@jungjaehoon/mama-os 0.32.0 → 0.32.2

package/dist/operator/task-ledger.js

@@ -23,9 +23,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TaskLedger = exports.WORKORDER_CHANNEL_PREFIX = exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS = exports.WORKORDER_KINDS = exports.TASK_KINDS = exports.TASK_PRIORITIES = exports.TASK_STATUSES = void 0;
 const node_crypto_1 = require("node:crypto");
 const operator_task_temporal_js_1 = require("../db/migrations/operator-task-temporal.js");
+const operator_task_external_lifecycle_js_1 = require("../db/migrations/operator-task-external-lifecycle.js");
 const effects_js_1 = require("../evidence/effects.js");
 const temporal_effect_js_1 = require("./temporal-effect.js");
 const task_temporal_js_1 = require("./task-temporal.js");
+const external_lifecycle_candidates_js_1 = require("./external-lifecycle-candidates.js");
+const workorder_publishers_js_1 = require("./workorder-publishers.js");
 exports.TASK_STATUSES = [
     'pending',
     'in_progress',
@@ -258,6 +261,7 @@ class TaskLedger {
                 }
             }
             (0, operator_task_temporal_js_1.applyOperatorTaskTemporalMigration)(this.db);
+            (0, operator_task_external_lifecycle_js_1.applyOperatorTaskExternalLifecycleMigration)(this.db);
             // Old-predicate unique index (no terminal exclusion) -> swap in place.
             const idxRow = this.db
                 .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND name='idx_operator_tasks_source'`)
@@ -419,6 +423,432 @@ class TaskLedger {
         const row = this.db.prepare(`SELECT * FROM operator_tasks WHERE id = ?`).get(id);
         return row ? this.toRecord(row) : null;
     }
+    /** Returns one active, explicitly receipted external identity for an owner task. */
+    getExternalBinding(taskId) {
+        const row = this.db
+            .prepare(`SELECT id, revision, task_id, connector, source_type, external_source_id,
+                last_observation_seq, created_by_attempt_id
+         FROM operator_external_task_bindings
+         WHERE task_id = ? AND active = 1`)
+            .get(taskId);
+        return row ? this.externalBindingFromRow(row) : null;
+    }
+    /**
+     * Host-only lookup material for immutable external-lifecycle candidates.
+     * The caller supplies exact event/source ids obtained from the connector index;
+     * no connector prose is read through this ledger surface.
+     */
+    getExternalLifecycleCandidateSupport(eventIds, externalSourceIds) {
+        const uniqueEventIds = [...new Set(eventIds)];
+        const uniqueSourceIds = [...new Set(externalSourceIds)];
+        const directTaskIdsByEventId = new Map();
+        const effectTaskIdsByEventId = new Map();
+        const bindings = [];
+        if (uniqueEventIds.length > 0) {
+            const placeholders = uniqueEventIds.map(() => '?').join(',');
+            const directRows = this.db
+                .prepare(`SELECT source_event_id, id FROM operator_tasks
+           WHERE kind = 'owner' AND source_event_id IN (${placeholders})`)
+                .all(...uniqueEventIds);
+            for (const row of directRows) {
+                const ids = directTaskIdsByEventId.get(row.source_event_id) ?? [];
+                directTaskIdsByEventId.set(row.source_event_id, [...ids, row.id]);
+            }
+            const effectRows = this.db
+                .prepare(`SELECT DISTINCT json_each.value AS event_id, evidence_effects.target_id AS task_id
+           FROM evidence_effects, json_each(evidence_effects.source_event_ids_json)
+           WHERE evidence_effects.target_type = 'task'
+             AND json_each.value IN (${placeholders})`)
+                .all(...uniqueEventIds);
+            for (const row of effectRows) {
+                const taskId = Number(row.task_id);
+                if (!Number.isSafeInteger(taskId) || taskId < 1)
+                    continue;
+                const ids = effectTaskIdsByEventId.get(row.event_id) ?? [];
+                effectTaskIdsByEventId.set(row.event_id, [...ids, taskId]);
+            }
+        }
+        if (uniqueSourceIds.length > 0) {
