ? ['revision'] : [])], 'source job intent');
+        ...(Object.hasOwn(intent, 'mode') ? ['mode'] : []), ...(Object.hasOwn(intent, 'creation') ? ['creation'] : []), ...(Object.hasOwn(intent, 'revision') ? ['revision'] : []),
+        ...(Object.hasOwn(intent, 'ownerInstruction') ? ['ownerInstruction'] : [])], 'source job intent');
     const authority = objectRecord(intent['authority'], 'source job authority');
     exactKeys(authority, ['id', 'digest', 'expiresAt', 'maxSubmissions'], 'source job authority');
     const owner = objectRecord(intent['owner'], 'source job owner');
@@ -1259,7 +1360,11 @@ function sourceJobIntentFromStored(value) {
         || (backend === 'macos-seatbelt' && (intent['mode'] !== 'create' && intent['mode'] !== 'revise-created'))
         || (intent['mode'] !== undefined && intent['mode'] !== 'create' && intent['mode'] !== 'revise-created')
         || (intent['mode'] === 'create') !== Object.hasOwn(intent, 'creation')
-        || (intent['mode'] === 'revise-created') !== Object.hasOwn(intent, 'revision')) {
+        || (intent['mode'] === 'revise-created') !== Object.hasOwn(intent, 'revision')
+        || (Object.hasOwn(intent, 'ownerInstruction') && intent['mode'] !== 'revise-created')
+        || (Object.hasOwn(intent, 'ownerInstruction')
+            && intent['revision'] !== null && typeof intent['revision'] === 'object'
+            && Object.hasOwn(intent['revision'], 'growthRun'))) {
         throw new ControlPlaneStoreError('invalid-input', 'source job intent is invalid');
     }
     if (native) {
@@ -1297,17 +1402,45 @@ function sourceJobIntentFromStored(value) {
         throw new ControlPlaneStoreError('invalid-input', 'source job files are invalid');
     }
     const creation = intent['mode'] === 'create' ? creationBindingFromStored(intent['creation']) : undefined;
-    const revision = intent['mode'] === 'revise-created' ? revisionBindingFromStored(intent['revision']) : undefined;
+    const revision = intent['mode'] === 'revise-created'
+        ? revisionBindingFromStored(intent['revision'], { allowWithoutGrowthRun: Object.hasOwn(intent, 'ownerInstruction') }) : undefined;
+    let ownerInstruction;
+    if (Object.hasOwn(intent, 'ownerInstruction')) {
+        const item = objectRecord(intent['ownerInstruction'], 'source job owner instruction');
+        const keys = ['instructionId', 'digest'];
+        if (Object.hasOwn(item, 'reviewFreezeDigest'))
+            keys.push('reviewFreezeDigest');
+        if (Object.hasOwn(item, 'reviewWindow'))
+            keys.push('reviewWindow');
+        exactKeys(item, keys, 'source job owner instruction');
+        if (typeof item['instructionId'] !== 'string' || !KEY.test(item['instructionId'])
+            || typeof item['digest'] !== 'string' || !DIGEST.test(item['digest'])
+            || (item['reviewFreezeDigest'] === undefined) !== (item['reviewWindow'] === undefined)
+            || item['reviewFreezeDigest'] !== undefined && (typeof item['reviewFreezeDigest'] !== 'string' || !DIGEST.test(item['reviewFreezeDigest']))) {
+            throw new ControlPlaneStoreError('invalid-input', 'source job owner instruction is invalid');
+        }
+        ownerInstruction = Object.freeze({
+            instructionId: item['instructionId'], digest: item['digest'],
+            ...(item['reviewFreezeDigest'] === undefined ? {} : {
+                reviewFreezeDigest: item['reviewFreezeDigest'],
+                reviewWindow: validateOwnerInstructionReviewWindow(item['reviewWindow'])
+            }),
+        });
+    }
     if (revision !== undefined && !intent['name'].startsWith(revision.grant.namePrefix))
         throw new ControlPlaneStoreError('invalid-input', 'source job plugin name is outside its revision grant');
     if (creation !== undefined && !intent['name'].startsWith(creation.grant.namePrefix)) {
         throw new ControlPlaneStoreError('invalid-input', 'source job plugin name is outside its creation grant');
     }
-    try {
-        validateSourceBuildConfig(intent['build']);
-    }
-    catch {
-        throw new ControlPlaneStoreError('invalid-input', 'source job build configuration is invalid');
+    if (isLegacyDockerSourceBuildConfig(intent['build']))
+        validateLegacyDockerSourceBuildConfig(intent['build']);
+    else {
+        try {
+            validateSourceBuildConfig(intent['build']);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-input', 'source job build configuration is invalid');
+        }
     }
     if (Object.hasOwn(intent, 'baseline')) {
         try {
@@ -1330,7 +1463,8 @@ function sourceJobIntentFromStored(value) {
             : { containerName: intent['containerName'] }),
         ...(creation === undefined ? {} : { mode: 'create', creation }),
         ...(revision === undefined ? {} : { mode: 'revise-created', revision }),
-        ...(Object.hasOwn(intent, 'baseline') ? { baseline: Object.freeze(intent['baseline']) } : {}) });
+        ...(Object.hasOwn(intent, 'baseline') ? { baseline: Object.freeze(intent['baseline']) } : {}),
+        ...(ownerInstruction === undefined ? {} : { ownerInstruction }) });
 }
 function exactInputRecord(value, label) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
@@ -1879,7 +2013,9 @@ export class ControlPlaneStore {
         }
         if (options.adoptionCoordinatorId && options.withOwnerActivationFence)
             throw new ControlPlaneStoreError('invalid-input', 'adoption coordinator cannot hold owner fence');
-        this.#database = options.readOnly === true ? openControlPlaneDatabaseReadOnly(options.path) : openControlPlaneDatabase(options.path);
+        this.#database = options.readOnly === true || options.readOnly === 'live'
+            ? openControlPlaneDatabaseReadOnly(options.path, options.readOnly === 'live' ? 'live' : 'checkpoint')
+            : openControlPlaneDatabase(options.path);
         this.#now = options.now ?? Date.now;
         this.#withLiveQualificationFence = options.withLiveQualificationFence;
         this.#withOwnerActivationFence = options.withOwnerActivationFence;
@@ -1932,6 +2068,7 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('invalid-input', 'gap limit must be 1..100');
         return this.#database.prepare(`SELECT gap.* FROM capability_gaps gap
       WHERE gap.status = 'open' AND gap.idempotency_key NOT LIKE 'owner-task-failure:%'
+        AND gap.idempotency_key NOT LIKE 'owner-instruction:%'
         AND NOT EXISTS (SELECT 1 FROM owner_task_failure_gaps sidecar WHERE sidecar.gap_id = gap.id)
       ORDER BY gap.roi DESC, gap.created_at, gap.id LIMIT ?`).all(limit).map(gapFromRow);
     }
@@ -2058,6 +2195,373 @@ export class ControlPlaneStore {
     getOwnerTaskFailureReference(gapId) {
         return readOwnerTaskFailureReference(this.#database, gapId);
     }
+    /**
+     * Record one Host-authenticated owner revision instruction. Idempotent on
+     * idempotencyKey: reusing a key with a different payload fails closed, and
+     * reusing the same full payload returns the stored instruction. The owner
+     * receipt, files digest and independent-review freeze are written once.
