@jungjaehoon/mama-os 0.53.1 → 0.57.0

package/dist/operator/task-ledger.js

@@ -1,3601 +0,0 @@
-"use strict";
-/**
- * TaskLedger - the operator-owned native work-item ledger (M8 Task 0.1).
- *
- * Extends the shape of Kagemusha's proven task store with assignment,
- * idempotency, temporal scheduling, durable generation, effect receipt, and
- * workorder state. Implements the pre-existing `TaskSource` interface
- * (operator-interfaces.ts) so the board projects one task model, not two.
- *
- * Owner conversations create rows through task_create. Reconcile runs update or
- * reclassify existing rows through the task_update/task_reclassify gateway
- * tools; the pipeline board slot is a projection of `list({order:
- * 'deadline_priority'})`. The agent proposes task changes, while this ledger
- * enforces revisions, temporal ownership, idempotency, and atomic receipts.
- *
- * Schema-extension note: CREATE TABLE IF NOT EXISTS is a no-op on existing
- * tables. Any post-ship column addition needs an explicit ALTER TABLE guarded
- * by a PRAGMA table_info check, added to runMigration().
- *
- * The db handle is SHARED with TriggerRegistry and owned by the caller
- * (start.ts opens and closes it once) - deliberately no close() here.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TaskLedger = exports.TASK_COMPLETION_CRITERIA_MAX_LENGTH = exports.TASK_RECLASSIFY_REASON_MAX_LENGTH = exports.TASK_RECLASSIFY_DISPOSITIONS = exports.TASK_RESOLUTION_KINDS = exports.WORKORDER_CHANNEL_PREFIX = exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS = exports.WORKORDER_DELEGATED_AT_KEY = exports.WORKORDER_KINDS = exports.TASK_KINDS = exports.TASK_PRIORITIES = exports.TASK_STATUSES = void 0;
-exports.publisherPayloadOfStoredWorkOrder = publisherPayloadOfStoredWorkOrder;
-const node_crypto_1 = require("node:crypto");
-const operator_task_temporal_js_1 = require("../db/migrations/operator-task-temporal.js");
-const operator_task_external_lifecycle_js_1 = require("../db/migrations/operator-task-external-lifecycle.js");
-const operator_task_review_lifecycle_js_1 = require("../db/migrations/operator-task-review-lifecycle.js");
-const operator_task_classification_js_1 = require("../db/migrations/operator-task-classification.js");
-const operator_owner_action_candidates_js_1 = require("../db/migrations/operator-owner-action-candidates.js");
-const effects_js_1 = require("../evidence/effects.js");
-const temporal_effect_js_1 = require("./temporal-effect.js");
-const task_temporal_js_1 = require("./task-temporal.js");
-const external_lifecycle_candidates_js_1 = require("./external-lifecycle-candidates.js");
-const workorder_publishers_js_1 = require("./workorder-publishers.js");
-/** listPage() only: a page size large enough to be the whole board, so the limit+1
- *  next-page probe stays intact when the caller passes no limit. list() has no LIMIT. */
-const WHOLE_BOARD_LIMIT = 100_000;
-exports.TASK_STATUSES = [
-    'pending',
-    'in_progress',
-    'review',
-    'blocked',
-    'done',
-    'cancelled',
-    // System-only terminal for workorder rows. Owner rows can never reach it:
-    // external create/update guards reject it, so it stays out of owner surfaces.
-    'failed',
-];
-exports.TASK_PRIORITIES = ['high', 'normal', 'low'];
-function scheduledPromotionReservationKeys(idempotencyKey) {
-    const legacy = /^promotion:(\d+)$/.exec(idempotencyKey);
-    if (legacy) {
-        return [idempotencyKey, `promotion:v2:${workorder_publishers_js_1.DEFAULT_PROMOTION_INTERVAL_MS}:${legacy[1]}`];
-    }
-    const versioned = /^promotion:v2:(\d+):(\d+)$/.exec(idempotencyKey);
-    if (!versioned)
-        return null;
-    const [, intervalMs, slot] = versioned;
-    return Number(intervalMs) === workorder_publishers_js_1.DEFAULT_PROMOTION_INTERVAL_MS
-        ? [idempotencyKey, `promotion:${slot}`]
-        : [idempotencyKey];
-}
-exports.TASK_KINDS = ['owner', 'system'];
-exports.WORKORDER_KINDS = [
-    'board',
-    'wiki',
-    'memory-curation',
-    'temporal',
-    'self-check',
-];
-/**
- * Ledger-managed payload key holding the delegation timestamp. Like `attempts`, it is never
- * valid publisher input (validateWorkOrderPayload rejects unknown fields at enqueue) and it
- * is stripped from a requeued replacement, which has delegated nothing.
- */
-exports.WORKORDER_DELEGATED_AT_KEY = 'delegated_at';
-/**
- * Publisher-shaped view of a STORED workorder payload.
- *
- * Stored rows carry ledger-managed keys (`attempts`, `delegated_at`) that the enqueue
- * validator rejects by design. Revalidating a stored row must therefore check only what a
- * publisher could have supplied; validating the raw stored payload turned a
- * delegated-and-verified board attempt into a permanently "unresolved" receipt state
- * (live, 2026-09-09, workorder #4765). Enqueue input is still rejected loudly.
- */
-function publisherPayloadOfStoredWorkOrder(payload) {
-    const { attempts: _attempts, [exports.WORKORDER_DELEGATED_AT_KEY]: _delegatedAt, ...publisherInput } = payload;
-    return publisherInput;
-}
-exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS = 3;
-/** source_channel namespace for workorder rows: 'workorder:<workKind>'. */
-exports.WORKORDER_CHANNEL_PREFIX = 'workorder:';
-/** SQL variable chunk for cause lookups (SQLite default limit is 999). */
-const EFFECT_CAUSE_CHUNK = 500;
-const KNOWN_WORKORDER_CHANNELS = exports.WORKORDER_KINDS.map((workKind) => `${exports.WORKORDER_CHANNEL_PREFIX}${workKind}`);
-const KNOWN_WORKORDER_CHANNELS_SQL = KNOWN_WORKORDER_CHANNELS.map(() => '?').join(',');
-/**
- * Why a row reached its terminal state. Without this the agent cannot tell
- * completed work from an item that was never a task, which is how connector
- * observations, principles and open questions accumulated as owner rows.
- */
-exports.TASK_RESOLUTION_KINDS = [
-    'completed_evidence',
-    'completed_no_issue',
-    'non_task_record',
-    'non_task_memory',
-];
-/** The recorrection an agent may apply to an existing owner row. */
-exports.TASK_RECLASSIFY_DISPOSITIONS = [
-    'completed_evidence',
-    'completed_no_issue',
-    'non_task_record',
-    'non_task_memory',
-    'reopen',
-];
-/** Upper bound on the preserved reason, matching latest_event's practical size. */
-exports.TASK_RECLASSIFY_REASON_MAX_LENGTH = 2000;
-exports.TASK_COMPLETION_CRITERIA_MAX_LENGTH = 500;
-const PRIORITY_RANK = { high: 0, normal: 1, low: 2 };
-function encodeListCursor(payload) {
-    return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
-}
-/** Loud on anything malformed or from a different ordering: a cursor silently
- *  reinterpreted under another order would skip or repeat rows, which is exactly
- *  the incompleteness this page contract exists to rule out. */
-function decodeListCursor(cursor, order) {
-    let parsed;
-    try {
-        parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
-    }
-    catch {
-        throw new Error('[task-ledger] malformed list cursor');
-    }
-    const payload = parsed;
-    if (!payload || payload.order !== order || !Array.isArray(payload.k)) {
-        throw new Error(`[task-ledger] list cursor does not belong to order '${order}'`);
-    }
-    const expected = order === 'deadline_priority' ? 4 : 2;
-    if (payload.k.length !== expected || payload.k.some((value) => value === null)) {
-        throw new Error('[task-ledger] malformed list cursor');
-    }
-    return payload;
-}
-const ISO_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
-function isoToEpochMs(iso) {
-    if (!iso)
-        return null;
-    const ms = Date.parse(`${iso}T00:00:00Z`);
-    return Number.isNaN(ms) ? null : ms;
-}
-const OWNER_ACTION_IDENTITY_MAX_LENGTH = 512;
-function requireOwnerActionIdentity(value, field) {
-    if (typeof value !== 'string') {
-        throw new Error(`owner action ${field} must be a non-blank string`);
-    }
-    if (value.trim().length === 0 || value.trim() !== value) {
-        throw new Error(`owner action ${field} must be a non-blank string without surrounding space`);
-    }
-    if (value.length > OWNER_ACTION_IDENTITY_MAX_LENGTH) {
-        throw new Error(`owner action ${field} must be at most ${OWNER_ACTION_IDENTITY_MAX_LENGTH} characters`);
-    }
-    return value;
-}
-/**
- * Same identity rules as OwnerActionEffectLedger: every field is a trusted
- * host identity, never model text. Checked before any storage is touched.
- */
-function requireOwnerActionContext(context) {
-    if (context === null || typeof context !== 'object') {
-        throw new Error('owner action context is required');
-    }
-    const workOrderAttemptId = context.workOrderAttemptId;
-    if (workOrderAttemptId !== undefined &&
-        (!Number.isSafeInteger(workOrderAttemptId) || workOrderAttemptId <= 0)) {
-        throw new Error('owner action workOrderAttemptId must be a positive integer when present');
-    }
-    return {
-        ownerScope: requireOwnerActionIdentity(context.ownerScope, 'ownerScope'),
-        occurrenceKey: requireOwnerActionIdentity(context.occurrenceKey, 'occurrenceKey'),
-        modelRunId: requireOwnerActionIdentity(context.modelRunId, 'modelRunId'),
-        envelopeHash: requireOwnerActionIdentity(context.envelopeHash, 'envelopeHash'),
-        workOrderAttemptId: workOrderAttemptId ?? null,
-    };
-}
-function assertEnum(value, allowed, field) {
-    if (!allowed.includes(value)) {
-        throw new Error(`${field} must be one of ${allowed.join('|')}, got: ${value}`);
-    }
-}
-function assertIsoDate(value, field) {
-    const match = ISO_DATE_PATTERN.exec(value);
-    if (!match) {
-        throw new Error(`${field} must be an ISO date (YYYY-MM-DD), got: ${value}`);
-    }
-    const [year, month, day] = value.split('-').map(Number);
-    const date = new Date(Date.UTC(year, month - 1, day));
-    const isRoundTrip = date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
-    if (!isRoundTrip) {
-        throw new Error(`${field} must be an ISO date (YYYY-MM-DD), got: ${value}`);
-    }
-}
-function normalizeCompletionCriteria(value, operation) {
-    if (value === undefined || value === null)
-        return null;
-    if (typeof value !== 'string' || value.trim().length === 0) {
-        throw new Error(`${operation}: completion_criteria must be a non-empty string`);
-    }
-    const normalized = value.trim();
-    if (normalized.length > exports.TASK_COMPLETION_CRITERIA_MAX_LENGTH) {
-        throw new Error(`${operation}: completion_criteria must be at most ${exports.TASK_COMPLETION_CRITERIA_MAX_LENGTH} characters`);
-    }
-    return normalized;
-}
-function rowToRecord(row, now, timeZone) {
-    return {
-        id: row.id,
-        title: row.title,
-        status: row.status,
-        priority: row.priority,
-        kind: (row.kind ?? 'owner'),
-        deadline: isoToEpochMs(row.deadline),
-        deadlineIso: row.deadline,
-        assignee: row.assignee,
-        sourceChannel: row.source_channel,
-        sourceEventId: row.source_event_id,
-        latestEvent: row.latest_event,
-        autoCreated: row.auto_created === 1,
-        confirmed: row.confirmed === 1,
-        dueAt: row.due_at,
-        deadlineOffsetMinutes: row.deadline_offset_minutes,
-        revision: row.revision,
-        temporalEpoch: row.temporal_epoch,
-        temporalReconciledOccurrenceKey: row.temporal_reconciled_occurrence_key,
-        lastTemporalCheckedAt: row.last_temporal_checked_at,
-        nextTemporalCheckAt: row.next_temporal_check_at,
-        lastTemporalAttemptId: row.last_temporal_attempt_id,
-        temporalState: (0, task_temporal_js_1.deriveTemporalState)({
-            status: row.status,
-            dueAt: row.due_at,
-            deadlineIso: row.deadline,
-            deadlineOffsetMinutes: row.deadline_offset_minutes,
-        }, now, timeZone),
-        reviewStartedAt: row.review_started_at,
-        reviewAnchorEventId: row.review_anchor_event_id,
-        reviewAnchorSourceChannel: row.review_anchor_source_channel ?? null,
-        completionCriteria: row.completion_criteria ?? null,
-        resolutionKind: (row.resolution_kind ?? null),
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-    };
-}
-class TaskLedger {
-    db;
-    now;
-    timeZone;
-    onOwnerTaskChangeCommitted;
-    pendingOwnerTaskGeneration = null;
-    ownerTaskNotificationScheduled = false;
-    constructor(db, options = {}) {
-        this.db = db;
-        this.now = options.now ?? Date.now;
-        this.timeZone = options.timeZone ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
-        this.onOwnerTaskChangeCommitted = options.onOwnerTaskChangeCommitted;
-        // Validate the injected or boot-resolved zone once, before reads depend on it.
-        new Intl.DateTimeFormat('en-US', { timeZone: this.timeZone }).format(0);
-        this.runMigration();
-    }
-    toRecord(row) {
-        return rowToRecord(row, this.now(), this.timeZone);
-    }
-    toRecordAt(row, observedAt) {
-        return rowToRecord(row, observedAt, this.timeZone);
-    }
-    temporalStateAt(task, observedAt) {
-        return (0, task_temporal_js_1.deriveTemporalState)(task, observedAt, this.timeZone);
-    }
-    runMigration() {
-        // Both construction sites (start.ts boot + operator-handler lazy) run this;
-        // busy_timeout here covers BOTH connections against the rebuild race.
-        this.db.pragma('busy_timeout = 5000');
-        this.db.pragma('foreign_keys = ON');
-        this.db.exec(`
-      CREATE TABLE IF NOT EXISTS operator_tasks (${TaskLedger.TABLE_COLUMNS_SQL});
-      ${TaskLedger.INDEXES_SQL}
-
-      CREATE TABLE IF NOT EXISTS operator_no_update_notes (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        scope TEXT NOT NULL,
-        reason TEXT NOT NULL,
-        created_at INTEGER NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_operator_no_update_scope
-        ON operator_no_update_notes(scope, id);
-    `);
-        // Same database as the tasks, so a change and its cause commit or roll back together.
-        // A ledger that can disagree with the rows it describes is worse than no ledger.
-        (0, effects_js_1.ensureEffectLedger)(this.db);
-        this.upgradeSchema();
-        const foreignKeyViolations = this.db.pragma('foreign_key_check');
-        if (foreignKeyViolations.length > 0) {
-            throw new Error(`operator task migration found ${foreignKeyViolations.length} foreign key violation(s)`);
-        }
-    }
-    /** Full current column set - single source for CREATE and the rebuild copy. */
-    static TABLE_COLUMNS_SQL = `
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        title TEXT NOT NULL,
-        status TEXT NOT NULL DEFAULT 'pending'
-          CHECK (status IN ('pending','in_progress','review','blocked','done','cancelled','failed')),
-        priority TEXT NOT NULL DEFAULT 'normal' CHECK (priority IN ('high','normal','low')),
-        kind TEXT NOT NULL DEFAULT 'owner' CHECK (kind IN ('owner','system')),
-        payload TEXT,
-        assignee TEXT,
-        deadline TEXT,
-        source_channel TEXT,
-        source_event_id TEXT,
-        latest_event TEXT,
-        auto_created INTEGER NOT NULL DEFAULT 1,
-        confirmed INTEGER NOT NULL DEFAULT 0,
-        due_at INTEGER,
-        deadline_offset_minutes INTEGER
-          CHECK (deadline_offset_minutes BETWEEN -840 AND 840),
-        revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0),
-        temporal_epoch INTEGER NOT NULL DEFAULT 0 CHECK (temporal_epoch >= 0),
-        temporal_reconciled_occurrence_key TEXT,
-        last_temporal_checked_at INTEGER,
-        next_temporal_check_at INTEGER,
-        last_temporal_attempt_id INTEGER,
-        review_started_at INTEGER,
-        review_anchor_event_id TEXT,
-        review_anchor_source_channel TEXT,
-        completion_criteria TEXT,
-        resolution_kind TEXT,
-        created_at INTEGER NOT NULL,
-        updated_at INTEGER NOT NULL`;
-    // Unique-index predicate excludes terminal rows so a terminal keyed workorder
-    // frees its idempotency slot for a fresh insert (plan M1); owner upsert is a
-    // SELECT probe, unaffected.
-    static INDEXES_SQL = `
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_operator_tasks_source
-        ON operator_tasks(source_channel, source_event_id)
-        WHERE source_event_id IS NOT NULL
-          AND status NOT IN ('done','failed','cancelled');
-      CREATE INDEX IF NOT EXISTS idx_operator_tasks_status ON operator_tasks(status);
-      CREATE INDEX IF NOT EXISTS idx_operator_tasks_deadline ON operator_tasks(deadline);`;
-    /**
-     * Stage-2 in-place upgrade for pre-existing tables. Guards are re-checked
-     * INSIDE `BEGIN IMMEDIATE`: two connections construct TaskLedger (boot +
-     * lazy API handler) and both run this - the loser must see the winner's
-     * finished work, not rebuild an already-migrated table.
-     */
-    upgradeSchema() {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const cols = this.db.prepare(`PRAGMA table_info(operator_tasks)`).all();
-            if (!cols.some((c) => c.name === 'kind')) {
-                this.db.exec(`ALTER TABLE operator_tasks ADD COLUMN kind TEXT NOT NULL DEFAULT 'owner'
-             CHECK (kind IN ('owner','system'))`);
-            }
-            if (!cols.some((c) => c.name === 'payload')) {
-                this.db.exec(`ALTER TABLE operator_tasks ADD COLUMN payload TEXT`);
-            }
-            // 'failed' lives in an inline CHECK -> table rebuild (copy-swap) required.
-            const tableSql = this.db
-                .prepare(`SELECT sql FROM sqlite_master WHERE type='table' AND name='operator_tasks'`)
-                .get().sql;
-            if (!tableSql.includes(`'failed'`)) {
-                const seqRow = this.db
-                    .prepare(`SELECT seq FROM sqlite_sequence WHERE name='operator_tasks'`)
-                    .get();
-                this.db.exec(`
-          CREATE TABLE operator_tasks_new (${TaskLedger.TABLE_COLUMNS_SQL});
-          INSERT INTO operator_tasks_new
-            (id, title, status, priority, kind, payload, assignee, deadline, source_channel,
-             source_event_id, latest_event, auto_created, confirmed, created_at, updated_at)
-            SELECT id, title, status, priority, kind, payload, assignee, deadline,
-                   source_channel, source_event_id, latest_event, auto_created, confirmed,
-                   created_at, updated_at
-            FROM operator_tasks;
-          DROP TABLE operator_tasks;
-          ALTER TABLE operator_tasks_new RENAME TO operator_tasks;
-        `);
-                if (seqRow) {
-                    // sqlite_sequence has NO unique key on name - INSERT OR REPLACE
-                    // would APPEND a duplicate row (review m2). UPDATE first; insert
-                    // only when the rename left no row behind.
-                    const updated = this.db
-                        .prepare(`UPDATE sqlite_sequence SET seq = ? WHERE name = 'operator_tasks'`)
-                        .run(seqRow.seq);
-                    if (updated.changes === 0) {
-                        this.db
-                            .prepare(`INSERT INTO sqlite_sequence (name, seq) VALUES ('operator_tasks', ?)`)
-                            .run(seqRow.seq);
-                    }
-                }
-            }
-            (0, operator_task_temporal_js_1.applyOperatorTaskTemporalMigration)(this.db);
-            (0, operator_task_external_lifecycle_js_1.applyOperatorTaskExternalLifecycleMigration)(this.db);
-            (0, operator_owner_action_candidates_js_1.applyOperatorOwnerActionCandidatesMigration)(this.db);
-            (0, operator_task_review_lifecycle_js_1.applyOperatorTaskReviewLifecycleMigration)(this.db);
-            (0, operator_task_classification_js_1.applyOperatorTaskClassificationMigration)(this.db);
-            // Old-predicate unique index (no terminal exclusion) -> swap in place.