+            const placeholders = uniqueSourceIds.map(() => '?').join(',');
+            const rows = this.db
+                .prepare(`SELECT id, revision, task_id, connector, source_type, external_source_id,
+                  last_observation_seq
+           FROM operator_external_task_bindings
+           WHERE active = 1 AND connector = 'kagemusha' AND source_type = 'kanban_card'
+             AND external_source_id IN (${placeholders})`)
+                .all(...uniqueSourceIds);
+            for (const row of rows) {
+                bindings.push({
+                    bindingId: row.id,
+                    bindingRevision: row.revision,
+                    taskId: row.task_id,
+                    connector: row.connector,
+                    sourceType: row.source_type,
+                    externalSourceId: row.external_source_id,
+                    lastObservationSeq: row.last_observation_seq,
+                });
+            }
+        }
+        const taskIds = new Set();
+        for (const ids of directTaskIdsByEventId.values())
+            ids.forEach((id) => taskIds.add(id));
+        for (const ids of effectTaskIdsByEventId.values())
+            ids.forEach((id) => taskIds.add(id));
+        for (const binding of bindings)
+            taskIds.add(binding.taskId);
+        const tasksById = new Map();
+        if (taskIds.size > 0) {
+            const ids = [...taskIds];
+            const placeholders = ids.map(() => '?').join(',');
+            const rows = this.db
+                .prepare(`SELECT id, revision FROM operator_tasks WHERE kind = 'owner' AND id IN (${placeholders})`)
+                .all(...ids);
+            for (const row of rows)
+                tasksById.set(row.id, { taskId: row.id, revision: row.revision });
+        }
+        return { taskHints: { directTaskIdsByEventId, effectTaskIdsByEventId }, tasksById, bindings };
+    }
+    getReceiptedExternalCandidateIds(candidateIds) {
+        const ids = [...new Set(candidateIds)];
+        if (ids.length === 0)
+            return new Set();
+        const placeholders = ids.map(() => '?').join(',');
+        const rows = this.db
+            .prepare(`SELECT candidate_id FROM operator_external_binding_receipts WHERE candidate_id IN (${placeholders})
+         UNION
+         SELECT candidate_id FROM operator_external_lifecycle_receipts WHERE candidate_id IN (${placeholders})`)
+            .all(...ids, ...ids);
+        return new Set(rows.map((row) => row.candidate_id));
+    }
+    /**
+     * Recover a candidate only from the payload of the exact currently claimed
+     * board attempt. Revalidate the serialized payload: database bytes are not
+     * a capability merely because they originated in a previous host process.
+     */
+    loadBoardCandidate(attemptId, candidateId, kind) {
+        const attempt = this.getWorkOrderById(attemptId);
+        if (!attempt || attempt.workKind !== 'board' || attempt.status !== 'in_progress') {
+            throw new Error(`external lifecycle candidate requires claimed board attempt ${attemptId}`);
+        }
+        const { attempts: _attempts, ...payload } = attempt.payload;
+        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
+        if (payload.mode !== 'reconcile' || !payload.candidates) {
+            throw new Error(`external lifecycle candidate ${candidateId} is absent from attempt ${attemptId}`);
+        }
+        const candidatePayload = payload.candidates;
+        const candidates = kind === 'binding'
+            ? candidatePayload.bindingCandidates
+            : candidatePayload.lifecycleCandidates;
+        const candidate = candidates.find((value) => value.candidateId === candidateId);
+        if (!candidate) {
+            throw new Error(`external lifecycle ${kind} candidate ${candidateId} is absent from attempt ${attemptId}`);
+        }
+        return candidate;
+    }
+    /**
+     * Read the complete, immutable candidate set for a board attempt against
+     * its durable decision receipts. This deliberately works for stale claims
+     * as well as live in-progress attempts: recovery must never infer effects
+     * from a runner result when the database can answer exactly.
