@jungjaehoon/mama-os 0.24.2 → 0.25.0

package/dist/operator/task-ledger.js

@@ -2,15 +2,15 @@
 /**
  * TaskLedger - the operator-owned native work-item ledger (M8 Task 0.1).
  *
- * Ports the SHAPE of Kagemusha's proven task store (11 columns: id/title/status/
- * priority/deadline/source/auto_created/confirmed/timestamps) plus `assignee`
- * and an idempotency key. Implements the pre-existing `TaskSource` interface
- * (operator-interfaces.ts) so the board projects ONE task model, not two.
+ * Extends the shape of Kagemusha's proven task store with assignment,
+ * idempotency, temporal scheduling, durable generation, effect receipt, and
+ * workorder state. Implements the pre-existing `TaskSource` interface
+ * (operator-interfaces.ts) so the board projects one task model, not two.
  *
  * Reconcile runs create/update rows through the task_create/task_update gateway
  * tools; the pipeline board slot is a projection of `list({order:
- * 'deadline_priority'})`. The AGENT makes every judgment about what becomes a
- * task; this store only persists.
+ * 'deadline_priority'})`. The agent proposes task changes, while this ledger
+ * enforces revisions, temporal ownership, idempotency, and atomic receipts.
  *
  * Schema-extension note: CREATE TABLE IF NOT EXISTS is a no-op on existing
  * tables. Any post-ship column addition needs an explicit ALTER TABLE guarded
@@ -20,8 +20,11 @@
  * (start.ts opens and closes it once) - deliberately no close() here.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TaskLedger = exports.WORKORDER_CHANNEL_PREFIX = exports.WORKORDER_KINDS = exports.TASK_KINDS = exports.TASK_PRIORITIES = exports.TASK_STATUSES = void 0;
+exports.TaskLedger = exports.WORKORDER_CHANNEL_PREFIX = exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS = exports.WORKORDER_KINDS = exports.TASK_KINDS = exports.TASK_PRIORITIES = exports.TASK_STATUSES = void 0;
 const node_crypto_1 = require("node:crypto");
+const operator_task_temporal_js_1 = require("../db/migrations/operator-task-temporal.js");
+const temporal_effect_js_1 = require("./temporal-effect.js");
+const task_temporal_js_1 = require("./task-temporal.js");
 exports.TASK_STATUSES = [
     'pending',
     'in_progress',
@@ -35,7 +38,8 @@ exports.TASK_STATUSES = [
 ];
 exports.TASK_PRIORITIES = ['high', 'normal', 'low'];
 exports.TASK_KINDS = ['owner', 'system'];
-exports.WORKORDER_KINDS = ['board', 'wiki', 'memory-curation'];
+exports.WORKORDER_KINDS = ['board', 'wiki', 'memory-curation', 'temporal'];
+exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS = 3;
 /** source_channel namespace for workorder rows: 'workorder:<workKind>'. */
 exports.WORKORDER_CHANNEL_PREFIX = 'workorder:';
 const KNOWN_WORKORDER_CHANNELS = exports.WORKORDER_KINDS.map((workKind) => `${exports.WORKORDER_CHANNEL_PREFIX}${workKind}`);
@@ -64,7 +68,7 @@ function assertIsoDate(value, field) {
         throw new Error(`${field} must be an ISO date (YYYY-MM-DD), got: ${value}`);
     }
 }
-function rowToRecord(row) {
+function rowToRecord(row, now, timeZone) {
     return {
         id: row.id,
         title: row.title,
@@ -79,20 +83,44 @@ function rowToRecord(row) {
         latestEvent: row.latest_event,
         autoCreated: row.auto_created === 1,
         confirmed: row.confirmed === 1,
+        dueAt: row.due_at,
+        deadlineOffsetMinutes: row.deadline_offset_minutes,
+        revision: row.revision,
+        temporalEpoch: row.temporal_epoch,
+        temporalReconciledOccurrenceKey: row.temporal_reconciled_occurrence_key,
+        lastTemporalCheckedAt: row.last_temporal_checked_at,
+        nextTemporalCheckAt: row.next_temporal_check_at,
+        lastTemporalAttemptId: row.last_temporal_attempt_id,
+        temporalState: (0, task_temporal_js_1.deriveTemporalState)({
+            status: row.status,
+            dueAt: row.due_at,
+            deadlineIso: row.deadline,
+            deadlineOffsetMinutes: row.deadline_offset_minutes,
+        }, now, timeZone),
         createdAt: row.created_at,
         updatedAt: row.updated_at,
     };
 }
 class TaskLedger {
     db;
-    constructor(db) {
+    now;
+    timeZone;
+    constructor(db, options = {}) {
         this.db = db;
+        this.now = options.now ?? Date.now;
+        this.timeZone = options.timeZone ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
+        // Validate the injected or boot-resolved zone once, before reads depend on it.
+        new Intl.DateTimeFormat('en-US', { timeZone: this.timeZone }).format(0);
         this.runMigration();
     }
+    toRecord(row) {
+        return rowToRecord(row, this.now(), this.timeZone);
+    }
     runMigration() {
         // Both construction sites (start.ts boot + operator-handler lazy) run this;
         // busy_timeout here covers BOTH connections against the rebuild race.
         this.db.pragma('busy_timeout = 5000');
+        this.db.pragma('foreign_keys = ON');
         this.db.exec(`
       CREATE TABLE IF NOT EXISTS operator_tasks (${TaskLedger.TABLE_COLUMNS_SQL});
       ${TaskLedger.INDEXES_SQL}
@@ -107,6 +135,10 @@ class TaskLedger {
         ON operator_no_update_notes(scope, id);
     `);
         this.upgradeSchema();
+        const foreignKeyViolations = this.db.pragma('foreign_key_check');
+        if (foreignKeyViolations.length > 0) {
+            throw new Error(`operator task migration found ${foreignKeyViolations.length} foreign key violation(s)`);
+        }
     }
     /** Full current column set - single source for CREATE and the rebuild copy. */
     static TABLE_COLUMNS_SQL = `
@@ -124,6 +156,15 @@ class TaskLedger {
         latest_event TEXT,
         auto_created INTEGER NOT NULL DEFAULT 1,
         confirmed INTEGER NOT NULL DEFAULT 0,
+        due_at INTEGER,
+        deadline_offset_minutes INTEGER
+          CHECK (deadline_offset_minutes BETWEEN -840 AND 840),
+        revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
+        temporal_epoch INTEGER NOT NULL DEFAULT 0 CHECK (temporal_epoch >= 0),
+        temporal_reconciled_occurrence_key TEXT,
+        last_temporal_checked_at INTEGER,
+        next_temporal_check_at INTEGER,
+        last_temporal_attempt_id INTEGER,
         created_at INTEGER NOT NULL,
         updated_at INTEGER NOT NULL`;
     // Unique-index predicate excludes terminal rows so a terminal keyed workorder
@@ -187,6 +228,7 @@ class TaskLedger {
                     }
                 }
             }
+            (0, operator_task_temporal_js_1.applyOperatorTaskTemporalMigration)(this.db);
             // Old-predicate unique index (no terminal exclusion) -> swap in place.
             const idxRow = this.db
                 .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND name='idx_operator_tasks_source'`)
@@ -249,7 +291,26 @@ class TaskLedger {
          ORDER BY ${order}
          LIMIT ?`)
             .all(...params, limit);
-        return rows.map(rowToRecord);
+        return rows.map((row) => this.toRecord(row));
+    }
+    /** Internal bounded page for temporal reconciliation; excludes rows that can never be candidates. */
+    listTemporalScanPage(input) {
+        const rawLimit = Number(input.limit);
+        const rawAfterId = Number(input.afterId);
+        const limit = Number.isFinite(rawLimit)
+            ? Math.max(1, Math.min(200, Math.floor(rawLimit)))
+            : 200;
+        const afterId = Number.isFinite(rawAfterId) ? Math.max(0, Math.floor(rawAfterId)) : 0;
+        const rows = this.db
+            .prepare(`SELECT * FROM operator_tasks INDEXED BY idx_operator_tasks_temporal_scan_id
+         WHERE kind = 'owner'
+           AND status IN ('pending','in_progress','review','blocked')
+           AND id > ?
