@humwick/server 0.0.0-stage → 0.130.1

package/src/db/landing-schema.ts

@@ -0,0 +1,479 @@
+import { getDb } from "./connection.ts";
+import { randomUUID } from "node:crypto";
+import { ensureLandTelemetrySchema } from "./land-telemetry-schema.ts";
+
+export const LANDING_AUTHORIZATION_INGRESS_DDL = `
+  CREATE TABLE IF NOT EXISTS landing_authorization_ingress (
+    authorization_event_id INTEGER PRIMARY KEY REFERENCES task_events(id) ON DELETE CASCADE,
+    task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+    workspace_id TEXT NOT NULL,
+    source_ref TEXT NOT NULL,
+    source_head_sha TEXT NOT NULL,
+    frozen_intent TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending', 'retry', 'admitted', 'rejected')),
+    run_id TEXT,
+    version INTEGER NOT NULL DEFAULT 0,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    next_attempt_at INTEGER,
+    last_error_code TEXT,
+    last_error_summary TEXT,
+    queued_at INTEGER NOT NULL,
+    admitted_at INTEGER,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_landing_ingress_due
+    ON landing_authorization_ingress(status, next_attempt_at, authorization_event_id);
+  CREATE INDEX IF NOT EXISTS idx_landing_ingress_workspace
+    ON landing_authorization_ingress(workspace_id, authorization_event_id DESC);
+
+  CREATE TABLE IF NOT EXISTS landing_ingress_audit (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    authorization_event_id INTEGER NOT NULL,
+    transition TEXT NOT NULL,
+    attempt INTEGER NOT NULL,
+    run_id TEXT,
+    error_code TEXT,
+    created_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_landing_ingress_audit_event
+    ON landing_ingress_audit(authorization_event_id, id);
+
+  CREATE TABLE IF NOT EXISTS landing_ingress_backfill_checkpoint (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    last_event_id INTEGER NOT NULL DEFAULT 0,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS landing_controller_ownership (
+    lane_key TEXT PRIMARY KEY,
+    repo_root TEXT NOT NULL,
+    remote_identity TEXT NOT NULL,
+    base_ref TEXT NOT NULL,
+    identity_digest TEXT NOT NULL,
+    controller_token TEXT,
+    controller_phase TEXT NOT NULL CHECK (controller_phase IN ('legacy_open', 'legacy_draining', 'kernel_owned')),
+    phase_rank INTEGER NOT NULL CHECK (phase_rank BETWEEN 0 AND 2),
+    phase_version INTEGER NOT NULL DEFAULT 0,
+    last_progress_at INTEGER,
+    updated_at INTEGER NOT NULL,
+    CHECK (
+      (controller_phase = 'legacy_open' AND phase_rank = 0) OR
+      (controller_phase = 'legacy_draining' AND phase_rank = 1) OR
+      (controller_phase = 'kernel_owned' AND phase_rank = 2)
+    )
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_landing_ownership_identity
+    ON landing_controller_ownership(identity_digest);
+
+  -- Phase 4 dry-run ownership is deliberately a separate fact. It must never be joined to, or
+  -- accepted in place of, the production landing_controller_ownership cutover row.
+  CREATE TABLE IF NOT EXISTS landing_kernel_dry_run_ownership (
+    lane_key TEXT NOT NULL,
+    run_id TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    command_generation INTEGER NOT NULL,
+    attempt INTEGER NOT NULL,
+    phase_ordinal INTEGER NOT NULL,
+    state_version INTEGER NOT NULL,
+    selected_orchestrator_id TEXT NOT NULL,
+    owner_token TEXT NOT NULL UNIQUE,
+    lease_expires_at INTEGER NOT NULL,
+    capability_digest TEXT NOT NULL,
+    safety_digest TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    PRIMARY KEY (lane_key, run_id, generation, command_generation, attempt, phase_ordinal,
+      state_version, selected_orchestrator_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_landing_kernel_dry_run_lease
+    ON landing_kernel_dry_run_ownership(lease_expires_at);
+
+  CREATE TABLE IF NOT EXISTS restart_epochs (
+    id TEXT PRIMARY KEY,
+    state TEXT NOT NULL CHECK (state IN ('requested', 'quiesced', 'deploying', 'released')),
+    deploy_event_id TEXT UNIQUE REFERENCES deploy_events(id),
+    owner_id TEXT NOT NULL,
+    owner_token TEXT NOT NULL,
+    owner_version INTEGER NOT NULL DEFAULT 0,
+    owner_lease_expires_at INTEGER NOT NULL,
+    execution_id TEXT,
+    execution_generation INTEGER NOT NULL DEFAULT 0,
+    execution_state TEXT,
+    terminal_process_proof TEXT CHECK (terminal_process_proof IN ('never_started', 'completed', 'process_tree_dead')),
+    blocker_code TEXT,
+    blocker_detail TEXT,
+    blocker_started_at INTEGER,
+    health TEXT,
+    requested_at INTEGER NOT NULL,
+    quiesced_at INTEGER,
+    deploying_at INTEGER,
+    released_at INTEGER,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epochs_open
+    ON restart_epochs(state, updated_at) WHERE state != 'released';
+
+  -- #2189 P7. Positive liveness evidence ONLY. There is deliberately no 'unknown' or 'read_error'
+  -- member: a subject with no row here is un-proven, and seal treats un-proven exactly like alive.