-            const idxRow = this.db
-                .prepare(`SELECT sql FROM sqlite_master WHERE type='index' AND name='idx_operator_tasks_source'`)
-                .get();
-            if (!idxRow || !idxRow.sql.includes('status NOT IN')) {
-                this.db.exec(`DROP INDEX IF EXISTS idx_operator_tasks_source;`);
-            }
-            this.db.exec(TaskLedger.INDEXES_SQL);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-    /** TaskSource conformance: open items in canonical board order. */
-    getTasks() {
-        return this.list({ order: 'deadline_priority' });
-    }
-    countOpenUnconfirmed() {
-        const row = this.db
-            .prepare(`SELECT COUNT(*) AS count
-         FROM operator_tasks
-         WHERE kind = 'owner'
-           AND auto_created = 1
-           AND confirmed = 0
-           AND status NOT IN ('done', 'cancelled')`)
-            .get();
-        return row.count;
-    }
-    list(filter = {}) {
-        const observedAt = this.temporalAsOf(filter.temporalAsOfMs);
-        const { where, params } = this.buildListPredicate({
-            ...filter,
-            temporalAsOfMs: observedAt,
-        });
-        const rawLimit = Number(filter.limit);
-        // No LIMIT at all unless the caller asks for one: the whole board is the read, and the
-        // 50/200 bound is what made the board turn judge 216 tasks from 50 (owner, 2026-09-04).
-        const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.floor(rawLimit)) : null;
-        const rows = this.db
-            .prepare(`SELECT * FROM operator_tasks
-         ${where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''}
-         ORDER BY ${TaskLedger.orderSql(filter.order)}
-         ${limit === null ? '' : 'LIMIT ?'}`)
-            .all(...params, ...(limit === null ? [] : [limit]));
-        return rows.map((row) => this.toRecordAt(row, observedAt));
-    }
-    temporalAsOf(value) {
-        const observedAt = value ?? this.now();
-        if (!Number.isSafeInteger(observedAt)) {
-            throw new Error('task list temporal as-of must be a finite integer epoch millisecond');
-        }
-        return observedAt;
-    }
-    /** Shared filter predicate. Owner surface only - system workorder rows never appear in
-     *  board/REST/gateway listings (Stage-2 kind filter; workorders have dedicated readers). */
-    buildListPredicate(filter) {
-        const where = [`kind = 'owner'`];
-        const params = [];
-        if (filter.status) {
-            where.push('status = ?');
-            params.push(filter.status);
-        }
-        else if (filter.includeTerminal === false) {
-            where.push("status NOT IN ('done', 'cancelled')");
-        }
-        if (filter.channel) {
-            where.push('source_channel = ?');
-            params.push(filter.channel);
-        }
-        if (filter.search) {
-            where.push('(title LIKE ? OR latest_event LIKE ? OR assignee LIKE ?)');
-            const like = `%${filter.search}%`;
-            params.push(like, like, like);
-        }
-        if (filter.assignee !== undefined) {
-            where.push('assignee = ?');
-            params.push(filter.assignee);
-        }
-        if (filter.priority !== undefined) {
-            where.push('priority = ?');
-            params.push(filter.priority);
-        }
-        if (filter.dueBeforeMs !== undefined) {
-            where.push('due_at IS NOT NULL AND due_at < ?');
-            params.push(filter.dueBeforeMs);
-        }
-        if (filter.dueAfterMs !== undefined) {
-            where.push('due_at IS NOT NULL AND due_at >= ?');
-            params.push(filter.dueAfterMs);
-        }
-        if (filter.updatedSinceMs !== undefined) {
-            where.push('updated_at >= ?');
-            params.push(filter.updatedSinceMs);
-        }
-        if (filter.updatedBeforeMs !== undefined) {
-            where.push('updated_at < ?');
-            params.push(filter.updatedBeforeMs);
-        }
-        if (filter.qualification === 'qualified') {
-            where.push('completion_criteria IS NOT NULL');
-        }
-        else if (filter.qualification === 'legacy_unqualified') {
-            where.push('completion_criteria IS NULL');
-        }
-        if (filter.dueBucket !== undefined) {
-            const observedAt = this.temporalAsOf(filter.temporalAsOfMs);
-            const rows = this.db
-                .prepare(`SELECT id, status, due_at, deadline, deadline_offset_minutes
-           FROM operator_tasks WHERE ${where.join(' AND ')}`)
-                .all(...params);
-            const ids = rows
-                .filter((row) => {
-                const state = (0, task_temporal_js_1.deriveTemporalState)({
-                    status: row.status,
-                    dueAt: row.due_at,
-                    deadlineIso: row.deadline,
-                    deadlineOffsetMinutes: row.deadline_offset_minutes,
-                }, observedAt, this.timeZone);
-                return (0, task_temporal_js_1.dueBucketForTemporalState)(state) === filter.dueBucket;
-            })
-                .map((row) => row.id);
-            // One JSON parameter avoids SQLite's variable limit even on a large board.
-            where.push('id IN (SELECT CAST(value AS INTEGER) FROM json_each(?))');
-            params.push(JSON.stringify(ids));
-        }
-        return { where, params };
-    }
-    /** ORDER BY for both list() and listPage(); the trailing id makes it a TOTAL order,
-     *  which is what lets a keyset cursor resume without skipping or repeating a row.
-     *  LIMIT applies AFTER ordering, so a bounded read still returns the true top-N. */
-    static orderSql(order) {
-        return order === 'updated'
-            ? 'updated_at DESC, id DESC'
-            : // deadline asc NULLS LAST, then priority high>normal>low, then id.
-                `CASE WHEN deadline IS NULL THEN 1 ELSE 0 END ASC, COALESCE(deadline, '') ASC,
-         CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END ASC, id ASC`;
-    }
-    static cursorFor(record, order) {
-        if (order === 'updated') {
-            return { order, k: [record.updatedAt, record.id] };
-        }
-        return {
-            order,
-            k: [
-                record.deadlineIso === null ? 1 : 0,
-                record.deadlineIso ?? '',
-                PRIORITY_RANK[record.priority] ?? 2,
-                record.id,
-            ],
-        };
-    }
-    /**
-     * One page of the same ordered set, with the totals that make completeness provable.
-     *
-     * Keyset, not OFFSET: an offset page silently skips or repeats rows when the set
-     * changes between pages, which would leave a "whole situation" claim resting on a
-     * read that quietly lost items.
-     */
-    listPage(filter = {}) {
-        const observedAt = this.temporalAsOf(filter.temporalAsOfMs);
-        const order = filter.order === 'updated' ? 'updated' : 'deadline_priority';
-        const { where, params } = this.buildListPredicate({
-            ...filter,
-            temporalAsOfMs: observedAt,
-        });
-        const rawLimit = Number(filter.limit);
-        // No cap and a whole-board default: Kagemusha's task_list is selectAll, and the 50/200
-        // bound is what made the board turn judge 216 tasks from 50 (owner, 2026-09-04). The
-        // large default keeps the limit+1 next-page probe below intact.
-        const limit = Number.isFinite(rawLimit) ? Math.max(1, Math.floor(rawLimit)) : WHOLE_BOARD_LIMIT;
-        const totalRow = this.db
-            .prepare(`SELECT COUNT(*) AS total FROM operator_tasks WHERE ${where.join(' AND ')}`)
-            .get(...params);
-        const pageWhere = [...where];
-        const pageParams = [...params];
-        if (filter.cursor) {
-            const { k } = decodeListCursor(filter.cursor, order);
-            if (order === 'updated') {
-                pageWhere.push('(updated_at, id) < (?, ?)');
-            }
-            else {
-                pageWhere.push(`(CASE WHEN deadline IS NULL THEN 1 ELSE 0 END, COALESCE(deadline, ''),
-            CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, id) > (?, ?, ?, ?)`);
-            }
-            pageParams.push(...k);
-        }
-        // limit + 1 probes for a next page instead of guessing from a full page, so the
-        // final page never hands out a cursor that resolves to nothing.
-        const rows = this.db
-            .prepare(`SELECT * FROM operator_tasks
-         WHERE ${pageWhere.join(' AND ')}
-         ORDER BY ${TaskLedger.orderSql(filter.order)}
-         LIMIT ?`)
-            .all(...pageParams, limit + 1);
-        const hasMore = rows.length > limit;
-        const tasks = rows.slice(0, limit).map((row) => this.toRecordAt(row, observedAt));
-        const last = tasks[tasks.length - 1];
-        return {
-            tasks,
-            total: totalRow.total,
-            returned: tasks.length,
-            nextCursor: hasMore && last ? encodeListCursor(TaskLedger.cursorFor(last, order)) : null,
-        };
-    }
-    /**
-     * One `listPage`, with the read generation and observation instant captured
-     * in the SAME synchronous call so total/rows/version cannot straddle a write
-     * from this process. The progressive `items` view pins its cursor to this
-     * readVersion and restarts if a later page observes a different one.
-     */
-    itemsPage(filter = {}) {
-        // One DEFERRED read transaction: the generation, the total and the rows all
-        // read the SAME SQLite snapshot, so another connection committing between the
-        // statements cannot make the returned readVersion disagree with the page it
-        // describes. Synchronous JS alone is not a cross-connection snapshot.
-        return this.readSnapshot(() => {
-            const observedAt = this.temporalAsOf(filter.temporalAsOfMs);
-            const readVersion = this.readGeneration();
-            const page = this.listPage({ ...filter, temporalAsOfMs: observedAt });
-            return { ...page, readVersion, observedAt };
-        });
-    }
-    /** The ledger's clock (injected in tests); progressive views stamp observedAt with it. */
-    nowMs() {
-        return this.now();
-    }
-    /**
-     * Run a read-only body inside a single DEFERRED transaction so every statement
-     * shares one snapshot. better-sqlite3 nests via SAVEPOINT, so this is safe even
-     * if a caller is already inside a transaction.
-     */
-    readSnapshot(body) {
-        const runner = this.db.transaction(body);
-        return runner();
-    }
-    /**
-     * A conservative change signature for the whole owner board, derived from
-     * existing columns - no snapshot table. COUNT catches inserts/deletes,
-     * SUM(revision) catches every owner update (each bumps revision), MAX(id)
-     * catches inserts, MAX(updated_at) is a coarse tie-breaker. It is NOT an
-     * immutable snapshot id: it only lets a paged read reject its own cursor once
-     * ANY owner row has changed, so a "whole board" claim never spans a write.
-     * System workorder churn is deliberately excluded (kind='owner').
-     */
-    readGeneration() {
-        const row = this.db
-            .prepare(`SELECT COUNT(*) AS c, COALESCE(SUM(revision), 0) AS r,
-                COALESCE(MAX(id), 0) AS m, COALESCE(MAX(updated_at), 0) AS u
-         FROM operator_tasks WHERE kind = 'owner'`)
-            .get();
-        return (0, node_crypto_1.createHash)('sha256')
-            .update(`${row.c}:${row.r}:${row.m}:${row.u}`)
-            .digest('base64url')
-            .slice(0, 22);
-    }
-    notifyOwnerTaskCommit(previousGeneration) {
-        if (!this.onOwnerTaskChangeCommitted) {
-            return;
-        }
-        const generation = this.readGeneration();
-        if (generation === previousGeneration) {
-            return;
-        }
-        this.pendingOwnerTaskGeneration = generation;
-        if (this.ownerTaskNotificationScheduled) {
-            return;
-        }
-        this.ownerTaskNotificationScheduled = true;
-        queueMicrotask(() => this.flushOwnerTaskNotification());
-    }
-    flushOwnerTaskNotification() {
-        this.ownerTaskNotificationScheduled = false;
-        const expected = this.pendingOwnerTaskGeneration;
-        this.pendingOwnerTaskGeneration = null;
-        if (!expected || !this.onOwnerTaskChangeCommitted) {
-            return;
-        }
-        const current = this.readGeneration();
-        if (current !== expected) {
-            this.pendingOwnerTaskGeneration = current;
-            this.ownerTaskNotificationScheduled = true;
-            queueMicrotask(() => this.flushOwnerTaskNotification());
-            return;
-        }
-        this.onOwnerTaskChangeCommitted(current);
-    }
-    /**
-     * Aggregate counts over the same owner predicate `listPage` filters by. Facets
-     * come from SQL GROUP BY (each partitions total); due buckets are computed in
-     * one JS pass over minimal rows using the SAME deriveTemporalState `items`
-     * uses, so an overview bucket and an item's temporal_state never disagree.
-     * readGeneration is captured in the same synchronous call as the counts.
-     */
-    overview(filter = {}) {
-        return this.readSnapshot(() => this.overviewInSnapshot(filter));
-    }
-    overviewInSnapshot(filter) {
-        // One captured time for every derived due bucket; one snapshot for every count.
-        const now = this.temporalAsOf(filter.temporalAsOfMs);
-        const readVersion = this.readGeneration();
-        const { where, params } = this.buildListPredicate({ ...filter, temporalAsOfMs: now });
-        const whereSql = where.join(' AND ');
-        const groupBy = (column) => this.db
-            .prepare(`SELECT ${column} AS key, COUNT(*) AS count FROM operator_tasks
-           WHERE ${whereSql} GROUP BY ${column}`)
-            .all(...params);
-        const total = this.db
-            .prepare(`SELECT COUNT(*) AS total FROM operator_tasks WHERE ${whereSql}`)
-            .get(...params).total;
-        const status = {};
-        for (const row of groupBy('status'))
-            status[String(row.key)] = row.count;
-        const priority = {};
-        for (const row of groupBy('priority'))
-            priority[String(row.key)] = row.count;
-        const channels = groupBy('source_channel').map((row) => ({
-            channel: row.key,
-            count: row.count,
-        }));
-        const assignees = groupBy('assignee').map((row) => ({ assignee: row.key, count: row.count }));
-        const due = { missing: 0, overdue: 0, upcoming: 0, closed: 0 };
-        const rows = this.db
-            .prepare(`SELECT status, due_at, deadline, deadline_offset_minutes
-         FROM operator_tasks WHERE ${whereSql}`)
-            .all(...params);
-        for (const row of rows) {
-            const state = (0, task_temporal_js_1.deriveTemporalState)({
-                status: row.status,
-                dueAt: row.due_at,
-                deadlineIso: row.deadline,
-                deadlineOffsetMinutes: row.deadline_offset_minutes,
-            }, now, this.timeZone);
-            due[(0, task_temporal_js_1.dueBucketForTemporalState)(state)] += 1;
-        }
-        return { total, observedAt: now, readVersion, status, priority, channels, assignees, due };
-    }
-    /** Internal bounded page for temporal reconciliation; excludes rows that can never be candidates. */
-    listTemporalScanPage(input) {
-        const rawLimit = Number(input.limit);
-        const rawAfterId = Number(input.afterId);
-        const limit = Number.isFinite(rawLimit)
-            ? Math.max(1, Math.min(200, Math.floor(rawLimit)))
-            : 200;
-        const afterId = Number.isFinite(rawAfterId) ? Math.max(0, Math.floor(rawAfterId)) : 0;
-        const rows = this.db
-            .prepare(`SELECT * FROM operator_tasks INDEXED BY idx_operator_tasks_temporal_scan_id
-         WHERE kind = 'owner'
-           AND status IN ('pending','in_progress','review','blocked')
-           AND id > ?
-           AND (due_at IS NOT NULL OR deadline IS NOT NULL OR next_temporal_check_at IS NOT NULL)
-         ORDER BY id ASC
-         LIMIT ?`)
-            .all(afterId, limit);
-        return rows.map((row) => this.toRecord(row));
-    }
-    /** Owner rows only - system workorder rows are invisible to external reads. */
-    getById(id) {
-        const record = this.getRowById(id);
-        return record && record.kind === 'owner' ? record : null;
-    }
-    /** Internal fetch without the kind filter (guards and workorder paths). */
-    getRowById(id) {
-        const row = this.db.prepare(`SELECT * FROM operator_tasks WHERE id = ?`).get(id);
-        return row ? this.toRecord(row) : null;
-    }
-    /** Returns one active, explicitly receipted external identity for an owner task. */
-    getExternalBinding(taskId) {
-        const row = this.db
-            .prepare(`SELECT id, revision, task_id, connector, source_type, external_source_id,
-                last_observation_seq, created_by_attempt_id, created_by_run_id,
-                created_by_owner_scope, created_at
-         FROM operator_external_task_bindings
-         WHERE task_id = ? AND active = 1`)
-            .get(taskId);
-        return row ? this.externalBindingFromRow(row) : null;
-    }
-    /**
-     * Host-only lookup material for immutable external-lifecycle candidates.
-     * The caller supplies exact event/source ids obtained from the connector index;
-     * no connector prose is read through this ledger surface.
-     */
-    getExternalLifecycleCandidateSupport(eventIds, externalSourceIds) {
-        const uniqueEventIds = [...new Set(eventIds)];
-        const uniqueSourceIds = [...new Set(externalSourceIds)];
-        const directTaskIdsByEventId = new Map();
-        const effectTaskIdsByEventId = new Map();
-        const bindings = [];
-        if (uniqueEventIds.length > 0) {
-            const placeholders = uniqueEventIds.map(() => '?').join(',');
-            const directRows = this.db
-                .prepare(`SELECT source_event_id, id FROM operator_tasks
-           WHERE kind = 'owner' AND source_event_id IN (${placeholders})`)
-                .all(...uniqueEventIds);
-            for (const row of directRows) {
-                const ids = directTaskIdsByEventId.get(row.source_event_id) ?? [];
-                directTaskIdsByEventId.set(row.source_event_id, [...ids, row.id]);
-            }
-            const effectRows = this.db
-                .prepare(`SELECT DISTINCT json_each.value AS event_id, evidence_effects.target_id AS task_id
-           FROM evidence_effects, json_each(evidence_effects.source_event_ids_json)
-           WHERE evidence_effects.target_type = 'task'
-             AND json_each.value IN (${placeholders})`)
-                .all(...uniqueEventIds);
-            for (const row of effectRows) {
-                const taskId = Number(row.task_id);
-                if (!Number.isSafeInteger(taskId) || taskId < 1)
-                    continue;
-                const ids = effectTaskIdsByEventId.get(row.event_id) ?? [];
-                effectTaskIdsByEventId.set(row.event_id, [...ids, taskId]);
-            }
-        }
-        if (uniqueSourceIds.length > 0) {
-            const placeholders = uniqueSourceIds.map(() => '?').join(',');
-            const rows = this.db
-                .prepare(`SELECT id, revision, task_id, connector, source_type, external_source_id,
-                  last_observation_seq
-           FROM operator_external_task_bindings
-           WHERE active = 1 AND connector = 'kagemusha' AND source_type = 'kanban_card'
-             AND external_source_id IN (${placeholders})`)
-                .all(...uniqueSourceIds);
-            for (const row of rows) {
-                bindings.push({
-                    bindingId: row.id,
-                    bindingRevision: row.revision,
-                    taskId: row.task_id,
-                    connector: row.connector,
-                    sourceType: row.source_type,
-                    externalSourceId: row.external_source_id,
-                    lastObservationSeq: row.last_observation_seq,
-                });
-            }
-        }
-        const taskIds = new Set();
-        for (const ids of directTaskIdsByEventId.values())
-            ids.forEach((id) => taskIds.add(id));
-        for (const ids of effectTaskIdsByEventId.values())
-            ids.forEach((id) => taskIds.add(id));
-        for (const binding of bindings)
-            taskIds.add(binding.taskId);
-        const tasksById = new Map();
-        if (taskIds.size > 0) {
-            const ids = [...taskIds];
-            const placeholders = ids.map(() => '?').join(',');
-            const rows = this.db
-                .prepare(`SELECT id, revision FROM operator_tasks WHERE kind = 'owner' AND id IN (${placeholders})`)
-                .all(...ids);
-            for (const row of rows)
-                tasksById.set(row.id, { taskId: row.id, revision: row.revision });
-        }
-        return { taskHints: { directTaskIdsByEventId, effectTaskIdsByEventId }, tasksById, bindings };
-    }
-    getReceiptedExternalCandidateIds(candidateIds) {
-        const ids = [...new Set(candidateIds)];
-        if (ids.length === 0)
-            return new Set();
-        const placeholders = ids.map(() => '?').join(',');
-        const rows = this.db
-            .prepare(`SELECT candidate_id FROM operator_external_binding_receipts WHERE candidate_id IN (${placeholders})
-         UNION
-         SELECT candidate_id FROM operator_external_lifecycle_receipts WHERE candidate_id IN (${placeholders})`)
-            .all(...ids, ...ids);
-        return new Set(rows.map((row) => row.candidate_id));
-    }
-    /**
-     * Recover a candidate only from the payload of the exact currently claimed
-     * board attempt. Revalidate the serialized payload: database bytes are not
-     * a capability merely because they originated in a previous host process.