+           AND (due_at IS NOT NULL OR deadline IS NOT NULL OR next_temporal_check_at IS NOT NULL)
+         ORDER BY id ASC
+         LIMIT ?`)
+            .all(afterId, limit);
+        return rows.map((row) => this.toRecord(row));
     }
     /** Owner rows only - system workorder rows are invisible to external reads. */
     getById(id) {
@@ -259,7 +320,7 @@ class TaskLedger {
     /** Internal fetch without the kind filter (guards and workorder paths). */
     getRowById(id) {
         const row = this.db.prepare(`SELECT * FROM operator_tasks WHERE id = ?`).get(id);
-        return row ? rowToRecord(row) : null;
+        return row ? this.toRecord(row) : null;
     }
     /**
      * Create a task. Idempotent under at-least-once delivery: a duplicate
@@ -286,7 +347,13 @@ class TaskLedger {
             assertEnum(input.priority, exports.TASK_PRIORITIES, 'priority');
         if (input.deadline !== undefined)
             assertIsoDate(input.deadline, 'deadline');
-        const now = Date.now();
+        const exactDue = input.due_at !== undefined ? (0, task_temporal_js_1.parseExactDueAt)(input.due_at) : null;
+        if (exactDue && input.deadline !== undefined && input.deadline !== exactDue.deadline) {
+            throw new Error('task_create: due_at and deadline conflict');
+        }
+        const normalizedDeadline = exactDue?.deadline ?? input.deadline ?? null;
+        const initialTemporalEpoch = normalizedDeadline !== null ? 1 : 0;
+        const now = this.now();
         if (input.source_channel && input.source_event_id) {
             // kind='owner' probe: an agent-supplied (channel, event) pair can never
             // reach a system workorder row (Stage-2 tamper guard).
@@ -295,13 +362,15 @@ class TaskLedger {
            WHERE source_channel = ? AND source_event_id = ? AND kind = 'owner'`)
                 .get(input.source_channel, input.source_event_id);
             if (existing) {
-                // Upsert carries every provided field EXCEPT title (the original naming
-                // stays stable across retries; movement and state updates flow through).
+                // Duplicate source delivery uses the same mutation boundary, including
+                // exact-time normalization and no-op detection. The original title stays
+                // stable across retries for backward compatibility.
                 return this.update(existing.id, {
                     ...(input.status !== undefined ? { status: input.status } : {}),
                     ...(input.priority !== undefined ? { priority: input.priority } : {}),
                     ...(input.assignee !== undefined ? { assignee: input.assignee } : {}),
                     ...(input.deadline !== undefined ? { deadline: input.deadline } : {}),
+                    ...(input.due_at !== undefined ? { due_at: input.due_at } : {}),
                     ...(input.confirmed !== undefined ? { confirmed: input.confirmed } : {}),
                     ...(input.latest_event !== undefined ? { latest_event: input.latest_event } : {}),
                 });
@@ -309,26 +378,17 @@ class TaskLedger {
         }
         const result = this.db
             .prepare(`INSERT INTO operator_tasks
-           (title, status, priority, assignee, deadline, source_channel, source_event_id,
-            latest_event, auto_created, confirmed, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(input.title.trim(), input.status ?? 'pending', input.priority ?? 'normal', input.assignee ?? null, input.deadline ?? null, input.source_channel ?? null, input.source_event_id ?? null, input.latest_event ?? null, 1, input.confirmed ? 1 : 0, now, now);
+           (title, status, priority, assignee, deadline, due_at, deadline_offset_minutes,
+            revision, temporal_epoch, source_channel, source_event_id, latest_event,
+            auto_created, confirmed, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(input.title.trim(), input.status ?? 'pending', input.priority ?? 'normal', input.assignee ?? null, normalizedDeadline, exactDue?.dueAt ?? null, exactDue?.offsetMinutes ?? null, initialTemporalEpoch, input.source_channel ?? null, input.source_event_id ?? null, input.latest_event ?? null, 1, input.confirmed ? 1 : 0, now, now);
         const created = this.getById(Number(result.lastInsertRowid));
         if (!created)
             throw new Error('task_create: inserted row could not be read back');
         return created;
     }
     update(id, patch) {
-        const existing = this.getRowById(id);
-        if (!existing)
-            throw new Error(`task_update: no task with id ${id}`);
-        // Stage-2 tamper guards: system workorder rows are host-managed (their
-        // transitions go through the workorder API only), and 'failed' can never
-        // be set on an owner task from any external surface (REST PATCH + gateway
-        // task_update both land here).
-        if (existing.kind === 'system') {
-            throw new Error(`task_update: task ${id} is a system workorder row (host-managed)`);
-        }
         if (patch.status === 'failed') {
             throw new Error(`task_update: 'failed' is a system-only status`);
         }
@@ -342,29 +402,154 @@ class TaskLedger {
         if (patch.title !== undefined && patch.title.trim() === '') {
             throw new Error('task title must be a non-empty string');
         }
-        const sets = ['updated_at = ?'];
-        const params = [Date.now()];
-        const assign = (column, value) => {
-            sets.push(`${column} = ?`);
-            params.push(value);
-        };
-        if (patch.title !== undefined)
-            assign('title', patch.title.trim());
-        if (patch.status !== undefined)
-            assign('status', patch.status);
-        if (patch.priority !== undefined)
-            assign('priority', patch.priority);
-        if (patch.assignee !== undefined)
-            assign('assignee', patch.assignee);
-        if (patch.deadline !== undefined)
-            assign('deadline', patch.deadline);
-        if (patch.latest_event !== undefined)
-            assign('latest_event', patch.latest_event);
-        if (patch.confirmed !== undefined)
-            assign('confirmed', patch.confirmed ? 1 : 0);
-        this.db.prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ?`).run(...params, id);
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const existing = this.db.prepare('SELECT * FROM operator_tasks WHERE id = ?').get(id);
+            if (!existing)
+                throw new Error(`task_update: no task with id ${id}`);
+            if (existing.kind === 'system') {
+                throw new Error(`task_update: task ${id} is a system workorder row (host-managed)`);
+            }
+            const next = {
+                title: existing.title,
+                status: existing.status,
+                priority: existing.priority,
+                assignee: existing.assignee,
+                deadline: existing.deadline,
+                due_at: existing.due_at,
+                deadline_offset_minutes: existing.deadline_offset_minutes,
+                latest_event: existing.latest_event,
+                confirmed: existing.confirmed,
+                temporal_epoch: existing.temporal_epoch,
+                temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
+                last_temporal_checked_at: existing.last_temporal_checked_at,
+                next_temporal_check_at: existing.next_temporal_check_at,
+                last_temporal_attempt_id: existing.last_temporal_attempt_id,
+            };
+            if (patch.title !== undefined)
+                next.title = patch.title.trim();
+            if (patch.status !== undefined)
+                next.status = patch.status;
+            if (patch.priority !== undefined)
+                next.priority = patch.priority;
+            if (patch.assignee !== undefined)
+                next.assignee = patch.assignee;
+            if (patch.latest_event !== undefined)
+                next.latest_event = patch.latest_event;
+            if (patch.confirmed !== undefined)
+                next.confirmed = patch.confirmed ? 1 : 0;
+            const hasDueAt = Object.prototype.hasOwnProperty.call(patch, 'due_at');
+            const hasDeadline = Object.prototype.hasOwnProperty.call(patch, 'deadline');
+            if (hasDueAt && patch.due_at !== null && patch.due_at !== undefined) {
+                const exactDue = (0, task_temporal_js_1.parseExactDueAt)(patch.due_at);
+                if (hasDeadline && patch.deadline !== exactDue.deadline) {
+                    throw new Error('task_update: due_at and deadline conflict');
+                }
+                next.due_at = exactDue.dueAt;
+                next.deadline = exactDue.deadline;
+                next.deadline_offset_minutes = exactDue.offsetMinutes;
+            }
+            else if (hasDeadline) {
+                next.deadline = patch.deadline ?? null;
+                next.due_at = null;
+                if (patch.deadline === null) {
+                    next.deadline_offset_minutes = null;