+  -- Recording "we could not tell" as a row would make an unknown indistinguishable from a proof at
+  -- the one query that must fail closed.
+  CREATE TABLE IF NOT EXISTS restart_epoch_liveness_proofs (
+    evidence_id TEXT PRIMARY KEY,
+    seq INTEGER NOT NULL,
+    epoch_id TEXT NOT NULL REFERENCES restart_epochs(id) ON DELETE CASCADE,
+    subject_type TEXT NOT NULL CHECK (subject_type IN ('command', 'publisher', 'spawn')),
+    subject_id TEXT NOT NULL,
+    execution_generation INTEGER NOT NULL,
+    proof TEXT NOT NULL CHECK (proof IN ('never_started', 'completed', 'process_tree_dead')),
+    detail TEXT,
+    created_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epoch_proofs_subject
+    ON restart_epoch_liveness_proofs(epoch_id, subject_type, subject_id, execution_generation, seq);
+
+  -- The host-registry FACT a takeover is fenced on. Unlike liveness proofs this one DOES carry
+  -- 'unknown', because takeover must be able to tell "the registry answered, and said it cannot
+  -- tell" apart from "nobody asked" — both reject a launch, but only the former is auditable.
+  CREATE TABLE IF NOT EXISTS restart_epoch_host_proofs (
+    proof_id TEXT PRIMARY KEY,
+    epoch_id TEXT NOT NULL REFERENCES restart_epochs(id) ON DELETE CASCADE,
+    execution_id TEXT NOT NULL,
+    verdict TEXT NOT NULL CHECK (verdict IN ('absent', 'present', 'unknown')),
+    detail TEXT,
+    created_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epoch_host_proofs_execution
+    ON restart_epoch_host_proofs(epoch_id, execution_id, created_at DESC);
+
+  CREATE TABLE IF NOT EXISTS restart_epoch_audit (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    epoch_id TEXT NOT NULL,
+    event TEXT NOT NULL,
+    actor TEXT,
+    request_id TEXT,
+    detail TEXT,
+    created_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epoch_audit_epoch ON restart_epoch_audit(epoch_id, id);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_restart_epoch_audit_request
+    ON restart_epoch_audit(epoch_id, event, request_id) WHERE request_id IS NOT NULL;
+
+  -- The bounded release OUTBOX. A page is claimed, committed, published, then settled — so a crash
+  -- between claim and settle re-drives that one page instead of re-scanning the whole backlog.
+  CREATE TABLE IF NOT EXISTS restart_epoch_release_pages (
+    claim_token TEXT PRIMARY KEY,
+    epoch_id TEXT NOT NULL REFERENCES restart_epochs(id) ON DELETE CASCADE,
+    command_ids TEXT NOT NULL,
+    after_command_id TEXT,
+    last_command_id TEXT,
+    claimed_at INTEGER NOT NULL,
+    settled_at INTEGER
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epoch_release_pages_open
+    ON restart_epoch_release_pages(epoch_id, settled_at, claimed_at);
+
+  CREATE TABLE IF NOT EXISTS restart_epoch_wakes (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    epoch_id TEXT NOT NULL,
+    command_id TEXT,
+    reason TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    consumed_at INTEGER
+  );
+  CREATE INDEX IF NOT EXISTS idx_restart_epoch_wakes_pending ON restart_epoch_wakes(consumed_at, id);
+`;
+
+/** #2189 P7 columns on the already-shipped `restart_epochs` table. Additive only — an upgraded
+ *  database reaches them through {@link addMissingColumns}, never a table rewrite. */
+const RESTART_EPOCH_PHASE_SEVEN_COLUMNS: ReadonlyArray<readonly [string, string]> = [
+  ["request_key", "TEXT"],
+  ["intent", "TEXT"],
+  ["proof_high_water", "INTEGER NOT NULL DEFAULT 0"],
+  // 1 while the epoch is open, NULL once released. The partial unique index below turns that into
+  // "at most one open epoch, fleet-wide", enforced by SQLite rather than by a read-then-write.
+  ["open_marker", "INTEGER"],
+  // #2988 — the Host this epoch holds; NULL is a fleet epoch. One open epoch per scope (index below).