-     */
-    loadBoardCandidate(attemptId, candidateId, kind) {
-        const attempt = this.getWorkOrderById(attemptId);
-        if (!attempt || attempt.workKind !== 'board' || attempt.status !== 'in_progress') {
-            throw new Error(`external lifecycle candidate requires claimed board attempt ${attemptId}`);
-        }
-        const payload = publisherPayloadOfStoredWorkOrder(attempt.payload);
-        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
-        if (payload.mode !== 'reconcile' || !payload.candidates) {
-            throw new Error(`external lifecycle candidate ${candidateId} is absent from attempt ${attemptId}`);
-        }
-        const candidatePayload = payload.candidates;
-        const candidates = kind === 'binding'
-            ? candidatePayload.bindingCandidates
-            : candidatePayload.lifecycleCandidates;
-        const candidate = candidates.find((value) => value.candidateId === candidateId);
-        if (!candidate) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} is absent from attempt ${attemptId}`);
-        }
-        return candidate;
-    }
-    /**
-     * Read the complete, immutable candidate set for a board attempt against
-     * its durable decision receipts. This deliberately works for stale claims
-     * as well as live in-progress attempts: recovery must never infer effects
-     * from a runner result when the database can answer exactly.
-     */
-    inspectBoardCandidateAttempt(attemptId) {
-        const attempt = this.getWorkOrderById(attemptId);
-        if (!attempt || attempt.workKind !== 'board') {
-            throw new Error(`board candidate inspection requires board attempt ${attemptId}`);
-        }
-        const payload = publisherPayloadOfStoredWorkOrder(attempt.payload);
-        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
-        if (payload.mode !== 'reconcile' || !payload.candidates) {
-            return { disposition: 'none' };
-        }
-        const candidates = payload.candidates;
-        const all = [...candidates.bindingCandidates, ...candidates.lifecycleCandidates];
-        if (all.length === 0) {
-            return { disposition: 'none' };
-        }
-        // Receipts are global by candidate id, so a decision settled by an owner
-        // run is seen here exactly like one settled by this attempt.
-        return this.candidateReceiptDisposition(all);
-    }
-    /**
-     * Resolve one candidate decision's authority (Task B2).
-     *
-     * A plain attempt id is the legacy Board wrapper. A discriminated source is
-     * either that same Board path or a verified owner run whose host-attested
-     * snapshot must match the caller's scope, run and envelope exactly. Both
-     * return the SAME decision inputs; the receipt records which one settled it.
-     */
-    resolveExternalCandidateAuthority(source, kind, origin) {
-        const resolved = typeof source === 'number' ? { kind: 'board', attemptId: source } : source;
-        const label = kind === 'binding' ? 'external binding' : 'external lifecycle';
-        if (resolved.kind === 'board') {
-            const attemptId = resolved.attemptId;
-            if (origin.workOrderAttemptId !== attemptId) {
-                throw new Error(`${label} decision requires trusted attempt origin ${attemptId}`);
-            }
-            return {
-                source: resolved,
-                receiptOrigin: {
-                    attemptId,
-                    runId: origin.runId ?? null,
-                    ownerScope: null,
-                    envelopeHash: null,
-                },
-                load: (candidateId) => {
-                    const attempt = this.getWorkOrderById(attemptId);
-                    return {
-                        candidate: this.loadBoardCandidate(attemptId, candidateId, kind),
-                        snapshotAt: attempt?.createdAt ?? 0,
-                    };
-                },
-            };
-        }
-        const context = requireOwnerActionContext(resolved.context);
-        if (origin.runId !== context.modelRunId) {
-            throw new Error(`${label} decision requires trusted owner run origin ${context.modelRunId}`);
-        }
-        if ((origin.workOrderAttemptId ?? null) !== context.workOrderAttemptId) {
-            throw new Error(`${label} decision attempt ${String(origin.workOrderAttemptId)} does not match the attesting owner run`);
-        }
-        if (context.workOrderAttemptId !== null) {
-            this.assertWorkOrderAttemptActive(label, context.workOrderAttemptId);
-        }
-        return {
-            source: resolved,
-            receiptOrigin: {
-                attemptId: context.workOrderAttemptId,
-                runId: context.modelRunId,
-                ownerScope: context.ownerScope,
-                envelopeHash: context.envelopeHash,
-            },
-            load: (candidateId) => {
-                const attested = this.loadOwnerAttestedCandidate(context, candidateId, kind);
-                return { candidate: attested.candidate, snapshotAt: attested.attestedAt };
-            },
-        };
-    }
-    /** Same contract as loadBoardCandidate, for either authority source. */
-    loadExternalCandidate(source, candidateId, kind) {
-        const resolved = typeof source === 'number' ? { kind: 'board', attemptId: source } : source;
-        return resolved.kind === 'board'
-            ? this.loadBoardCandidate(resolved.attemptId, candidateId, kind)
-            : this.loadOwnerActionCandidate(resolved.context, candidateId, kind);
-    }
-    /**
-     * Persist host-built candidate snapshots under a verified owner run.
-     *
-     * Every snapshot is re-validated as host-built (exact shape, Kagemusha
-     * mapping, fixed evidence summary, content-derived id) before it is stored;
-     * model-authored bytes never enter this table. Rows are immutable. The same
-     * run attesting the same candidate again with identical bytes is a no-op;
-     * different bytes under the same id are a conflict, not a second row.
-     */
-    attestOwnerActionCandidates(context, candidates) {
-        const verified = requireOwnerActionContext(context);
-        const prepared = [
-            ...candidates.bindingCandidates.map((candidate) => (0, external_lifecycle_candidates_js_1.parseHostBuiltExternalLifecycleCandidate)('binding', candidate)),
-            ...candidates.lifecycleCandidates.map((candidate) => (0, external_lifecycle_candidates_js_1.parseHostBuiltExternalLifecycleCandidate)('lifecycle', candidate)),
-        ].map((candidate) => {
-            const json = (0, external_lifecycle_candidates_js_1.canonicalExternalLifecycleCandidateJson)(candidate);
-            return { candidate, json, sha256: (0, node_crypto_1.createHash)('sha256').update(json).digest('hex') };
-        });
-        let attested = 0;
-        let alreadyAttested = 0;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            for (const entry of prepared) {
-                const existing = this.db
-                    .prepare(`SELECT owner_scope, envelope_hash, occurrence_key, workorder_attempt_id,
-                    candidate_kind, candidate_sha256
-               FROM ${operator_owner_action_candidates_js_1.OWNER_ACTION_CANDIDATES_TABLE}
-              WHERE model_run_id = ? AND candidate_id = ?`)
-                    .get(verified.modelRunId, entry.candidate.candidateId);
-                if (existing) {
-                    if (existing.owner_scope !== verified.ownerScope ||
-                        existing.envelope_hash !== verified.envelopeHash ||
-                        existing.occurrence_key !== verified.occurrenceKey ||
-                        existing.workorder_attempt_id !== verified.workOrderAttemptId ||
-                        existing.candidate_kind !== entry.candidate.kind ||
-                        existing.candidate_sha256 !== entry.sha256) {
-                        throw new Error(`owner action candidate ${entry.candidate.candidateId} attestation conflict: run ${verified.modelRunId} already holds a snapshot that differs`);
-                    }
-                    alreadyAttested += 1;
-                    continue;
-                }
-                const task = this.getRowById(entry.candidate.taskId);
-                if (!task || task.kind !== 'owner') {
-                    throw new Error(`owner action candidate ${entry.candidate.candidateId} references no owner task`);
-                }
-                this.db
-                    .prepare(`INSERT INTO ${operator_owner_action_candidates_js_1.OWNER_ACTION_CANDIDATES_TABLE}
-               (model_run_id, candidate_id, owner_scope, envelope_hash, occurrence_key,
-                workorder_attempt_id, candidate_kind, task_id, event_id, candidate_json,
-                candidate_sha256, created_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(verified.modelRunId, entry.candidate.candidateId, verified.ownerScope, verified.envelopeHash, verified.occurrenceKey, verified.workOrderAttemptId, entry.candidate.kind, entry.candidate.taskId, entry.candidate.eventId, entry.json, entry.sha256, this.now());
-                attested += 1;
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        return { attested, alreadyAttested };
-    }
-    /** Bounded, intent-free listing of what one owner run attested. */
-    listOwnerActionCandidates(context) {
-        const verified = requireOwnerActionContext(context);
-        return this.db
-            .prepare(`SELECT candidate_id, candidate_kind, task_id, event_id
-             FROM ${operator_owner_action_candidates_js_1.OWNER_ACTION_CANDIDATES_TABLE}
-            WHERE model_run_id = ? AND owner_scope = ? AND envelope_hash = ?
-              AND occurrence_key = ? AND workorder_attempt_id IS ?
-            ORDER BY created_at ASC, candidate_kind ASC, candidate_id ASC`)
-            .all(verified.modelRunId, verified.ownerScope, verified.envelopeHash, verified.occurrenceKey, verified.workOrderAttemptId).map((row) => ({
-            candidateId: row.candidate_id,
-            kind: row.candidate_kind,
-            taskId: row.task_id,
-            eventId: row.event_id,
-        }));
-    }
-    /**
-     * Receipt view of one owner run's attested candidates, in the same shape as
-     * inspectBoardCandidateAttempt so recovery can treat both sources alike.
-     */
-    inspectOwnerActionCandidateRun(context) {
-        const all = this.listOwnerActionCandidates(context);
-        if (all.length === 0) {
-            return { disposition: 'none' };
-        }
-        return this.candidateReceiptDisposition(all);
-    }
-    loadOwnerActionCandidate(context, candidateId, kind) {
-        return this.loadOwnerAttestedCandidate(requireOwnerActionContext(context), candidateId, kind)
-            .candidate;
-    }
-    /**
-     * Recover a candidate only from the attestation the exact owner run made.
-     * Stored bytes are revalidated: sha256 over the canonical JSON, exact shape,
-     * and the content-derived candidate id must all still agree.
-     */
-    loadOwnerAttestedCandidate(context, candidateId, kind) {
-        const row = this.db
-            .prepare(`SELECT owner_scope, envelope_hash, occurrence_key, workorder_attempt_id,
-                candidate_kind, task_id, event_id, candidate_json, candidate_sha256, created_at
-           FROM ${operator_owner_action_candidates_js_1.OWNER_ACTION_CANDIDATES_TABLE}
-          WHERE model_run_id = ? AND candidate_id = ?`)
-            .get(context.modelRunId, candidateId);
-        if (!row) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} is not attested for owner run ${context.modelRunId}`);
-        }
-        if (row.owner_scope !== context.ownerScope) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} was attested under a different owner scope`);
-        }
-        if (row.envelope_hash !== context.envelopeHash) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} was attested under a different envelope`);
-        }
-        if (row.occurrence_key !== context.occurrenceKey) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} was attested under a different occurrence`);
-        }
-        if (row.workorder_attempt_id !== context.workOrderAttemptId) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} was attested under a different workorder attempt`);
-        }
-        if (row.candidate_kind !== kind) {
-            throw new Error(`external lifecycle candidate ${candidateId} has the wrong kind (attested as ${row.candidate_kind})`);
-        }
-        const digest = (0, node_crypto_1.createHash)('sha256').update(row.candidate_json).digest('hex');
-        if (digest !== row.candidate_sha256) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} failed attestation integrity (sha256 mismatch)`);
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(row.candidate_json);
-        }
-        catch {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} failed attestation integrity (unreadable)`);
-        }
-        const candidate = (0, external_lifecycle_candidates_js_1.parseHostBuiltExternalLifecycleCandidate)(kind, parsed);
-        if (candidate.candidateId !== candidateId ||
-            candidate.taskId !== row.task_id ||
-            candidate.eventId !== row.event_id ||
-            (0, external_lifecycle_candidates_js_1.canonicalExternalLifecycleCandidateJson)(candidate) !== row.candidate_json) {
-            throw new Error(`external lifecycle ${kind} candidate ${candidateId} failed attestation integrity (identity mismatch)`);
-        }
-        return { candidate, attestedAt: row.created_at };
-    }
-    candidateReceiptDisposition(all) {
-        const outcomes = [];
-        const missingCandidateIds = [];
-        for (const candidate of all) {
-            const receipt = this.getExternalCandidateReceipt(candidate.candidateId);
-            if (!receipt) {
-                missingCandidateIds.push(candidate.candidateId);
-                continue;
-            }
-            if (receipt.kind !== candidate.kind) {
-                throw new Error(`external lifecycle candidate ${candidate.candidateId} has a receipt of the wrong kind`);
-            }
-            outcomes.push(receipt.outcome);
-        }
-        if (missingCandidateIds.length === 0) {
-            return { disposition: 'complete', outcomes };
-        }
-        if (missingCandidateIds.length === all.length) {
-            return { disposition: 'zero' };
-        }
-        return { disposition: 'partial', missingCandidateIds };
-    }
-    applyExternalBindingDecision(source, input, origin) {
-        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('binding', input);
-        const authority = this.resolveExternalCandidateAuthority(source, 'binding', origin);
-        const receiptOrigin = authority.receiptOrigin;
-        let receipt = null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const { candidate } = authority.load(input.candidate_id);
-            if (candidate.kind !== 'binding') {
-                throw new Error(`external lifecycle candidate ${input.candidate_id} has the wrong kind`);
-            }
-            if (input.expected_revision !== candidate.taskRevision) {
-                throw new Error(`external binding candidate ${candidate.candidateId} revision does not match its host snapshot`);
-            }
-            if (origin.causeEventIds?.length !== 1 || origin.causeEventIds[0] !== candidate.eventId) {
-                throw new Error(`external binding candidate ${candidate.candidateId} requires its exact host origin event`);
-            }
-            const existing = this.getExternalCandidateReceipt(candidate.candidateId);
-            if (existing) {
-                if (existing.kind !== 'binding') {
-                    throw new Error(`external lifecycle candidate ${candidate.candidateId} already has another receipt kind`);
-                }
-                this.assertBindingReplayMatches(existing, candidate, input);
-                receipt = existing;
-            }
-            else {
-                const task = this.getRowById(candidate.taskId);
-                if (!task || task.kind !== 'owner') {
-                    throw new Error(`external binding candidate ${candidate.candidateId} references no owner task`);
-                }
-                const outcome = task.revision === candidate.taskRevision
-                    ? input.decision === 'bind'
-                        ? 'bound'
-                        : 'declined'
-                    : 'superseded';
-                let bindingId;
-                if (outcome === 'bound') {
-                    const collision = this.db
-                        .prepare(`SELECT id, task_id, external_source_id FROM operator_external_task_bindings
-               WHERE active = 1 AND (task_id = ? OR (connector = ? AND source_type = ? AND external_source_id = ?))`)
-                        .get(candidate.taskId, candidate.connector, candidate.sourceType, candidate.externalSourceId);
-                    if (collision) {
-                        throw new Error(`external binding conflict for task ${candidate.taskId} or ${candidate.externalSourceId}`);
-                    }
-                    const now = this.now();
-                    const inserted = this.db
-                        .prepare(`INSERT INTO operator_external_task_bindings
-                 (task_id, connector, source_type, external_source_id, last_observation_seq,
-                  created_by_attempt_id, created_by_run_id, created_by_owner_scope,
-                  created_by_envelope_hash, active, created_at, updated_at)
-               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)`)
-                        .run(candidate.taskId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.operatorObservationSeq, receiptOrigin.attemptId, receiptOrigin.runId, receiptOrigin.ownerScope, receiptOrigin.envelopeHash, now, now);
-                    bindingId = Number(inserted.lastInsertRowid);
-                }
-                this.insertBindingReceipt(candidate, receiptOrigin, input, outcome, bindingId, origin);
-                receipt = {
-                    kind: 'binding',
-                    candidateId: candidate.candidateId,
-                    workOrderAttemptId: receiptOrigin.attemptId,
-                    originRunId: receiptOrigin.runId,
-                    originOwnerScope: receiptOrigin.ownerScope,
-                    taskId: candidate.taskId,
-                    outcome,
-                    reason: input.reason,
-                    ...(bindingId === undefined ? {} : { bindingId }),
-                };
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        return receipt;
-    }
-    applyExternalLifecycleDecision(source, input, origin) {
-        (0, external_lifecycle_candidates_js_1.validateExternalLifecycleDecision)('lifecycle', input);
-        const authority = this.resolveExternalCandidateAuthority(source, 'lifecycle', origin);
-        const receiptOrigin = authority.receiptOrigin;
-        let receipt = null;
-        const previousGeneration = this.onOwnerTaskChangeCommitted ? this.readGeneration() : null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const { candidate, snapshotAt } = authority.load(input.candidate_id);
-            if (candidate.kind !== 'lifecycle') {
-                throw new Error(`external lifecycle candidate ${input.candidate_id} has the wrong kind`);
-            }
-            if (input.expected_revision !== candidate.taskRevision) {
-                throw new Error(`external lifecycle candidate ${candidate.candidateId} revision does not match its host snapshot`);
-            }
-            if (origin.causeEventIds?.length !== 1 || origin.causeEventIds[0] !== candidate.eventId) {
-                throw new Error(`external lifecycle candidate ${candidate.candidateId} requires its exact host origin event`);
-            }
-            const existing = this.getExternalCandidateReceipt(candidate.candidateId);
-            if (existing) {
-                if (existing.kind !== 'lifecycle') {
-                    throw new Error(`external lifecycle candidate ${candidate.candidateId} already has another receipt kind`);
-                }
-                this.assertLifecycleReplayMatches(existing, candidate, input);
-                receipt = existing;
-            }
-            else {
-                const task = this.getRowById(candidate.taskId);
-                const binding = this.getExternalBinding(candidate.taskId);
-                if (!task || task.kind !== 'owner' || !binding) {
-                    throw new Error(`external lifecycle candidate ${candidate.candidateId} has no active binding`);
-                }
-                // A binding that came into being after this candidate's snapshot cannot
-                // be the binding the snapshot described. Board attempts keep the exact
-                // legacy ordering rule; when either side lacks an attempt id (owner-run
-                // decisions), the ledger clock decides.
-                const bindingPostdatesSnapshot = authority.source.kind === 'board' && binding.createdByAttemptId !== null
-                    ? binding.createdByAttemptId >= authority.source.attemptId
-                    : binding.createdAt > snapshotAt;
-                const superseded = binding.id !== candidate.bindingId ||
-                    binding.revision !== candidate.bindingRevision ||
-                    binding.connector !== candidate.connector ||
-                    binding.sourceType !== candidate.sourceType ||
-                    binding.externalSourceId !== candidate.externalSourceId ||
-                    bindingPostdatesSnapshot ||
-                    task.revision !== candidate.taskRevision ||
-                    candidate.operatorObservationSeq <= binding.lastObservationSeq;
-                const taskRevisionBefore = task.revision;
-                let taskRevisionAfter = task.revision;
-                let outcome;
-                if (superseded) {
-                    outcome = 'superseded';
-                }
-                else if (input.decision === 'apply') {
-                    const terminalEvidence = candidate.proposedStatus === 'done' || candidate.proposedStatus === 'cancelled';
-                    const transitioned = this.transitionTaskInTransaction(candidate.taskId, {
-                        status: candidate.proposedStatus,
-                        latest_event: candidate.evidenceSummary,
-                        // This candidate is a host-issued current authoritative lifecycle
-                        // observation. Preserve its semantic completion, or clear an earlier
-                        // terminal classification when later feedback reopens the same row.
-                        resolution_kind: terminalEvidence ? 'completed_evidence' : null,
-                    }, origin, true);
-                    taskRevisionAfter = transitioned.revision;
-                    outcome = 'applied';
-                }
-                else {
-                    outcome = 'retained';
-                }
-                if (outcome !== 'superseded') {
-                    const updated = this.db
-                        .prepare(`UPDATE operator_external_task_bindings
-               SET last_observation_seq = ?, revision = revision + 1, updated_at = ?