+     */
+    inspectBoardCandidateAttempt(attemptId) {
+        const attempt = this.getWorkOrderById(attemptId);
+        if (!attempt || attempt.workKind !== 'board') {
+            throw new Error(`board candidate inspection requires board attempt ${attemptId}`);
+        }
+        const { attempts: _attempts, ...payload } = attempt.payload;
+        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
+        if (payload.mode !== 'reconcile' || !payload.candidates) {
+            return { disposition: 'none' };
+        }
+        const candidates = payload.candidates;
+        const all = [...candidates.bindingCandidates, ...candidates.lifecycleCandidates];
+        if (all.length === 0) {
+            return { disposition: 'none' };
+        }
+        const outcomes = [];
+        const missingCandidateIds = [];
+        for (const candidate of all) {
+            const receipt = this.getExternalCandidateReceipt(candidate.candidateId);
+            if (!receipt) {
+                missingCandidateIds.push(candidate.candidateId);
+                continue;
+            }
+            if (receipt.kind !== candidate.kind) {
+                throw new Error(`external lifecycle candidate ${candidate.candidateId} has a receipt of the wrong kind`);
+            }
+            outcomes.push(receipt.outcome);
+        }
+        if (missingCandidateIds.length === 0) {
+            return { disposition: 'complete', outcomes };
+        }
+        if (missingCandidateIds.length === all.length) {
+            return { disposition: 'zero' };
+        }
+        return { disposition: 'partial', missingCandidateIds };
+    }
+    applyExternalBindingDecision(attemptId, input, origin) {
+        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('binding', input);
+        if (origin.workOrderAttemptId !== attemptId) {
+            throw new Error(`external binding decision requires trusted attempt origin ${attemptId}`);
+        }
+        let receipt = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const candidate = this.loadBoardCandidate(attemptId, input.candidate_id, 'binding');
+            if (candidate.kind !== 'binding') {
+                throw new Error(`external lifecycle candidate ${input.candidate_id} has the wrong kind`);
+            }
+            if (input.expected_revision !== candidate.taskRevision) {
+                throw new Error(`external binding candidate ${candidate.candidateId} revision does not match its host snapshot`);
+            }
+            if (origin.causeEventIds?.length !== 1 || origin.causeEventIds[0] !== candidate.eventId) {
+                throw new Error(`external binding candidate ${candidate.candidateId} requires its exact host origin event`);
+            }
+            const existing = this.getExternalCandidateReceipt(candidate.candidateId);
+            if (existing) {
+                if (existing.kind !== 'binding') {
+                    throw new Error(`external lifecycle candidate ${candidate.candidateId} already has another receipt kind`);
+                }
+                this.assertBindingReplayMatches(existing, candidate, input);
+                receipt = existing;
+            }
+            else {
+                const task = this.getRowById(candidate.taskId);
+                if (!task || task.kind !== 'owner') {
+                    throw new Error(`external binding candidate ${candidate.candidateId} references no owner task`);
+                }
+                const outcome = task.revision === candidate.taskRevision
+                    ? input.decision === 'bind'
+                        ? 'bound'
+                        : 'declined'
+                    : 'superseded';
+                let bindingId;
+                if (outcome === 'bound') {
+                    const collision = this.db
+                        .prepare(`SELECT id, task_id, external_source_id FROM operator_external_task_bindings
+               WHERE active = 1 AND (task_id = ? OR (connector = ? AND source_type = ? AND external_source_id = ?))`)
+                        .get(candidate.taskId, candidate.connector, candidate.sourceType, candidate.externalSourceId);
+                    if (collision) {
+                        throw new Error(`external binding conflict for task ${candidate.taskId} or ${candidate.externalSourceId}`);
+                    }
+                    const now = this.now();
+                    const inserted = this.db
+                        .prepare(`INSERT INTO operator_external_task_bindings
+                 (task_id, connector, source_type, external_source_id, last_observation_seq,
+                  created_by_attempt_id, active, created_at, updated_at)
+               VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)`)
+                        .run(candidate.taskId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.operatorObservationSeq, attemptId, now, now);
+                    bindingId = Number(inserted.lastInsertRowid);
+                }
+                this.insertBindingReceipt(candidate, attemptId, input, outcome, bindingId, origin);
+                receipt = {
+                    kind: 'binding',
+                    candidateId: candidate.candidateId,
+                    workOrderAttemptId: attemptId,
+                    taskId: candidate.taskId,
+                    outcome,
+                    reason: input.reason,
+                    ...(bindingId === undefined ? {} : { bindingId }),
+                };
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        return receipt;
+    }
+    applyExternalLifecycleDecision(attemptId, input, origin) {