+     */
+    recordOwnerInstruction(input) {
+        const instructionId = bounded(input.instructionId, 'instructionId', 160);
+        const ownerRouteId = bounded(input.ownerRouteId, 'ownerRouteId', 200);
+        const planId = bounded(input.planId, 'planId', 160);
+        const pluginName = bounded(input.pluginName, 'pluginName', 160);
+        const idempotencyKey = bounded(input.idempotencyKey, 'idempotencyKey', 160);
+        if (!KEY.test(instructionId) || !KEY.test(planId) || !KEY.test(idempotencyKey) || !KEY.test(ownerRouteId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction identity is invalid');
+        }
+        if (!DIGEST.test(input.filesDigest))
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction files digest is invalid');
+        if (!Number.isSafeInteger(input.createdAt) || input.createdAt < 1
+            || !Number.isSafeInteger(input.expiresAt) || input.expiresAt <= input.createdAt) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction timing is invalid');
+        }
+        const ownerDigest = controlPlaneDigest(input.ownerReceipt);
+        if (!DIGEST.test(ownerDigest))
+            throw new ControlPlaneStoreError('invalid-input', 'owner receipt is invalid');
+        validateOwnerInstructionReviewFreeze(input.review);
+        const review = Object.freeze({ ...input.review });
+        if (review.budget.authority.expiresAt <= input.createdAt) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction review authority is already expired');
+        }
+        const receiptJson = JSON.stringify(input.ownerReceipt);
+        const prior = this.#database.prepare('SELECT * FROM source_owner_instructions WHERE idempotency_key = ? OR instruction_id = ?')
+            .get(idempotencyKey, instructionId);
+        if (prior !== undefined) {
+            const stored = this.ownerInstructionFromRow(prior);
+            // Retries may recompute createdAt; every frozen field must match. A
+            // reused id or key with a different payload is a conflict either way.
+            const expected = this.#ownerInstructionPayload({ ...input, ownerDigest, createdAt: stored.createdAt });
+            const storedReview = stored.instructionId === instructionId ? this.reviewFreezeFromRow(prior) : undefined;
+            if (stored.idempotencyKey !== idempotencyKey || stored.instructionId !== instructionId
+                || controlPlaneDigest(stored) !== controlPlaneDigest(expected)
+                || storedReview === undefined || controlPlaneDigest(storedReview) !== controlPlaneDigest(review)) {
+                throw new ControlPlaneStoreError('conflict', 'owner instruction identity or idempotency key was reused with different input');
+            }
+            return stored;
+        }
+        this.#database.prepare(`INSERT INTO source_owner_instructions
+      (instruction_id, owner_receipt_json, owner_digest, owner_route_id, plan_id, plugin_name,
+        files_digest, created_at, expires_at, idempotency_key,
+        review_supplier_json, review_budget_json, review_freeze_digest)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(instructionId, receiptJson, ownerDigest, ownerRouteId, planId, pluginName, input.filesDigest, input.createdAt, input.expiresAt, idempotencyKey, JSON.stringify(review.supplier), JSON.stringify(review.budget), review.digest);
+        const row = this.#database.prepare('SELECT * FROM source_owner_instructions WHERE instruction_id = ?')
+            .get(instructionId);
+        return this.ownerInstructionFromRow(row);
+    }
+    /**
+     * The immutable review supplier/budget written with one owner instruction.
+     * Undefined only for rows recorded before schema 41; every execution path
+     * treats that as unavailable and fails closed rather than consulting the live
+     * owner route or live verifier configuration.
+     */
+    getOwnerInstructionReviewFreeze(instructionId) {
+        if (typeof instructionId !== 'string' || !KEY.test(instructionId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'instruction id is invalid');
+        }
+        const row = this.#database.prepare('SELECT * FROM source_owner_instructions WHERE instruction_id = ?')
+            .get(instructionId);
+        if (row === undefined)
+            return undefined;
+        return this.reviewFreezeFromRow(row);
+    }
+    reviewFreezeFromRow(row) {
+        const values = [row.review_supplier_json, row.review_budget_json, row.review_freeze_digest];
+        if (values.every(value => value === null))
+            return undefined;
+        if (values.some(value => value === null)) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction review freeze is corrupt');
+        }
+        let supplier, budget;
+        try {
+            supplier = JSON.parse(row.review_supplier_json);
+            budget = JSON.parse(row.review_budget_json);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction review freeze is corrupt');
+        }
+        const freeze = { protocol: OWNER_INSTRUCTION_REVIEW_FREEZE_PROTOCOL,
+            supplier, budget, digest: row.review_freeze_digest };
+        try {
+            validateOwnerInstructionReviewFreeze(freeze);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction review freeze is corrupt');
+        }
+        return Object.freeze(freeze);
+    }
+    getOwnerInstruction(instructionId) {
+        if (typeof instructionId !== 'string' || !KEY.test(instructionId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'instruction id is invalid');
+        }
+        const row = this.#database.prepare('SELECT * FROM source_owner_instructions WHERE instruction_id = ?')
+            .get(instructionId);
+        return row === undefined ? undefined : this.ownerInstructionFromRow(row);
+    }
+    /**
+     * Records a structured owner-instruction request written by the control-plane
+     * CLI. This table is CLI-writable and drained by the running service's SourceJobs
+     * continuation tick, which re-validates the owner route inside its trust boundary
+     * before enqueueing; the CLI never writes source_jobs and the model tool surface
+     * never reaches this table. The request freezes the exact candidate files (bound
+     * by filesDigest) and expires.
+     */
+    recordOwnerInstructionRequest(input) {
+        const planId = bounded(input.planId, 'planId', 160);
+        const pluginName = bounded(input.pluginName, 'pluginName', 160);
+        const idempotencyKey = bounded(input.idempotencyKey, 'idempotencyKey', 160);
+        if (!KEY.test(planId) || !KEY.test(idempotencyKey) || pluginName.normalize('NFC') !== pluginName
+            || pluginName.length === 0 || pluginName.length > 160) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request identity is invalid');
+        }
+        if (typeof input.expectedBaseCommit !== 'string' || !COMMIT.test(input.expectedBaseCommit)) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request base commit is invalid');
+        }
+        if (!Number.isSafeInteger(input.ttlMs) || input.ttlMs < 900_000 || input.ttlMs > 86_400_000) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request ttl is invalid');
+        }
+        if (!Number.isSafeInteger(input.createdAt) || input.createdAt < 1) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request timing is invalid');
+        }
+        const files = structuredClone(input.files);
+        validateSourceCreationFiles(files);
+        const filesDigest = controlPlaneDigest(files);
+        const filesJson = JSON.stringify(files);
+        if (filesJson.length > 1_048_576)
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request files are too large');
+        const expiresAt = input.createdAt + input.ttlMs;
+        const requestId = `oir-${controlPlaneDigest({ planId, expectedBaseCommit: input.expectedBaseCommit, idempotencyKey }).slice(0, 32)}`;
+        const prior = this.#database.prepare('SELECT * FROM source_owner_instruction_requests WHERE idempotency_key = ? OR request_id = ?')
+            .get(idempotencyKey, requestId);
+        if (prior !== undefined) {
+            const stored = this.ownerInstructionRequestFromRow(prior);
+            // Retries are idempotent; a reused key/id with a different payload is a conflict.
+            if (stored.idempotencyKey !== idempotencyKey || stored.requestId !== requestId
+                || stored.planId !== planId || stored.pluginName !== pluginName
+                || stored.expectedBaseCommit !== input.expectedBaseCommit || stored.filesDigest !== filesDigest
+                || stored.ttlMs !== input.ttlMs) {
+                throw new ControlPlaneStoreError('conflict', 'owner instruction request identity or idempotency key was reused with different input');
+            }
+            return stored;
+        }
+        this.#database.prepare(`INSERT INTO source_owner_instruction_requests
+      (request_id, plan_id, plugin_name, expected_base_commit, files_json, files_digest, ttl_ms,
+        idempotency_key, created_at, expires_at, status, failure_code)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', NULL)`).run(requestId, planId, pluginName, input.expectedBaseCommit, filesJson, filesDigest, input.ttlMs, idempotencyKey, input.createdAt, expiresAt);
+        const row = this.#database.prepare('SELECT * FROM source_owner_instruction_requests WHERE request_id = ?')