-               WHERE id = ? AND revision = ? AND last_observation_seq < ?`)
-                        .run(candidate.operatorObservationSeq, this.now(), candidate.bindingId, candidate.bindingRevision, candidate.operatorObservationSeq);
-                    if (updated.changes !== 1) {
-                        throw new Error(`external lifecycle candidate ${candidate.candidateId} binding watermark changed`);
-                    }
-                }
-                this.insertLifecycleReceipt(candidate, receiptOrigin, input, outcome, taskRevisionBefore, taskRevisionAfter, origin);
-                receipt = {
-                    kind: 'lifecycle',
-                    candidateId: candidate.candidateId,
-                    workOrderAttemptId: receiptOrigin.attemptId,
-                    originRunId: receiptOrigin.runId,
-                    originOwnerScope: receiptOrigin.ownerScope,
-                    taskId: candidate.taskId,
-                    outcome,
-                    reason: input.reason,
-                    taskRevisionBefore,
-                    taskRevisionAfter,
-                };
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        this.notifyOwnerTaskCommit(previousGeneration);
-        return receipt;
-    }
-    getExternalCandidateReceipt(candidateId) {
-        const binding = this.db
-            .prepare(`SELECT candidate_id, workorder_attempt_id, origin_run_id, origin_owner_scope, task_id,
-                outcome, reason, binding_id
-         FROM operator_external_binding_receipts WHERE candidate_id = ?`)
-            .get(candidateId);
-        const lifecycle = this.db
-            .prepare(`SELECT candidate_id, workorder_attempt_id, origin_run_id, origin_owner_scope, task_id,
-                outcome, reason, task_revision_before, task_revision_after
-         FROM operator_external_lifecycle_receipts WHERE candidate_id = ?`)
-            .get(candidateId);
-        if (binding && lifecycle) {
-            throw new Error(`external lifecycle candidate ${candidateId} has duplicate global receipts`);
-        }
-        const receiptKind = binding ? 'binding' : lifecycle ? 'lifecycle' : null;
-        const identity = this.db
-            .prepare(`SELECT receipt_kind FROM operator_external_receipt_identities WHERE candidate_id = ?`)
-            .get(candidateId);
-        if (receiptKind === null) {
-            if (identity) {
-                throw new Error(`external lifecycle candidate ${candidateId} has an orphan receipt identity`);
-            }
-            return null;
-        }
-        if (!identity || identity.receipt_kind !== receiptKind) {
-            throw new Error(`external lifecycle candidate ${candidateId} has inconsistent global receipt identity`);
-        }
-        if (binding) {
-            return {
-                kind: 'binding',
-                candidateId: binding.candidate_id,
-                workOrderAttemptId: binding.workorder_attempt_id,
-                originRunId: binding.origin_run_id,
-                originOwnerScope: binding.origin_owner_scope,
-                taskId: binding.task_id,
-                outcome: binding.outcome,
-                reason: binding.reason,
-                ...(binding.binding_id === null ? {} : { bindingId: binding.binding_id }),
-            };
-        }
-        return lifecycle
-            ? {
-                kind: 'lifecycle',
-                candidateId: lifecycle.candidate_id,
-                workOrderAttemptId: lifecycle.workorder_attempt_id,
-                originRunId: lifecycle.origin_run_id,
-                originOwnerScope: lifecycle.origin_owner_scope,
-                taskId: lifecycle.task_id,
-                outcome: lifecycle.outcome,
-                reason: lifecycle.reason,
-                taskRevisionBefore: lifecycle.task_revision_before,
-                taskRevisionAfter: lifecycle.task_revision_after,
-            }
-            : null;
-    }
-    externalBindingFromRow(row) {
-        return {
-            id: row.id,
-            revision: row.revision,
-            taskId: row.task_id,
-            connector: row.connector,
-            sourceType: row.source_type,
-            externalSourceId: row.external_source_id,
-            lastObservationSeq: row.last_observation_seq,
-            createdByAttemptId: row.created_by_attempt_id,
-            createdByRunId: row.created_by_run_id,
-            createdByOwnerScope: row.created_by_owner_scope,
-            createdAt: row.created_at,
-        };
-    }
-    assertBindingReplayMatches(receipt, candidate, input) {
-        const stored = this.db
-            .prepare(`SELECT decision FROM operator_external_binding_receipts WHERE candidate_id = ?`)
-            .get(candidate.candidateId);
-        if (!stored ||
-            stored.decision !== input.decision ||
-            receipt.taskId !== candidate.taskId ||
-            receipt.reason !== input.reason) {
-            throw new Error(`external binding receipt ${candidate.candidateId} conflicts with replay decision`);
-        }
-    }
-    insertBindingReceipt(candidate, receiptOrigin, input, outcome, bindingId, origin) {
-        this.db
-            .prepare(`INSERT INTO operator_external_binding_receipts
-           (candidate_id, decision, workorder_attempt_id, task_id, event_id, connector, source_type,
-            external_source_id, channel_partition, content_sha256, source_timestamp_ms,
-            operator_ingest_seq, operator_observation_seq, task_revision, outcome, reason, binding_id,
-            origin_run_id, origin_cause_event_ids, origin_owner_scope, origin_envelope_hash,
-            created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(candidate.candidateId, input.decision, receiptOrigin.attemptId, candidate.taskId, candidate.eventId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.channelPartition, candidate.contentSha256, candidate.sourceTimestampMs, candidate.operatorIngestSeq, candidate.operatorObservationSeq, candidate.taskRevision, outcome, input.reason, bindingId ?? null, receiptOrigin.runId, JSON.stringify(origin.causeEventIds ?? []), receiptOrigin.ownerScope, receiptOrigin.envelopeHash, this.now());
-    }
-    assertLifecycleReplayMatches(receipt, candidate, input) {
-        const stored = this.db
-            .prepare(`SELECT decision FROM operator_external_lifecycle_receipts WHERE candidate_id = ?`)
-            .get(candidate.candidateId);
-        if (!stored ||
-            stored.decision !== input.decision ||
-            receipt.taskId !== candidate.taskId ||
-            receipt.reason !== input.reason) {
-            throw new Error(`external lifecycle receipt ${candidate.candidateId} conflicts with replay decision`);
-        }
-    }
-    insertLifecycleReceipt(candidate, receiptOrigin, input, outcome, taskRevisionBefore, taskRevisionAfter, origin) {
-        this.db
-            .prepare(`INSERT INTO operator_external_lifecycle_receipts
-           (candidate_id, decision, workorder_attempt_id, task_id, event_id, connector, source_type,
-            external_source_id, channel_partition, content_sha256, source_timestamp_ms,
-            operator_ingest_seq, operator_observation_seq, binding_id, binding_revision,
-            task_revision_before, task_revision_after, outcome, reason, origin_run_id,
-            origin_cause_event_ids, origin_owner_scope, origin_envelope_hash, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(candidate.candidateId, input.decision, receiptOrigin.attemptId, candidate.taskId, candidate.eventId, candidate.connector, candidate.sourceType, candidate.externalSourceId, candidate.channelPartition, candidate.contentSha256, candidate.sourceTimestampMs, candidate.operatorIngestSeq, candidate.operatorObservationSeq, candidate.bindingId, candidate.bindingRevision, taskRevisionBefore, taskRevisionAfter, outcome, input.reason, receiptOrigin.runId, JSON.stringify(origin.causeEventIds ?? []), receiptOrigin.ownerScope, receiptOrigin.envelopeHash, this.now());
-    }
-    /**
-     * Create a task. Idempotent under at-least-once delivery: a duplicate
-     * (source_channel, source_event_id) UPSERTS - the existing row gets the new
-     * latest_event (and title stays) instead of a near-duplicate row appearing.
-     */
-    create(input, origin = {}) {
-        if (!input.title || input.title.trim() === '') {
-            throw new Error('task title must be a non-empty string');
-        }
-        if (input.status !== undefined)
-            assertEnum(input.status, exports.TASK_STATUSES, 'status');
-        if (input.status === 'failed') {
-            throw new Error(`task_create: 'failed' is a system-only status`);
-        }
-        if (input.status === 'review') {
-            // review carries a host-verified submission anchor (review_started_at,
-            // review_anchor_event_id) that only the task_update path can supply. A row
-            // created directly in review would sit in the unanchored state reserved for
-            // legacy rows and could never enter the Temporal review lifecycle.
-            throw new Error(`task_create: 'review' requires verified submission evidence; create the task, then task_update it to review`);
-        }
-        // Namespace reservation (review m3): the occurrence keys are deterministic
-        // (epoch slots, readable from OSS source) - an agent-created owner row on
-        // a 'workorder:' (channel,event) pair would collide with the system
-        // INSERT via the shared unique index and DoS that schedule slot.
-        if (input.source_channel?.startsWith(exports.WORKORDER_CHANNEL_PREFIX)) {
-            throw new Error(`task_create: source_channel namespace '${exports.WORKORDER_CHANNEL_PREFIX}*' is reserved for system workorders`);
-        }
-        if (input.priority !== undefined)
-            assertEnum(input.priority, exports.TASK_PRIORITIES, 'priority');
-        if (input.deadline !== undefined)
-            assertIsoDate(input.deadline, 'deadline');
-        const exactDue = input.due_at !== undefined ? (0, task_temporal_js_1.parseExactDueAt)(input.due_at) : null;
-        if (exactDue && input.deadline !== undefined && input.deadline !== exactDue.deadline) {
-            throw new Error('task_create: due_at and deadline conflict');
-        }
-        const normalizedDeadline = exactDue?.deadline ?? input.deadline ?? null;
-        const initialTemporalEpoch = normalizedDeadline !== null ? 1 : 0;
-        // Optional HERE on purpose: the PUBLIC task_create boundary requires it, while
-        // internal/system seeding and legacy callers stay backward compatible.
-        const normalizedCompletionCriteria = normalizeCompletionCriteria(input.completion_criteria, 'task_create');
-        const now = this.now();
-        if (input.source_channel && input.source_event_id) {
-            // kind='owner' probe: an agent-supplied (channel, event) pair can never
-            // reach a system workorder row (Stage-2 tamper guard).
-            const existing = this.db
-                .prepare(`SELECT * FROM operator_tasks
-           WHERE source_channel = ? AND source_event_id = ? AND kind = 'owner'`)
-                .get(input.source_channel, input.source_event_id);
-            if (existing) {
-                // Duplicate source delivery uses the same mutation boundary, including
-                // exact-time normalization and no-op detection. The original title stays
-                // stable across retries for backward compatibility.
-                return this.update(existing.id, {
-                    ...(input.status !== undefined ? { status: input.status } : {}),
-                    ...(input.priority !== undefined ? { priority: input.priority } : {}),
-                    ...(input.assignee !== undefined ? { assignee: input.assignee } : {}),
-                    ...(input.deadline !== undefined ? { deadline: input.deadline } : {}),
-                    ...(input.due_at !== undefined ? { due_at: input.due_at } : {}),
-                    ...(input.confirmed !== undefined ? { confirmed: input.confirmed } : {}),
-                    ...(input.latest_event !== undefined ? { latest_event: input.latest_event } : {}),
-                    ...(normalizedCompletionCriteria !== null
-                        ? { completion_criteria: normalizedCompletionCriteria }
-                        : {}),
-                    ...(input.expected_revision !== undefined
-                        ? { expected_revision: input.expected_revision }
-                        : {}),
-                }, 
-                // A duplicate delivery of the same event. The HOST batch still wins
-                // (review: the agent-supplied source_event_id was overriding it here,
-                // letting a model forge an attributed cause on every judgment-borne
-                // create); the keyed event is only the fallback when the host
-                // carried nothing.
-                {
-                    ...origin,
-                    taskCreateUpsert: true,
-                    causeEventIds: origin.causeEventIds?.length
-                        ? origin.causeEventIds
-                        : input.source_event_id
-                            ? [input.source_event_id]
-                            : origin.causeEventIds,
-                });
-            }
-        }
-        let createdId = 0;
-        const previousGeneration = this.onOwnerTaskChangeCommitted ? this.readGeneration() : null;
-        const write = this.db.transaction(() => {
-            const result = this.db
-                .prepare(`INSERT INTO operator_tasks
-           (title, status, priority, assignee, deadline, due_at, deadline_offset_minutes,
-            revision, temporal_epoch, source_channel, source_event_id, latest_event,
-            auto_created, confirmed, completion_criteria, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(input.title.trim(), input.status ?? 'pending', input.priority ?? 'normal', input.assignee ?? null, normalizedDeadline, exactDue?.dueAt ?? null, exactDue?.offsetMinutes ?? null, initialTemporalEpoch, input.source_channel ?? null, input.source_event_id ?? null, input.latest_event ?? null, 1, input.confirmed ? 1 : 0, normalizedCompletionCriteria, now, now);
-            createdId = Number(result.lastInsertRowid);
-            this.recordTaskChange({
-                kind: 'task_create',
-                taskId: createdId,
-                // The HOST batch wins. `source_event_id` arrives on agent-authored task_create
-                // input, so letting it take precedence made the attribution the agent's to choose:
-                // any 1-200 character string passes the ledger's shape check, and the change was
-                // then stamped `attributed` on a cause nobody could resolve. The run id is already
-                // protected for exactly this reason; the cause was not. Found in review.
-                //
-                // The agent's field is still USED when the host handed the run no batch - a named
-                // source event is better evidence than none, and an unbounded run has nothing else.
-                // It is weaker evidence, not worthless.
-                //
-                // A plain spread would be wrong in the other direction: an absent caller field must
-                // not erase what the host knows.
-                origin: {
-                    ...origin,
-                    causeEventIds: origin.causeEventIds && origin.causeEventIds.length > 0
-                        ? origin.causeEventIds
-                        : input.source_event_id
-                            ? [input.source_event_id]
-                            : origin.causeEventIds,
-                },
-                channel: input.source_channel ?? null,
-                // Everything the INSERT wrote. A hash over two of fifteen columns cannot tell two
-                // materially different writes apart, which is most of what a receipt is for.
-                payload: {
-                    title: input.title.trim(),
-                    status: input.status ?? 'pending',
-                    priority: input.priority ?? 'normal',
-                    assignee: input.assignee ?? null,
-                    deadline: normalizedDeadline,
-                    due_at: exactDue?.dueAt ?? null,
-                    deadline_offset_minutes: exactDue?.offsetMinutes ?? null,
-                    temporal_epoch: initialTemporalEpoch,
-                    source_channel: input.source_channel ?? null,
-                    source_event_id: input.source_event_id ?? null,
-                    latest_event: input.latest_event ?? null,
-                    confirmed: input.confirmed ? 1 : 0,
-                    completion_criteria: normalizedCompletionCriteria,
-                },
-                atMs: now,
-            });
-        }, 'immediate');
-        write();
-        this.notifyOwnerTaskCommit(previousGeneration);
-        const created = this.getById(createdId);
-        if (!created)
-            throw new Error('task_create: inserted row could not be read back');
-        return created;
-    }
-    /**
-     * Write the effect row for a task change.
-     *
-     * Called from inside the same transaction as the write it describes. The cause is the
-     * event the caller already recorded on the row - the tool has always accepted it, and
-     * 178 of the 179 owner tasks that carry one resolve to a real indexed event, so this is
-     * attribution that already exists rather than a new burden on the agent.
-     *
-     * When there is no cause the change is still recorded, marked unattributed. That is the
-     * honest reading of `task_update`, which has never had a cause field at all: the system
-     * has been changing owner work items without recording why, and the ledger's job is to
-     * show how often, not to pretend otherwise or to start refusing writes.
-     */
-    recordTaskChange(input) {
-        const common = {
-            runId: input.origin.runId ?? null,
-            channelId: input.channel,
-            kind: input.kind,
-            targetType: 'task',
-            targetId: String(input.taskId),
-            payload: input.payload,
-            atMs: input.atMs,
-        };
-        // A cause the ledger cannot use makes the change unattributed - it never makes the
-        // change fail. Some live rows carry 400-character legacy source identifiers, and an
-        // operator that cannot close a work item because its upstream id is malformed is a
-        // worse system than one that admits it does not know why the item changed.
-        const causes = (input.origin.causeEventIds ?? []).filter(effects_js_1.isUsableCause);
-        if (causes.length > 0) {
-            (0, effects_js_1.recordEffect)(this.db, { ...common, sourceEventIds: causes });
-            return;
-        }
-        (0, effects_js_1.recordUnattributedChange)(this.db, common, input.origin.causeKind ?? 'owner_message');
-    }
-    update(id, patch, origin = {}) {
-        this.validateTaskUpdatePatch(patch);
-        const previousGeneration = this.onOwnerTaskChangeCommitted ? this.readGeneration() : null;
-        const updated = this.db.transaction(() => this.transitionTaskInTransaction(id, patch, origin), 'immediate')();
-        this.notifyOwnerTaskCommit(previousGeneration);
-        return updated;
-    }
-    /**
-     * Recorrect an existing owner row with a NAMED disposition.
-     *
-     * Records and tasks are separate. Without a semantic terminal reason the agent
-     * could not distinguish completed work from an item that was never a task, so
-     * connector observations, principles, lessons and open questions accumulated as
-     * owner rows and could only be "closed" as if they had been done.
-     *
-     * Every path requires the exact current revision, a non-empty bounded reason
-     * preserved as `latest_event`, an OWNER row, and the same workorder-attempt
-     * currency and causal-provenance checks as task_update (TG-03/TG-04/TG-06) -
-     * a terminal attempt of any kind cannot mutate a row, and an owner-event
-     * decision cannot rest on a fabricated cause. Scheduler hint pages and the
-     * causal batch's channel select what the host READS; they do not narrow the
-     * authenticated owner's decisions. The whole transition, its
-     * `resolution_kind` and its effect receipt commit as ONE transaction.
-     */
-    reclassify(id, input, origin = {}) {
-        const disposition = input?.disposition;
-        if (!exports.TASK_RECLASSIFY_DISPOSITIONS.includes(disposition)) {
-            throw new Error(`task_reclassify: disposition must be one of ${exports.TASK_RECLASSIFY_DISPOSITIONS.join('|')}, got: ${String(disposition)}`);
-        }
-        const reason = typeof input.reason === 'string' ? input.reason.trim() : '';
-        if (reason.length === 0) {
-            throw new Error('task_reclassify: reason must be a non-empty string');
-        }
-        if (reason.length > exports.TASK_RECLASSIFY_REASON_MAX_LENGTH) {
-            throw new Error(`task_reclassify: reason must be at most ${exports.TASK_RECLASSIFY_REASON_MAX_LENGTH} characters`);
-        }
-        if (!Number.isSafeInteger(input.expected_revision) || input.expected_revision < 0) {
-            throw new Error('task_reclassify: expected_revision must be a non-negative integer');
-        }
-        const previousGeneration = this.onOwnerTaskChangeCommitted ? this.readGeneration() : null;
-        let record;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const existing = this.db.prepare('SELECT * FROM operator_tasks WHERE id = ?').get(id);
-            if (!existing)
-                throw new Error(`task_reclassify: no task with id ${id}`);
-            if (existing.kind === 'system') {
-                throw new Error(`task_reclassify: task ${id} is a system workorder row (owner rows only)`);
-            }
-            if (input.expected_revision !== existing.revision) {
-                throw new Error(`task_reclassify: expected revision ${input.expected_revision}, current ${existing.revision}`);
-            }
-            this.assertTaskReclassificationAuthorized(origin);
-            const patch = this.buildReclassifyPatch(existing, disposition, reason);
-            // Same primitive as task_update: candidate guard, board-attempt liveness,
-            // revision-checked UPDATE, effect receipt, temporal generation supersession.
-            record = this.transitionTaskInTransaction(id, patch, origin);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        this.notifyOwnerTaskCommit(previousGeneration);
-        return record;
-    }
-    assertTaskReclassificationAuthorized(origin) {
-        if (origin.workOrderAttemptId !== undefined) {
-            // A carried attempt must be CURRENT. Its kind is scheduling metadata: a
-            // wiki or temporal run that discovers a record-shaped owner row may
-            // reclassify it under the same CAS rules as a Board run. Its candidate
-            // page is a bounded-read hint, so a row outside the page is not refused.
-            this.assertWorkOrderAttemptActive('task_reclassify', origin.workOrderAttemptId);
-        }
-        if (origin.reclassificationCauseBound) {
-            const eventIds = (origin.causeEventIds ?? []).filter(effects_js_1.isUsableCause);
-            if (eventIds.length === 0) {
-                throw new Error('task_reclassify: owner-event reclassification requires causal events');
-            }
-            // Provenance: every cause must be an event a durable inbox batch actually
-            // carried. The batch's channel is not compared with the task's source -
-            // cross-source relevance is MAMA's judgment under the owner's grant.
-            const unknown = this.findCausalEventsWithoutInboxBatch(eventIds);
-            if (unknown.length > 0) {
-                throw new Error(`task_reclassify: causal event(s) ${unknown.join(', ')} were not carried by any owner-event inbox batch`);
-            }
-        }
-    }
-    /**
-     * A retained attempt context outlives its workorder: a late direct or nested
-     * tool call can still carry it after the row reached a terminal status. Any
-     * lifecycle judgment made under a carried attempt requires that attempt to be
-     * the claimed, in-progress one, whatever its work kind.
-     */
-    assertWorkOrderAttemptActive(tool, attemptId) {
-        const attempt = this.getWorkOrderById(attemptId);
-        if (!attempt) {
-            throw new Error(`${tool}: workorder ${String(attemptId)} is no longer active (missing)`);
-        }
-        if (attempt.status !== 'in_progress') {
-            throw new Error(`${tool}: ${attempt.workKind} workorder ${String(attemptId)} is no longer active (${attempt.status})`);
-        }
-        return attempt;
-    }
-    findCausalEventsWithoutInboxBatch(eventIds) {
-        const placeholders = eventIds.map(() => '?').join(',');
-        const known = new Set(this.db
-            .prepare(`SELECT DISTINCT event.value AS event_id
-               FROM owner_event_inbox AS inbox, json_each(inbox.event_ids_json) AS event
-              WHERE event.value IN (${placeholders})`)
-            .all(...eventIds).map((row) => row.event_id));
-        return eventIds.filter((eventId) => !known.has(eventId));
-    }
-    buildReclassifyPatch(existing, disposition, reason) {
-        const base = {
-            latest_event: reason,
-            expected_revision: existing.revision,
-        };
-        if (disposition === 'reopen') {
-            if (existing.status !== 'done' && existing.status !== 'cancelled') {
-                throw new Error(`task_reclassify: reopen requires a terminal owner row, task is '${existing.status}'`);
-            }
-            // A reopened row must not inherit a deadline that already passed: it would
-            // read as overdue the moment it reopens. A still-future deadline is kept.