+  ["host_id", "TEXT"],
+  ["release_state", "TEXT CHECK (release_state IN ('pending', 'complete'))"],
+  ["release_cursor", "TEXT"],
+  ["terminal_result_id", "TEXT"],
+  // #2317 — a blocker is ordinary on the first seal attempt. The watchdog pages only when this
+  // durable first-blocked timestamp proves the same blocker has made no progress for its threshold.
+  ["blocker_started_at", "INTEGER"],
+  // #2369 — 1 while an unrelated LAND GATE is what makes quiescence impossible. The create/claim
+  // admission seam reads it off the same single-row point read it already does, so keeping spawns
+  // moving through a 30-minute gate costs no extra query on the hot path. Defaults to 0, which is
+  // the fail-closed direction: an epoch that has not yet assessed itself parks everything.
+  ["spawn_admission_deferred", "INTEGER NOT NULL DEFAULT 0"],
+];
+
+const COMMAND_PHASE_ONE_COLUMNS: ReadonlyArray<readonly [string, string]> = [
+  ["controller", "TEXT"],
+  ["controller_version", "INTEGER"],
+  ["controller_token", "TEXT"],
+  ["lane_key", "TEXT"],
+  ["actuator", "TEXT"],
+  ["command_generation", "INTEGER"],
+  ["landing_progress_epoch", "INTEGER"],
+  ["landing_progress_sequence", "INTEGER"],
+  ["restart_sensitive", "INTEGER NOT NULL DEFAULT 0"],
+  ["admission", "TEXT NOT NULL DEFAULT 'admitted' CHECK (admission IN ('admitted', 'parked', 'dry-run'))"],
+  ["blocked_by_epoch_id", "TEXT"],
+  ["execution_id", "TEXT"],
+  ["execution_generation", "INTEGER NOT NULL DEFAULT 0"],
+  ["execution_owner_token", "TEXT"],
+  ["process_group_id", "INTEGER"],
+  ["transient_unit", "TEXT"],
+  ["terminal_process_proof", "TEXT CHECK (terminal_process_proof IN ('never_started', 'completed', 'process_tree_dead'))"],
+  ["landing_blocker_code", "TEXT"],
+  ["landing_blocker_detail", "TEXT"],
+  ["landing_containment_mode", "TEXT CHECK (landing_containment_mode IN ('cgroup-v2-close-v1', 'legacy-unfenced-v0'))"],
+  ["landing_workspace_id", "TEXT"],
+  ["landing_source_head_sha", "TEXT"],
+  ["landing_attempt_ordinal", "INTEGER"],
+  // #2994 — last refused claim by the land's own host where only the lane refused it (cross-host FIFO).
+  ["lane_wait_at", "INTEGER"],
+  // #2987 — stacked lane: the depth in force at claim, the member stacked on with its candidate, and
+  // this land's own reported candidate.
+  ["landing_stack_depth", "INTEGER"],
+  ["landing_stack_base", "TEXT"],
+  ["landing_stack_base_sha", "TEXT"],
+  ["landing_candidate_sha", "TEXT"],
+];
+
+const LANDING_CONTROLLER_CUTOVER_COLUMNS: ReadonlyArray<readonly [string, string]> = [
+  ["safety_digest", "TEXT"],
+  ["selected_host_digest", "TEXT"],
+  ["retirement_digest", "TEXT"],
+  ["retirement_total", "INTEGER NOT NULL DEFAULT 0"],
+  ["retirement_proven", "INTEGER NOT NULL DEFAULT 0"],
+  ["cutover_requested_by", "TEXT"],
+  ["cutover_request_id", "TEXT"],
+  ["closed_at", "INTEGER"],
+  ["completed_at", "INTEGER"],
+  ["blocker_code", "TEXT"],
+  ["blocker_detail", "TEXT"],
+  ["last_progress_at", "INTEGER"],
+];
+
+const DEPLOY_PHASE_ONE_COLUMNS: ReadonlyArray<readonly [string, string]> = [
+  ["restart_epoch_id", "TEXT"],
+  ["execution_id", "TEXT"],
+  ["execution_generation", "INTEGER NOT NULL DEFAULT 0"],
+  ["terminal_process_proof", "TEXT CHECK (terminal_process_proof IN ('never_started', 'completed', 'process_tree_dead'))"],
+  ["rollout_partial", "INTEGER"],
+];
+
+function addMissingColumns(table: string, columns: ReadonlyArray<readonly [string, string]>): void {
+  const present = new Set((getDb().query(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>).map((row) => row.name));
+  for (const [name, definition] of columns) {
+    if (!present.has(name)) getDb().run(`ALTER TABLE ${table} ADD COLUMN ${name} ${definition}`);
+  }
+}
+
+/** Phase 4 widens the already-shipped command admission enum. SQLite cannot ALTER a column CHECK and
+ * bun:sqlite is DEFENSIVE (no writable_schema edit, #2995), so swap the column: add the widened one,
+ * copy, drop the old (after its indexes, which this installer recreates), rename. One transaction. */