+            .get(requestId);
+        return this.ownerInstructionRequestFromRow(row);
+    }
+    getOwnerInstructionRequest(requestId) {
+        if (typeof requestId !== 'string' || !KEY.test(requestId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request id is invalid');
+        }
+        const row = this.#database.prepare('SELECT * FROM source_owner_instruction_requests WHERE request_id = ?')
+            .get(requestId);
+        return row === undefined ? undefined : this.ownerInstructionRequestFromRow(row);
+    }
+    /** Historical status projection, independent of the candidate payload and current owner authorization. */
+    inspectOwnerInstructionRequest(requestId) {
+        if (typeof requestId !== 'string' || !KEY.test(requestId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request id is invalid');
+        }
+        this.#database.exec('BEGIN');
+        try {
+            const row = this.#database.prepare(`SELECT request_id, plan_id, plugin_name, expected_base_commit, status,
+        failure_code, created_at, expires_at, instruction_id, job_id FROM source_owner_instruction_requests WHERE request_id = ?`)
+                .get(requestId);
+            if (row === undefined)
+                return undefined;
+            if (!/^oir-[a-f0-9]{32}$/u.test(row.request_id) || !KEY.test(row.plan_id) || !COMMIT.test(row.expected_base_commit)
+                || bounded(row.plugin_name, 'stored owner instruction plugin name', 160) !== row.plugin_name
+                || !['pending', 'claimed', 'accepted', 'rejected'].includes(row.status)
+                || (row.status === 'rejected') !== (row.failure_code !== null)
+                || (row.failure_code !== null && !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,119}$/u.test(row.failure_code))
+                || !Number.isSafeInteger(row.created_at) || row.created_at < 1
+                || !Number.isSafeInteger(row.expires_at) || row.expires_at <= row.created_at
+                || (row.status !== 'accepted' && (row.instruction_id !== null || row.job_id !== null))
+                || (row.instruction_id !== null && !KEY.test(row.instruction_id))
+                || (row.job_id !== null && !/^source-job-[a-f0-9]{64}$/u.test(row.job_id))) {
+                throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction request status is corrupt');
+            }
+            const job = row.status === 'accepted' && row.instruction_id !== null && row.job_id !== null
+                ? this.#inspectRecordedOwnerInstructionJob(requestId) : null;
+            const jobAssociation = job !== null ? 'matched' : row.status === 'accepted' ? 'unknown' : null;
+            return { requestId: row.request_id, planId: row.plan_id, pluginName: row.plugin_name,
+                expectedBaseCommit: row.expected_base_commit, status: row.status, failureCode: row.failure_code,
+                createdAt: row.created_at, expiresAt: row.expires_at, instructionId: row.instruction_id, jobId: row.job_id,
+                jobAssociation, job };
+        }
+        finally {
+            this.#database.exec('ROLLBACK');
+        }
+    }
+    #inspectRecordedOwnerInstructionJob(requestId) {
+        try {
+            const request = this.getOwnerInstructionRequest(requestId);
+            if (request === undefined || request.instructionId === null || request.jobId === null)
+                return null;
+            const instruction = this.getOwnerInstruction(request.instructionId);
+            const job = this.getSourceJob(request.jobId);
+            if (instruction === undefined || job === undefined)
+                return null;
+            const intent = job.intent;
+            if (instruction.idempotencyKey !== request.idempotencyKey || job.idempotencyKey !== request.idempotencyKey
+                || instruction.planId !== request.planId || intent.revision?.parent.planId !== request.planId
+                || instruction.pluginName !== request.pluginName || intent.name !== request.pluginName
+                || instruction.filesDigest !== request.filesDigest || controlPlaneDigest(intent.files) !== request.filesDigest
+                || instruction.createdAt !== request.createdAt || instruction.expiresAt !== request.expiresAt
+                || intent.baseCommit !== request.expectedBaseCommit || intent.ttlMs !== request.ttlMs
+                || intent.mode !== 'revise-created' || intent.ownerDigest !== instruction.ownerDigest
+                || intent.ownerInstruction?.instructionId !== instruction.instructionId
+                || intent.ownerInstruction.digest !== controlPlaneDigest(instruction))
+                return null;
+            return { status: job.status, failureCode: job.failureCode ?? null, candidatePlanId: job.planId ?? null };
+        }
+        catch (error) {
+            if (error instanceof ControlPlaneStoreError)
+                return null;
+            throw error;
+        }
+    }
+    /** Pending, unexpired requests, oldest first. This read never quarantines rows. */
+    listPendingOwnerInstructionRequests(now, limit = 16) {
+        return this.#pendingOwnerInstructionRows(now, limit).map(row => this.ownerInstructionRequestFromRow(row));
+    }
+    #pendingOwnerInstructionRows(now, limit) {
+        if (!Number.isSafeInteger(now) || now < 1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request query bounds are invalid');
+        }
+        // Sort only request identities before loading the bounded batch of files.
+        return this.#database.prepare(`SELECT r.* FROM (
+      SELECT request_id FROM source_owner_instruction_requests WHERE status = 'pending' AND expires_at > ?
+      ORDER BY created_at, request_id LIMIT ?
+    ) batch JOIN source_owner_instruction_requests r ON r.request_id = batch.request_id
+      ORDER BY r.created_at, r.request_id`).all(now, limit);
+    }
+    /** Decode and quarantine exactly one batch. Never re-read beyond its limit after quarantine. */
+    readOwnerInstructionDrainBatch(now, limit) {
+        const rows = this.#pendingOwnerInstructionRows(now, limit);
+        const pending = [];
+        let quarantined = 0;
+        for (const row of rows) {
+            try {
+                pending.push(this.ownerInstructionRequestFromRow(row));
+            }
+            catch {
+                const result = this.#database.prepare(`UPDATE source_owner_instruction_requests
+          SET status = 'rejected', failure_code = 'request-corrupt'
+          WHERE request_id = ? AND status = 'pending' AND claim_generation = ?`).run(row.request_id, row.claim_generation);
+                quarantined += Number(result.changes);
+            }
+        }
+        return { pending, quarantined };
+    }
+    /** Read-only readiness for the existing native scheduler wake. */
+    hasOwnerInstructionRequestWork(now, claimTimeoutMs) {
+        return this.#database.prepare(`SELECT 1 FROM source_owner_instruction_requests
+      WHERE status = 'pending' OR (status = 'claimed' AND
+        (expires_at <= ? OR claimed_at IS NULL OR claimed_at <= ?)) LIMIT 1`).get(now, now - claimTimeoutMs) !== undefined;
+    }
+    expireOwnerInstructionRequests(now) {
+        this.#database.prepare(`UPDATE source_owner_instruction_requests
+      SET status = 'rejected', claimed_at = NULL, failure_code = 'request-expired'
+      WHERE status IN ('pending', 'claimed') AND expires_at <= ?`).run(now);
+    }
+    /** Pending-to-claimed CAS returns a durable, monotonically increasing claim generation. */
+    claimOwnerInstructionRequest(requestId, now) {
+        if (typeof requestId !== 'string' || !KEY.test(requestId) || !Number.isSafeInteger(now) || now < 1) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request claim is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_owner_instruction_requests
+      SET status = 'claimed', claimed_at = ?, claim_generation = claim_generation + 1
+      WHERE request_id = ? AND status = 'pending' AND expires_at > ? RETURNING claim_generation`)
+            .get(now, requestId, now);
+        return result?.claim_generation;
+    }
+    /** Requeue stale claims, including legacy v38 claims without a timestamp. */
+    reclaimOrphanedOwnerInstructionRequests(now, claimTimeoutMs) {
+        if (!Number.isSafeInteger(now) || now < 1 || !Number.isSafeInteger(claimTimeoutMs) || claimTimeoutMs < 1) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request orphan reclamation is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_owner_instruction_requests
+      SET status = 'pending', claimed_at = NULL
+      WHERE status = 'claimed' AND (claimed_at IS NULL OR claimed_at <= ?) AND expires_at > ?`).run(now - claimTimeoutMs, now);
+        return Number(result.changes);
+    }
+    rejectOwnerInstructionRequest(requestId, generation, failureCode) {
+        this.#assertOwnerInstructionClaim(requestId, generation);
+        if (typeof failureCode !== 'string' || failureCode.length === 0 || failureCode.length > 120) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request rejection is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_owner_instruction_requests
+      SET status = 'rejected', claimed_at = NULL, failure_code = ?