+        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('lifecycle', input);
+        if (origin.workOrderAttemptId !== attemptId) {
+            throw new Error(`external lifecycle decision requires trusted attempt origin ${attemptId}`);
+        }
+        let receipt = null;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const candidate = this.loadBoardCandidate(attemptId, input.candidate_id, 'lifecycle');
+            if (candidate.kind !== 'lifecycle') {
+                throw new Error(`external lifecycle candidate ${input.candidate_id} has the wrong kind`);
+            }
+            if (input.expected_revision !== candidate.taskRevision) {
+                throw new Error(`external lifecycle candidate ${candidate.candidateId} revision does not match its host snapshot`);
+            }
+            if (origin.causeEventIds?.length !== 1 || origin.causeEventIds[0] !== candidate.eventId) {
+                throw new Error(`external lifecycle candidate ${candidate.candidateId} requires its exact host origin event`);
+            }
+            const existing = this.getExternalCandidateReceipt(candidate.candidateId);
+            if (existing) {
+                if (existing.kind !== 'lifecycle') {
+                    throw new Error(`external lifecycle candidate ${candidate.candidateId} already has another receipt kind`);
+                }
+                this.assertLifecycleReplayMatches(existing, candidate, input);
+                receipt = existing;
+            }
+            else {
+                const task = this.getRowById(candidate.taskId);
+                const binding = this.getExternalBinding(candidate.taskId);
+                if (!task || task.kind !== 'owner' || !binding) {
+                    throw new Error(`external lifecycle candidate ${candidate.candidateId} has no active binding`);
+                }
+                const superseded = binding.id !== candidate.bindingId ||
+                    binding.revision !== candidate.bindingRevision ||
+                    binding.connector !== candidate.connector ||
+                    binding.sourceType !== candidate.sourceType ||
+                    binding.externalSourceId !== candidate.externalSourceId ||
+                    binding.createdByAttemptId >= attemptId ||
+                    task.revision !== candidate.taskRevision ||
+                    candidate.operatorObservationSeq <= binding.lastObservationSeq;
+                const taskRevisionBefore = task.revision;
+                let taskRevisionAfter = task.revision;
+                let outcome;
+                if (superseded) {
+                    outcome = 'superseded';
+                }
+                else if (input.decision === 'apply') {
+                    const transitioned = this.transitionTaskInTransaction(candidate.taskId, { status: candidate.proposedStatus, latest_event: candidate.evidenceSummary }, origin, true);
+                    taskRevisionAfter = transitioned.revision;
+                    outcome = 'applied';
+                }
+                else {
+                    outcome = 'retained';
+                }
+                if (outcome !== 'superseded') {
+                    const updated = this.db
+                        .prepare(`UPDATE operator_external_task_bindings
+               SET last_observation_seq = ?, revision = revision + 1, updated_at = ?
+               WHERE id = ? AND revision = ? AND last_observation_seq < ?`)
+                        .run(candidate.operatorObservationSeq, this.now(), candidate.bindingId, candidate.bindingRevision, candidate.operatorObservationSeq);
+                    if (updated.changes !== 1) {
+                        throw new Error(`external lifecycle candidate ${candidate.candidateId} binding watermark changed`);
+                    }
+                }
+                this.insertLifecycleReceipt(candidate, attemptId, input, outcome, taskRevisionBefore, taskRevisionAfter, origin);
+                receipt = {
+                    kind: 'lifecycle',
+                    candidateId: candidate.candidateId,
+                    workOrderAttemptId: attemptId,
+                    taskId: candidate.taskId,
+                    outcome,
+                    reason: input.reason,
+                    taskRevisionBefore,
+                    taskRevisionAfter,
+                };
+            }
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+        return receipt;
+    }
+    getExternalCandidateReceipt(candidateId) {
+        const binding = this.db
+            .prepare(`SELECT candidate_id, workorder_attempt_id, task_id, outcome, reason, binding_id
+         FROM operator_external_binding_receipts WHERE candidate_id = ?`)
+            .get(candidateId);
+        const lifecycle = this.db
+            .prepare(`SELECT candidate_id, workorder_attempt_id, task_id, outcome, reason,
+                task_revision_before, task_revision_after
+         FROM operator_external_lifecycle_receipts WHERE candidate_id = ?`)
+            .get(candidateId);
+        if (binding && lifecycle) {
+            throw new Error(`external lifecycle candidate ${candidateId} has duplicate global receipts`);
+        }
+        const receiptKind = binding ? 'binding' : lifecycle ? 'lifecycle' : null;
+        const identity = this.db
+            .prepare(`SELECT receipt_kind FROM operator_external_receipt_identities WHERE candidate_id = ?`)
+            .get(candidateId);
+        if (receiptKind === null) {
+            if (identity) {
+                throw new Error(`external lifecycle candidate ${candidateId} has an orphan receipt identity`);
+            }
+            return null;