+function widenCommandAdmissionForDryRun(): void {
+  const row = getDb().query("SELECT sql FROM sqlite_schema WHERE type = 'table' AND name = 'commands'").get() as { sql: string } | undefined;
+  if (!row?.sql.includes("CHECK (admission IN ('admitted', 'parked'))")) return;
+  getDb().transaction(() => {
+    getDb().run("DROP INDEX IF EXISTS idx_commands_restart_admission");
+    getDb().run("DROP INDEX IF EXISTS idx_commands_parked_epoch");
+    getDb().run("ALTER TABLE commands ADD COLUMN admission_next TEXT NOT NULL DEFAULT 'admitted' CHECK (admission_next IN ('admitted', 'parked', 'dry-run'))");
+    getDb().run("UPDATE commands SET admission_next = admission");
+    getDb().run("ALTER TABLE commands DROP COLUMN admission");
+    getDb().run("ALTER TABLE commands RENAME COLUMN admission_next TO admission");
+  })();
+}
+
+/** #2988: epochs are admission holds; a deploy ledger row binds when sealed epochs deploy, so the
+ * shipped NOT NULL goes. bun:sqlite runs DEFENSIVE (writable_schema is a no-op), so this is SQLite's
+ * documented rebuild: foreign keys off so the evidence tables' ON DELETE CASCADE never fires. */
+function relaxRestartEpochDeployEventId(): void {
+  const row = getDb().query("SELECT sql FROM sqlite_schema WHERE type = 'table' AND name = 'restart_epochs'").get() as { sql: string } | undefined;
+  const oldColumn = "deploy_event_id TEXT NOT NULL UNIQUE REFERENCES deploy_events(id)";
+  if (!row?.sql.includes(oldColumn)) return;
+  const indexes = getDb().query("SELECT sql FROM sqlite_schema WHERE type = 'index' AND tbl_name = 'restart_epochs' AND sql IS NOT NULL")
+    .all() as Array<{ sql: string }>;
+  const relaxed = row.sql.replace(oldColumn, "deploy_event_id TEXT UNIQUE REFERENCES deploy_events(id)")
+    .replace(/^CREATE TABLE "?restart_epochs"?/, "CREATE TABLE restart_epochs_relaxed");
+  getDb().run("PRAGMA foreign_keys = OFF");
+  try {
+    getDb().transaction(() => {
+      getDb().run(relaxed);
+      getDb().run("INSERT INTO restart_epochs_relaxed SELECT * FROM restart_epochs");
+      getDb().run("DROP TABLE restart_epochs");
+      getDb().run("ALTER TABLE restart_epochs_relaxed RENAME TO restart_epochs");
+      for (const index of indexes) getDb().run(index.sql);
+    })();
+  } finally {
+    getDb().run("PRAGMA foreign_keys = ON");
+  }
+}
+
+/** Startup-only schema install shared by fresh catalog bootstrap and upgraded databases. */
+export function ensureLandingPhaseOneSchema(): void {
+  if (getDb().inTransaction) throw new Error("landing phase-one schema must install outside a transaction");
+  getDb().run(LANDING_AUTHORIZATION_INGRESS_DDL);
+  getDb().run(`
+    CREATE TRIGGER IF NOT EXISTS trg_landing_ownership_rank_monotonic
+    BEFORE UPDATE OF phase_rank ON landing_controller_ownership
+    WHEN NEW.phase_rank < OLD.phase_rank
+    BEGIN
+      SELECT RAISE(ABORT, 'landing ownership phase rank cannot decrease');
+    END
+  `);
+  addMissingColumns("commands", COMMAND_PHASE_ONE_COLUMNS);
+  widenCommandAdmissionForDryRun();
+  getDb().run(`UPDATE commands SET
+    landing_workspace_id = json_extract(params, '$.workspaceId'),
+    landing_source_head_sha = lower(json_extract(params, '$.expectedHeadSha'))
+    WHERE type = 'workspace.merge' AND json_valid(params)
+      AND (landing_workspace_id IS NULL OR landing_source_head_sha IS NULL)`);
+  getDb().run(`WITH ranked AS (
+    SELECT rowid AS command_rowid,
+      row_number() OVER (PARTITION BY landing_workspace_id, landing_source_head_sha
+        ORDER BY created_at, rowid) - 1 AS ordinal
+    FROM commands WHERE type = 'workspace.merge'
+      AND landing_workspace_id IS NOT NULL AND landing_source_head_sha IS NOT NULL
+  ) UPDATE commands SET landing_attempt_ordinal = (
+    SELECT ordinal FROM ranked WHERE ranked.command_rowid = commands.rowid
+  ) WHERE type = 'workspace.merge' AND landing_attempt_ordinal IS NULL`);
+  // #2184 Design B: old merge rows are explicitly compatibility-mode. Never infer fencing from
+  // newer controller/execution columns because historical partial rows can contain any subset.