+      WHERE request_id = ? AND status = 'claimed' AND claim_generation = ?`).run(failureCode, requestId, generation);
+        return Number(result.changes) === 1;
+    }
+    acceptOwnerInstructionRequest(requestId, generation, receipt) {
+        this.#assertOwnerInstructionClaim(requestId, generation);
+        if (!KEY.test(receipt.instructionId) || !/^source-job-[a-f0-9]{64}$/u.test(receipt.jobId)) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request admission receipt is invalid');
+        }
+        const result = this.#database.prepare(`UPDATE source_owner_instruction_requests
+      SET status = 'accepted', claimed_at = NULL, instruction_id = ?, job_id = ?
+      WHERE request_id = ? AND status = 'claimed' AND claim_generation = ?`)
+            .run(receipt.instructionId, receipt.jobId, requestId, generation);
+        return Number(result.changes) === 1;
+    }
+    releaseOwnerInstructionRequestClaim(requestId, generation) {
+        this.#assertOwnerInstructionClaim(requestId, generation);
+        const result = this.#database.prepare(`UPDATE source_owner_instruction_requests SET status = 'pending', claimed_at = NULL
+      WHERE request_id = ? AND status = 'claimed' AND claim_generation = ?`).run(requestId, generation);
+        return Number(result.changes) === 1;
+    }
+    #assertOwnerInstructionClaim(requestId, generation) {
+        if (typeof requestId !== 'string' || !KEY.test(requestId) || !Number.isSafeInteger(generation) || generation < 1) {
+            throw new ControlPlaneStoreError('invalid-input', 'owner instruction request claim is invalid');
+        }
+    }
+    ownerInstructionRequestFromRow(row) {
+        let files;
+        try {
+            files = JSON.parse(row.files_json);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction request files are corrupt');
+        }
+        if (!Array.isArray(files) || controlPlaneDigest(files) !== row.files_digest) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction request digest is corrupt');
+        }
+        return { requestId: row.request_id, planId: row.plan_id, pluginName: row.plugin_name,
+            expectedBaseCommit: row.expected_base_commit, files, filesDigest: row.files_digest, ttlMs: row.ttl_ms,
+            idempotencyKey: row.idempotency_key, createdAt: row.created_at, expiresAt: row.expires_at,
+            status: row.status, failureCode: row.failure_code, claimedAt: row.claimed_at,
+            claimGeneration: row.claim_generation, instructionId: row.instruction_id, jobId: row.job_id };
+    }
+    #ownerInstructionPayload(input) {
+        return { instructionId: input.instructionId, ownerReceipt: input.ownerReceipt, ownerDigest: input.ownerDigest,
+            ownerRouteId: input.ownerRouteId, planId: input.planId, pluginName: input.pluginName,
+            filesDigest: input.filesDigest, createdAt: input.createdAt, expiresAt: input.expiresAt,
+            idempotencyKey: input.idempotencyKey };
+    }
+    ownerInstructionFromRow(row) {
+        let ownerReceipt;
+        try {
+            ownerReceipt = JSON.parse(row.owner_receipt_json);
+        }
+        catch {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction receipt is corrupt');
+        }
+        if (controlPlaneDigest(ownerReceipt) !== row.owner_digest) {
+            throw new ControlPlaneStoreError('invalid-state', 'stored owner instruction digest is corrupt');
+        }
+        return {
+            instructionId: row.instruction_id, ownerReceipt, ownerDigest: row.owner_digest,
+            ownerRouteId: row.owner_route_id, planId: row.plan_id, pluginName: row.plugin_name,
+            filesDigest: row.files_digest, createdAt: row.created_at, expiresAt: row.expires_at,
+            idempotencyKey: row.idempotency_key,
+        };
+    }
     withOwnerTaskFailureGapAdmission(gapId, callback) {
         if (this.#adoptionCoordinatorId !== undefined)
             throw new ControlPlaneStoreError('invalid-state', 'adoption coordinator cannot create or approve owner work');
@@ -2399,6 +2903,15 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('conflict', 'source job quota authority changed');
         return { sourceSubmissions: Math.max(0, a.maxSubmissions - (row?.submissions ?? 0)), creates: Math.max(0, c.maxCreates - (grant?.creates ?? 0)) };
     }
+    /** Read-only revision quota companion of inspectSourceJobQuota; mirrors the enqueue-side invariants. */
+    inspectSourceJobRevisionQuota(input) {
+        const a = input.authority, g = input.revision;
+        const row = this.#database.prepare('SELECT * FROM source_job_authorities WHERE authority_id=?').get(a.id);
+        const grant = this.#database.prepare('SELECT * FROM source_revision_grants WHERE grant_id=?').get(g.id);
+        if (row && (row.authority_digest !== a.digest || row.expires_at !== a.expiresAt || row.max_submissions !== a.maxSubmissions) || grant && (grant.grant_digest !== controlPlaneDigest(g) || grant.expires_at !== g.expiresAt || grant.max_revisions !== g.maxRevisions))
+            throw new ControlPlaneStoreError('conflict', 'source job revision quota authority changed');
+        return { sourceSubmissions: Math.max(0, a.maxSubmissions - (row?.submissions ?? 0)), revisions: Math.max(0, g.maxRevisions - (grant?.revisions ?? 0)) };
+    }
     enqueueSourceJob(input) {
         if (!/^source-job-[a-f0-9]{64}$/u.test(input.id) || input.automationId !== input.id) {
             throw new ControlPlaneStoreError('invalid-input', 'source job identity is invalid');
@@ -2422,8 +2935,19 @@ export class ControlPlaneStore {
             throw new ControlPlaneStoreError('expired', 'source job authority is expired');
         if (intent.creation !== undefined && now >= intent.creation.grant.expiresAt)
             throw new ControlPlaneStoreError('expired', 'source creation grant is expired');
-        if (intent.revision !== undefined && (this.getOwnerTaskFailureReference(intent.gapId) === undefined || now >= intent.revision.grant.expiresAt))
+        if (intent.revision !== undefined && (now >= intent.revision.grant.expiresAt
+            || (this.getOwnerTaskFailureReference(intent.gapId) === undefined && intent.ownerInstruction === undefined))) {
             throw new ControlPlaneStoreError('expired', 'revision grant or owner task is unavailable');
+        }
+        // Re-validate the frozen instruction at the writer boundary: a revoked or
+        // changed instruction must never produce a source job, even after restart.