-            const stale = this.isDeadlineInThePast(existing);
-            return {
-                ...base,
-                status: 'pending',
-                resolution_kind: null,
-                ...(stale ? { deadline: null, due_at: null } : {}),
-            };
-        }
-        if (existing.status === 'done' || existing.status === 'cancelled') {
-            throw new Error(`task_reclassify: ${disposition} requires an active owner row, task is '${existing.status}'`);
-        }
-        if (disposition === 'completed_evidence') {
-            return { ...base, status: 'done', resolution_kind: 'completed_evidence' };
-        }
-        if (disposition === 'completed_no_issue') {
-            // Owner policy: a PAST deadline plus a complete relevant-source check with no
-            // issue is enough. Without a passed deadline there is nothing to conclude from.
-            if (!this.isDeadlineInThePast(existing)) {
-                throw new Error('task_reclassify: completed_no_issue requires a deadline or due_at already in the past');
-            }
-            return { ...base, status: 'done', resolution_kind: 'completed_no_issue' };
-        }
-        // non_task_record / non_task_memory: this was never a task. Cancelled, not done,
-        // so accounting never reads it as finished work.
-        return {
-            ...base,
-            status: 'cancelled',
-            completion_criteria: null,
-            resolution_kind: disposition,
-        };
-    }
-    /** True when the row carries a deadline/due_at that has already passed. */
-    isDeadlineInThePast(existing) {
-        const state = (0, task_temporal_js_1.deriveTemporalState)({
-            // Terminal rows derive 'closed', which would hide a genuinely past deadline;
-            // ask the temporal question about the CLOCK fields only.
-            status: 'pending',
-            dueAt: existing.due_at,
-            deadlineIso: existing.deadline,
-            deadlineOffsetMinutes: existing.deadline_offset_minutes,
-        }, this.now(), this.timeZone);
-        return state === 'exact_overdue' || state === 'date_overdue';
-    }
-    /**
-     * The one mutation primitive for owner-task state. Callers own the outer
-     * transaction so lifecycle receipts, effects, generation ownership, and the
-     * row revision can commit or roll back as one unit.
-     */
-    transitionTaskInTransaction(id, patch, origin, skipCandidateGuard = false) {
-        this.validateTaskUpdatePatch(patch);
-        if (!skipCandidateGuard) {
-            this.assertCandidateTaskMutationAllowed(id, patch, origin);
-        }
-        const existing = this.db.prepare('SELECT * FROM operator_tasks WHERE id = ?').get(id);
-        if (!existing)
-            throw new Error(`task_update: no task with id ${id}`);
-        if (existing.kind === 'system') {
-            throw new Error(`task_update: task ${id} is a system workorder row (host-managed)`);
-        }
-        const hasLifecyclePatch = Object.prototype.hasOwnProperty.call(patch, 'status') ||
-            Object.prototype.hasOwnProperty.call(patch, 'due_at') ||
-            Object.prototype.hasOwnProperty.call(patch, 'latest_event') ||
-            Object.prototype.hasOwnProperty.call(patch, 'completion_criteria');
-        // Direct-ABI mutation under a carried attempt: the attempt must be current
-        // for EVERY patch shape (a stale attempt renaming a task is as stale as one
-        // closing it). Work kind is scheduling metadata, not owner authority.
-        // Internal receipted primitives (external lifecycle apply) do not set the
-        // direct-ABI guard and validate their own claimed attempt separately.
-        const isCarriedDirectMutation = origin.requiresExpectedRevision === true && origin.workOrderAttemptId !== undefined;
-        if (isCarriedDirectMutation) {
-            this.assertWorkOrderAttemptActive('task_update', origin.workOrderAttemptId);
-        }
-        // A lifecycle judgment additionally proves the revision actually read plus a reason.
-        const isWorkorderLifecycleJudgment = isCarriedDirectMutation && hasLifecyclePatch;
-        if (isWorkorderLifecycleJudgment) {
-            if (!Number.isSafeInteger(patch.expected_revision) || patch.expected_revision < 0) {
-                throw new Error('task_update: lifecycle workorder requires expected_revision');
-            }
-            if (patch.expected_revision !== existing.revision) {
-                throw new Error(`task_update: expected revision ${patch.expected_revision}, current ${existing.revision}`);
-            }
-            if (typeof patch.latest_event !== 'string' || patch.latest_event.trim().length === 0) {
-                throw new Error('task_update: lifecycle workorder requires a plain latest_event reason');
-            }
-        }
-        return this.transitionOwnerTaskRowInTransaction(id, existing, patch, origin);
-    }
-    validateTaskUpdatePatch(patch) {
-        if (patch.status === 'failed') {
-            throw new Error(`task_update: 'failed' is a system-only status`);
-        }
-        if (patch.status !== undefined)
-            assertEnum(patch.status, exports.TASK_STATUSES, 'status');
-        if (patch.priority !== undefined)
-            assertEnum(patch.priority, exports.TASK_PRIORITIES, 'priority');
-        if (patch.deadline !== undefined && patch.deadline !== null) {
-            assertIsoDate(patch.deadline, 'deadline');
-        }
-        if (patch.title !== undefined && patch.title.trim() === '') {
-            throw new Error('task title must be a non-empty string');
-        }
-    }
-    transitionOwnerTaskRowInTransaction(id, existing, patch, origin) {
-        const next = {
-            title: existing.title,
-            status: existing.status,
-            priority: existing.priority,
-            assignee: existing.assignee,
-            deadline: existing.deadline,
-            due_at: existing.due_at,
-            deadline_offset_minutes: existing.deadline_offset_minutes,
-            latest_event: existing.latest_event,
-            confirmed: existing.confirmed,
-            temporal_epoch: existing.temporal_epoch,
-            temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
-            last_temporal_checked_at: existing.last_temporal_checked_at,
-            next_temporal_check_at: existing.next_temporal_check_at,
-            last_temporal_attempt_id: existing.last_temporal_attempt_id,
-            review_started_at: existing.review_started_at,
-            review_anchor_event_id: existing.review_anchor_event_id,
-            review_anchor_source_channel: existing.review_anchor_source_channel,
-            completion_criteria: existing.completion_criteria,
-            resolution_kind: existing.resolution_kind,
-        };
-        if (patch.title !== undefined)
-            next.title = patch.title.trim();
-        if (patch.status !== undefined)
-            next.status = patch.status;
-        if (patch.priority !== undefined)
-            next.priority = patch.priority;
-        if (patch.assignee !== undefined)
-            next.assignee = patch.assignee;
-        if (patch.latest_event !== undefined)
-            next.latest_event = patch.latest_event;
-        if (patch.confirmed !== undefined)
-            next.confirmed = patch.confirmed ? 1 : 0;
-        if (patch.completion_criteria !== undefined) {
-            next.completion_criteria = normalizeCompletionCriteria(patch.completion_criteria, 'task_update');
-        }
-        // Host-internal (reclassify only); the public task_update surface rejects it.
-        if (patch.resolution_kind !== undefined)
-            next.resolution_kind = patch.resolution_kind;
-        const leavingVerifiedReview = existing.status === 'review' &&
-            patch.status !== undefined &&
-            patch.status !== 'review' &&
-            existing.review_started_at !== null &&
-            typeof existing.review_anchor_event_id === 'string' &&
-            existing.review_anchor_event_id.trim().length > 0;
-        if (leavingVerifiedReview) {
-            next.review_started_at = null;
-            next.review_anchor_event_id = null;
-            next.review_anchor_source_channel = null;
-            next.due_at = null;
-            next.deadline = null;
-            next.deadline_offset_minutes = null;
-        }
-        const reviewAttempt = origin.requiresExpectedRevision
-            ? this.getWorkOrderById(origin.workOrderAttemptId ?? -1)
-            : null;
-        if (patch.status === 'review' &&
-            ((reviewAttempt?.workKind === 'board' && reviewAttempt.status === 'in_progress') ||
-                origin.verifiedReviewEvidence !== undefined)) {
-            if (Object.prototype.hasOwnProperty.call(patch, 'due_at') ||
-                Object.prototype.hasOwnProperty.call(patch, 'deadline')) {
-                throw new Error('task_update: review due_at and deadline are computed from verified evidence');
-            }
-            const evidence = origin.verifiedReviewEvidence;
-            if (!evidence) {
-                throw new Error('task_update: review requires host-verified submission evidence');
-            }
-            if (!evidence.sourceChannel.trim()) {
-                throw new Error('task_update: review evidence source is required');
-            }
-            if (!Number.isSafeInteger(evidence.sourceTimestampMs) || evidence.sourceTimestampMs < 0) {
-                throw new Error('task_update: review evidence timestamp is invalid');
-            }
-            next.review_started_at = evidence.sourceTimestampMs;
-            next.review_anchor_event_id = evidence.eventIndexId;
-            next.review_anchor_source_channel = evidence.sourceChannel;
-            next.due_at = evidence.sourceTimestampMs + 14 * 24 * 60 * 60 * 1000;
-            next.deadline = new Date(next.due_at).toISOString().slice(0, 10);
-            next.deadline_offset_minutes = 0;
-        }
-        const hasDueAt = Object.prototype.hasOwnProperty.call(patch, 'due_at');
-        const hasDeadline = Object.prototype.hasOwnProperty.call(patch, 'deadline');
-        if (hasDueAt && patch.due_at !== null && patch.due_at !== undefined) {
-            const exactDue = (0, task_temporal_js_1.parseExactDueAt)(patch.due_at);
-            if (hasDeadline && patch.deadline !== exactDue.deadline) {
-                throw new Error('task_update: due_at and deadline conflict');
-            }
-            next.due_at = exactDue.dueAt;
-            next.deadline = exactDue.deadline;
-            next.deadline_offset_minutes = exactDue.offsetMinutes;
-        }
-        else if (hasDeadline) {
-            next.deadline = patch.deadline ?? null;
-            next.due_at = null;
-            if (patch.deadline === null) {
-                next.deadline_offset_minutes = null;
-            }
-        }
-        else if (hasDueAt) {
-            next.due_at = null;
-        }
-        const temporalChanged = next.due_at !== existing.due_at || next.deadline !== existing.deadline;
-        const terminalToOpen = (existing.status === 'done' || existing.status === 'cancelled') &&
-            next.status !== 'done' &&
-            next.status !== 'cancelled';
-        if (terminalToOpen && existing.resolution_kind !== null && patch.resolution_kind !== null) {
-            throw new Error('task_update: a classified terminal row must reopen through task_reclassify');
-        }
-        if (patch.status !== undefined &&
-            next.status !== existing.status &&
-            patch.resolution_kind === undefined) {
-            // A generic status change has no semantic reclassification authority. Clear an
-            // old terminal meaning rather than rendering contradictory status/reason pairs.
-            next.resolution_kind = null;
-        }
-        const openToTerminal = existing.status !== 'done' &&
-            existing.status !== 'cancelled' &&
-            (next.status === 'done' || next.status === 'cancelled');
-        if (temporalChanged || terminalToOpen) {
-            next.temporal_epoch = existing.temporal_epoch + 1;
-            next.temporal_reconciled_occurrence_key = null;
-            next.last_temporal_checked_at = null;
-            next.next_temporal_check_at = null;
-            next.last_temporal_attempt_id = null;
-        }
-        const persistedColumns = [
-            'title',
-            'status',
-            'priority',
-            'assignee',
-            'deadline',
-            'due_at',
-            'deadline_offset_minutes',
-            'latest_event',
-            'confirmed',
-            'temporal_epoch',
-            'temporal_reconciled_occurrence_key',
-            'last_temporal_checked_at',
-            'next_temporal_check_at',
-            'last_temporal_attempt_id',
-            'review_started_at',
-            'review_anchor_event_id',
-            'review_anchor_source_channel',
-            'completion_criteria',
-            'resolution_kind',
-        ];
-        const changedColumns = persistedColumns.filter((column) => next[column] !== existing[column]);
-        if (changedColumns.length === 0) {
-            return this.toRecord(existing);
-        }
-        else {
-            const nextRevision = existing.revision + 1;
-            const sets = changedColumns.map((column) => `${column} = ?`);
-            const values = changedColumns.map((column) => next[column]);
-            const updatedAt = this.now();
-            sets.push('revision = ?', 'updated_at = ?');
-            values.push(nextRevision, updatedAt);
-            const updated = this.db
-                .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ? AND revision = ?`)
-                .run(...values, id, existing.revision);
-            if (updated.changes !== 1) {
-                throw new Error(`task_update: task ${id} revision changed during transition`);
-            }
-            this.recordTaskChange({
-                kind: 'task_update',
-                taskId: id,
-                origin,
-                channel: existing.source_channel,
-                payload: {
-                    revision: nextRevision,
-                    changed: Object.fromEntries(changedColumns.map((column) => [column, next[column]])),
-                },
-                atMs: updatedAt,
-            });
-            if (temporalChanged || terminalToOpen) {
-                this.supersedeTemporalGenerationsInTransaction(id, Number(next.temporal_epoch));
-            }
-            else if (openToTerminal) {
-                this.supersedeAllActiveTemporalGenerationsInTransaction(id);
-            }
-            const transitioned = this.getRowById(id);
-            if (!transitioned)
-                throw new Error(`task_update: task ${id} disappeared during transition`);
-            return transitioned;
-        }
-    }
-    assertCandidateTaskMutationAllowed(taskId, patch, origin) {
-        if (origin.workOrderAttemptId === undefined ||
-            (!Object.prototype.hasOwnProperty.call(patch, 'status') &&
-                !Object.prototype.hasOwnProperty.call(patch, 'latest_event') &&
-                !Object.prototype.hasOwnProperty.call(patch, 'completion_criteria'))) {
-            return;
-        }
-        const attempt = this.getWorkOrderById(origin.workOrderAttemptId);
-        // Unlike a lifecycle decision, this is a standing mutation guard. A late
-        // direct or nested tool call can retain the host-issued attempt context
-        // after its board workorder has reached a terminal status, and its durable
-        // candidate payload must remain authoritative in that case. Decision
-        // application still calls loadBoardCandidate(), which requires a claimed
-        // in-progress attempt.
-        //
-        // The payload's reclassificationCandidates page is NOT consulted here: it is
-        // the scheduler's bounded-read hint, and qualifying a legacy row the owner
-        // discovered outside that page is an ordinary owner decision guarded by
-        // attempt currency, expected_revision and a plain reason (see
-        // transitionTaskInTransaction). Only host-attested external binding /
-        // lifecycle candidates keep their receipted-decision-only rule below.
-        if (!attempt || attempt.workKind !== 'board') {
-            return;
-        }
-        const payload = publisherPayloadOfStoredWorkOrder(attempt.payload);
-        (0, workorder_publishers_js_1.validateWorkOrderPayload)('board', payload);
-        if (payload.mode !== 'reconcile' || !payload.candidates) {
-            return;
-        }
-        const candidates = payload.candidates;
-        if ([...candidates.bindingCandidates, ...candidates.lifecycleCandidates].some((candidate) => candidate.taskId === taskId)) {
-            throw new Error(`task_update: candidate-bound lifecycle task ${taskId} may change status/latest_event only through its receipted decision`);
-        }
-    }
-    supersedeTemporalGenerationsInTransaction(taskId, currentEpoch, excludeGenerationKey, updatedAt = this.now()) {
-        const reason = 'task temporal occurrence superseded';
-        const exclusion = excludeGenerationKey ? ' AND generation_key != ?' : '';
-        const generationParams = excludeGenerationKey
-            ? [taskId, currentEpoch, excludeGenerationKey]
-            : [taskId, currentEpoch];
-        this.db
-            .prepare(`UPDATE operator_tasks SET status = 'cancelled', latest_event = ?, updated_at = ?
-         WHERE kind = 'system' AND status IN ('pending','in_progress') AND id IN (
-           SELECT last_workorder_id FROM operator_temporal_generations
-           WHERE task_id = ? AND disposition = 'active' AND temporal_epoch < ?${exclusion}
-         )`)
-            .run(reason, updatedAt, ...generationParams);
-        this.db
-            .prepare(`UPDATE operator_temporal_generations
-         SET disposition = 'superseded', reason = ?, updated_at = ?
-         WHERE task_id = ? AND disposition = 'active' AND temporal_epoch < ?${exclusion}`)
-            .run(reason, updatedAt, ...generationParams);
-    }
-    supersedeAllActiveTemporalGenerationsInTransaction(taskId, updatedAt = this.now()) {
-        const reason = 'owner task closed';
-        this.db
-            .prepare(`UPDATE operator_tasks SET status = 'cancelled', latest_event = ?, updated_at = ?
-         WHERE kind = 'system' AND status IN ('pending','in_progress') AND id IN (
-           SELECT last_workorder_id FROM operator_temporal_generations
-           WHERE task_id = ? AND disposition = 'active'
-         )`)
-            .run(reason, updatedAt, taskId);
-        this.db
-            .prepare(`UPDATE operator_temporal_generations
-         SET disposition = 'superseded', reason = ?, updated_at = ?
-         WHERE task_id = ? AND disposition = 'active'`)
-            .run(reason, updatedAt, taskId);
-    }
-    /**
-     * Stable hash over ordered OWNER rows - the Phase-2 verifier's ledger
-     * snapshot. kind filter keeps concurrent system enqueues from shaking the
-     * hash mid-bracket (evidence-only signal, but noise is noise).
-     */
-    payloadHash() {
-        const rows = this.db
-            .prepare(`SELECT id, title, status, priority, assignee, deadline, latest_event, confirmed,
-                updated_at
-         FROM operator_tasks WHERE kind = 'owner' ORDER BY id ASC`)
-            .all();
-        return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(rows)).digest('hex');
-    }
-    // ── Workorder API (Stage 2) ─────────────────────────────────────────────
-    // System rows only. These are the ONLY paths that create or transition
-    // kind='system' rows; external create/update guards reject everything else.
-    /**
-     * Enqueue a workorder. Idempotent per occurrence key: an open (pending or
-     * in_progress) keyed row dedups. Completed owner-event occurrences and
-     * scheduled promotion slots also dedup; other terminal rows free the key
-     * and a fresh row is inserted.
-     */
-    enqueueWorkOrder(order) {
-        if (order.workKind === 'temporal') {
-            throw new Error('enqueueWorkOrder: temporal work requires enqueueTemporalGeneration');
-        }
-        if (Object.prototype.hasOwnProperty.call(order.input, 'attempts')) {
-            throw new Error('enqueueWorkOrder: attempts is ledger-managed and cannot be supplied');
-        }
-        return this.insertWorkOrder(order, 1);
-    }
-    /** Read a durable workorder acceptance by its host-issued occurrence key. */
-    findWorkOrderByOccurrence(workKind, idempotencyKey) {
-        const row = this.db
-            .prepare(`SELECT * FROM operator_tasks
-          WHERE kind = 'system' AND source_channel = ? AND source_event_id = ?
-          ORDER BY id ASC LIMIT 1`)
-            .get(`${exports.WORKORDER_CHANNEL_PREFIX}${workKind}`, idempotencyKey);
-        return row ? this.rowToWorkOrder(row) : null;
-    }
-    /**
-     * The newest COMPLETED full-board-class run - the baseline the scheduled full-board producer
-     * gates against (board-delta-gate.ts). A `delta` run counts too: it publishes the same three
-     * judgment slots from the same accumulated state, so excluding it would leave the previous
-     * full run as the baseline forever and re-trigger a delta on every tick.
-     *
-     * Only `status='done'` full/delta rows count: an open or failed run has not
-     * discharged its interval. `watermark` is null when the run captured none
-     * (an owner-forced refresh), which makes the next scheduled tick enqueue
-     * rather than skip.
-     */
-    lastCompletedBoardFullRun() {
-        const row = this.db
-            .prepare(`SELECT json_extract(payload, '$.deltaWatermark') AS watermark, created_at, updated_at
-           FROM operator_tasks
-          WHERE kind = 'system' AND source_channel = ? AND status = 'done'
-            AND json_extract(payload, '$.mode') IN ('full', 'delta')
-          ORDER BY id DESC LIMIT 1`)
-            .get(`${exports.WORKORDER_CHANNEL_PREFIX}board`);
-        if (!row)
-            return null;
-        return {
-            watermark: typeof row.watermark === 'string' && row.watermark.length > 0 ? row.watermark : null,
-            createdAt: row.created_at,
-            completedAt: row.updated_at,
-        };
-    }
-    /**
-     * The newest COMPLETED wiki run - the baseline the wiki daily-continuity
-     * planner gates against (wiki-continuity.ts). Only `status='done'` rows count.