+  getDb().run(`UPDATE commands SET landing_containment_mode = 'legacy-unfenced-v0'
+    WHERE type = 'workspace.merge' AND landing_containment_mode IS NULL`);
+  addMissingColumns("landing_controller_ownership", [["controller_token", "TEXT"]]);
+  addMissingColumns("landing_controller_ownership", LANDING_CONTROLLER_CUTOVER_COLUMNS);
+  getDb().run(`UPDATE landing_controller_ownership SET last_progress_at = updated_at
+    WHERE last_progress_at IS NULL`);
+  const tokenlessOwnership = getDb().query("SELECT lane_key FROM landing_controller_ownership WHERE controller_token IS NULL").all() as Array<{ lane_key: string }>;
+  for (const row of tokenlessOwnership) getDb().query("UPDATE landing_controller_ownership SET controller_token = ? WHERE lane_key = ? AND controller_token IS NULL").run(randomUUID(), row.lane_key);
+  addMissingColumns("deploy_events", DEPLOY_PHASE_ONE_COLUMNS);
+  addMissingColumns("landing_receipts", [["landing_kind", "TEXT CHECK (landing_kind IN ('kernel', 'external'))"]]);
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_commands_landing_lane ON commands(controller, lane_key, status)");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_commands_landing_shadow ON commands(type, landing_workspace_id, landing_source_head_sha, created_at DESC)");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_landing_receipts_workspace_landed ON landing_receipts(workspace_id, landed_at DESC)");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_commands_restart_admission ON commands(restart_sensitive, admission, status)");
+  // #2189 P7 — the release outbox pages parked commands by id, so the keyset scan must be indexed on
+  // exactly (epoch, id) and must not touch a row of any other admission.
+  addMissingColumns("restart_epochs", RESTART_EPOCH_PHASE_SEVEN_COLUMNS);
+  relaxRestartEpochDeployEventId();
+  getDb().run(`CREATE INDEX IF NOT EXISTS idx_commands_parked_epoch
+    ON commands(blocked_by_epoch_id, id) WHERE admission = 'parked'`);
+  // #2988 — at most one open epoch per scope; '' is the fleet scope.
+  getDb().run("DROP INDEX IF EXISTS idx_restart_epochs_single_open");
+  getDb().run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_restart_epochs_scope_open
+    ON restart_epochs(coalesce(host_id, '')) WHERE open_marker IS NOT NULL`);
+  // Serves the admission seam's target → Host point read.
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_orchestrators_agent ON orchestrators(agent_id)");
+  getDb().run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_restart_epochs_request_key
+    ON restart_epochs(request_key) WHERE request_key IS NOT NULL`);
+  getDb().run(`
+    CREATE TABLE IF NOT EXISTS landing_command_audit (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      command_id TEXT NOT NULL,
+      lane_key TEXT NOT NULL,
+      event TEXT NOT NULL,
+      reason TEXT,
+      controller_token TEXT,
+      execution_generation INTEGER,
+      detail TEXT,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_command_audit_command ON landing_command_audit(command_id, id);
+    CREATE TABLE IF NOT EXISTS landing_publish_permits (
+      id TEXT PRIMARY KEY,
+      command_id TEXT NOT NULL,
+      lane_key TEXT NOT NULL,
+      controller_token TEXT NOT NULL,
+      execution_generation INTEGER NOT NULL,
+      expected_base_sha TEXT NOT NULL,
+      source_ref TEXT NOT NULL,
+      source_head_sha TEXT NOT NULL,
+      push_attempt_id TEXT,
+      consumed_at INTEGER,
+      retired_at INTEGER,
+      issued_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS landing_execution_proofs (
+      evidence_id TEXT PRIMARY KEY,
+      command_id TEXT NOT NULL,
+      execution_generation INTEGER NOT NULL,
+      proof TEXT NOT NULL CHECK (proof IN ('never_started', 'completed', 'process_tree_dead')),
+      host_evidence TEXT,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_execution_proof_command ON landing_execution_proofs(command_id, execution_generation);
+    CREATE TABLE IF NOT EXISTS landing_command_retirements (