+        if (intent.ownerInstruction !== undefined) {
+            const instruction = this.getOwnerInstruction(intent.ownerInstruction.instructionId);
+            if (instruction === undefined || controlPlaneDigest(instruction) !== intent.ownerInstruction.digest
+                || instruction.expiresAt <= now) {
+                throw new ControlPlaneStoreError('expired', 'owner instruction is unavailable or changed');
+            }
+        }
         const growthRun = intent.creation?.growthRun ?? intent.revision?.growthRun;
         if (growthRun !== undefined && (now >= growthRun.generationDeadlineAt || now >= growthRun.expiresAt))
             throw new ControlPlaneStoreError('expired', 'source growth generation window is expired');
@@ -2536,12 +3060,14 @@ export class ControlPlaneStore {
       created_at DESC, id DESC LIMIT ?`).all(limit).map(sourceJobFromRow);
     }
     /** Prepared owner continuations have a bounded recovery query, independent of job history. */
-    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false, includeCreation = false, includeCreationAdoption = false, includeRevision = false, includeRegression = false) {
+    listPreparedSourceApprovalJobs(includeRelease = false, includeExecution = false, includeAdoption = false, includeCreation = false, includeCreationAdoption = false, includeRevision = false, includeRegression = false, includeRevisionAdoption = false) {
         return this.#database.prepare(`SELECT j.* FROM source_jobs j JOIN source_plans p ON p.id = j.plan_id
-      JOIN owner_task_failure_gaps g ON g.gap_id = p.gap_id
+      LEFT JOIN owner_task_failure_gaps g ON g.gap_id = p.gap_id
       LEFT JOIN source_adoptions a ON a.source_plan_id = p.id
       LEFT JOIN activation_plans ap ON ap.id = a.activation_plan_id
-      WHERE j.status = 'prepared' AND ((p.mode = 'modify' AND (p.status = 'pending-approval' OR (? = 1 AND p.status IN ('approved', 'ready-for-human-review'))
+      WHERE j.status = 'prepared'
+        AND (g.gap_id IS NOT NULL OR (p.mode = 'prepared-revise' AND json_type(j.intent_json, '$.ownerInstruction') = 'object'))
+        AND ((p.mode = 'modify' AND (p.status = 'pending-approval' OR (? = 1 AND p.status IN ('approved', 'ready-for-human-review'))
         OR (? = 1 AND p.status IN ('awaiting-pr', 'awaiting-review', 'awaiting-merge', 'awaiting-build', 'awaiting-sign', 'awaiting-publish',
           'awaiting-registry-verify', 'awaiting-catalog-admission'))
         OR (? = 1 AND p.status = 'release-complete' AND (ap.id IS NULL OR ap.status NOT IN ('activated', 'rolled-back', 'rejected')))))
@@ -2551,14 +3077,20 @@ export class ControlPlaneStore {
         OR (? = 1 AND p.mode = 'prepared-create' AND p.status = 'pending-approval'
           AND EXISTS (SELECT 1 FROM source_creation_verifications v WHERE v.plan_id = p.id AND v.status = 'verified'))
         OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
-          AND json_type(j.intent_json, '$.revision.growthRun.revisionAcceptance') IS NOT NULL
+          AND (json_type(j.intent_json, '$.revision.growthRun.revisionAcceptance') IS NOT NULL
+            OR (g.gap_id IS NULL AND json_type(j.intent_json, '$.ownerInstruction') = 'object'))
           AND NOT EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id))
         OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
           AND json_type(j.intent_json, '$.revision.growthRun.revisionRegressionAcceptance') IS NOT NULL
           AND EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id AND v.status='verified')
-          AND NOT EXISTS (SELECT 1 FROM source_revision_regressions v WHERE v.plan_id=p.id)))
+          AND NOT EXISTS (SELECT 1 FROM source_revision_regressions v WHERE v.plan_id=p.id))
+        OR (? = 1 AND p.mode = 'prepared-revise' AND p.status = 'pending-approval'
+          AND g.gap_id IS NOT NULL
+          AND EXISTS (SELECT 1 FROM source_revision_verifications v WHERE v.plan_id=p.id AND v.status='verified')
+          AND (json_type(j.intent_json, '$.revision.growthRun.revisionRegressionAcceptance') IS NULL
+            OR EXISTS (SELECT 1 FROM source_revision_regressions r WHERE r.plan_id=p.id AND r.status='verified'))))
         AND (p.expires_at > ? OR ap.status IN ('staging', 'awaiting-reload', 'awaiting-readiness', 'awaiting-live-tasks', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health', 'commit-pending', 'rollback-pending'))
-      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, includeCreation ? 1 : 0, includeCreationAdoption ? 1 : 0, includeRevision ? 1 : 0, includeRegression ? 1 : 0, this.#now()).map(sourceJobFromRow);
+      ORDER BY j.created_at, j.id LIMIT 1000`).all(includeRelease ? 1 : 0, includeExecution ? 1 : 0, includeAdoption ? 1 : 0, includeCreation ? 1 : 0, includeCreationAdoption ? 1 : 0, includeRevision ? 1 : 0, includeRegression ? 1 : 0, includeRevisionAdoption ? 1 : 0, this.#now()).map(sourceJobFromRow);
     }
     bindSourceJobDefinition(input) {
         if (!Number.isSafeInteger(input.revision) || input.revision < 1 || !DIGEST.test(input.definitionHash))
@@ -2648,7 +3180,10 @@ export class ControlPlaneStore {
             || (creation !== undefined && (creation.generatorDigest !== input.generatorDigest || !name.startsWith(creation.grant.namePrefix)))) {
             throw new ControlPlaneStoreError('invalid-input', 'prepared source creation binding is invalid');
         }
-        const revision = input.revision === undefined ? undefined : revisionBindingFromStored(input.revision);
+        const instructionJob = mode === 'prepared-revise' && input.sourceJob !== undefined
+            ? this.getSourceJob(input.sourceJob.jobId)?.intent.ownerInstruction : undefined;
+        const revision = input.revision === undefined ? undefined
+            : revisionBindingFromStored(input.revision, { allowWithoutGrowthRun: instructionJob !== undefined });
         if ((mode === 'prepared-revise') !== (revision !== undefined)
             || (revision !== undefined && (revision.generatorDigest !== input.generatorDigest || !name.startsWith(revision.grant.namePrefix)))) {
             throw new ControlPlaneStoreError('invalid-input', 'prepared source revision binding is invalid');
@@ -2680,9 +3215,6 @@ export class ControlPlaneStore {
                 || createHash('sha256').update(input.preparedArtifact).digest('hex') !== preparedEvidence.pack.sha256) {
                 throw new ControlPlaneStoreError('invalid-input', 'prepared source artifact differs from checked package evidence');
             }
-            if (this.getOwnerTaskFailureReference(input.gapId) === undefined) {
-                throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact requires an owner task failure gap');
-            }
             preparedArtifact = Buffer.from(input.preparedArtifact);
         }
         positiveInteger(input.ttlMs, 'ttlMs');
@@ -2755,6 +3287,16 @@ export class ControlPlaneStore {
                     || (mode === 'prepared-revise' && controlPlaneDigest(sourceJob.intent.revision) !== controlPlaneDigest(revision))) {
                     throw new ControlPlaneStoreError('conflict', 'source job completion lost its immutable running binding');
                 }
+                const reference = this.getOwnerTaskFailureReference(input.gapId);
+                if (sourceJob.intent.ownerInstruction !== undefined) {
+                    if (reference !== undefined || mode !== 'prepared-revise') {
+                        throw new ControlPlaneStoreError('invalid-state', 'prepared revision owner sources conflict');
+                    }
+                    this.#assertRevisionInstruction(sourceJob, now);
+                }
+                else if (preparedArtifact !== undefined && reference === undefined) {
+                    throw new ControlPlaneStoreError('invalid-state', 'prepared source artifact requires an owner task failure gap');
+                }
                 if (now >= sourceJob.expiresAt || (creation !== undefined && now >= creation.grant.expiresAt) || (revision !== undefined && now >= revision.grant.expiresAt))
                     throw new ControlPlaneStoreError('expired', 'source job authority is expired');
                 if (mode === 'prepared-create' && this.getOwnerTaskFailureReference(input.gapId) !== undefined
@@ -2762,7 +3304,8 @@ export class ControlPlaneStore {
                     throw new ControlPlaneStoreError('expired', 'task-backed creation growth run is absent or expired');
                 }
             }
-            if (revision !== undefined && (this.getOwnerTaskFailureReference(input.gapId) === undefined || now >= revision.growthRun.expiresAt)) {
+            if (revision !== undefined && revision.growthRun !== undefined
+                && (this.getOwnerTaskFailureReference(input.gapId) === undefined || now >= revision.growthRun.expiresAt)) {
                 throw new ControlPlaneStoreError('expired', 'revision requires a current owner task and frozen growth run');
             }
             if (preparedArtifact !== undefined) {
@@ -2824,7 +3367,19 @@ export class ControlPlaneStore {
         const row = this.#database.prepare('SELECT * FROM source_plans WHERE id = ?').get(id);
         if (row === undefined)
             throw new ControlPlaneStoreError('not-found', 'source plan not found');
-        return sourceFromRow(row);
+        return this.#readSourcePlanRow(row);
+    }
+    #readSourcePlanRow(row) {
+        const plan = sourceFromRow(row, row.mode === 'prepared-revise');
+        if (plan.sourceRevision !== undefined && plan.sourceRevision.growthRun === undefined) {
+            // Historical reads can parse the v3 form only when the matching durable
+            // job and instruction still bind this plan. Authority use rechecks time.