-     *
-     * `ownerDate`/`sourceWatermark` are read straight from the completed run's
-     * payload and are null for a LEGACY row (one enqueued before the continuity
-     * fields existed): the planner treats a null-field baseline as "no baseline"
-     * and re-runs from the owner day's start rather than fabricating a boundary.
-     */
-    lastCompletedWikiRun() {
-        const row = this.db
-            .prepare(`SELECT json_extract(payload, '$.ownerDate') AS owner_date,
-                json_extract(payload, '$.sourceWatermark') AS source_watermark,
-                json_extract(payload, '$.range.end_ms') AS covered_through_ms,
-                updated_at
-           FROM operator_tasks
-          WHERE kind = 'system' AND source_channel = ? AND status = 'done'
-          ORDER BY id DESC LIMIT 1`)
-            .get(`${exports.WORKORDER_CHANNEL_PREFIX}wiki`);
-        if (!row)
-            return null;
-        return {
-            ownerDate: typeof row.owner_date === 'string' && row.owner_date.length > 0 ? row.owner_date : null,
-            sourceWatermark: typeof row.source_watermark === 'string' && row.source_watermark.length > 0
-                ? row.source_watermark
-                : null,
-            // The prior run's range.end_ms - where the next same-day run resumes.
-            // Null for a legacy row with no range; never fabricated.
-            coveredThroughMs: typeof row.covered_through_ms === 'number' && Number.isFinite(row.covered_through_ms)
-                ? row.covered_through_ms
-                : null,
-            completedAt: row.updated_at,
-        };
-    }
-    /**
-     * Board-input term for the NATIVE owner task ledger - the pipeline slot's
-     * projection source. Reuses payloadHash(): it already digests exactly the
-     * owner-row fields the pipeline slot renders, so a status or assignee edit
-     * moves the term even within the same millisecond as the row's creation,
-     * which a MAX(updated_at) marker would miss. System workorder rows are
-     * excluded by that same query - they are pipeline plumbing, not board truth.
-     */
-    ownerTaskTerm() {
-        return `t:${this.payloadHash()}`;
-    }
-    insertWorkOrder(order, attempts) {
-        assertEnum(order.workKind, exports.WORKORDER_KINDS, 'workKind');
-        if (order.priority !== undefined) {
-            assertEnum(order.priority, exports.TASK_PRIORITIES, 'priority');
-        }
-        if (!order.idempotencyKey || order.idempotencyKey.trim() === '') {
-            throw new Error('enqueueWorkOrder: idempotencyKey must be non-empty');
-        }
-        const channel = `${exports.WORKORDER_CHANNEL_PREFIX}${order.workKind}`;
-        // Owner-event occurrences and scheduled six-hour promotion slots stay
-        // reserved after they COMPLETE. The former prevents post-enqueue/pre-ACK
-        // replay; the latter prevents daemon restarts from repeating an already
-        // discharged slot. Manual promotions use promotion:manual:<time> and do
-        // not enter this branch. 'failed' and 'cancelled' must NOT reserve either
-        // occurrence: those rows are dead and must remain retryable.
-        const durableOwnerEvent = order.idempotencyKey.startsWith('owner-event:');
-        const scheduledPromotionKeys = order.workKind === 'memory-curation'
-            ? scheduledPromotionReservationKeys(order.idempotencyKey)
-            : null;
-        const completedScheduledPromotion = scheduledPromotionKeys !== null;
-        const reservingStatuses = durableOwnerEvent || completedScheduledPromotion
-            ? "'pending','in_progress','done'"
-            : "'pending','in_progress'";
-        const reservationKeys = scheduledPromotionKeys ?? [order.idempotencyKey];
-        const reservationPlaceholders = reservationKeys.map(() => '?').join(',');
-        const open = this.db
-            .prepare(`SELECT * FROM operator_tasks
-         WHERE kind = 'system' AND source_channel = ?
-           AND source_event_id IN (${reservationPlaceholders})
-           AND status IN (${reservingStatuses})
-         ORDER BY id ASC LIMIT 1`)
-            .get(channel, ...reservationKeys);
-        if (open) {
-            return this.rowToWorkOrder(open);
-        }
-        if (!Number.isSafeInteger(attempts) || attempts < 1) {
-            throw new Error(`insertWorkOrder: attempts must be a positive integer, got: ${attempts}`);
-        }
-        const payload = JSON.stringify({ ...order.input, attempts });
-        const now = this.now();
-        const result = this.db
-            .prepare(`INSERT INTO operator_tasks
-           (title, status, priority, kind, payload, source_channel, source_event_id,
-            auto_created, confirmed, created_at, updated_at)
-         VALUES (?, 'pending', ?, 'system', ?, ?, ?, 1, 0, ?, ?)`)
-            .run(`workorder:${order.workKind}`, order.priority ?? 'normal', payload, channel, order.idempotencyKey, now, now);
-        return this.getWorkOrderById(Number(result.lastInsertRowid));
-    }
-    enqueueTemporalGeneration(input) {
-        this.validateTemporalGenerationInput(input);
-        const sourceChannelRef = this.temporalSourceIdentifierRef(input.sourceChannel);
-        const sourceEventIdRef = this.temporalSourceIdentifierRef(input.sourceEventId);
-        let result = null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const existing = this.getTemporalGeneration(input.generationKey);
-            if (existing) {
-                if (existing.taskId !== input.taskId ||
-                    existing.temporalEpoch !== input.temporalEpoch ||
-                    existing.occurrenceKey !== input.occurrenceKey ||
-                    existing.checkAt !== input.checkAt) {
-                    throw new Error(`temporal generation '${input.generationKey}' conflicts with its stored identity`);
-                }
-                if (existing.lastWorkOrderId === null) {
-                    throw new Error(`temporal generation '${input.generationKey}' has no owning workorder attempt`);
-                }
-                const workOrder = this.getWorkOrderById(existing.lastWorkOrderId);
-                if (!workOrder) {
-                    throw new Error(`temporal generation '${input.generationKey}' owns missing workorder ${existing.lastWorkOrderId}`);
-                }
-                this.assertTemporalPayloadMatches(workOrder, existing);
-                if (workOrder.payload.sourceChannel !== sourceChannelRef ||
-                    workOrder.payload.sourceEventId !== sourceEventIdRef) {
-                    throw new Error(`temporal generation '${input.generationKey}' conflicts with stored source identifiers`);
-                }
-                result = { generation: existing, workOrder, created: false };
-            }
-            else {
-                const task = this.getRowById(input.taskId);
-                if (!task || task.kind !== 'owner') {
-                    throw new Error(`temporal generation: owner task ${input.taskId} does not exist`);
-                }
-                if (task.status === 'done' || task.status === 'cancelled') {
-                    throw new Error(`temporal generation: task ${input.taskId} is closed`);
-                }
-                if (task.status === 'review' &&
-                    (task.reviewStartedAt === null ||
-                        !Number.isSafeInteger(task.reviewStartedAt) ||
-                        typeof task.reviewAnchorEventId !== 'string' ||
-                        task.reviewAnchorEventId.trim().length === 0)) {
-                    throw new Error(`temporal generation: review task ${input.taskId} has no verified review anchor`);
-                }
-                const currentOccurrence = (0, task_temporal_js_1.occurrenceKeyForTask)(task);
-                if (task.temporalEpoch !== input.temporalEpoch ||
-                    currentOccurrence !== input.occurrenceKey) {
-                    throw new Error(`temporal generation: task occurrence no longer matches enqueue input`);
-                }
-                if (this.temporalSourceIdentifierRef(task.status === 'review'
-                    ? (task.reviewAnchorSourceChannel ?? task.sourceChannel)
-                    : task.sourceChannel) !== sourceChannelRef ||
-                    this.temporalSourceIdentifierRef(task.status === 'review' && task.reviewAnchorEventId
-                        ? task.reviewAnchorEventId
-                        : task.sourceEventId) !== sourceEventIdRef) {
-                    throw new Error(`temporal generation: source identifiers do not match owner task`);
-                }
-                const openCollision = this.db
-                    .prepare(`SELECT id FROM operator_tasks
-             WHERE kind = 'system' AND source_channel = 'workorder:temporal'
-               AND source_event_id = ? AND status IN ('pending','in_progress')`)
-                    .get(input.generationKey);
-                if (openCollision) {
-                    throw new Error(`temporal generation '${input.generationKey}' has orphan open workorder ${openCollision.id}`);
-                }
-                const timestamp = this.now();
-                this.db
-                    .prepare(`INSERT INTO operator_temporal_generations
-               (generation_key, task_id, temporal_epoch, occurrence_key, check_at,
-                disposition, created_at, updated_at)
-             VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`)
-                    .run(input.generationKey, input.taskId, input.temporalEpoch, input.occurrenceKey, input.checkAt, timestamp, timestamp);
-                const workOrder = this.insertWorkOrder({
-                    workKind: 'temporal',
-                    idempotencyKey: input.generationKey,
-                    input: {
-                        generationKey: input.generationKey,
-                        taskId: input.taskId,
-                        temporalEpoch: input.temporalEpoch,
-                        occurrenceKey: input.occurrenceKey,
-                        checkAt: input.checkAt,
-                        sourceChannel: sourceChannelRef,
-                        sourceEventId: sourceEventIdRef,
-                    },
-                    priority: input.priority ?? 'normal',
-                }, 1);
-                this.db
-                    .prepare(`UPDATE operator_temporal_generations
-             SET last_workorder_id = ?, updated_at = ? WHERE generation_key = ?`)
-                    .run(workOrder.id, timestamp, input.generationKey);
-                const generation = this.getTemporalGeneration(input.generationKey);
-                if (!generation) {
-                    throw new Error(`temporal generation '${input.generationKey}' could not be read back`);
-                }
-                result = { generation, workOrder, created: true };
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        if (!result) {
-            throw new Error(`temporal generation '${input.generationKey}' produced no result`);
-        }
-        return result;
-    }
-    getTemporalGeneration(generationKey) {
-        const row = this.db
-            .prepare(`SELECT * FROM operator_temporal_generations WHERE generation_key = ?`)
-            .get(generationKey);
-        if (!row)
-            return null;
-        return {
-            generationKey: row.generation_key,
-            taskId: row.task_id,
-            temporalEpoch: row.temporal_epoch,
-            occurrenceKey: row.occurrence_key,
-            checkAt: row.check_at,
-            disposition: row.disposition,
-            lastWorkOrderId: row.last_workorder_id,
-            reason: row.reason,
-            createdAt: row.created_at,
-            updatedAt: row.updated_at,
-        };
-    }
-    loadTemporalWorkContext(attemptId) {
-        return this.loadTemporalWorkContextInternal(attemptId);
-    }
-    assertTemporalWorkContextActive(suppliedContext) {
-        const trustedContext = this.loadTemporalWorkContextInternal(suppliedContext.attemptId);
-        this.assertTemporalContextMatches(suppliedContext, trustedContext);
-        return trustedContext;
-    }
-    /**
-     * What this system changed, and what it changed it for.
-     *
-     * Reads live beside the writes because the effect ledger shares the tasks database on
-     * purpose. Exposed here rather than by handing out the connection: the ledger owns both
-     * halves, so a change and its account of itself cannot drift apart.
-     */
-    listChanges(query = {}) {
-        return (0, effects_js_1.listEffects)(this.db, query);
-    }
-    /** Owner rows created since `sinceMs` (the ledger stagnation probe's numerator). */
-    countOwnerTasksCreatedSince(sinceMs) {
-        const row = this.db
-            .prepare(`SELECT count(*) AS n FROM operator_tasks WHERE kind = 'owner' AND created_at >= ?`)
-            .get(sinceMs);
-        return Number(row?.n ?? 0);
-    }
-    /** Receipt for a run the host stopped on its token budget; target is the run id. */
-    recordBudgetStop(input) {
-        (0, effects_js_1.recordUnattributedChange)(this.db, {
-            runId: input.modelRunId,
-            channelId: null,
-            kind: 'run_budget_stop',
-            targetType: 'run',
-            targetId: input.modelRunId ?? `run:${this.now()}`,
-            payload: { budgetTokens: input.budgetTokens, runTokenBudget: input.runTokenBudget },
-            atMs: this.now(),
-        }, 'clock');
-    }
-    /** Receipt for a repair request filed by the self-check turn; target is the issue id. */
-    recordRepairRequest(input) {
-        const change = {
-            runId: input.runId,
-            channelId: null,
-            kind: 'repair_request',
-            targetType: 'issue',
-            targetId: input.issueId,
-            payload: { repairId: input.repairId },
-            atMs: this.now(),
-        };
-        const causes = (input.causeEventIds ?? []).filter(effects_js_1.isUsableCause);
-        if (causes.length > 0) {
-            (0, effects_js_1.recordEffect)(this.db, { ...change, sourceEventIds: causes });
-        }
-        else {
-            (0, effects_js_1.recordUnattributedChange)(this.db, change, 'clock');
-        }
-    }
-    /** Receipt for a deliverable file the owner can receive; target is the content hash. */
-    recordFileExport(input) {
-        const change = {
-            runId: input.runId,
-            channelId: input.channelId ?? null,
-            kind: 'file_export',
-            targetType: 'file',
-            targetId: input.sha256,
-            payload: input.payload,
-            atMs: this.now(),
-        };
-        const causes = (input.causeEventIds ?? []).filter(effects_js_1.isUsableCause);
-        if (causes.length > 0) {
-            (0, effects_js_1.recordEffect)(this.db, { ...change, sourceEventIds: causes });
-        }
-        else {
-            (0, effects_js_1.recordUnattributedChange)(this.db, change, 'owner_message');
-        }
-    }
-    /**
-     * Receipt for a memory write made inside a bounded run. Without it a crash between
-     * mama_save and the batch ACK re-runs the batch and saves the decision twice; with it
-     * the crash-recovery resolver (effectsCausedBy) sees the write and ACKs without a run.
-     * Unattributed when the run had no cause: the count of those stays visible.
-     */
-    recordMemoryWrite(input) {
-        const change = {
-            runId: input.runId,
-            channelId: input.channelId ?? null,
-            kind: 'memory_write',
-            targetType: 'memory',
-            targetId: input.memoryRef,
-            payload: input.payload,
-            atMs: this.now(),
-        };
-        const causes = (input.causeEventIds ?? []).filter(effects_js_1.isUsableCause);
-        if (causes.length > 0) {
-            (0, effects_js_1.recordEffect)(this.db, { ...change, sourceEventIds: causes });
-        }
-        else {
-            (0, effects_js_1.recordUnattributedChange)(this.db, change, 'owner_message');
-        }
-    }
-    /**
-     * Effect kinds this system recorded with ANY of the given events as cause.
-     * The owner-event crash-recovery receipt reads it: a ledger write that named
-     * the batch's events is a durable outcome even when the run died afterwards.
-     */
-    effectsCausedBy(eventIds, sinceMs = 0) {
-        const ids = [...new Set(eventIds.filter((id) => typeof id === 'string' && id.length > 0))];
-        if (ids.length === 0) {
-            return [];
-        }
-        const kinds = new Set();
-        // Chunked like the inbox's SEEN_CHUNK: a backfill batch must not hit SQLite's
-        // variable limit and abort the whole tick. Time-bounded to the batch: effects are
-        // never pruned, inbox dedupe is, so a re-delivered old event must not match its
-        // own year-old effect row and skip the model.
-        for (let offset = 0; offset < ids.length; offset += EFFECT_CAUSE_CHUNK) {
-            const chunk = ids.slice(offset, offset + EFFECT_CAUSE_CHUNK);
-            const rows = this.db
-                .prepare(`SELECT DISTINCT effect_kind FROM evidence_effects
-            WHERE cause_state = 'attributed'
-              AND created_at >= ?
-              AND EXISTS (
-                SELECT 1 FROM json_each(evidence_effects.source_event_ids_json)
-                 WHERE json_each.value IN (${chunk.map(() => '?').join(', ')})
-              )`)
-                .all(sinceMs, ...chunk);
-            for (const row of rows)
-                kinds.add(row.effect_kind);
-        }
-        return [...kinds].sort();
-    }
-    /** Of what this system changed, how much rests on evidence. */
-    changeCoverage(sinceMs, targetType) {
-        return (0, effects_js_1.changeCoverage)(this.db, sinceMs, targetType);
-    }
-    getTemporalEffect(attemptId) {
-        const row = this.db
-            .prepare(`SELECT * FROM operator_temporal_effects WHERE workorder_attempt_id = ?`)
-            .get(attemptId);
-        if (!row)
-            return null;
-        const changedFields = JSON.parse(row.changed_fields);
-        if (!Array.isArray(changedFields) ||
-            !changedFields.every((field) => typeof field === 'string')) {
-            throw new Error(`temporal effect ${attemptId} has invalid changed_fields`);
-        }
-        if (!['resolved', 'final_no_update', 'deferred'].includes(row.outcome)) {
-            throw new Error(`temporal effect ${attemptId} has invalid outcome '${row.outcome}'`);
-        }
-        return {
-            workorderAttemptId: row.workorder_attempt_id,
-            taskId: row.task_id,
-            generationKey: row.generation_key,
-            occurrenceKey: row.occurrence_key,
-            outcome: row.outcome,
-            beforeRevision: row.before_revision,
-            afterRevision: row.after_revision,
-            changedFields,
-            reason: row.reason,
-            attestationVersion: row.attestation_version === 1 ? 1 : 0,
-            contextPacketId: row.context_packet_id ?? '',
-            contextPacketSha256: row.context_packet_sha256 ?? '',
-            packetCreatedAt: row.packet_created_at ?? null,
-            nextTemporalCheckAt: row.next_temporal_check_at,
-            createdAt: row.created_at,
-        };
-    }
-    /**
-     * Read and validate the durable state that decides a temporal attempt's
-     * terminal outcome. This intentionally does not require an active attempt:
-     * consumers must be able to arbitrate committed, superseded, and exhausted
-     * attempts after runner/auditor failures and daemon restarts.