+      request_id TEXT PRIMARY KEY,
+      command_id TEXT NOT NULL,
+      lane_key TEXT NOT NULL,
+      run_tuple TEXT NOT NULL,
+      reason TEXT NOT NULL,
+      command_generation INTEGER NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('pending', 'completed')),
+      created_at INTEGER NOT NULL,
+      completed_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_command_retirements_pending
+      ON landing_command_retirements(status, created_at, request_id);
+  `);
+  addMissingColumns("landing_publish_permits", [
+    ["push_attempt_id", "TEXT"], ["consumed_at", "INTEGER"], ["retired_at", "INTEGER"],
+    ["base_ref", "TEXT"], ["candidate_head_sha", "TEXT"], ["gate_attestation_digest", "TEXT"],
+    ["observation_generation", "INTEGER"], ["expected_restart_epoch", "TEXT"],
+    ["run_tuple", "TEXT"], ["workspace_head", "TEXT"], ["lane_token", "TEXT"],
+    ["frozen_argv", "TEXT"], ["fence_digest", "TEXT"],
+  ]);
+  getDb().run("DROP INDEX IF EXISTS idx_landing_publish_permit_attempt");
+  getDb().run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_landing_publish_permit_attempt
+    ON landing_publish_permits(command_id, push_attempt_id)`);
+  getDb().run("CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_events_restart_epoch ON deploy_events(restart_epoch_id) WHERE restart_epoch_id IS NOT NULL");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_deploy_events_execution ON deploy_events(execution_id) WHERE execution_id IS NOT NULL");
+  getDb().run(`
+    CREATE TABLE IF NOT EXISTS landing_controller_retirement (
+      lane_key TEXT NOT NULL,
+      cutover_version INTEGER NOT NULL,
+      command_id TEXT NOT NULL,
+      snapshot_execution_generation INTEGER NOT NULL,
+      current_execution_generation INTEGER NOT NULL,
+      snapshot_status TEXT NOT NULL,
+      proof TEXT CHECK (proof IN ('never_started', 'completed', 'process_tree_dead')),
+      evidence_id TEXT,
+      proven_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (lane_key, cutover_version, command_id),
+      UNIQUE (evidence_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_retirement_unproven
+      ON landing_controller_retirement(lane_key, cutover_version, proof, command_id);
+    CREATE TABLE IF NOT EXISTS landing_controller_audit (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lane_key TEXT NOT NULL,
+      phase_version INTEGER NOT NULL,
+      event TEXT NOT NULL,
+      request_id TEXT,
+      detail TEXT,
+      created_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_controller_audit_lane
+      ON landing_controller_audit(lane_key, id);
+    CREATE TABLE IF NOT EXISTS landing_controller_wakes (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lane_key TEXT NOT NULL,
+      phase_version INTEGER NOT NULL,
+      run_id TEXT,
+      reason TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      consumed_at INTEGER
+    );
+    CREATE INDEX IF NOT EXISTS idx_landing_controller_wakes_pending
+      ON landing_controller_wakes(consumed_at, id);
+  `);
+  ensureLandTelemetrySchema();
+}

package/src/db/launch-facts.ts

@@ -0,0 +1,60 @@
+// #1245 — who launched a runner agent, written once per fresh launch and never by a successor (restart,
+// resume, self-restart, in-place re-mint). Successor mints re-derive their ceiling from it at mint time
+// against the CURRENT profile, so a later profile grant reaches long-lived agents without a stored copy.
+import { getDb } from "./connection.ts";
+
+export type LaunchFact = (
+  /** Agent-initiated: the parent's current derived scopes bound it. A missing parent confers nothing. */
+  | { kind: "agent"; parentAgentId?: string; profile?: string }
+  /** Root (non-agent) launch: Relay itself (no launcherScopes) or a caller holding launcherScopes. */
+  | { kind: "root"; launcherScopes?: string[]; profile?: string }
+) & { maxSpawnedAgents?: number };
+
+export function ensureLaunchFactsSchema(): void {
+  // The #3110 ceilings stored copied issued scopes; launch facts replace them.