+            if (this.getOwnerTaskFailureReference(plan.gapId) !== undefined) {
+                throw new ControlPlaneStoreError('invalid-state', 'prepared revision owner sources conflict');
+            }
+            this.#assertRevisionInstruction(this.#retainedPreparedRevisionJob(plan));
+        }
+        return plan;
     }
     /** Exact durable source job for a currently admitted prepared creation. */
     getPreparedSourceJob(planId) {
@@ -2880,22 +3435,64 @@ export class ControlPlaneStore {
             || this.#now() >= plan.expiresAt || this.#now() >= plan.sourceRevision.grant.expiresAt) {
             throw new ControlPlaneStoreError('invalid-state', 'prepared revision requires a current pending plan');
         }
+        const job = this.#retainedPreparedRevisionJob(plan);
         const owner = this.getOwnerTaskFailureReference(plan.gapId);
-        if (owner === undefined)
-            throw new ControlPlaneStoreError('invalid-state', 'prepared revision requires an owner task failure gap');
-        this.#assertOwnerTaskFailureGapAdmission(plan.gapId);
-        return this.getRetainedPreparedRevision(planId).job;
+        if (owner === undefined) {
+            this.#assertRevisionInstruction(job, this.#now());
+        }
+        else {
+            this.#assertOwnerTaskFailureGapAdmission(plan.gapId);
+            if (job.intent.ownerInstruction !== undefined || job.intent.ownerDigest !== controlPlaneDigest(owner.owner)) {
+                throw new ControlPlaneStoreError('invalid-state', 'prepared revision owner task binding changed');
+            }
+        }
+        return job;
+    }
+    /**
+     * Host-only content-free benefit intent projection. Reading the pinned
+     * contract digest needs no owner-gap admission: it is Host metadata already
+     * validated against the plan binding, never task content or execution
+     * authority.
+     */
+    inspectRevisionBenefitIntent(planId) {
+        const plan = this.getSourcePlan(planId);
+        if (plan.mode !== 'prepared-revise' || plan.sourceRevision === undefined)
+            return undefined;
+        const job = this.#retainedPreparedRevisionJob(plan);
+        const pinned = job.intent.revision?.grant.benefit;
+        return Object.freeze({
+            ...(pinned === undefined ? {} : { pinnedContractDigest: pinned.contractDigest }),
+            growthRunAcceptance: job.intent.revision?.growthRun?.revisionAcceptance !== undefined,
+        });
+    }
+    #assertRevisionInstruction(job, now) {
+        const binding = job.intent.ownerInstruction;
+        const instruction = binding === undefined ? undefined : this.getOwnerInstruction(binding.instructionId);
+        if (!instruction || controlPlaneDigest(instruction) !== binding.digest || (now !== undefined && (instruction.expiresAt <= now || job.expiresAt <= now))
+            || instruction.planId !== job.intent.revision?.parent.planId
+            || instruction.pluginName !== job.intent.name || job.intent.revision?.growthRun !== undefined
+            || instruction.ownerDigest !== job.intent.ownerDigest || instruction.filesDigest !== controlPlaneDigest(job.intent.files)
+            || this.getGap(job.intent.gapId).idempotencyKey !== `owner-instruction:${instruction.instructionId}`) {
+            throw new ControlPlaneStoreError('invalid-state', 'prepared revision requires a current exact owner instruction');
+        }
     }
     /** Read-only exact historical binding for an already signed adoption. Caller must hold the current owner fence. */
     getRetainedPreparedRevision(planId) {
         const plan = this.getSourcePlan(planId);
+        const owner = this.getOwnerTaskFailureReference(plan.gapId);
+        if (owner === undefined)
+            throw new ControlPlaneStoreError('invalid-state', 'retained revision requires an owner task failure gap');
+        const job = this.#retainedPreparedRevisionJob(plan);
+        if (job.intent.ownerInstruction !== undefined || job.intent.ownerDigest !== controlPlaneDigest(owner.owner)) {
+            throw new ControlPlaneStoreError('invalid-state', 'retained revision owner task binding changed');
+        }
+        return { plan, job, reference: owner };
+    }
+    #retainedPreparedRevisionJob(plan) {
         if (plan.mode !== 'prepared-revise' || !['pending-approval', 'expired'].includes(plan.status)
             || plan.sourceRevision === undefined || plan.preparedEvidence === undefined || plan.sourceCheck === undefined) {
             throw new ControlPlaneStoreError('invalid-state', 'retained revision requires exact prepared evidence');
         }
-        const owner = this.getOwnerTaskFailureReference(plan.gapId);
-        if (owner === undefined)
-            throw new ControlPlaneStoreError('invalid-state', 'retained revision requires an owner task failure gap');
         const row = this.#database.prepare('SELECT * FROM source_jobs WHERE plan_id = ?')