-     */
-    inspectTemporalAttempt(attemptId) {
-        const workOrder = this.getWorkOrderById(attemptId);
-        if (!workOrder || workOrder.workKind !== 'temporal') {
-            throw new Error(`temporal attempt state: no temporal attempt ${attemptId}`);
-        }
-        const generationKey = this.requirePayloadString(workOrder.payload, 'generationKey', attemptId);
-        const generation = this.getTemporalGeneration(generationKey);
-        if (!generation) {
-            throw new Error(`temporal attempt state: generation '${generationKey}' is missing`);
-        }
-        this.assertTemporalPayloadMatches(workOrder, generation);
-        const receipt = this.getTemporalEffect(attemptId);
-        if (receipt) {
-            const receiptError = (0, temporal_effect_js_1.temporalReceiptInvariantError)(receipt, {
-                attemptId,
-                taskId: generation.taskId,
-                generationKey: generation.generationKey,
-                occurrenceKey: generation.occurrenceKey,
-            });
-            if (receiptError) {
-                throw new Error(`temporal attempt state: ${receiptError}`);
-            }
-            if (workOrder.status !== 'done' ||
-                generation.lastWorkOrderId !== attemptId ||
-                generation.disposition !== receipt.outcome) {
-                throw new Error(`temporal attempt state: receipt ${attemptId} is not atomically committed`);
-            }
-            const task = this.getById(generation.taskId);
-            if (!task || task.revision < receipt.afterRevision) {
-                throw new Error(`temporal attempt state: receipt ${attemptId} owner revision is invalid`);
-            }
-            if (receipt.outcome !== 'resolved') {
-                const scope = (0, temporal_effect_js_1.temporalNoUpdateScope)({
-                    attemptId,
-                    generationKey: generation.generationKey,
-                    taskId: generation.taskId,
-                    temporalEpoch: generation.temporalEpoch,
-                    occurrenceKey: generation.occurrenceKey,
-                    checkAt: generation.checkAt,
-                    revision: receipt.beforeRevision,
-                    sourceChannel: null,
-                    sourceEventId: null,
-                });
-                const note = this.db
-                    .prepare(`SELECT id FROM operator_no_update_notes
-             WHERE scope = ? AND reason = ? AND created_at = ? LIMIT 1`)
-                    .get(scope, receipt.reason, receipt.createdAt);
-                if (!note) {
-                    throw new Error(`temporal attempt state: exact-scope no-update note is missing`);
-                }
-            }
-            if (task.revision === receipt.afterRevision) {
-                if (task.lastTemporalAttemptId !== attemptId ||
-                    task.lastTemporalCheckedAt !== receipt.createdAt) {
-                    throw new Error(`temporal attempt state: owner attempt markers are invalid`);
-                }
-                if (receipt.outcome === 'resolved' || receipt.outcome === 'final_no_update') {
-                    if (task.temporalReconciledOccurrenceKey !== generation.occurrenceKey ||
-                        task.nextTemporalCheckAt !== null) {
-                        throw new Error(`temporal attempt state: owner final markers are invalid`);
-                    }
-                }
-                else if (task.nextTemporalCheckAt !== receipt.nextTemporalCheckAt) {
-                    throw new Error(`temporal attempt state: owner deferred check is invalid`);
-                }
-            }
-        }
-        else if (workOrder.status === 'done') {
-            throw new Error(`temporal attempt state: done attempt ${attemptId} has no receipt`);
-        }
-        if (workOrder.status === 'in_progress') {
-            if (receipt ||
-                generation.disposition !== 'active' ||
-                generation.lastWorkOrderId !== attemptId) {
-                throw new Error(`temporal attempt state: active attempt ${attemptId} lost ownership`);
-            }
-        }
-        if (workOrder.status === 'cancelled' &&
-            generation.disposition !== 'superseded' &&
-            (generation.disposition !== 'active' || generation.lastWorkOrderId !== attemptId)) {
-            throw new Error(`temporal attempt state: cancelled attempt ${attemptId} has invalid ownership`);
-        }
-        if (workOrder.status === 'failed' &&
-            generation.disposition === 'active' &&
-            generation.lastWorkOrderId !== attemptId) {
-            const replacement = generation.lastWorkOrderId === null
-                ? null
-                : this.getWorkOrderById(generation.lastWorkOrderId);
-            if (!replacement ||
-                replacement.workKind !== 'temporal' ||
-                (replacement.status !== 'pending' && replacement.status !== 'in_progress')) {
-                throw new Error(`temporal attempt state: retry replacement is missing or terminal`);
-            }
-            this.assertTemporalPayloadMatches(replacement, generation);
-        }
-        if (generation.disposition === 'superseded' &&
-            workOrder.status !== 'cancelled' &&
-            workOrder.status !== 'failed') {
-            throw new Error(`temporal attempt state: superseded attempt ${attemptId} is still open`);
-        }
-        return { workOrder, generation, receipt };
-    }
-    applyTemporalEffect(suppliedContext, input, evidence, now = this.now()) {
-        if (!Number.isSafeInteger(now)) {
-            throw new Error('temporal effect time must be an epoch millisecond integer');
-        }
-        this.validateTemporalEffectInput(input, now);
-        if (!evidence ||
-            typeof evidence.contextPacketId !== 'string' ||
-            evidence.contextPacketId.trim().length < 1 ||
-            evidence.contextPacketId.length > 300 ||
-            !/^[a-f0-9]{64}$/.test(evidence.contextPacketSha256)) {
-            throw new Error('temporal effect requires a valid host evidence attestation');
-        }
-        let receipt = null;
-        const previousGeneration = this.onOwnerTaskChangeCommitted ? this.readGeneration() : null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const context = this.assertTemporalWorkContextActive(suppliedContext);
-            if (input.expected_revision !== context.revision) {
-                throw new Error(`temporal effect revision mismatch: expected ${input.expected_revision}, current ${context.revision}`);
-            }
-            const existing = this.db
-                .prepare(`SELECT * FROM operator_tasks WHERE id = ?`)
-                .get(context.taskId);
-            if (!existing || existing.kind !== 'owner' || existing.revision !== context.revision) {
-                throw new Error(`temporal effect owner task no longer matches trusted context`);
-            }
-            const next = {
-                status: existing.status,
-                deadline: existing.deadline,
-                due_at: existing.due_at,
-                deadline_offset_minutes: existing.deadline_offset_minutes,
-                temporal_epoch: existing.temporal_epoch,
-                temporal_reconciled_occurrence_key: existing.temporal_reconciled_occurrence_key,
-                last_temporal_checked_at: now,
-                next_temporal_check_at: null,
-                last_temporal_attempt_id: context.attemptId,
-                review_started_at: existing.review_started_at,
-                review_anchor_event_id: existing.review_anchor_event_id,
-                review_anchor_source_channel: existing.review_anchor_source_channel,
-            };
-            const auditParts = [`reason=${input.reason.trim()}`];
-            if (input.outcome === 'final_no_update') {
-                auditParts.push(`evidence=${input.evidence_summary.trim()}`);
-            }
-            const receiptReason = this.temporalAuditText(`effect-${input.outcome}`, auditParts);
-            let nextCheck = null;
-            let rescheduled = false;
-            if (input.outcome === 'resolved') {
-                if (input.status !== undefined)
-                    next.status = input.status;
-                if (existing.status === 'review' && next.status !== 'review') {
-                    // Leaving verified review through the Temporal path: the submission
-                    // anchor and its derived 14-day due time do not survive the exit, exactly
-                    // as the task_update path clears them. A later reopen re-verifies.
-                    next.review_started_at = null;
-                    next.review_anchor_event_id = null;
-                    next.review_anchor_source_channel = null;
-                    if (existing.review_started_at !== null &&
-                        !Object.prototype.hasOwnProperty.call(input, 'due_at')) {
-                        next.due_at = null;
-                        next.deadline = null;
-                        next.deadline_offset_minutes = null;
-                    }
-                }
-                if (Object.prototype.hasOwnProperty.call(input, 'due_at')) {
-                    if (input.due_at === null) {
-                        next.due_at = null;
-                    }
-                    else if (input.due_at !== undefined) {
-                        const exactDue = (0, task_temporal_js_1.parseExactDueAt)(input.due_at);
-                        if (exactDue.dueAt !== existing.due_at) {
-                            next.due_at = exactDue.dueAt;
-                            next.deadline = exactDue.deadline;
-                            next.deadline_offset_minutes = exactDue.offsetMinutes;
-                        }
-                    }
-                }
-                const resolvedEffectChanged = next.status !== existing.status || next.due_at !== existing.due_at;
-                if (!resolvedEffectChanged) {
-                    throw new Error('temporal resolved outcome requires an actual status or due_at change');
-                }
-                rescheduled = next.due_at !== existing.due_at;
-                if (rescheduled)
-                    next.temporal_epoch = existing.temporal_epoch + 1;
-                next.temporal_reconciled_occurrence_key = context.occurrenceKey;
-            }
-            else if (input.outcome === 'final_no_update') {
-                next.temporal_reconciled_occurrence_key = context.occurrenceKey;
-            }
-            else {
-                nextCheck = (0, task_temporal_js_1.parseExactDueAt)(input.next_temporal_check_at).dueAt;
-                next.next_temporal_check_at = nextCheck;
-            }
-            const persistedColumns = [
-                'status',
-                'deadline',
-                'due_at',
-                'deadline_offset_minutes',
-                'temporal_epoch',
-                'temporal_reconciled_occurrence_key',
-                'last_temporal_checked_at',
-                'next_temporal_check_at',
-                'last_temporal_attempt_id',
-                'review_started_at',
-                'review_anchor_event_id',
-                'review_anchor_source_channel',
-            ];
-            const changedFields = persistedColumns.filter((column) => next[column] !== existing[column]);
-            const afterRevision = existing.revision + 1;
-            const sets = changedFields.map((column) => `${column} = ?`);
-            const values = changedFields.map((column) => next[column]);
-            sets.push('revision = ?', 'updated_at = ?');
-            values.push(afterRevision, now);
-            const ownerUpdate = this.db
-                .prepare(`UPDATE operator_tasks SET ${sets.join(', ')} WHERE id = ? AND kind = 'owner' AND revision = ?`)
-                .run(...values, context.taskId, existing.revision);
-            if (ownerUpdate.changes !== 1) {
-                throw new Error(`temporal effect lost owner task revision for task ${context.taskId}`);
-            }
-            // The same ledger as every other owner-task change. This is the canonical case -
-            // a scheduled run closing a work item - and leaving it out would have meant the
-            // effect ledger could not see the one change type it was built to account for,
-            // with its receipt filed in a second table nobody joins against.
-            //
-            // Unattributed, and correctly so: a temporal check fires because a clock advanced,
-            // not because an event arrived. Its evidence is the context packet, which today
-            // carries recalled memories and zero connector events - measured, not assumed.
-            // Recording it as attributed would name a cause that does not exist.
-            this.recordTaskChange({
-                kind: 'task_update',
-                taskId: context.taskId,
-                origin: { runId: null, causeKind: 'clock' },
-                channel: existing.source_channel,
-                payload: {
-                    revision: afterRevision,
-                    outcome: input.outcome,
-                    changed: Object.fromEntries(changedFields.map((column) => [column, next[column]])),
-                },
-                atMs: now,
-            });
-            if (rescheduled) {
-                this.supersedeTemporalGenerationsInTransaction(context.taskId, Number(next.temporal_epoch), context.generationKey, now);
-            }
-            const generationUpdate = this.db
-                .prepare(`UPDATE operator_temporal_generations
-           SET disposition = ?, reason = ?, updated_at = ?
-           WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
-                .run(input.outcome, receiptReason, now, context.generationKey, context.attemptId);
-            if (generationUpdate.changes !== 1) {
-                throw new Error(`temporal effect lost generation ownership for attempt ${context.attemptId}`);
-            }
-            if (input.outcome === 'resolved' && (next.status === 'done' || next.status === 'cancelled')) {
-                this.supersedeAllActiveTemporalGenerationsInTransaction(context.taskId, now);
-            }
-            if (input.outcome !== 'resolved') {
-                this.insertNoUpdateNote((0, temporal_effect_js_1.temporalNoUpdateScope)(context), receiptReason, now);
-            }
-            this.db
-                .prepare(`INSERT INTO operator_temporal_effects
-             (workorder_attempt_id, task_id, generation_key, occurrence_key, outcome,
-              before_revision, after_revision, changed_fields, reason,
-              attestation_version, context_packet_id, context_packet_sha256,
-              packet_created_at, next_temporal_check_at, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?)`)
-                .run(context.attemptId, context.taskId, context.generationKey, context.occurrenceKey, input.outcome, existing.revision, afterRevision, JSON.stringify(changedFields), receiptReason, evidence.contextPacketId, evidence.contextPacketSha256, evidence.packetCreatedAt, nextCheck, now);
-            const workOrderUpdate = this.db
-                .prepare(`UPDATE operator_tasks SET status = 'done', latest_event = ?, updated_at = ?
-           WHERE id = ? AND kind = 'system' AND status = 'in_progress'
-             AND source_channel = 'workorder:temporal' AND source_event_id = ?`)
-                .run(receiptReason, now, context.attemptId, context.generationKey);
-            if (workOrderUpdate.changes !== 1) {
-                throw new Error(`temporal effect lost active workorder ${context.attemptId}`);
-            }
-            receipt = this.getTemporalEffect(context.attemptId);
-            if (!receipt)
-                throw new Error(`temporal effect receipt could not be read back`);
-            const receiptError = (0, temporal_effect_js_1.temporalReceiptInvariantError)(receipt, {
-                attemptId: context.attemptId,
-                taskId: context.taskId,
-                generationKey: context.generationKey,
-                occurrenceKey: context.occurrenceKey,
-                beforeRevision: context.revision,
-            });
-            if (receiptError) {
-                throw new Error(`temporal effect receipt invariant failed: ${receiptError}`);
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        this.notifyOwnerTaskCommit(previousGeneration);
-        if (!receipt)
-            throw new Error(`temporal effect produced no receipt`);
-        return receipt;
-    }
-    requeueTemporalWorkOrder(attemptId, reason) {
-        this.assertTemporalReason(reason);
-        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
-        let replacement = null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const context = this.loadTemporalWorkContextInternal(attemptId);
-            const workOrder = this.getWorkOrderById(attemptId);
-            if (workOrder.payload.attempts >= exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
-                throw new Error(`temporal retry budget exhausted for attempt ${attemptId}`);
-            }
-            replacement = this.requeueTemporalWorkOrderInTransaction(context, workOrder, auditReason);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        if (!replacement)
-            throw new Error(`temporal retry for attempt ${attemptId} produced no row`);
-        return replacement;
-    }
-    exhaustTemporalWorkOrder(attemptId, reason) {
-        this.assertTemporalReason(reason);
-        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const context = this.loadTemporalWorkContextInternal(attemptId);
-            const workOrder = this.getWorkOrderById(attemptId);
-            if (workOrder.payload.attempts !== exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
-                throw new Error(`temporal exhaustion requires attempt ${exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS}, got ${workOrder.payload.attempts}`);
-            }
-            this.exhaustTemporalWorkOrderInTransaction(context, auditReason);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-    failTemporalWorkOrder(attemptId, reason, allowRetry = true) {
-        this.assertTemporalReason(reason);
-        const auditReason = this.temporalAuditText('worker-failure', [`failure=${reason}`]);
-        let result = null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const repairedAttempt = this.repairClosedTemporalOwnershipInTransaction(attemptId);
-            if (repairedAttempt !== null) {
-                result = {
-                    disposition: 'superseded',
-                    attempt: repairedAttempt,
-                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
-                };
-                this.db.exec('COMMIT');
-                return result;
-            }
-            const context = this.loadTemporalWorkContextInternal(attemptId);
-            const workOrder = this.getWorkOrderById(attemptId);
-            const attempt = workOrder.payload.attempts;
-            if (!allowRetry) {
-                this.exhaustTemporalWorkOrderInTransaction(context, auditReason);
-                result = {
-                    disposition: 'exhausted',
-                    attempt,
-                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
-                    retrySuppressed: true,
-                };
-            }
-            else if (attempt < exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
-                result = {
-                    disposition: 'requeued',
-                    replacement: this.requeueTemporalWorkOrderInTransaction(context, workOrder, auditReason),
-                    attempt,
-                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
-                };
-            }
-            else if (attempt === exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS) {
-                this.exhaustTemporalWorkOrderInTransaction(context, auditReason);
-                result = {
-                    disposition: 'exhausted',
-                    attempt,
-                    maxAttempts: exports.TEMPORAL_WORKORDER_MAX_ATTEMPTS,
-                };
-            }
-            else {
-                throw new Error(`temporal attempt ${attemptId} exceeds retry budget: ${attempt}`);
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        if (!result)
-            throw new Error(`temporal failure for attempt ${attemptId} produced no result`);
-        return result;
-    }
-    repairClosedTemporalOwnershipInTransaction(attemptId) {
-        const workOrder = this.getWorkOrderById(attemptId);
-        if (!workOrder || workOrder.workKind !== 'temporal') {
-            return null;
-        }
-        const generationKey = this.requirePayloadString(workOrder.payload, 'generationKey', attemptId);
-        const generation = this.getTemporalGeneration(generationKey);
-        if (!generation || generation.lastWorkOrderId !== attemptId) {
-            return null;
-        }
-        const task = this.getById(generation.taskId);
-        if (!task || (task.status !== 'done' && task.status !== 'cancelled')) {
-            return null;
-        }
-        const openAttempt = workOrder.status === 'pending' || workOrder.status === 'in_progress';
-        if (generation.disposition === 'active' && openAttempt) {
-            this.supersedeAllActiveTemporalGenerationsInTransaction(task.id);
-        }
-        else if (generation.disposition !== 'superseded' || workOrder.status !== 'cancelled') {
-            return null;
-        }
-        return workOrder.payload.attempts;
-    }
-    /** Repair pre-fix databases where a terminal owner still has active temporal ownership. */
-    repairClosedTemporalGenerations() {
-        let repaired = 0;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const rows = this.db
-                .prepare(`SELECT DISTINCT generation.task_id
-           FROM operator_temporal_generations generation
-           JOIN operator_tasks owner ON owner.id = generation.task_id
-           WHERE generation.disposition = 'active'
-             AND owner.kind = 'owner'
-             AND owner.status IN ('done','cancelled')
-           ORDER BY generation.task_id ASC`)
-                .all();
-            const updatedAt = this.now();
-            for (const row of rows) {
-                this.supersedeAllActiveTemporalGenerationsInTransaction(row.task_id, updatedAt);
-            }
-            repaired = rows.length;
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        return repaired;
-    }
-    /** Control-plane pause: cancel open attempts but keep generations resumable. */
-    pauseActiveTemporalWork(reason) {
-        this.assertTemporalReason(reason);
-        let changed = 0;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const result = this.db
-                .prepare(`UPDATE operator_tasks
-           SET status = 'cancelled', latest_event = ?, updated_at = ?
-           WHERE kind = 'system' AND source_channel = 'workorder:temporal'
-             AND status IN ('pending','in_progress')`)
-                .run(reason, this.now());
-            changed = result.changes;
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        return changed;
-    }
-    /** Resume paused active generations without spending another model attempt. */
-    resumePausedTemporalWork() {
-        const resumed = [];
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const rows = this.db
-                .prepare(`SELECT generation_key, last_workorder_id
-           FROM operator_temporal_generations generation
-           WHERE disposition = 'active' AND last_workorder_id IS NOT NULL
-             AND NOT EXISTS (
-               SELECT 1 FROM operator_tasks open_attempt
-               WHERE open_attempt.kind = 'system'
-                 AND open_attempt.source_channel = 'workorder:temporal'
-                 AND open_attempt.source_event_id = generation.generation_key
-                 AND open_attempt.status IN ('pending','in_progress')
-             )
-           ORDER BY generation_key ASC`)
-                .all();
-            for (const row of rows) {
-                const generation = this.getTemporalGeneration(row.generation_key);
-                const previous = this.getWorkOrderById(row.last_workorder_id);
-                if (!generation || !previous || previous.status !== 'cancelled') {
-                    throw new Error(`temporal resume: active generation '${row.generation_key}' has no paused attempt`);
-                }
-                this.assertTemporalPayloadMatches(previous, generation);
-                const { attempts, ...payload } = previous.payload;
-                const replacement = this.insertWorkOrder({
-                    workKind: 'temporal',
-                    idempotencyKey: generation.generationKey,
-                    input: payload,
-                    priority: previous.priority,
-                }, attempts);
-                const ownership = this.db
-                    .prepare(`UPDATE operator_temporal_generations
-             SET last_workorder_id = ?, updated_at = ?
-             WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
-                    .run(replacement.id, this.now(), generation.generationKey, previous.id);
-                if (ownership.changes !== 1) {
-                    throw new Error(`temporal resume lost ownership for generation '${generation.generationKey}'`);
-                }
-                resumed.push(replacement);
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        return resumed;
-    }
-    requeueTemporalWorkOrderInTransaction(context, workOrder, reason) {
-        this.transitionWorkOrder(workOrder.id, 'failed', reason);
-        const payload = publisherPayloadOfStoredWorkOrder(workOrder.payload);
-        const replacement = this.insertWorkOrder({
-            workKind: 'temporal',
-            idempotencyKey: context.generationKey,
-            input: payload,
-            priority: workOrder.priority,
-        }, workOrder.payload.attempts + 1);
-        const ownership = this.db
-            .prepare(`UPDATE operator_temporal_generations
-         SET last_workorder_id = ?, updated_at = ?
-         WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
-            .run(replacement.id, this.now(), context.generationKey, workOrder.id);
-        if (ownership.changes !== 1) {
-            throw new Error(`temporal retry lost generation ownership for attempt ${workOrder.id}`);
-        }
-        return replacement;
-    }
-    exhaustTemporalWorkOrderInTransaction(context, reason) {
-        this.transitionWorkOrder(context.attemptId, 'failed', reason);
-        const update = this.db
-            .prepare(`UPDATE operator_temporal_generations
-         SET disposition = 'exhausted', reason = ?, updated_at = ?
-         WHERE generation_key = ? AND disposition = 'active' AND last_workorder_id = ?`)
-            .run(reason, this.now(), context.generationKey, context.attemptId);
-        if (update.changes !== 1) {
-            throw new Error(`temporal exhaustion lost ownership for attempt ${context.attemptId}`);
-        }
-    }
-    supersedeTemporalGenerations(taskId, currentEpoch, excludeGenerationKey) {
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            this.supersedeTemporalGenerationsInTransaction(taskId, currentEpoch, excludeGenerationKey);
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-    validateTemporalGenerationInput(input) {
-        const bounded = (value, field, max) => {
-            if (value.length < 1 || value.length > max) {
-                throw new Error(`temporal generation: ${field} must contain 1-${max} characters`);
-            }
-        };
-        bounded(input.generationKey, 'generationKey', 500);
-        bounded(input.occurrenceKey, 'occurrenceKey', 300);
-        if (!Number.isSafeInteger(input.taskId) || input.taskId < 1) {
-            throw new Error(`temporal generation: taskId must be a positive integer`);
-        }
-        if (!Number.isSafeInteger(input.temporalEpoch) || input.temporalEpoch < 0) {
-            throw new Error(`temporal generation: temporalEpoch must be a non-negative integer`);
-        }
-        if (!Number.isSafeInteger(input.checkAt)) {
-            throw new Error(`temporal generation: checkAt must be an epoch millisecond integer`);
-        }
-        const canonicalKey = (0, task_temporal_js_1.temporalGenerationKey)(input.taskId, input.occurrenceKey, input.checkAt);
-        if (input.generationKey !== canonicalKey) {
-            throw new Error(`temporal generation: generationKey must equal canonical identity key`);
-        }
-        for (const [field, value] of [
-            ['sourceChannel', input.sourceChannel],
-            ['sourceEventId', input.sourceEventId],
-        ]) {
-            if (value !== null && typeof value !== 'string') {
-                throw new Error(`temporal generation: ${field} must be a string or null`);
-            }
-        }
-        if (input.priority !== undefined)
-            assertEnum(input.priority, exports.TASK_PRIORITIES, 'priority');
-    }
-    /**
-     * Workorder payloads carry only bounded references to owner-source identifiers.