+  getDb().run("DROP TABLE IF EXISTS agent_delegation_ceilings");
+  getDb().run(`
+    CREATE TABLE IF NOT EXISTS agent_launch_facts (
+      agent_id TEXT PRIMARY KEY,
+      agent_initiated INTEGER NOT NULL,
+      parent_agent_id TEXT,
+      launcher_scopes TEXT,
+      profile TEXT,
+      max_spawned_agents INTEGER,
+      launched_at INTEGER NOT NULL
+    )
+  `);
+  const columns = getDb().query("PRAGMA table_info(agent_launch_facts)").all() as Array<{ name: string }>;
+  if (!columns.some(column => column.name === "max_spawned_agents")) getDb().run("ALTER TABLE agent_launch_facts ADD COLUMN max_spawned_agents INTEGER");
+}
+
+/** A fresh launch replaces the agent's previous launch fact; successors never call this. */
+export function recordLaunchFact(agentId: string, fact: LaunchFact, now = Date.now()): void {
+  const parent = fact.kind === "agent" ? fact.parentAgentId ?? null : null;
+  const scopes = fact.kind === "root" && fact.launcherScopes ? JSON.stringify(fact.launcherScopes) : null;
+  getDb().query(`
+    INSERT INTO agent_launch_facts (agent_id, agent_initiated, parent_agent_id, launcher_scopes, profile, max_spawned_agents, launched_at) VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(agent_id) DO UPDATE SET agent_initiated = excluded.agent_initiated, parent_agent_id = excluded.parent_agent_id,
+      launcher_scopes = excluded.launcher_scopes, profile = excluded.profile, max_spawned_agents = excluded.max_spawned_agents, launched_at = excluded.launched_at
+  `).run(agentId, fact.kind === "agent" ? 1 : 0, parent, scopes, fact.profile ?? null, fact.maxSpawnedAgents ?? null, now);
+}
+
+function scopeList(raw: string): string[] {
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    return Array.isArray(parsed) ? parsed.filter((item): item is string => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+
+export function getLaunchFact(agentId: string): LaunchFact | null {
+  const row = getDb().query("SELECT agent_initiated, parent_agent_id, launcher_scopes, profile, max_spawned_agents FROM agent_launch_facts WHERE agent_id = ?").get(agentId) as
+    | { agent_initiated: number; parent_agent_id: string | null; launcher_scopes: string | null; profile: string | null; max_spawned_agents: number | null }
+    | null;
+  if (!row) return null;
+  const profile = { ...(row.profile ? { profile: row.profile } : {}), ...(row.max_spawned_agents === null ? {} : { maxSpawnedAgents: row.max_spawned_agents }) };
+  if (row.agent_initiated === 1) return { kind: "agent", ...(row.parent_agent_id ? { parentAgentId: row.parent_agent_id } : {}), ...profile };
+  // An unreadable scope list fails closed: the launcher confers nothing beyond the baseline.
+  return { kind: "root", ...(row.launcher_scopes === null ? {} : { launcherScopes: scopeList(row.launcher_scopes) }), ...profile };
+}

package/src/db/legacy-landing-publication.ts

@@ -0,0 +1,103 @@
+import { normalizeLandingBaseRef } from "../landing-base-ref";
+// #2765: consumed permits are history, not a permanent veto after proven execution death.
+// Keep consumption immutable; exact receipt/owning-host evidence resolves each push attempt.
+import { getDb } from "./connection.ts";
+import { getCommand } from "../commands-db.ts";
+import type { LandingTargetObservation } from "../services/legacy-landing-host.ts";
+
+export interface LegacyConsumedPermit {
+  id: string; commandId: string; laneKey: string; controllerToken: string;
+  executionGeneration: number; candidateHeadSha: string | null; sourceHeadSha: string;
+  baseRef: string | null; frozenArgv: string | null; issuedAt: number;
+}
+
+export function consumedLegacyPermits(commandId: string): LegacyConsumedPermit[] {
+  return getDb().query(`SELECT id, command_id AS commandId, lane_key AS laneKey,
+    controller_token AS controllerToken, execution_generation AS executionGeneration,
+    candidate_head_sha AS candidateHeadSha, source_head_sha AS sourceHeadSha,
+    base_ref AS baseRef, frozen_argv AS frozenArgv, issued_at AS issuedAt
+    FROM landing_publish_permits WHERE command_id = ? AND consumed_at IS NOT NULL`).all(commandId) as LegacyConsumedPermit[];
+}
+
+export function terminalConsumedLegacyPermits(workspaceId: string): LegacyConsumedPermit[] {
+  const commands = getDb().query(`SELECT id FROM commands WHERE correlation_id = ?
+    AND type = 'workspace.merge' AND controller = 'legacy'
+    AND status IN ('failed', 'timed_out', 'canceled', 'rejected')`).all(workspaceId) as Array<{ id: string }>;
+  return commands.flatMap((command) => consumedLegacyPermits(command.id)).filter((permit) =>
+    !resolvedEvidence(permit, 'publish-landed') && !resolvedEvidence(permit, 'publish-not-landed'));
+}
+
+function stopped(commandId: string, generation: number): boolean {
+  const command = getCommand(commandId);
+  return Boolean(command && ['failed', 'timed_out', 'canceled', 'rejected'].includes(command.status)
+    && command.landingContainmentMode === 'cgroup-v2-close-v1' && command.executionGeneration === generation
+    && (command.terminalProcessProof === 'completed' || command.terminalProcessProof === 'process_tree_dead')
+    && getDb().query(`SELECT 1 FROM landing_execution_proofs WHERE command_id = ?
+      AND execution_generation = ? AND proof IN ('completed', 'process_tree_dead') LIMIT 1`).get(commandId, generation));
+}
+
+function receiptSettled(permit: LegacyConsumedPermit): boolean {
+  const command = getCommand(permit.commandId);
+  const remote = command?.params.remoteIdentity;
+  const base = permit.baseRef ?? command?.params.baseRef;
+  if (typeof remote !== 'string' || typeof base !== 'string') return false;
+  // Receipts use the Task's issue-repo slug; exact workspace attribution is also durable.