+                }
+            }
+            else if (hasDueAt) {
+                next.due_at = null;
+            }
+            const temporalChanged = next.due_at !== existing.due_at || next.deadline !== existing.deadline;
+            const terminalToOpen = (existing.status === 'done' || existing.status === 'cancelled') &&
+                next.status !== 'done' &&
+                next.status !== 'cancelled';
+            const openToTerminal = existing.status !== 'done' &&
+                existing.status !== 'cancelled' &&
+                (next.status === 'done' || next.status === 'cancelled');
+            if (temporalChanged || terminalToOpen) {
+                next.temporal_epoch = existing.temporal_epoch + 1;
+                next.temporal_reconciled_occurrence_key = null;
+                next.last_temporal_checked_at = null;
+                next.next_temporal_check_at = null;
+                next.last_temporal_attempt_id = null;
+            }
+            const persistedColumns = [
+                'title',
+                'status',
+                'priority',
+                'assignee',
+                'deadline',
+                'due_at',
+                'deadline_offset_minutes',
+                'latest_event',
+                'confirmed',
+                'temporal_epoch',
+                'temporal_reconciled_occurrence_key',
+                'last_temporal_checked_at',
+                'next_temporal_check_at',
+                'last_temporal_attempt_id',
+            ];
+            const changedColumns = persistedColumns.filter((column) => next[column] !== existing[column]);
+            if (changedColumns.length === 0) {
+                this.db.exec('COMMIT');
+                return this.toRecord(existing);
+            }
+            const nextRevision = existing.revision + 1;
+            const sets = changedColumns.map((column) => `${column} = ?`);
+            const values = changedColumns.map((column) => next[column]);
+            sets.push('revision = ?', 'updated_at = ?');
+            values.push(nextRevision, this.now());
+            this.db
+                .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ?`)
+                .run(...values, id);
+            if (temporalChanged || terminalToOpen) {
+                this.supersedeTemporalGenerationsInTransaction(id, Number(next.temporal_epoch));
+            }
+            else if (openToTerminal) {
+                this.supersedeAllActiveTemporalGenerationsInTransaction(id);
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
         return this.getById(id);
     }
+    supersedeTemporalGenerationsInTransaction(taskId, currentEpoch, excludeGenerationKey, updatedAt = this.now()) {
+        const reason = 'task temporal occurrence superseded';
+        const exclusion = excludeGenerationKey ? ' AND generation_key != ?' : '';
+        const generationParams = excludeGenerationKey
+            ? [taskId, currentEpoch, excludeGenerationKey]
+            : [taskId, currentEpoch];
+        this.db
+            .prepare(`UPDATE operator_tasks SET status = 'cancelled', latest_event = ?, updated_at = ?
+         WHERE kind = 'system' AND status IN ('pending','in_progress') AND id IN (
+           SELECT last_workorder_id FROM operator_temporal_generations
+           WHERE task_id = ? AND disposition = 'active' AND temporal_epoch < ?${exclusion}
+         )`)
+            .run(reason, updatedAt, ...generationParams);
+        this.db
+            .prepare(`UPDATE operator_temporal_generations
+         SET disposition = 'superseded', reason = ?, updated_at = ?
+         WHERE task_id = ? AND disposition = 'active' AND temporal_epoch < ?${exclusion}`)
+            .run(reason, updatedAt, ...generationParams);
+    }
+    supersedeAllActiveTemporalGenerationsInTransaction(taskId, updatedAt = this.now()) {
+        const reason = 'owner task closed';
+        this.db
+            .prepare(`UPDATE operator_tasks SET status = 'cancelled', latest_event = ?, updated_at = ?
+         WHERE kind = 'system' AND status IN ('pending','in_progress') AND id IN (
+           SELECT last_workorder_id FROM operator_temporal_generations
+           WHERE task_id = ? AND disposition = 'active'
+         )`)
+            .run(reason, updatedAt, taskId);
+        this.db
+            .prepare(`UPDATE operator_temporal_generations
+         SET disposition = 'superseded', reason = ?, updated_at = ?
+         WHERE task_id = ? AND disposition = 'active'`)
+            .run(reason, updatedAt, taskId);
+    }
     /**
      * Stable hash over ordered OWNER rows - the Phase-2 verifier's ledger
      * snapshot. kind filter keeps concurrent system enqueues from shaking the
@@ -387,6 +572,15 @@ class TaskLedger {
      * unique index excludes terminal statuses) and a fresh row is inserted.
      */
     enqueueWorkOrder(order) {
+        if (order.workKind === 'temporal') {
+            throw new Error('enqueueWorkOrder: temporal work requires enqueueTemporalGeneration');
+        }
+        if (Object.prototype.hasOwnProperty.call(order.input, 'attempts')) {
+            throw new Error('enqueueWorkOrder: attempts is ledger-managed and cannot be supplied');
+        }
+        return this.insertWorkOrder(order, 1);
+    }
+    insertWorkOrder(order, attempts) {
         assertEnum(order.workKind, exports.WORKORDER_KINDS, 'workKind');
         if (order.priority !== undefined) {
             assertEnum(order.priority, exports.TASK_PRIORITIES, 'priority');
@@ -403,11 +597,11 @@ class TaskLedger {
         if (open) {
             return this.rowToWorkOrder(open);
         }
-        const attempts = typeof order.input.attempts === 'number' && order.input.attempts >= 1
-            ? order.input.attempts
-            : 1;
+        if (!Number.isSafeInteger(attempts) || attempts < 1) {
+            throw new Error(`insertWorkOrder: attempts must be a positive integer, got: ${attempts}`);
+        }
         const payload = JSON.stringify({ ...order.input, attempts });
-        const now = Date.now();
+        const now = this.now();
         const result = this.db
             .prepare(`INSERT INTO operator_tasks
            (title, status, priority, kind, payload, source_channel, source_event_id,
@@ -416,6 +610,877 @@ class TaskLedger {
             .run(`workorder:${order.workKind}`, order.priority ?? 'normal', payload, channel, order.idempotencyKey, now, now);
         return this.getWorkOrderById(Number(result.lastInsertRowid));
     }
+    enqueueTemporalGeneration(input) {
+        this.validateTemporalGenerationInput(input);
+        const sourceChannelRef = this.temporalSourceIdentifierRef(input.sourceChannel);
+        const sourceEventIdRef = this.temporalSourceIdentifierRef(input.sourceEventId);
+        let result = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const existing = this.getTemporalGeneration(input.generationKey);
+            if (existing) {
+                if (existing.taskId !== input.taskId ||
+                    existing.temporalEpoch !== input.temporalEpoch ||
+                    existing.occurrenceKey !== input.occurrenceKey ||
+                    existing.checkAt !== input.checkAt) {
+                    throw new Error(`temporal generation '${input.generationKey}' conflicts with its stored identity`);
+                }
+                if (existing.lastWorkOrderId === null) {
+                    throw new Error(`temporal generation '${input.generationKey}' has no owning workorder attempt`);
+                }
+                const workOrder = this.getWorkOrderById(existing.lastWorkOrderId);
+                if (!workOrder) {
+                    throw new Error(`temporal generation '${input.generationKey}' owns missing workorder ${existing.lastWorkOrderId}`);
+                }
+                this.assertTemporalPayloadMatches(workOrder, existing);
+                if (workOrder.payload.sourceChannel !== sourceChannelRef ||
+                    workOrder.payload.sourceEventId !== sourceEventIdRef) {
+                    throw new Error(`temporal generation '${input.generationKey}' conflicts with stored source identifiers`);
+                }
+                result = { generation: existing, workOrder, created: false };
+            }
+            else {
+                const task = this.getRowById(input.taskId);
+                if (!task || task.kind !== 'owner') {
+                    throw new Error(`temporal generation: owner task ${input.taskId} does not exist`);
+                }
+                if (task.status === 'done' || task.status === 'cancelled') {
+                    throw new Error(`temporal generation: task ${input.taskId} is closed`);
+                }
+                const currentOccurrence = (0, task_temporal_js_1.occurrenceKeyForTask)(task);
+                if (task.temporalEpoch !== input.temporalEpoch ||
+                    currentOccurrence !== input.occurrenceKey) {
+                    throw new Error(`temporal generation: task occurrence no longer matches enqueue input`);
+                }