-     * Owner rows created by older releases may contain empty or arbitrarily long
-     * connector identifiers; hashing preserves exact identity without making one
-     * legacy row able to abort temporal boot or inflate every retry payload.
-     */
-    temporalSourceIdentifierRef(value) {
-        if (value === null)
-            return null;
-        return `sha256:${(0, node_crypto_1.createHash)('sha256').update(value).digest('hex')}`;
-    }
-    validateTemporalEffectInput(input, now) {
-        if (!input || typeof input !== 'object' || Array.isArray(input)) {
-            throw new Error('temporal effect input must be an object');
-        }
-        if (!Number.isSafeInteger(input.expected_revision) || input.expected_revision < 0) {
-            throw new Error('temporal effect expected_revision must be a non-negative integer');
-        }
-        this.assertTemporalReason(input.reason);
-        const baseKeys = ['expected_revision', 'outcome', 'reason'];
-        let allowedKeys;
-        if (input.outcome === 'resolved') {
-            allowedKeys = [...baseKeys, 'status', 'due_at'];
-            if (input.status !== undefined) {
-                assertEnum(input.status, exports.TASK_STATUSES, 'temporal effect status');
-                if (String(input.status) === 'failed') {
-                    throw new Error(`temporal effect: 'failed' is a system-only status`);
-                }
-            }
-            if (input.due_at !== undefined && input.due_at !== null)
-                (0, task_temporal_js_1.parseExactDueAt)(input.due_at);
-        }
-        else if (input.outcome === 'final_no_update') {
-            allowedKeys = [...baseKeys, 'evidence_summary'];
-            if (typeof input.evidence_summary !== 'string' ||
-                input.evidence_summary.trim().length < 1 ||
-                input.evidence_summary.length > 1_000) {
-                throw new Error('temporal effect evidence_summary must contain 1-1000 characters');
-            }
-        }
-        else if (input.outcome === 'deferred') {
-            allowedKeys = [...baseKeys, 'next_temporal_check_at'];
-            if (typeof input.next_temporal_check_at !== 'string') {
-                throw new Error('temporal effect next_temporal_check_at must be RFC 3339');
-            }
-            const nextCheck = (0, task_temporal_js_1.parseExactDueAt)(input.next_temporal_check_at).dueAt;
-            if (nextCheck <= now) {
-                throw new Error('temporal effect deferred check must be strictly in the future');
-            }
-        }
-        else {
-            throw new Error(`temporal effect outcome is unknown or forbidden`);
-        }
-        const unknownKeys = Object.keys(input).filter((key) => !allowedKeys.includes(key));
-        if (unknownKeys.length > 0) {
-            throw new Error(`temporal effect contains unknown or forbidden fields: ${unknownKeys.join(', ')}`);
-        }
-    }
-    assertTemporalContextMatches(supplied, trusted) {
-        const fields = [
-            'attemptId',
-            'generationKey',
-            'taskId',
-            'temporalEpoch',
-            'occurrenceKey',
-            'checkAt',
-            'revision',
-            'sourceChannel',
-            'sourceEventId',
-        ];
-        if (fields.some((field) => supplied[field] !== trusted[field])) {
-            throw new Error('temporal effect supplied context does not match trusted host context');
-        }
-    }
-    loadTemporalWorkContextInternal(attemptId) {
-        const workOrder = this.getWorkOrderById(attemptId);
-        if (!workOrder || workOrder.workKind !== 'temporal') {
-            throw new Error(`temporal context: no temporal attempt ${attemptId}`);
-        }
-        if (workOrder.status !== 'in_progress') {
-            throw new Error(`temporal context: attempt ${attemptId} is '${workOrder.status}', expected active attempt`);
-        }
-        const payload = workOrder.payload;
-        const generationKey = this.requirePayloadString(payload, 'generationKey', attemptId);
-        const taskId = this.requirePayloadInteger(payload, 'taskId', attemptId, 1);
-        const temporalEpoch = this.requirePayloadInteger(payload, 'temporalEpoch', attemptId, 0);
-        const occurrenceKey = this.requirePayloadString(payload, 'occurrenceKey', attemptId);
-        const checkAt = this.requirePayloadInteger(payload, 'checkAt', attemptId);
-        const sourceChannel = this.requireNullablePayloadString(payload, 'sourceChannel', attemptId);
-        const sourceEventId = this.requireNullablePayloadString(payload, 'sourceEventId', attemptId);
-        const generation = this.getTemporalGeneration(generationKey);
-        if (!generation || generation.disposition !== 'active') {
-            throw new Error(`temporal context: generation '${generationKey}' is not active`);
-        }
-        if (generation.lastWorkOrderId !== attemptId) {
-            throw new Error(`temporal context: attempt ${attemptId} no longer owns generation`);
-        }
-        this.assertTemporalPayloadMatches(workOrder, generation);
-        const task = this.getRowById(taskId);
-        if (!task || task.kind !== 'owner') {
-            throw new Error(`temporal context: owner task ${taskId} does not exist`);
-        }
-        if (task.status === 'done' || task.status === 'cancelled') {
-            throw new Error(`temporal context: owner task ${taskId} is closed`);
-        }
-        if (task.status === 'review' &&
-            (task.reviewStartedAt === null ||
-                !Number.isSafeInteger(task.reviewStartedAt) ||
-                typeof task.reviewAnchorEventId !== 'string' ||
-                task.reviewAnchorEventId.trim().length === 0)) {
-            throw new Error(`temporal context: review task ${taskId} has no verified review anchor`);
-        }
-        if (task.temporalEpoch !== temporalEpoch ||
-            (0, task_temporal_js_1.occurrenceKeyForTask)(task) !== occurrenceKey ||
-            this.temporalSourceIdentifierRef(task.status === 'review'
-                ? (task.reviewAnchorSourceChannel ?? task.sourceChannel)
-                : task.sourceChannel) !== sourceChannel ||
-            this.temporalSourceIdentifierRef(task.status === 'review' && task.reviewAnchorEventId
-                ? task.reviewAnchorEventId
-                : task.sourceEventId) !== sourceEventId ||
-            generation.taskId !== taskId ||
-            generation.temporalEpoch !== temporalEpoch ||
-            generation.occurrenceKey !== occurrenceKey ||
-            generation.checkAt !== checkAt) {
-            throw new Error(`temporal context: attempt ${attemptId} payload no longer matches ownership`);
-        }
-        return {
-            attemptId,
-            generationKey,
-            taskId,
-            temporalEpoch,
-            occurrenceKey,
-            checkAt,
-            revision: task.revision,
-            sourceChannel,
-            sourceEventId,
-        };
-    }
-    assertTemporalPayloadMatches(workOrder, generation) {
-        const payload = workOrder.payload;
-        if (payload.generationKey !== generation.generationKey ||
-            payload.taskId !== generation.taskId ||
-            payload.temporalEpoch !== generation.temporalEpoch ||
-            payload.occurrenceKey !== generation.occurrenceKey ||
-            payload.checkAt !== generation.checkAt) {
-            throw new Error(`temporal attempt ${workOrder.id} payload does not match generation ownership`);
-        }
-    }
-    requirePayloadString(payload, field, attemptId) {
-        const value = payload[field];
-        if (typeof value !== 'string' || value.length === 0) {
-            throw new Error(`temporal attempt ${attemptId}: ${field} must be a non-empty string`);
-        }
-        return value;
-    }
-    requireNullablePayloadString(payload, field, attemptId) {
-        const value = payload[field];
-        if (value !== null && typeof value !== 'string') {
-            throw new Error(`temporal attempt ${attemptId}: ${field} must be a string or null`);
-        }
-        return value;
-    }
-    requirePayloadInteger(payload, field, attemptId, minimum = Number.MIN_SAFE_INTEGER) {
-        const value = payload[field];
-        if (!Number.isSafeInteger(value) || value < minimum) {
-            throw new Error(`temporal attempt ${attemptId}: ${field} must be an integer`);
-        }
-        return value;
-    }
-    assertTemporalReason(reason) {
-        if (reason.trim().length < 1 || reason.length > 500) {
-            throw new Error('temporal workorder reason must contain 1-500 characters');
-        }
-    }
-    temporalAuditText(kind, values) {
-        const refs = values.map((value, index) => {
-            const separator = value.indexOf('=');
-            const label = separator > 0 ? value.slice(0, separator) : `value${index + 1}`;
-            const text = separator > 0 ? value.slice(separator + 1) : value;
-            const digest = (0, node_crypto_1.createHash)('sha256').update(text).digest('hex');
-            return `${label}_sha256=${digest};${label}_length=${text.length}`;
-        });
-        return `temporal-${kind};${refs.join(';')}`;
-    }
-    /**
-     * Claim the next pending workorder: priority high>normal>low, then id ASC
-     * (plan D2/E2 - CASE mapping, never lexicographic on the TEXT enum).
-     * pending -> in_progress. Single serial consumer; transaction for atomicity.
-     */
-    claimNextWorkOrder() {
-        let claimedId = null;
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const claimAt = this.now();
-            const row = this.db
-                .prepare(`SELECT * FROM operator_tasks
-           WHERE kind = 'system' AND status = 'pending'
-             AND source_channel IN (${KNOWN_WORKORDER_CHANNELS_SQL})
-             AND (due_at IS NULL OR due_at <= ?)
-           ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END ASC,
-                    id ASC
-           LIMIT 1`)
-                .get(...KNOWN_WORKORDER_CHANNELS, claimAt);
-            if (row) {
-                this.db
-                    .prepare(`UPDATE operator_tasks SET status = 'in_progress', updated_at = ? WHERE id = ?`)
-                    .run(claimAt, row.id);
-                claimedId = row.id;
-            }
-            this.db.exec('COMMIT');
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-        // Read-back OUTSIDE the try: a throw here (corrupt payload) must not
-        // trigger ROLLBACK after COMMIT (PR bot round - masked error class).
-        return claimedId === null ? null : this.getWorkOrderById(claimedId);
-    }
-    /**
-     * Atomic fail-and-requeue (PR bot round): the failure mark and the
-     * replacement row commit together - a crash between the two would lose
-     * the retry (the old row terminal, the new one never inserted). The
-     * replacement can only be inserted AFTER the old row leaves the partial
-     * unique index, hence one transaction, not two calls.
-     */
-    requeueWorkOrder(wo, reason) {
-        if (wo.workKind === 'temporal') {
-            return this.requeueTemporalWorkOrder(wo.id, reason);
-        }
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            const current = this.getWorkOrderById(wo.id);
-            if (!current || current.workKind !== wo.workKind) {
-                throw new Error(`workorder retry: claimed row ${wo.id} no longer matches input`);
-            }
-            this.transitionWorkOrder(current.id, 'failed', reason);
-            const input = publisherPayloadOfStoredWorkOrder(current.payload);
-            const replacement = this.insertWorkOrder({
-                workKind: current.workKind,
-                idempotencyKey: current.idempotencyKey,
-                input,
-                priority: current.priority,
-            }, current.payload.attempts + 1);
-            this.db.exec('COMMIT');
-            return replacement;
-        }
-        catch (error) {
-            this.db.exec('ROLLBACK');
-            throw error;
-        }
-    }
-    /**
-     * Record that a claimed attempt is waiting on a native subagent.
-     *
-     * The status stays `in_progress`, which is the truth: the attempt is open and its
-     * idempotency slot is still held, so nothing re-enqueues the same occurrence underneath
-     * the child. Only the durable verification (or the consumer's timeout) moves it on.
-     */
-    markWorkOrderDelegated(id, delegatedAt) {
-        if (!Number.isSafeInteger(delegatedAt) || delegatedAt < 0) {
-            throw new Error('workorder delegation timestamp must be a non-negative safe integer');
-        }
-        const row = this.getWorkOrderById(id);
-        if (!row)
-            throw new Error(`workorder delegation: no system row with id ${id}`);
-        if (row.status !== 'in_progress') {
-            throw new Error(`workorder delegation: row ${id} is '${row.status}', expected in_progress`);
-        }
-        const payload = { ...row.payload, [exports.WORKORDER_DELEGATED_AT_KEY]: delegatedAt };
-        const result = this.db
-            .prepare(`UPDATE operator_tasks SET payload = ?, latest_event = ?, updated_at = ?
-         WHERE id = ? AND kind = 'system' AND status = 'in_progress'`)
-            .run(JSON.stringify(payload), 'delegated to a native subagent', this.now(), id);
-        // The row can leave in_progress between the read above and this write. A no-op UPDATE
-        // is not a delegation: say so instead of reporting a mark that was never stored.
-        if (result.changes !== 1) {
-            throw new Error(`workorder delegation: row ${id} left in_progress before the mark`);
-        }
-    }
-    completeWorkOrder(id) {
-        this.transitionWorkOrder(id, 'done', null);
-    }
-    failWorkOrder(id, reason) {
-        this.transitionWorkOrder(id, 'failed', reason);
-    }
-    countPendingWorkOrders() {
-        const row = this.db
-            .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
-         WHERE kind = 'system' AND status = 'pending'
-           AND source_channel IN (${KNOWN_WORKORDER_CHANNELS_SQL})`)
-            .get(...KNOWN_WORKORDER_CHANNELS);
-        return row.count;
-    }
-    countOpenWorkOrders(kind) {
-        const row = (kind
-            ? this.db
-                .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
-               WHERE kind = 'system' AND status IN ('pending','in_progress')
-                 AND source_channel = ?`)
-                .get(`${exports.WORKORDER_CHANNEL_PREFIX}${kind}`)
-            : this.db
-                .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
-               WHERE kind = 'system' AND status IN ('pending','in_progress')`)
-                .get());
-        return row.count;
-    }
-    findTemporalGenerationKeys(generationKeys) {
-        if (generationKeys.length === 0)
-            return new Set();
-        if (generationKeys.length > 500) {
-            throw new Error('findTemporalGenerationKeys accepts at most 500 keys');
-        }
-        const rows = this.db
-            .prepare(`SELECT generation_key FROM operator_temporal_generations
-         WHERE generation_key IN (${generationKeys.map(() => '?').join(',')})`)
-            .all(...generationKeys);
-        return new Set(rows.map((row) => row.generation_key));
-    }
-    /** In-progress system rows at boot = crash artifacts (single serial consumer). */
-    listStaleClaims() {
-        const rows = this.db
-            .prepare(`SELECT * FROM operator_tasks
-         WHERE kind = 'system' AND status = 'in_progress'
-           AND source_channel IN (${KNOWN_WORKORDER_CHANNELS_SQL})`)
-            .all(...KNOWN_WORKORDER_CHANNELS);
-        return rows.map((row) => this.rowToWorkOrder(row));
-    }
-    /**
-     * Boot cleanup (plan D3 + review N4): open system rows -> cancelled. A
-     * rollback is not a failure - excluded from failed counters/alarms; caller
-     * logs ONE summary line with the returned count. `onlyKinds` scopes the
-     * cancellation.
-     */
-    cancelOpenWorkOrders(reason, onlyKinds) {
-        // An explicit empty scope means "cancel nothing", never "cancel all"
-        // (review F2 - the fall-through would silently widen a scoped call).
-        if (onlyKinds !== undefined && onlyKinds.length === 0) {
-            return 0;
-        }
-        const selectedKinds = onlyKinds ?? exports.WORKORDER_KINDS;
-        const kindFilter = ` AND source_channel IN (${selectedKinds.map(() => '?').join(',')})`;
-        const kindParams = selectedKinds.map((kind) => `${exports.WORKORDER_CHANNEL_PREFIX}${kind}`);
-        const result = this.db
-            .prepare(`UPDATE operator_tasks
-         SET status = 'cancelled', latest_event = ?, updated_at = ?
-         WHERE kind = 'system' AND status IN ('pending','in_progress')${kindFilter}`)
-            .run(reason, this.now(), ...kindParams);
-        return result.changes;
-    }
-    /** Per-kind last run and failure counts of the system lanes (operator UI and tests). */
-    workOrderStats() {
-        return exports.WORKORDER_KINDS.map((workKind) => {
-            const channel = `${exports.WORKORDER_CHANNEL_PREFIX}${workKind}`;
-            const last = this.db
-                .prepare(`SELECT status, updated_at FROM operator_tasks
-           WHERE kind = 'system' AND source_channel = ?
-           ORDER BY updated_at DESC, id DESC LIMIT 1`)
-                .get(channel);
-            const failed = this.db
-                .prepare(`SELECT COUNT(*) AS count FROM operator_tasks
-           WHERE kind = 'system' AND source_channel = ? AND status = 'failed'`)
-                .get(channel);
-            const lastFailure = this.db
-                .prepare(`SELECT latest_event FROM operator_tasks
-           WHERE kind = 'system' AND source_channel = ? AND status = 'failed'
-           ORDER BY updated_at DESC, id DESC LIMIT 1`)
-                .get(channel);
-            return {
-                workKind,
-                lastRunAt: last?.updated_at ?? null,
-                lastStatus: last?.status ?? null,
-                failedCount: failed.count,
-                lastFailureReason: lastFailure?.latest_event ?? null,
-            };
-        });
-    }
-    getWorkOrderById(id) {
-        const row = this.db
-            .prepare(`SELECT * FROM operator_tasks WHERE id = ? AND kind = 'system'`)
-            .get(id);
-        return row ? this.rowToWorkOrder(row) : null;
-    }
-    transitionWorkOrder(id, status, reason) {
-        const row = this.getWorkOrderById(id);
-        if (!row)
-            throw new Error(`workorder transition: no system row with id ${id}`);
-        if (row.status !== 'in_progress') {
-            throw new Error(`workorder transition: row ${id} is '${row.status}', expected in_progress`);
-        }
-        this.db
-            .prepare(`UPDATE operator_tasks SET status = ?, latest_event = COALESCE(?, latest_event),
-                updated_at = ? WHERE id = ?`)
-            .run(status, reason, this.now(), id);
-    }
-    rowToWorkOrder(row) {
-        const workKind = (row.source_channel ?? '').slice(exports.WORKORDER_CHANNEL_PREFIX.length);
-        assertEnum(workKind, exports.WORKORDER_KINDS, 'workKind');
-        let payload;
-        try {
-            payload = row.payload ? JSON.parse(row.payload) : {};
-        }
-        catch (error) {
-            // No-fallback: a corrupt payload is a real fault, surface it loudly.
-            throw new Error(`workorder ${row.id}: corrupt payload JSON (${error instanceof Error ? error.message : String(error)})`);
-        }
-        // Strict reads (PR bot round): silently normalizing corrupt ownership or
-        // retry metadata would mask a real fault - every row here was written by
-        // enqueueWorkOrder, which guarantees both fields.
-        if (typeof payload.attempts !== 'number' || payload.attempts < 1) {
-            throw new Error(`workorder ${row.id}: invalid attempts in payload (${String(payload.attempts)})`);
-        }
-        if (!row.source_event_id) {
-            throw new Error(`workorder ${row.id}: missing idempotency key (source_event_id)`);
-        }
-        return {
-            id: row.id,
-            workKind: workKind,
-            status: row.status,
-            priority: row.priority,
-            idempotencyKey: row.source_event_id,
-            payload: { ...payload, attempts: payload.attempts },
-            delegatedAt: typeof payload[exports.WORKORDER_DELEGATED_AT_KEY] === 'number'
-                ? payload[exports.WORKORDER_DELEGATED_AT_KEY]
-                : null,
-            createdAt: row.created_at,
-            updatedAt: row.updated_at,
-        };
-    }
-    /** contract_no_update: silence as a verifiable judgment, scoped to one reconcile run. */
-    recordNoUpdate(scope, reason) {
-        if (!scope || !reason) {
-            throw new Error('contract_no_update requires both scope and reason');
-        }
-        return this.insertNoUpdateNote(scope, reason, this.now());
-    }
-    insertNoUpdateNote(scope, reason, createdAt) {
-        const result = this.db
-            .prepare(`INSERT INTO operator_no_update_notes (scope, reason, created_at) VALUES (?, ?, ?)`)
-            .run(scope, reason, createdAt);
-        return { id: Number(result.lastInsertRowid) };
-    }
-    /** Max no-update note id, optionally scoped - the verifier's note snapshot. */
-    maxNoUpdateId(scope) {
-        const row = (scope
-            ? this.db
-                .prepare(`SELECT MAX(id) AS max_id FROM operator_no_update_notes WHERE scope = ?`)
-                .get(scope)
-            : this.db.prepare(`SELECT MAX(id) AS max_id FROM operator_no_update_notes`).get());
-        return row.max_id ?? 0;
-    }
-}
-exports.TaskLedger = TaskLedger;
-//# sourceMappingURL=task-ledger.js.map