+        }
+        if (!identity || identity.receipt_kind !== receiptKind) {
+            throw new Error(`external lifecycle candidate ${candidateId} has inconsistent global receipt identity`);
+        }
+        if (binding) {
+            return {
+                kind: 'binding',
+                candidateId: binding.candidate_id,
+                workOrderAttemptId: binding.workorder_attempt_id,
+                taskId: binding.task_id,
+                outcome: binding.outcome,
+                reason: binding.reason,
+                ...(binding.binding_id === null ? {} : { bindingId: binding.binding_id }),
+            };
+        }
+        return lifecycle
+            ? {
+                kind: 'lifecycle',
+                candidateId: lifecycle.candidate_id,
+                workOrderAttemptId: lifecycle.workorder_attempt_id,
+                taskId: lifecycle.task_id,
+                outcome: lifecycle.outcome,
+                reason: lifecycle.reason,
+                taskRevisionBefore: lifecycle.task_revision_before,
+                taskRevisionAfter: lifecycle.task_revision_after,
+            }
+            : null;
+    }
+    externalBindingFromRow(row) {
+        return {
+            id: row.id,
+            revision: row.revision,
+            taskId: row.task_id,
+            connector: row.connector,
+            sourceType: row.source_type,
+            externalSourceId: row.external_source_id,
+            lastObservationSeq: row.last_observation_seq,
+            createdByAttemptId: row.created_by_attempt_id,
+        };
+    }
+    assertBindingReplayMatches(receipt, candidate, input) {
+        const stored = this.db
+            .prepare(`SELECT decision FROM operator_external_binding_receipts WHERE candidate_id = ?`)
+            .get(candidate.candidateId);
+        if (!stored ||
+            stored.decision !== input.decision ||
+            receipt.taskId !== candidate.taskId ||
+            receipt.reason !== input.reason) {
+            throw new Error(`external binding receipt ${candidate.candidateId} conflicts with replay decision`);
+        }
+    }
+    insertBindingReceipt(candidate, attemptId, input, outcome, bindingId, origin) {
+        this.db
+            .prepare(`INSERT INTO operator_external_binding_receipts
+           (candidate_id, decision, workorder_attempt_id, task_id, event_id, connector, source_type,
+            external_source_id, channel_partition, content_sha256, source_timestamp_ms,
+            operator_ingest_seq, operator_observation_seq, task_revision, outcome, reason, binding_id,
+            origin_run_id, origin_cause_event_ids, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(candidate.candidateId, input.decision, attemptId, candidate.taskId, candidate.eventId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.channelPartition, candidate.contentSha256, candidate.sourceTimestampMs, candidate.operatorIngestSeq, candidate.operatorObservationSeq, candidate.taskRevision, outcome, input.reason, bindingId ?? null, origin.runId ?? null, JSON.stringify(origin.causeEventIds ?? []), this.now());
+    }
+    assertLifecycleReplayMatches(receipt, candidate, input) {
+        const stored = this.db
+            .prepare(`SELECT decision FROM operator_external_lifecycle_receipts WHERE candidate_id = ?`)
+            .get(candidate.candidateId);
+        if (!stored ||
+            stored.decision !== input.decision ||
+            receipt.taskId !== candidate.taskId ||
+            receipt.reason !== input.reason) {
+            throw new Error(`external lifecycle receipt ${candidate.candidateId} conflicts with replay decision`);
+        }
+    }
+    insertLifecycleReceipt(candidate, attemptId, input, outcome, taskRevisionBefore, taskRevisionAfter, origin) {
+        this.db
+            .prepare(`INSERT INTO operator_external_lifecycle_receipts
+           (candidate_id, decision, workorder_attempt_id, task_id, event_id, connector, source_type,
+            external_source_id, channel_partition, content_sha256, source_timestamp_ms,
+            operator_ingest_seq, operator_observation_seq, binding_id, binding_revision,
+            task_revision_before, task_revision_after, outcome, reason, origin_run_id,
+            origin_cause_event_ids, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(candidate.candidateId, input.decision, attemptId, candidate.taskId, candidate.eventId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.channelPartition, candidate.contentSha256, candidate.sourceTimestampMs, candidate.operatorIngestSeq, candidate.operatorObservationSeq, candidate.bindingId, candidate.bindingRevision, taskRevisionBefore, taskRevisionAfter, outcome, input.reason, origin.runId ?? null, JSON.stringify(origin.causeEventIds ?? []), this.now());
+    }
     /**
      * Create a task. Idempotent under at-least-once delivery: a duplicate
      * (source_channel, source_event_id) UPSERTS - the existing row gets the new
@@ -585,6 +1015,37 @@ class TaskLedger {
         (0, effects_js_1.recordUnattributedChange)(this.db, common, input.origin.causeKind ?? 'owner_message');
     }
     update(id, patch, origin = {}) {
+        this.validateTaskUpdatePatch(patch);
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const task = this.transitionTaskInTransaction(id, patch, origin);
+            this.db.exec('COMMIT');
+            return task;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /**
+     * The one mutation primitive for owner-task state. Callers own the outer
+     * transaction so lifecycle receipts, effects, generation ownership, and the
+     * row revision can commit or roll back as one unit.