+                if (this.temporalSourceIdentifierRef(task.sourceChannel) !== sourceChannelRef ||
+                    this.temporalSourceIdentifierRef(task.sourceEventId) !== sourceEventIdRef) {
+                    throw new Error(`temporal generation: source identifiers do not match owner task`);
+                }
+                const openCollision = this.db
+                    .prepare(`SELECT id FROM operator_tasks
+             WHERE kind = 'system' AND source_channel = 'workorder:temporal'
+               AND source_event_id = ? AND status IN ('pending','in_progress')`)
+                    .get(input.generationKey);
+                if (openCollision) {
+                    throw new Error(`temporal generation '${input.generationKey}' has orphan open workorder ${openCollision.id}`);
+                }
+                const timestamp = this.now();
+                this.db
+                    .prepare(`INSERT INTO operator_temporal_generations
+               (generation_key, task_id, temporal_epoch, occurrence_key, check_at,
+                disposition, created_at, updated_at)
+             VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`)
+                    .run(input.generationKey, input.taskId, input.temporalEpoch, input.occurrenceKey, input.checkAt, timestamp, timestamp);
+                const workOrder = this.insertWorkOrder({
+                    workKind: 'temporal',
+                    idempotencyKey: input.generationKey,
+                    input: {
+                        generationKey: input.generationKey,
+                        taskId: input.taskId,
+                        temporalEpoch: input.temporalEpoch,
+                        occurrenceKey: input.occurrenceKey,
+                        checkAt: input.checkAt,
+                        sourceChannel: sourceChannelRef,
+                        sourceEventId: sourceEventIdRef,
+                    },
+                    priority: input.priority ?? 'normal',
+                }, 1);
+                this.db
+                    .prepare(`UPDATE operator_temporal_generations
+             SET last_workorder_id = ?, updated_at = ? WHERE generation_key = ?`)
+                    .run(workOrder.id, timestamp, input.generationKey);
+                const generation = this.getTemporalGeneration(input.generationKey);
+                if (!generation) {
+                    throw new Error(`temporal generation '${input.generationKey}' could not be read back`);
+                }
+                result = { generation, workOrder, created: true };
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        if (!result) {
+            throw new Error(`temporal generation '${input.generationKey}' produced no result`);
+        }
+        return result;
+    }
+    getTemporalGeneration(generationKey) {
+        const row = this.db
+            .prepare(`SELECT * FROM operator_temporal_generations WHERE generation_key = ?`)
+            .get(generationKey);
+        if (!row)
+            return null;
+        return {
+            generationKey: row.generation_key,
+            taskId: row.task_id,
+            temporalEpoch: row.temporal_epoch,
+            occurrenceKey: row.occurrence_key,
+            checkAt: row.check_at,
+            disposition: row.disposition,
+            lastWorkOrderId: row.last_workorder_id,
+            reason: row.reason,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    loadTemporalWorkContext(attemptId) {
+        return this.loadTemporalWorkContextInternal(attemptId);
+    }
+    assertTemporalWorkContextActive(suppliedContext) {
+        const trustedContext = this.loadTemporalWorkContextInternal(suppliedContext.attemptId);
+        this.assertTemporalContextMatches(suppliedContext, trustedContext);
+        return trustedContext;
+    }
+    getTemporalEffect(attemptId) {
+        const row = this.db
+            .prepare(`SELECT * FROM operator_temporal_effects WHERE workorder_attempt_id = ?`)
+            .get(attemptId);
+        if (!row)
+            return null;
+        const changedFields = JSON.parse(row.changed_fields);
+        if (!Array.isArray(changedFields) ||
+            !changedFields.every((field) => typeof field === 'string')) {
+            throw new Error(`temporal effect ${attemptId} has invalid changed_fields`);
+        }
+        if (!['resolved', 'final_no_update', 'deferred'].includes(row.outcome)) {
+            throw new Error(`temporal effect ${attemptId} has invalid outcome '${row.outcome}'`);
+        }
+        return {
+            workorderAttemptId: row.workorder_attempt_id,
+            taskId: row.task_id,
+            generationKey: row.generation_key,
+            occurrenceKey: row.occurrence_key,
+            outcome: row.outcome,
+            beforeRevision: row.before_revision,
+            afterRevision: row.after_revision,
+            changedFields,
+            reason: row.reason,
+            attestationVersion: row.attestation_version === 1 ? 1 : 0,
+            contextPacketId: row.context_packet_id ?? '',
+            contextPacketSha256: row.context_packet_sha256 ?? '',
+            nextTemporalCheckAt: row.next_temporal_check_at,
+            createdAt: row.created_at,
+        };
+    }
+    /**
+     * Read and validate the durable state that decides a temporal attempt's
+     * terminal outcome. This intentionally does not require an active attempt:
+     * consumers must be able to arbitrate committed, superseded, and exhausted
+     * attempts after runner/auditor failures and daemon restarts.
+     */
+    inspectTemporalAttempt(attemptId) {
+        const workOrder = this.getWorkOrderById(attemptId);
+        if (!workOrder || workOrder.workKind !== 'temporal') {
+            throw new Error(`temporal attempt state: no temporal attempt ${attemptId}`);
+        }
+        const generationKey = this.requirePayloadString(workOrder.payload, 'generationKey', attemptId);
+        const generation = this.getTemporalGeneration(generationKey);
+        if (!generation) {
+            throw new Error(`temporal attempt state: generation '${generationKey}' is missing`);
+        }
+        this.assertTemporalPayloadMatches(workOrder, generation);
+        const receipt = this.getTemporalEffect(attemptId);
+        if (receipt) {
+            const receiptError = (0, temporal_effect_js_1.temporalReceiptInvariantError)(receipt, {
+                attemptId,
+                taskId: generation.taskId,
+                generationKey: generation.generationKey,
+                occurrenceKey: generation.occurrenceKey,
+            });
+            if (receiptError) {
+                throw new Error(`temporal attempt state: ${receiptError}`);
+            }
+            if (workOrder.status !== 'done' ||
+                generation.lastWorkOrderId !== attemptId ||
+                generation.disposition !== receipt.outcome) {
+                throw new Error(`temporal attempt state: receipt ${attemptId} is not atomically committed`);
+            }
+            const task = this.getById(generation.taskId);
+            if (!task || task.revision < receipt.afterRevision) {
+                throw new Error(`temporal attempt state: receipt ${attemptId} owner revision is invalid`);
+            }
+            if (receipt.outcome !== 'resolved') {
+                const scope = (0, temporal_effect_js_1.temporalNoUpdateScope)({
+                    attemptId,
+                    generationKey: generation.generationKey,
+                    taskId: generation.taskId,
+                    temporalEpoch: generation.temporalEpoch,
+                    occurrenceKey: generation.occurrenceKey,
+                    checkAt: generation.checkAt,
+                    revision: receipt.beforeRevision,
+                    sourceChannel: null,
+                    sourceEventId: null,
+                });
+                const note = this.db
+                    .prepare(`SELECT id FROM operator_no_update_notes
+             WHERE scope = ? AND reason = ? AND created_at = ? LIMIT 1`)
+                    .get(scope, receipt.reason, receipt.createdAt);
+                if (!note) {
+                    throw new Error(`temporal attempt state: exact-scope no-update note is missing`);
+                }
+            }
+            if (task.revision === receipt.afterRevision) {
+                if (task.lastTemporalAttemptId !== attemptId ||
+                    task.lastTemporalCheckedAt !== receipt.createdAt) {
+                    throw new Error(`temporal attempt state: owner attempt markers are invalid`);
+                }
+                if (receipt.outcome === 'resolved' || receipt.outcome === 'final_no_update') {
+                    if (task.temporalReconciledOccurrenceKey !== generation.occurrenceKey ||
+                        task.nextTemporalCheckAt !== null) {
+                        throw new Error(`temporal attempt state: owner final markers are invalid`);
+                    }
+                }
+                else if (task.nextTemporalCheckAt !== receipt.nextTemporalCheckAt) {