+  const githubRepo = remote.startsWith('remote:github.com/') ? remote.slice('remote:github.com/'.length) : remote;
+  return Boolean(getDb().query(`SELECT 1 FROM landing_receipts r WHERE r.ref = ?1
+    AND (r.repo IN (?2, ?3) OR r.workspace_id = ?4) AND r.landed_at >= ?5
+    AND (r.tip_sha IN (?6, ?7) OR EXISTS (SELECT 1 FROM json_each(r.commit_shas) WHERE value IN (?6, ?7))) LIMIT 1`)
+    .get(normalizeLandingBaseRef(base), remote, githubRepo, command?.correlationId ?? '', permit.issuedAt, permit.sourceHeadSha, permit.candidateHeadSha));
+}
+
+function resolvedEvidence(permit: LegacyConsumedPermit, event: string): boolean {
+  return Boolean(getDb().query(`SELECT 1 FROM landing_command_audit WHERE command_id = ? AND event = ?
+    AND controller_token = ? AND execution_generation = ?
+    AND json_extract(detail, '$.permitId') = ? AND json_extract(detail, '$.candidateHeadSha') = ? LIMIT 1`)
+    .get(permit.commandId, event, permit.controllerToken, permit.executionGeneration, permit.id, permit.candidateHeadSha));
+}
+
+export function legacyPublicationState(commandId: string): 'none' | 'not-landed' | 'settled' | 'unresolved' {
+  const permits = consumedLegacyPermits(commandId);
+  if (!permits.length) return 'none';
+  if (permits.some((permit) => receiptSettled(permit) || resolvedEvidence(permit, 'publish-landed'))) return 'settled';
+  return permits.every((permit) => stopped(commandId, permit.executionGeneration)
+    && resolvedEvidence(permit, 'publish-not-landed')) ? 'not-landed' : 'unresolved';
+}
+
+export interface ResolveLegacyPublicationArgs {
+  permit: LegacyConsumedPermit;
+  executionId: string; executionOwnerToken: string; controllerVersion: number;
+  observation: LandingTargetObservation;
+}
+
+/** Writer CAS after host I/O: no live publisher, changed permit/fence, stale host or unknown target. */
+export function resolveLegacyPublicationBody(args: ResolveLegacyPublicationArgs, now: number): { resolved: boolean } {
+  const expected = args.permit;
+  const permit = consumedLegacyPermits(expected.commandId).find((row) => row.id === expected.id);
+  const command = getCommand(expected.commandId);
+  if (!permit || !command || Object.entries(permit).some(([key, value]) => expected[key as keyof LegacyConsumedPermit] !== value)
+    || !stopped(command.id, permit.executionGeneration) || command.controller !== 'legacy'
+    || command.executionId !== args.executionId || command.executionOwnerToken !== args.executionOwnerToken
+    || command.controllerVersion !== args.controllerVersion || command.controllerToken !== permit.controllerToken
+    || command.laneKey !== permit.laneKey || !permit.candidateHeadSha || !permit.baseRef
+    || typeof command.params.baseRef !== 'string' || normalizeLandingBaseRef(permit.baseRef) !== normalizeLandingBaseRef(command.params.baseRef)
+    || permit.sourceHeadSha !== (getDb().query("SELECT landing_source_head_sha AS sha FROM commands WHERE id = ?").get(command.id) as { sha: string | null }).sha) return { resolved: false };
+  const baseRef = normalizeLandingBaseRef(permit.baseRef);
+  let argv: unknown;
+  try { argv = JSON.parse(permit.frozenArgv ?? 'null'); } catch { return { resolved: false }; }
+  if (!Array.isArray(argv) || argv.length !== 3 || argv[0] !== 'push'
+    || typeof argv[1] !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(argv[1])
+    || argv[2] !== `${permit.candidateHeadSha}:refs/heads/${baseRef}`) return { resolved: false };
+  const observation = args.observation;
+  if (observation.remoteIdentity !== command.params.remoteIdentity || !observation.targetRef.startsWith(`${argv[1]}/`)
+    || normalizeLandingBaseRef(observation.targetRef.slice(argv[1].length + 1)) !== baseRef
+    || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(observation.targetHeadSha ?? '')
+    || !((observation.status === 'negative' && observation.sourceContained === false && observation.candidateContained === false)
+      || (observation.status === 'positive' && (observation.sourceContained === true || observation.candidateContained === true)))) return { resolved: false };
+  const event = receiptSettled(permit) || observation.status === 'positive' ? 'publish-landed' : 'publish-not-landed';
+  if (!resolvedEvidence(permit, event)) getDb().query(`INSERT INTO landing_command_audit
+    (command_id, lane_key, event, controller_token, execution_generation, detail, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?)`).run(command.id, permit.laneKey, event, permit.controllerToken,
+      permit.executionGeneration, JSON.stringify({ permitId: permit.id, candidateHeadSha: permit.candidateHeadSha, observation }), now);
+  return { resolved: true };
+}