+     */
+    transitionTaskInTransaction(id, patch, origin, skipCandidateGuard = false) {
+        this.validateTaskUpdatePatch(patch);
+        if (!skipCandidateGuard) {
+            this.assertCandidateTaskMutationAllowed(id, patch, origin);
+        }
+        const existing = this.db.prepare('SELECT * FROM operator_tasks WHERE id = ?').get(id);
+        if (!existing)
+            throw new Error(`task_update: no task with id ${id}`);
+        if (existing.kind === 'system') {
+            throw new Error(`task_update: task ${id} is a system workorder row (host-managed)`);
+        }
+        return this.transitionOwnerTaskRowInTransaction(id, existing, patch, origin);
+    }
+    validateTaskUpdatePatch(patch) {
         if (patch.status === 'failed') {
             throw new Error(`task_update: 'failed' is a system-only status`);
         }
@@ -598,138 +1059,152 @@ class TaskLedger {
         if (patch.title !== undefined && patch.title.trim() === '') {
             throw new Error('task title must be a non-empty string');
         }
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const existing = this.db.prepare('SELECT * FROM operator_tasks WHERE id = ?').get(id);
-            if (!existing)
-                throw new Error(`task_update: no task with id ${id}`);
-            if (existing.kind === 'system') {
-                throw new Error(`task_update: task ${id} is a system workorder row (host-managed)`);
+    }
+    transitionOwnerTaskRowInTransaction(id, existing, patch, origin) {
+        const next = {
+            title: existing.title,
+            status: existing.status,
+            priority: existing.priority,
+            assignee: existing.assignee,
+            deadline: existing.deadline,
+            due_at: existing.due_at,
+            deadline_offset_minutes: existing.deadline_offset_minutes,
+            latest_event: existing.latest_event,
+            confirmed: existing.confirmed,
+            temporal_epoch: existing.temporal_epoch,
+            temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
+            last_temporal_checked_at: existing.last_temporal_checked_at,
+            next_temporal_check_at: existing.next_temporal_check_at,
+            last_temporal_attempt_id: existing.last_temporal_attempt_id,
+        };
+        if (patch.title !== undefined)
+            next.title = patch.title.trim();
+        if (patch.status !== undefined)
+            next.status = patch.status;
+        if (patch.priority !== undefined)
+            next.priority = patch.priority;
+        if (patch.assignee !== undefined)
+            next.assignee = patch.assignee;
+        if (patch.latest_event !== undefined)
+            next.latest_event = patch.latest_event;
+        if (patch.confirmed !== undefined)
+            next.confirmed = patch.confirmed ? 1 : 0;
+        const hasDueAt = Object.prototype.hasOwnProperty.call(patch, 'due_at');
+        const hasDeadline = Object.prototype.hasOwnProperty.call(patch, 'deadline');
+        if (hasDueAt && patch.due_at !== null && patch.due_at !== undefined) {
+            const exactDue = (0, task_temporal_js_1.parseExactDueAt)(patch.due_at);
+            if (hasDeadline && patch.deadline !== exactDue.deadline) {
+                throw new Error('task_update: due_at and deadline conflict');
             }
-            const next = {
-                title: existing.title,
-                status: existing.status,
-                priority: existing.priority,
-                assignee: existing.assignee,
-                deadline: existing.deadline,
-                due_at: existing.due_at,
-                deadline_offset_minutes: existing.deadline_offset_minutes,
-                latest_event: existing.latest_event,
-                confirmed: existing.confirmed,
-                temporal_epoch: existing.temporal_epoch,
-                temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
-                last_temporal_checked_at: existing.last_temporal_checked_at,
-                next_temporal_check_at: existing.next_temporal_check_at,
-                last_temporal_attempt_id: existing.last_temporal_attempt_id,
-            };
-            if (patch.title !== undefined)
-                next.title = patch.title.trim();
-            if (patch.status !== undefined)
-                next.status = patch.status;
-            if (patch.priority !== undefined)
-                next.priority = patch.priority;
-            if (patch.assignee !== undefined)
-                next.assignee = patch.assignee;
-            if (patch.latest_event !== undefined)
-                next.latest_event = patch.latest_event;
-            if (patch.confirmed !== undefined)
-                next.confirmed = patch.confirmed ? 1 : 0;
-            const hasDueAt = Object.prototype.hasOwnProperty.call(patch, 'due_at');
-            const hasDeadline = Object.prototype.hasOwnProperty.call(patch, 'deadline');
-            if (hasDueAt && patch.due_at !== null && patch.due_at !== undefined) {
-                const exactDue = (0, task_temporal_js_1.parseExactDueAt)(patch.due_at);
-                if (hasDeadline && patch.deadline !== exactDue.deadline) {
-                    throw new Error('task_update: due_at and deadline conflict');
-                }
-                next.due_at = exactDue.dueAt;
-                next.deadline = exactDue.deadline;