+                    throw new Error(`temporal attempt state: owner deferred check is invalid`);
+                }
+            }
+        }
+        else if (workOrder.status === 'done') {
+            throw new Error(`temporal attempt state: done attempt ${attemptId} has no receipt`);
+        }
+        if (workOrder.status === 'in_progress') {
+            if (receipt ||
+                generation.disposition !== 'active' ||
+                generation.lastWorkOrderId !== attemptId) {
+                throw new Error(`temporal attempt state: active attempt ${attemptId} lost ownership`);
+            }
+        }
+        if (workOrder.status === 'cancelled' &&
+            generation.disposition !== 'superseded' &&
+            (generation.disposition !== 'active' || generation.lastWorkOrderId !== attemptId)) {
+            throw new Error(`temporal attempt state: cancelled attempt ${attemptId} has invalid ownership`);
+        }
+        if (workOrder.status === 'failed' &&
+            generation.disposition === 'active' &&
+            generation.lastWorkOrderId !== attemptId) {
+            const replacement = generation.lastWorkOrderId === null
+                ? null
+                : this.getWorkOrderById(generation.lastWorkOrderId);
+            if (!replacement ||
+                replacement.workKind !== 'temporal' ||
+                (replacement.status !== 'pending' && replacement.status !== 'in_progress')) {
+                throw new Error(`temporal attempt state: retry replacement is missing or terminal`);
+            }
+            this.assertTemporalPayloadMatches(replacement, generation);
+        }
+        if (generation.disposition === 'superseded' &&
+            workOrder.status !== 'cancelled' &&
+            workOrder.status !== 'failed') {
+            throw new Error(`temporal attempt state: superseded attempt ${attemptId} is still open`);
+        }
+        return { workOrder, generation, receipt };
+    }
+    applyTemporalEffect(suppliedContext, input, evidence, now = this.now()) {
+        if (!Number.isSafeInteger(now)) {
+            throw new Error('temporal effect time must be an epoch millisecond integer');
+        }
+        this.validateTemporalEffectInput(input, now);
+        if (!evidence ||
+            typeof evidence.contextPacketId !== 'string' ||
+            evidence.contextPacketId.trim().length < 1 ||
+            evidence.contextPacketId.length > 300 ||
+            !/^[a-f0-9]{64}$/.test(evidence.contextPacketSha256)) {
+            throw new Error('temporal effect requires a valid host evidence attestation');
+        }
+        let receipt = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const context = this.assertTemporalWorkContextActive(suppliedContext);
+            if (input.expected_revision !== context.revision) {
+                throw new Error(`temporal effect revision mismatch: expected ${input.expected_revision}, current ${context.revision}`);
+            }
+            const existing = this.db
+                .prepare(`SELECT * FROM operator_tasks WHERE id = ?`)
+                .get(context.taskId);
+            if (!existing || existing.kind !== 'owner' || existing.revision !== context.revision) {
+                throw new Error(`temporal effect owner task no longer matches trusted context`);
+            }
+            const next = {
+                status: existing.status,
+                deadline: existing.deadline,
+                due_at: existing.due_at,
+                deadline_offset_minutes: existing.deadline_offset_minutes,
+                temporal_epoch: existing.temporal_epoch,
+                temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
+                last_temporal_checked_at: now,
+                next_temporal_check_at: null,
+                last_temporal_attempt_id: context.attemptId,
+            };
+            const auditParts = [`reason=${input.reason.trim()}`];
+            if (input.outcome === 'final_no_update') {
+                auditParts.push(`evidence=${input.evidence_summary.trim()}`);
+            }
+            const receiptReason = this.temporalAuditText(`effect-${input.outcome}`, auditParts);
+            let nextCheck = null;
+            let rescheduled = false;
+            if (input.outcome === 'resolved') {
+                if (input.status !== undefined)
+                    next.status = input.status;
+                if (Object.prototype.hasOwnProperty.call(input, 'due_at')) {
+                    if (input.due_at === null) {
+                        next.due_at = null;
+                    }
+                    else if (input.due_at !== undefined) {
+                        const exactDue = (0, task_temporal_js_1.parseExactDueAt)(input.due_at);
+                        if (exactDue.dueAt !== existing.due_at) {
+                            next.due_at = exactDue.dueAt;
+                            next.deadline = exactDue.deadline;
+                            next.deadline_offset_minutes = exactDue.offsetMinutes;
+                        }
+                    }
+                }
+                const resolvedEffectChanged = next.status !== existing.status || next.due_at !== existing.due_at;
+                if (!resolvedEffectChanged) {
+                    throw new Error('temporal resolved outcome requires an actual status or due_at change');
+                }
+                rescheduled = next.due_at !== existing.due_at;
+                if (rescheduled)
+                    next.temporal_epoch = existing.temporal_epoch + 1;
+                next.temporal_reconciled_occurrence_key = context.occurrenceKey;
+            }
+            else if (input.outcome === 'final_no_update') {
+                next.temporal_reconciled_occurrence_key = context.occurrenceKey;
+            }
+            else {
+                nextCheck = (0, task_temporal_js_1.parseExactDueAt)(input.next_temporal_check_at).dueAt;
+                next.next_temporal_check_at = nextCheck;
+            }
+            const persistedColumns = [
+                'status',
+                'deadline',
+                'due_at',
+                'deadline_offset_minutes',
+                'temporal_epoch',
+                'temporal_reconciled_occurrence_key',
+                'last_temporal_checked_at',
+                'next_temporal_check_at',
+                'last_temporal_attempt_id',
+            ];
+            const changedFields = persistedColumns.filter((column) => next[column] !== existing[column]);
+            const afterRevision = existing.revision + 1;
+            const sets = changedFields.map((column) => `${column} = ?`);
+            const values = changedFields.map((column) => next[column]);
+            sets.push('revision = ?', 'updated_at = ?');
+            values.push(afterRevision, now);
+            const ownerUpdate = this.db
+                .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ? AND kind = 'owner' AND revision = ?`)
+                .run(...values, context.taskId, existing.revision);
+            if (ownerUpdate.changes !== 1) {
+                throw new Error(`temporal effect lost owner task revision for task ${context.taskId}`);
+            }
+            if (rescheduled) {
+                this.supersedeTemporalGenerationsInTransaction(context.taskId, Number(next.temporal_epoch), context.generationKey, now);
+            }
+            const generationUpdate = this.db
+                .prepare(`UPDATE operator_temporal_generations
+           SET disposition = ?, reason = ?, updated_at = ?
+           WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
+                .run(input.outcome, receiptReason, now, context.generationKey, context.attemptId);
+            if (generationUpdate.changes !== 1) {
+                throw new Error(`temporal effect lost generation ownership for attempt ${context.attemptId}`);
+            }
+            if (input.outcome === 'resolved' && (next.status === 'done' || next.status === 'cancelled')) {
+                this.supersedeAllActiveTemporalGenerationsInTransaction(context.taskId, now);
+            }
+            if (input.outcome !== 'resolved') {
+                this.insertNoUpdateNote((0, temporal_effect_js_1.temporalNoUpdateScope)(context), receiptReason, now);
+            }
+            this.db
+                .prepare(`INSERT INTO operator_temporal_effects
+             (workorder_attempt_id, task_id, generation_key, occurrence_key, outcome,
+              before_revision, after_revision, changed_fields, reason,
+              attestation_version, context_packet_id, context_packet_sha256,
+              next_temporal_check_at, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?)`)
+                .run(context.attemptId, context.taskId, context.generationKey, context.occurrenceKey, input.outcome, existing.revision, afterRevision, JSON.stringify(changedFields), receiptReason, evidence.contextPacketId, evidence.contextPacketSha256, nextCheck, now);
+            const workOrderUpdate = this.db
+                .prepare(`UPDATE operator_tasks SET status = 'done', latest_event = ?, updated_at = ?