             .get(plan.id);
         if (row === undefined)
@@ -2906,7 +3503,6 @@ export class ControlPlaneStore {
             || job.intent.revision === undefined || job.intent.gapId !== plan.gapId
             || job.intent.gapRevision !== plan.gapSnapshot.revision
             || gap.inputDigest !== plan.gapSnapshot.inputDigest
-            || job.intent.ownerDigest !== controlPlaneDigest(owner.owner)
             || controlPlaneDigest(job.intent.owner) !== job.intent.ownerDigest
             || controlPlaneDigest(job.intent.revision) !== controlPlaneDigest(plan.sourceRevision)
             || job.intent.revision.generatorDigest !== plan.generatorDigest
@@ -2916,7 +3512,7 @@ export class ControlPlaneStore {
             || plan.expiresAt !== plan.createdAt + job.intent.ttlMs) {
             throw new ControlPlaneStoreError('invalid-state', 'prepared revision source job binding is corrupt');
         }
-        return { plan, job, reference: owner };
+        return job;
     }
     /** Host-only package bytes for an owner-admitted, still-pending created plugin. */
     readPreparedSourceArtifact(planId) {
@@ -3025,7 +3621,8 @@ export class ControlPlaneStore {
     }
     claimCreationVerification(planId) {
         const job = this.getPreparedSourceJob(planId);
-        const pinned = job.intent.creation?.growthRun?.creationAcceptance;
+        const run = job.intent.creation?.growthRun;
+        const pinned = run && run.protocol !== 'assistant-growth/source-run/v3' ? run.creationAcceptance : undefined;
         if (!pinned || this.#now() >= pinned.expiresAt) {
             throw new ControlPlaneStoreError('invalid-state', 'creation verification requires a current pre-author policy binding');
         }
@@ -3061,21 +3658,42 @@ export class ControlPlaneStore {
         const job = this.getPreparedRevisionJob(plan.id);
         const reference = this.getOwnerTaskFailureReference(plan.gapId);
         validateCreationCapabilitySource(source, certificate);
-        if (!reference || controlPlaneDigest(plan.sourceRevision?.parent) !== controlPlaneDigest(certificate.parent) || !plan.sourceCheck || !plan.preparedEvidence || !plan.sourceRevision?.growthRun
-            || !revisionVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)
-            || !job.intent.revision?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
-            || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
-            || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
-            || plan.preparedEvidence.pack.sha256 !== certificate.plan.artifactSha256
-            || plan.preparedEvidence.pack.sizeBytes !== certificate.plan.artifactBytes
-            || plan.generatorDigest !== certificate.plan.generatorDigest
-            || controlPlaneDigest(reference) !== certificate.source.referenceDigest
-            || controlPlaneDigest(reference.owner) !== certificate.source.ownerDigest
-            || sourceGrowthRunDigest(plan.sourceRevision.growthRun) !== certificate.source.growthRunDigest
-            || sourceGrowthRunDigest(job.intent.revision.growthRun) !== certificate.source.growthRunDigest
-            || controlPlaneDigest(plan.sourceRevision.growthRun.model) !== controlPlaneDigest(certificate.model)
-            || certificate.expiresAt > Math.min(plan.expiresAt, plan.sourceRevision.grant.expiresAt, plan.sourceRevision.growthRun.expiresAt, certificate.authority.expiresAt)) {
-            throw new ControlPlaneStoreError('invalid-input', 'revision verification certificate does not match exact prepared source');
+        if (isPluginRevisionTaskSource(certificate.source)) {
+            if (!reference || controlPlaneDigest(plan.sourceRevision?.parent) !== controlPlaneDigest(certificate.parent) || !plan.sourceCheck || !plan.preparedEvidence || !plan.sourceRevision?.growthRun
+                || !revisionVerificationMatchesPreparedEvidence(certificate, plan.preparedEvidence)
+                || !job.intent.revision?.growthRun || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
+                || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
+                || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
+                || plan.preparedEvidence.pack.sha256 !== certificate.plan.artifactSha256
+                || plan.preparedEvidence.pack.sizeBytes !== certificate.plan.artifactBytes
+                || plan.generatorDigest !== certificate.plan.generatorDigest
+                || controlPlaneDigest(reference) !== certificate.source.referenceDigest
+                || controlPlaneDigest(reference.owner) !== certificate.source.ownerDigest
+                || sourceGrowthRunDigest(plan.sourceRevision.growthRun) !== certificate.source.growthRunDigest
+                || sourceGrowthRunDigest(job.intent.revision.growthRun) !== certificate.source.growthRunDigest
+                || controlPlaneDigest(plan.sourceRevision.growthRun.model) !== controlPlaneDigest(certificate.model)
+                || certificate.expiresAt > Math.min(plan.expiresAt, plan.sourceRevision.grant.expiresAt, plan.sourceRevision.growthRun.expiresAt, certificate.authority.expiresAt)) {
+                throw new ControlPlaneStoreError('invalid-input', 'revision verification certificate does not match exact prepared source');
+            }
+        }
+        else {
+            // Owner-instruction revisions: the signed instruction source replaces
+            // the task reference and growth run, which must be absent on both sides.
+            const instruction = job.intent.ownerInstruction;
+            if (!instruction || plan.sourceRevision?.growthRun !== undefined || job.intent.revision?.growthRun !== undefined
+                || !plan.sourceCheck || !plan.preparedEvidence || certificate.protocol !== 'assistant-growth/revision-verification/v3'
+                || plan.digest !== certificate.plan.digest || plan.name !== certificate.plan.name
+                || plan.sourceCheck.treeDigest !== certificate.plan.sourceTreeDigest
+                || plan.sourceCheck.patchDigest !== certificate.plan.sourcePatchDigest
+                || plan.preparedEvidence.pack.sha256 !== certificate.plan.artifactSha256
+                || plan.preparedEvidence.pack.sizeBytes !== certificate.plan.artifactBytes
+                || plan.generatorDigest !== certificate.plan.generatorDigest
+                || controlPlaneDigest(plan.sourceRevision?.parent) !== controlPlaneDigest(certificate.parent)
+                || certificate.source.instructionDigest !== instruction.digest
+                || growthObjectDigest(job.intent.owner) !== certificate.source.ownerDigest
+                || certificate.expiresAt > Math.min(plan.expiresAt, plan.sourceRevision.grant.expiresAt, certificate.authority.expiresAt)) {
+                throw new ControlPlaneStoreError('invalid-input', 'instruction revision certificate does not match exact prepared source');
+            }
         }
         this.readPreparedSourceArtifact(plan.id);
         if (source.baseCommit !== plan.baseCommit || controlPlaneDigest(source.scope) !== controlPlaneDigest(plan.scope))
@@ -3159,7 +3777,7 @@ export class ControlPlaneStore {
     claimRevisionVerification(planId) {
         const job = this.getPreparedRevisionJob(planId);
         const pinned = job.intent.revision?.growthRun?.revisionAcceptance;
-        if (!pinned || this.#now() >= pinned.expiresAt) {
+        if (job.intent.ownerInstruction === undefined && (!pinned || this.#now() >= pinned.expiresAt)) {
             throw new ControlPlaneStoreError('invalid-state', 'revision verification requires a current pre-author policy binding');
         }
         this.#beginMutation();
@@ -3197,11 +3815,17 @@ export class ControlPlaneStore {
         const source = this.readRevisionSource(plan.id);
         const reference = this.getOwnerTaskFailureReference(plan.gapId);
         const run = plan.sourceRevision?.growthRun;
+        // Regressions exist only for task-failure revisions with frozen acceptance pins.