-                next.deadline_offset_minutes = exactDue.offsetMinutes;
-            }
-            else if (hasDeadline) {
-                next.deadline = patch.deadline ?? null;
-                next.due_at = null;
-                if (patch.deadline === null) {
-                    next.deadline_offset_minutes = null;
-                }
+            next.due_at = exactDue.dueAt;
+            next.deadline = exactDue.deadline;
+            next.deadline_offset_minutes = exactDue.offsetMinutes;
+        }
+        else if (hasDeadline) {
+            next.deadline = patch.deadline ?? null;
+            next.due_at = null;
+            if (patch.deadline === null) {
+                next.deadline_offset_minutes = null;
             }
-            else if (hasDueAt) {
-                next.due_at = null;
+        }
+        else if (hasDueAt) {
+            next.due_at = null;
+        }
+        const temporalChanged = next.due_at !== existing.due_at || next.deadline !== existing.deadline;
+        const terminalToOpen = (existing.status === 'done' || existing.status === 'cancelled') &&
+            next.status !== 'done' &&
+            next.status !== 'cancelled';
+        const openToTerminal = existing.status !== 'done' &&
+            existing.status !== 'cancelled' &&
+            (next.status === 'done' || next.status === 'cancelled');
+        if (temporalChanged || terminalToOpen) {
+            next.temporal_epoch = existing.temporal_epoch + 1;
+            next.temporal_reconciled_occurrence_key = null;
+            next.last_temporal_checked_at = null;
+            next.next_temporal_check_at = null;
+            next.last_temporal_attempt_id = null;
+        }
+        const persistedColumns = [
+            'title',
+            'status',
+            'priority',
+            'assignee',
+            'deadline',
+            'due_at',
+            'deadline_offset_minutes',
+            'latest_event',
+            'confirmed',
+            'temporal_epoch',
+            'temporal_reconciled_occurrence_key',
+            'last_temporal_checked_at',
+            'next_temporal_check_at',
+            'last_temporal_attempt_id',
+        ];
+        const changedColumns = persistedColumns.filter((column) => next[column] !== existing[column]);
+        if (changedColumns.length === 0) {
+            return this.toRecord(existing);
+        }
+        else {
+            const nextRevision = existing.revision + 1;
+            const sets = changedColumns.map((column) => `${column} = ?`);
+            const values = changedColumns.map((column) => next[column]);
+            const updatedAt = this.now();
+            sets.push('revision = ?', 'updated_at = ?');
+            values.push(nextRevision, updatedAt);
+            const updated = this.db
+                .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ? AND revision = ?`)
+                .run(...values, id, existing.revision);
+            if (updated.changes !== 1) {
+                throw new Error(`task_update: task ${id} revision changed during transition`);
             }
-            const temporalChanged = next.due_at !== existing.due_at || next.deadline !== existing.deadline;
-            const terminalToOpen = (existing.status === 'done' || existing.status === 'cancelled') &&
-                next.status !== 'done' &&
-                next.status !== 'cancelled';
-            const openToTerminal = existing.status !== 'done' &&
-                existing.status !== 'cancelled' &&
-                (next.status === 'done' || next.status === 'cancelled');
+            this.recordTaskChange({
+                kind: 'task_update',
+                taskId: id,
+                origin,
+                channel: existing.source_channel,
+                payload: {
+                    revision: nextRevision,
+                    changed: Object.fromEntries(changedColumns.map((column) => [column, next[column]])),
+                },
+                atMs: updatedAt,
+            });
             if (temporalChanged || terminalToOpen) {
-                next.temporal_epoch = existing.temporal_epoch + 1;
-                next.temporal_reconciled_occurrence_key = null;
-                next.last_temporal_checked_at = null;
-                next.next_temporal_check_at = null;
-                next.last_temporal_attempt_id = null;
+                this.supersedeTemporalGenerationsInTransaction(id, Number(next.temporal_epoch));
             }
-            const persistedColumns = [
-                'title',
-                'status',
-                'priority',
-                'assignee',
-                'deadline',
-                'due_at',
-                'deadline_offset_minutes',
-                'latest_event',
-                'confirmed',
-                'temporal_epoch',
-                'temporal_reconciled_occurrence_key',
-                'last_temporal_checked_at',
-                'next_temporal_check_at',
-                'last_temporal_attempt_id',
-            ];
-            const changedColumns = persistedColumns.filter((column) => next[column] !== existing[column]);
-            if (changedColumns.length === 0) {
-                // Nothing moved, so nothing is recorded. This is the whole point of the ledger:
-                // a call that ran is not a change, and the two must not be countable as one.