+           WHERE id = ? AND kind = 'system' AND status = 'in_progress'
+             AND source_channel = 'workorder:temporal' AND source_event_id = ?`)
+                .run(receiptReason, now, context.attemptId, context.generationKey);
+            if (workOrderUpdate.changes !== 1) {
+                throw new Error(`temporal effect lost active workorder ${context.attemptId}`);
+            }
+            receipt = this.getTemporalEffect(context.attemptId);
+            if (!receipt)
+                throw new Error(`temporal effect receipt could not be read back`);
+            const receiptError = (0, temporal_effect_js_1.temporalReceiptInvariantError)(receipt, {
+                attemptId: context.attemptId,
+                taskId: context.taskId,
+                generationKey: context.generationKey,
+                occurrenceKey: context.occurrenceKey,
+                beforeRevision: context.revision,
+            });
+            if (receiptError) {
+                throw new Error(`temporal effect receipt invariant failed: ${receiptError}`);
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        if (!receipt)
+            throw new Error(`temporal effect produced no receipt`);
+        return receipt;
+    }
+    requeueTemporalWorkOrder(attemptId, reason) {
+        this.assertTemporalReason(reason);
+        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
+        let replacement = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const context = this.loadTemporalWorkContextInternal(attemptId);
+            const workOrder = this.getWorkOrderById(attemptId);
+            if (workOrder.payload.attempts >= exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
+                throw new Error(`temporal retry budget exhausted for attempt ${attemptId}`);
+            }
+            replacement = this.requeueTemporalWorkOrderInTransaction(context, workOrder, auditReason);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        if (!replacement)
+            throw new Error(`temporal retry for attempt ${attemptId} produced no row`);
+        return replacement;
+    }
+    exhaustTemporalWorkOrder(attemptId, reason) {
+        this.assertTemporalReason(reason);
+        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const context = this.loadTemporalWorkContextInternal(attemptId);
+            const workOrder = this.getWorkOrderById(attemptId);
+            if (workOrder.payload.attempts !== exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
+                throw new Error(`temporal exhaustion requires attempt ${exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS}, got ${workOrder.payload.attempts}`);
+            }
+            this.exhaustTemporalWorkOrderInTransaction(context, auditReason);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    failTemporalWorkOrder(attemptId, reason) {
+        this.assertTemporalReason(reason);
+        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
+        let result = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const repairedAttempt = this.repairClosedTemporalOwnershipInTransaction(attemptId);
+            if (repairedAttempt !== null) {
+                result = {
+                    disposition: 'superseded',
+                    attempt: repairedAttempt,
+                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
+                };
+                this.db.exec('COMMIT');
+                return result;
+            }
+            const context = this.loadTemporalWorkContextInternal(attemptId);
+            const workOrder = this.getWorkOrderById(attemptId);
+            const attempt = workOrder.payload.attempts;
+            if (attempt < exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
+                result = {
+                    disposition: 'requeued',
+                    replacement: this.requeueTemporalWorkOrderInTransaction(context, workOrder, auditReason),
+                    attempt,
+                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
+                };
+            }
+            else if (attempt === exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
+                this.exhaustTemporalWorkOrderInTransaction(context, auditReason);
+                result = {
+                    disposition: 'exhausted',
+                    attempt,
+                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
+                };
+            }
+            else {
+                throw new Error(`temporal attempt ${attemptId} exceeds retry budget: ${attempt}`);
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        if (!result)
+            throw new Error(`temporal failure for attempt ${attemptId} produced no result`);
+        return result;
+    }
+    repairClosedTemporalOwnershipInTransaction(attemptId) {
+        const workOrder = this.getWorkOrderById(attemptId);
+        if (!workOrder || workOrder.workKind !== 'temporal') {
+            return null;
+        }
+        const generationKey = this.requirePayloadString(workOrder.payload, 'generationKey', attemptId);
+        const generation = this.getTemporalGeneration(generationKey);
+        if (!generation || generation.lastWorkOrderId !== attemptId) {
+            return null;
+        }
+        const task = this.getById(generation.taskId);
+        if (!task || (task.status !== 'done' && task.status !== 'cancelled')) {
+            return null;
+        }
+        const openAttempt = workOrder.status === 'pending' || workOrder.status === 'in_progress';
+        if (generation.disposition === 'active' && openAttempt) {
+            this.supersedeAllActiveTemporalGenerationsInTransaction(task.id);
+        }
+        else if (generation.disposition !== 'superseded' || workOrder.status !== 'cancelled') {
+            return null;
+        }
+        return workOrder.payload.attempts;
+    }
+    /** Repair pre-fix databases where a terminal owner still has active temporal ownership. */
+    repairClosedTemporalGenerations() {
+        let repaired = 0;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const rows = this.db
+                .prepare(`SELECT DISTINCT generation.task_id
+           FROM operator_temporal_generations generation
+           JOIN operator_tasks owner ON owner.id = generation.task_id
+           WHERE generation.disposition = 'active'
+             AND owner.kind = 'owner'
+             AND owner.status IN ('done','cancelled')
+           ORDER BY generation.task_id ASC`)
+                .all();
+            const updatedAt = this.now();
+            for (const row of rows) {
+                this.supersedeAllActiveTemporalGenerationsInTransaction(row.task_id, updatedAt);
+            }
+            repaired = rows.length;
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        return repaired;
+    }
+    /** Control-plane pause: cancel open attempts but keep generations resumable. */
+    pauseActiveTemporalWork(reason) {
+        this.assertTemporalReason(reason);
+        let changed = 0;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = this.db
+                .prepare(`UPDATE operator_tasks
+           SET status = 'cancelled', latest_event = ?, updated_at = ?
+           WHERE kind = 'system' AND source_channel = 'workorder:temporal'
+             AND status IN ('pending','in_progress')`)
+                .run(reason, this.now());
+            changed = result.changes;
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        return changed;
+    }
+    /** Resume paused active generations without spending another model attempt. */
+    resumePausedTemporalWork() {
+        const resumed = [];
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const rows = this.db
+                .prepare(`SELECT generation_key, last_workorder_id
+           FROM operator_temporal_generations generation
+           WHERE disposition = 'active' AND last_workorder_id IS NOT NULL
+             AND NOT EXISTS (
+               SELECT 1 FROM operator_tasks open_attempt
+               WHERE open_attempt.kind = 'system'
+                 AND open_attempt.source_channel = 'workorder:temporal'
+                 AND open_attempt.source_event_id = generation.generation_key
+                 AND open_attempt.status IN ('pending','in_progress')
+             )
+           ORDER BY generation_key ASC`)
+                .all();
+            for (const row of rows) {
+                const generation = this.getTemporalGeneration(row.generation_key);
+                const previous = this.getWorkOrderById(row.last_workorder_id);
+                if (!generation || !previous || previous.status !== 'cancelled') {
+                    throw new Error(`temporal resume: active generation '${row.generation_key}' has no paused attempt`);
+                }
+                this.assertTemporalPayloadMatches(previous, generation);
+                const { attempts, ...payload } = previous.payload;
+                const replacement = this.insertWorkOrder({
+                    workKind: 'temporal',
+                    idempotencyKey: generation.generationKey,
+                    input: payload,
+                    priority: previous.priority,
+                }, attempts);
+                const ownership = this.db
+                    .prepare(`UPDATE operator_temporal_generations
+             SET last_workorder_id = ?, updated_at = ?