+        if (!candidate || !isPluginRevisionTaskSource(candidate.source)
+            || candidate.protocol === 'assistant-growth/revision-verification/v3') {
+            throw new ControlPlaneStoreError('invalid-input', 'owner-instruction revisions carry no regression acceptance');
+        }
+        const candidateSource = candidate.source;
         const previousJobs = new Set([...(parent?.observations ?? []), ...(candidate?.observations ?? [])].map(item => item.jobId));
         if (certificate.verifiedAt > this.#now() || certificate.expiresAt <= this.#now()
             || !candidate || !parent || !source || !reference || !run?.revisionRegressionAcceptance
             || !revisionRegressionMatchesCandidate(certificate, candidate, parent)
-            || !job.intent.revision?.growthRun.revisionRegressionAcceptance
+            || !job.intent.revision?.growthRun?.revisionRegressionAcceptance
             || controlPlaneDigest(certificate.plan) !== controlPlaneDigest(candidate.plan)
             || controlPlaneDigest(certificate.source) !== controlPlaneDigest(candidate.source)
             || controlPlaneDigest(certificate.parent) !== controlPlaneDigest(candidate.parent)
@@ -3214,10 +3838,9 @@ export class ControlPlaneStore {
             || controlPlaneDigest(certificate.model) !== controlPlaneDigest(run.model)
             || controlPlaneDigest(certificate.authority) !== controlPlaneDigest(run.revisionRegressionAcceptance)
             || controlPlaneDigest(certificate.authority) !== controlPlaneDigest(job.intent.revision.growthRun.revisionRegressionAcceptance)
-            || certificate.source.referenceDigest !== controlPlaneDigest(reference)
-            || certificate.source.ownerDigest !== controlPlaneDigest(reference.owner)
-            || certificate.source.growthRunDigest !== sourceGrowthRunDigest(run)
-            || sourceGrowthRunDigest(run) !== sourceGrowthRunDigest(job.intent.revision.growthRun)
+            || candidateSource.referenceDigest !== controlPlaneDigest(reference)
+            || candidateSource.ownerDigest !== controlPlaneDigest(reference.owner)
+            || candidateSource.growthRunDigest !== sourceGrowthRunDigest(run)
             || certificate.observations.length !== parent.observations.length
             || certificate.observations.some((item, index) => item.caseId !== parent.observations[index]?.caseId
                 || previousJobs.has(item.parent.jobId) || previousJobs.has(item.candidate.jobId))
@@ -3315,6 +3938,53 @@ export class ControlPlaneStore {
         if (Number(result.changes) !== 1)
             throw new ControlPlaneStoreError('conflict', 'revision regression claim is not current');
     }
+    /**
+     * P1-4 non-inferiority outcome for one evaluated plan window. Rows exist
+     * only under a verified revision verification (FK enforces it); the
+     * contract digest pins which owner contract produced the verdict.
+     */
+    recordRevisionBenefit(planId, input) {
+        if (!/^[a-f0-9]{64}$/u.test(input.contractDigest)
+            || !['insufficient', 'inferior', 'non-inferior'].includes(input.status)
+            || typeof input.reason !== 'string' || !/^[a-z][a-z0-9-]{0,127}$/u.test(input.reason)) {
+            throw new ControlPlaneStoreError('invalid-input', 'revision benefit outcome fields are invalid');
+        }
+        const evaluationJson = JSON.stringify(input.evaluation);
+        if (Buffer.byteLength(evaluationJson) > 1_048_576) {
+            throw new ControlPlaneStoreError('invalid-input', 'revision benefit evaluation exceeds its bound');
+        }
+        this.#beginMutation();
+        try {
+            this.#database.prepare(`INSERT INTO source_revision_benefit_outcomes
+        (plan_id, contract_digest, status, reason, evaluation_json, recorded_at) VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(plan_id) DO UPDATE SET contract_digest=excluded.contract_digest, status=excluded.status,
+        reason=excluded.reason, evaluation_json=excluded.evaluation_json, recorded_at=excluded.recorded_at
+        WHERE source_revision_benefit_outcomes.recorded_at <= excluded.recorded_at`)
+                .run(planId, input.contractDigest, input.status, input.reason, evaluationJson, this.#now());
+            this.#commitMutation();
+        }
+        catch (error) {
+            this.#rollbackMutation();
+            throw error;
+        }
+    }
+    getRevisionBenefitStatus(planId) {
+        const row = this.#database.prepare('SELECT status FROM source_revision_benefit_outcomes WHERE plan_id=?')
+            .get(planId);
+        return row?.status;
+    }
+    inspectRevisionBenefitOutcome(planId) {
+        const row = this.#database.prepare(`SELECT contract_digest,status,reason,recorded_at
+      FROM source_revision_benefit_outcomes WHERE plan_id=?`).get(planId);
+        if (row === undefined)
+            return undefined;
+        if (!/^[a-f0-9]{64}$/u.test(row.contract_digest)
+            || !['insufficient', 'inferior', 'non-inferior'].includes(row.status)
+            || !/^[a-z][a-z0-9-]{0,127}$/u.test(row.reason) || !Number.isSafeInteger(row.recorded_at) || row.recorded_at < 1) {
+            throw new ControlPlaneStoreError('invalid-state', 'revision benefit outcome record is corrupt');
+        }
+        return { contractDigest: row.contract_digest, status: row.status, reason: row.reason, recordedAt: row.recorded_at };
+    }
     readRevisionSource(planId) {
         const certificate = this.getRevisionVerification(planId);
         if (!certificate)
@@ -3593,7 +4263,7 @@ export class ControlPlaneStore {
             ? this.#database.prepare(`SELECT * FROM source_plans WHERE mode = 'modify' ORDER BY created_at, id`).all()
             : this.#database.prepare(`SELECT * FROM source_plans WHERE mode = 'modify' AND expires_at < ? ORDER BY created_at, id`)
                 .all(filter.expiredBefore);
-        return rows.map(sourceFromRow);
+        return rows.map(row => sourceFromRow(row));
     }
     /** Isolated worktrees owned by the background prepared flows, including owner-granted creation. */
     listPreparedSourcePlans(filter) {
@@ -3602,7 +4272,7 @@ export class ControlPlaneStore {
                 .all()
             : this.#database.prepare(`SELECT * FROM source_plans WHERE mode IN ('modify', 'prepared-create', 'prepared-revise') AND expires_at < ? ORDER BY created_at, id`)
                 .all(filter.expiredBefore);
-        return rows.map(sourceFromRow);
+        return rows.map(row => this.#readSourcePlanRow(row));
     }
     /** Retire an expired prepared plan before removing its worktree. The CAS
      * fences owner approval/review, and releases only this plan's gap claim. */
@@ -6241,8 +6911,9 @@ export class ControlPlaneStore {
         const receipt = this.#receipt(idempotencyKey, operation, inputDigest);
         if (receipt === undefined)
             return undefined;
-        const result = sourceSnapshotFromStored(receipt.result);
         const authoritative = this.getSourcePlan(planId);
+        const result = sourceSnapshotFromStored(receipt.result, authoritative.sourceRevision !== undefined
+            && authoritative.sourceRevision.growthRun === undefined);
         if (result.id !== planId || result.digest !== authoritative.digest || result.gapId !== authoritative.gapId
             || result.revision > authoritative.revision
             || (result.approval !== undefined && controlPlaneDigest(result.approval) !== controlPlaneDigest(authoritative.approval))
@@ -6261,7 +6932,9 @@ export class ControlPlaneStore {
         const receipt = this.#receipt(idempotencyKey, operation, inputDigest);
         if (receipt === undefined)
             return undefined;
-        const snapshot = sourceSnapshotFromStored(receipt.result);
+        // The authoritative read below must prove the linked owner instruction
+        // for the historical v3 shape before this receipt can be returned.
+        const snapshot = sourceSnapshotFromStored(receipt.result, true);
         const authoritative = this.getSourcePlan(snapshot.id);
         const replayBinding = { operation: 'create-source-plan', gapId: snapshot.gapId, repository: snapshot.repository,
             worktree: snapshot.worktree, baseCommit: snapshot.baseCommit, name: snapshot.name, generatorDigest: snapshot.generatorDigest,