-                //
-                // The read-back happens after the catch, not here: a throw between COMMIT and
-                // return would send this into the catch and issue ROLLBACK with no open
-                // transaction, replacing the real error with a confusing one.
-                this.db.exec('COMMIT');
-            }
-            else {
-                const nextRevision = existing.revision + 1;
-                const sets = changedColumns.map((column) => `${column} = ?`);
-                const values = changedColumns.map((column) => next[column]);
-                const updatedAt = this.now();
-                sets.push('revision = ?', 'updated_at = ?');
-                values.push(nextRevision, updatedAt);
-                this.db
-                    .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ?`)
-                    .run(...values, id);
-                this.recordTaskChange({
-                    kind: 'task_update',
-                    taskId: id,
-                    origin,
-                    channel: existing.source_channel,
-                    payload: {
-                        revision: nextRevision,
-                        changed: Object.fromEntries(changedColumns.map((column) => [column, next[column]])),
-                    },
-                    atMs: updatedAt,
-                });
-                if (temporalChanged || terminalToOpen) {
-                    this.supersedeTemporalGenerationsInTransaction(id, Number(next.temporal_epoch));
-                }
-                else if (openToTerminal) {
-                    this.supersedeAllActiveTemporalGenerationsInTransaction(id);
-                }
-                this.db.exec('COMMIT');
+            else if (openToTerminal) {
+                this.supersedeAllActiveTemporalGenerationsInTransaction(id);
             }
+            const transitioned = this.getRowById(id);
+            if (!transitioned)
+                throw new Error(`task_update: task ${id} disappeared during transition`);
+            return transitioned;
         }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
+    }
+    assertCandidateTaskMutationAllowed(taskId, patch, origin) {
+        if (origin.workOrderAttemptId === undefined ||
+            (!Object.prototype.hasOwnProperty.call(patch, 'status') &&
+                !Object.prototype.hasOwnProperty.call(patch, 'latest_event'))) {
+            return;
+        }
+        const attempt = this.getWorkOrderById(origin.workOrderAttemptId);
+        // Unlike a lifecycle decision, this is a standing mutation guard. A late
+        // direct or nested tool call can retain the host-issued attempt context
+        // after its board workorder has reached a terminal status, and its durable
+        // candidate payload must remain authoritative in that case. Decision
+        // application still calls loadBoardCandidate(), which requires a claimed
+        // in-progress attempt.
+        if (!attempt || attempt.workKind !== 'board') {
+            return;
+        }
+        const { attempts: _attempts, ...payload } = attempt.payload;
+        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
+        if (payload.mode !== 'reconcile' || !payload.candidates) {
+            return;
+        }
+        const candidates = payload.candidates;
+        if ([...candidates.bindingCandidates, ...candidates.lifecycleCandidates].some((candidate) => candidate.taskId === taskId)) {
+            throw new Error(`task_update: candidate-bound lifecycle task ${taskId} may change status/latest_event only through its receipted decision`);
         }
-        return this.getById(id);
     }
     supersedeTemporalGenerationsInTransaction(taskId, currentEpoch, excludeGenerationKey, updatedAt = this.now()) {
         const reason = 'task temporal occurrence superseded';