+             WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
+                    .run(replacement.id, this.now(), generation.generationKey, previous.id);
+                if (ownership.changes !== 1) {
+                    throw new Error(`temporal resume lost ownership for generation '${generation.generationKey}'`);
+                }
+                resumed.push(replacement);
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        return resumed;
+    }
+    requeueTemporalWorkOrderInTransaction(context, workOrder, reason) {
+        this.transitionWorkOrder(workOrder.id, 'failed', reason);
+        const { attempts: _attempts, ...payload } = workOrder.payload;
+        const replacement = this.insertWorkOrder({
+            workKind: 'temporal',
+            idempotencyKey: context.generationKey,
+            input: payload,
+            priority: workOrder.priority,
+        }, workOrder.payload.attempts + 1);
+        const ownership = this.db
+            .prepare(`UPDATE operator_temporal_generations
+         SET last_workorder_id = ?, updated_at = ?
+         WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
+            .run(replacement.id, this.now(), context.generationKey, workOrder.id);
+        if (ownership.changes !== 1) {
+            throw new Error(`temporal retry lost generation ownership for attempt ${workOrder.id}`);
+        }
+        return replacement;
+    }
+    exhaustTemporalWorkOrderInTransaction(context, reason) {
+        this.transitionWorkOrder(context.attemptId, 'failed', reason);
+        const update = this.db
+            .prepare(`UPDATE operator_temporal_generations
+         SET disposition = 'exhausted', reason = ?, updated_at = ?
+         WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
+            .run(reason, this.now(), context.generationKey, context.attemptId);
+        if (update.changes !== 1) {
+            throw new Error(`temporal exhaustion lost ownership for attempt ${context.attemptId}`);
+        }
+    }
+    supersedeTemporalGenerations(taskId, currentEpoch, excludeGenerationKey) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.supersedeTemporalGenerationsInTransaction(taskId, currentEpoch, excludeGenerationKey);
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    validateTemporalGenerationInput(input) {
+        const bounded = (value, field, max) => {
+            if (value.length < 1 || value.length > max) {
+                throw new Error(`temporal generation: ${field} must contain 1-${max} characters`);
+            }
+        };
+        bounded(input.generationKey, 'generationKey', 500);
+        bounded(input.occurrenceKey, 'occurrenceKey', 300);
+        if (!Number.isSafeInteger(input.taskId) || input.taskId < 1) {
+            throw new Error(`temporal generation: taskId must be a positive integer`);
+        }
+        if (!Number.isSafeInteger(input.temporalEpoch) || input.temporalEpoch < 0) {
+            throw new Error(`temporal generation: temporalEpoch must be a non-negative integer`);
+        }
+        if (!Number.isSafeInteger(input.checkAt)) {
+            throw new Error(`temporal generation: checkAt must be an epoch millisecond integer`);
+        }
+        const canonicalKey = (0, task_temporal_js_1.temporalGenerationKey)(input.taskId, input.occurrenceKey, input.checkAt);
+        if (input.generationKey !== canonicalKey) {
+            throw new Error(`temporal generation: generationKey must equal canonical identity key`);
+        }
+        for (const [field, value] of [
+            ['sourceChannel', input.sourceChannel],
+            ['sourceEventId', input.sourceEventId],
+        ]) {
+            if (value !== null && typeof value !== 'string') {
+                throw new Error(`temporal generation: ${field} must be a string or null`);
+            }
+        }
+        if (input.priority !== undefined)
+            assertEnum(input.priority, exports.TASK_PRIORITIES, 'priority');
+    }
+    /**
+     * Workorder payloads carry only bounded references to owner-source identifiers.
+     * Owner rows created by older releases may contain empty or arbitrarily long
+     * connector identifiers; hashing preserves exact identity without making one
+     * legacy row able to abort temporal boot or inflate every retry payload.
+     */
+    temporalSourceIdentifierRef(value) {
+        if (value === null)
+            return null;
+        return `sha256:${(0, node_crypto_1.createHash)('sha256').update(value).digest('hex')}`;
+    }
+    validateTemporalEffectInput(input, now) {
+        if (!input || typeof input !== 'object' || Array.isArray(input)) {
+            throw new Error('temporal effect input must be an object');
+        }
+        if (!Number.isSafeInteger(input.expected_revision) || input.expected_revision < 0) {
+            throw new Error('temporal effect expected_revision must be a non-negative integer');
+        }
+        this.assertTemporalReason(input.reason);
+        const baseKeys = ['expected_revision', 'outcome', 'reason'];
+        let allowedKeys;
+        if (input.outcome === 'resolved') {
+            allowedKeys = [...baseKeys, 'status', 'due_at'];
+            if (input.status !== undefined) {
+                assertEnum(input.status, exports.TASK_STATUSES, 'temporal effect status');
+                if (String(input.status) === 'failed') {
+                    throw new Error(`temporal effect: 'failed' is a system-only status`);
+                }
+            }
+            if (input.due_at !== undefined && input.due_at !== null)
+                (0, task_temporal_js_1.parseExactDueAt)(input.due_at);
+        }
+        else if (input.outcome === 'final_no_update') {
+            allowedKeys = [...baseKeys, 'evidence_summary'];
+            if (typeof input.evidence_summary !== 'string' ||
+                input.evidence_summary.trim().length < 1 ||
+                input.evidence_summary.length > 1_000) {
+                throw new Error('temporal effect evidence_summary must contain 1-1000 characters');
+            }
+        }
+        else if (input.outcome === 'deferred') {
+            allowedKeys = [...baseKeys, 'next_temporal_check_at'];
+            if (typeof input.next_temporal_check_at !== 'string') {
+                throw new Error('temporal effect next_temporal_check_at must be RFC 3339');
+            }
+            const nextCheck = (0, task_temporal_js_1.parseExactDueAt)(input.next_temporal_check_at).dueAt;
+            if (nextCheck <= now) {
+                throw new Error('temporal effect deferred check must be strictly in the future');
+            }
+        }
+        else {
+            throw new Error(`temporal effect outcome is unknown or forbidden`);
+        }
+        const unknownKeys = Object.keys(input).filter((key) => !allowedKeys.includes(key));
+        if (unknownKeys.length > 0) {
+            throw new Error(`temporal effect contains unknown or forbidden fields: ${unknownKeys.join(', ')}`);
+        }
+    }
+    assertTemporalContextMatches(supplied, trusted) {
+        const fields = [
+            'attemptId',
+            'generationKey',
+            'taskId',
+            'temporalEpoch',
+            'occurrenceKey',
+            'checkAt',
+            'revision',
+            'sourceChannel',
+            'sourceEventId',
+        ];
+        if (fields.some((field) => supplied[field] !== trusted[field])) {
+            throw new Error('temporal effect supplied context does not match trusted host context');
+        }
+    }
+    loadTemporalWorkContextInternal(attemptId) {
+        const workOrder = this.getWorkOrderById(attemptId);
+        if (!workOrder || workOrder.workKind !== 'temporal') {
+            throw new Error(`temporal context: no temporal attempt ${attemptId}`);
+        }
+        if (workOrder.status !== 'in_progress') {
+            throw new Error(`temporal context: attempt ${attemptId} is '${workOrder.status}', expected active attempt`);
+        }
+        const payload = workOrder.payload;
+        const generationKey = this.requirePayloadString(payload, 'generationKey', attemptId);
+        const taskId = this.requirePayloadInteger(payload, 'taskId', attemptId, 1);
+        const temporalEpoch = this.requirePayloadInteger(payload, 'temporalEpoch', attemptId, 0);
+        const occurrenceKey = this.requirePayloadString(payload, 'occurrenceKey', attemptId);
+        const checkAt = this.requirePayloadInteger(payload, 'checkAt', attemptId);
+        const sourceChannel = this.requireNullablePayloadString(payload, 'sourceChannel', attemptId);
+        const sourceEventId = this.requireNullablePayloadString(payload, 'sourceEventId', attemptId);
+        const generation = this.getTemporalGeneration(generationKey);
+        if (!generation || generation.disposition !== 'active') {
+            throw new Error(`temporal context: generation '${generationKey}' is not active`);
+        }
+        if (generation.lastWorkOrderId !== attemptId) {
+            throw new Error(`temporal context: attempt ${attemptId} no longer owns generation`);
+        }
+        this.assertTemporalPayloadMatches(workOrder, generation);
+        const task = this.getRowById(taskId);
+        if (!task || task.kind !== 'owner') {
+            throw new Error(`temporal context: owner task ${taskId} does not exist`);
+        }
+        if (task.status === 'done' || task.status === 'cancelled') {
+            throw new Error(`temporal context: owner task ${taskId} is closed`);
+        }
+        if (task.temporalEpoch !== temporalEpoch ||
+            (0, task_temporal_js_1.occurrenceKeyForTask)(task) !== occurrenceKey ||
+            this.temporalSourceIdentifierRef(task.sourceChannel) !== sourceChannel ||
+            this.temporalSourceIdentifierRef(task.sourceEventId) !== sourceEventId ||
+            generation.taskId !== taskId ||
+            generation.temporalEpoch !== temporalEpoch ||
+            generation.occurrenceKey !== occurrenceKey ||
+            generation.checkAt !== checkAt) {
+            throw new Error(`temporal context: attempt ${attemptId} payload no longer matches ownership`);
+        }
+        return {
+            attemptId,
+            generationKey,
+            taskId,
+            temporalEpoch,
+            occurrenceKey,
+            checkAt,
+            revision: task.revision,
+            sourceChannel,
+            sourceEventId,
+        };
+    }
+    assertTemporalPayloadMatches(workOrder, generation) {
+        const payload = workOrder.payload;
+        if (payload.generationKey !== generation.generationKey ||
+            payload.taskId !== generation.taskId ||
+            payload.temporalEpoch !== generation.temporalEpoch ||
+            payload.occurrenceKey !== generation.occurrenceKey ||
+            payload.checkAt !== generation.checkAt) {
+            throw new Error(`temporal attempt ${workOrder.id} payload does not match generation ownership`);
+        }
+    }
+    requirePayloadString(payload, field, attemptId) {
+        const value = payload[field];
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new Error(`temporal attempt ${attemptId}: ${field} must be a non-empty string`);
+        }
+        return value;
+    }
+    requireNullablePayloadString(payload, field, attemptId) {
+        const value = payload[field];
+        if (value !== null && typeof value !== 'string') {
+            throw new Error(`temporal attempt ${attemptId}: ${field} must be a string or null`);
+        }
+        return value;
+    }
+    requirePayloadInteger(payload, field, attemptId, minimum = Number.MIN_SAFE_INTEGER) {
+        const value = payload[field];
+        if (!Number.isSafeInteger(value) || value < minimum) {
+            throw new Error(`temporal attempt ${attemptId}: ${field} must be an integer`);
+        }
+        return value;
+    }
+    assertTemporalReason(reason) {
+        if (reason.trim().length < 1 || reason.length > 500) {
+            throw new Error('temporal workorder reason must contain 1-500 characters');
+        }
+    }
+    temporalAuditText(kind, values) {
+        const refs = values.map((value, index) => {
+            const separator = value.indexOf('=');
+            const label = separator > 0 ? value.slice(0, separator) : `value${index + 1}`;
+            const text = separator > 0 ? value.slice(separator + 1) : value;
+            const digest = (0, node_crypto_1.createHash)('sha256').update(text).digest('hex');
+            return `${label}_sha256=${digest};${label}_length=${text.length}`;
+        });
+        return `temporal-${kind};${refs.join(';')}`;
+    }
     /**
      * Claim the next pending workorder: priority high>normal>low, then id ASC
      * (plan D2/E2 - CASE mapping, never lexicographic on the TEXT enum).
@@ -436,7 +1501,7 @@ class TaskLedger {
             if (row) {
                 this.db
                     .prepare(`UPDATE operator_tasks SET status = 'in_progress', updated_at = ? WHERE id = ?`)
-                    .run(Date.now(), row.id);
+                    .run(this.now(), row.id);
                 claimedId = row.id;
             }
             this.db.exec('COMMIT');
@@ -457,15 +1522,23 @@ class TaskLedger {
      * unique index, hence one transaction, not two calls.
      */
     requeueWorkOrder(wo, reason) {
+        if (wo.workKind === 'temporal') {
+            return this.requeueTemporalWorkOrder(wo.id, reason);
+        }
         this.db.exec('BEGIN IMMEDIATE');
         try {
-            this.transitionWorkOrder(wo.id, 'failed', reason);
-            const replacement = this.enqueueWorkOrder({
-                workKind: wo.workKind,
-                idempotencyKey: wo.idempotencyKey,
-                input: { ...wo.payload, attempts: wo.payload.attempts + 1 },
-                priority: wo.priority,
-            });
+            const current = this.getWorkOrderById(wo.id);
+            if (!current || current.workKind !== wo.workKind) {
+                throw new Error(`workorder retry: claimed row ${wo.id} no longer matches input`);
+            }
+            this.transitionWorkOrder(current.id, 'failed', reason);
+            const { attempts: _attempts, ...input } = current.payload;
+            const replacement = this.insertWorkOrder({
+                workKind: current.workKind,
+                idempotencyKey: current.idempotencyKey,
+                input,
+                priority: current.priority,
+            }, current.payload.attempts + 1);
             this.db.exec('COMMIT');
             return replacement;
         }
@@ -488,6 +1561,31 @@ class TaskLedger {
             .get(...KNOWN_WORKORDER_CHANNELS);
         return row.count;
     }
+    countOpenWorkOrders(kind) {
+        const row = (kind
+            ? this.db
+                .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
+               WHERE kind = 'system' AND status IN ('pending','in_progress')
+                 AND source_channel = ?`)
+                .get(`${exports.WORKORDER_CHANNEL_PREFIX}${kind}`)
+            : this.db
+                .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
+               WHERE kind = 'system' AND status IN ('pending','in_progress')`)
+                .get());
+        return row.count;
+    }
+    findTemporalGenerationKeys(generationKeys) {
+        if (generationKeys.length === 0)
+            return new Set();
+        if (generationKeys.length > 500) {
+            throw new Error('findTemporalGenerationKeys accepts at most 500 keys');
+        }
+        const rows = this.db
+            .prepare(`SELECT generation_key FROM operator_temporal_generations
+         WHERE generation_key IN (${generationKeys.map(() => '?').join(',')})`)
+            .all(...generationKeys);
+        return new Set(rows.map((row) => row.generation_key));
+    }
     /** In-progress system rows at boot = crash artifacts (single serial consumer). */
     listStaleClaims() {
         const rows = this.db
@@ -516,7 +1614,7 @@ class TaskLedger {
             .prepare(`UPDATE operator_tasks
          SET status = 'cancelled', latest_event = ?, updated_at = ?
          WHERE kind = 'system' AND status IN ('pending','in_progress')${kindFilter}`)
-            .run(reason, Date.now(), ...kindParams);
+            .run(reason, this.now(), ...kindParams);
         return result.changes;
     }
     /** Per-kind stats for the workorder_status surface. */
@@ -562,7 +1660,7 @@ class TaskLedger {
         this.db
             .prepare(`UPDATE operator_tasks SET status = ?, latest_event = COALESCE(?, latest_event),
                 updated_at = ? WHERE id = ?`)
-            .run(status, reason, Date.now(), id);
+            .run(status, reason, this.now(), id);
     }
     rowToWorkOrder(row) {
         const workKind = (row.source_channel ?? '').slice(exports.WORKORDER_CHANNEL_PREFIX.length);
@@ -600,9 +1698,12 @@ class TaskLedger {
         if (!scope || !reason) {
             throw new Error('contract_no_update requires both scope and reason');
         }
+        return this.insertNoUpdateNote(scope, reason, this.now());
+    }
+    insertNoUpdateNote(scope, reason, createdAt) {
         const result = this.db
             .prepare(`INSERT INTO operator_no_update_notes (scope, reason, created_at) VALUES (?, ?, ?)`)
-            .run(scope, reason, Date.now());
+            .run(scope, reason, createdAt);
         return { id: Number(result.lastInsertRowid) };
     }
     /** Max no-update note id, optionally scoped - the verifier's note snapshot. */