@knpkv/herdr-work 0.5.1 → 0.6.0

package/dist/store.js

@@ -1,16 +1,20 @@
-import { agentConnectTarget, fleetResponseBodyMaxBytes, workReassignActivitySummary } from "@knpkv/herdr-fleet";
+import { agentConnectTarget, fleetResponseBodyMaxBytes, workAbandonActivitySummary, workReassignActivitySummary } from "@knpkv/herdr-fleet";
 import { openPrivateSqlite } from "@knpkv/herdr-fleet/sqlite";
-import { Clock, Crypto, Effect, Equal, Option, Schema } from "effect";
+import { Clock, Crypto, Effect, Equal, Option, Result, Schema } from "effect";
 import { Hex } from "effect/encoding";
 import { makeWorkAgentBinding } from "./agent-binding.js";
-import { WorkAdmissionConflictError, WorkAgentBindingAuthorityError, WorkAgentBindingConflictError, WorkCheckpointConflictError, WorkCoordinatorHandoffConflictError, WorkDecisionAuthorityConflictError, WorkDecisionHandoffConflictError, WorkDecisionRevisionConflictError, WorkGoalAgentTargetConflictError, WorkGoalBindingRequiresAgentError, WorkGoalOwnerMismatchError, WorkGoalReassignmentConflictError, WorkGoalRevisionConflictError, WorkLaneClaimConflictError, WorkLaneGoalConflictError, WorkLaneOperationConflictError, WorkProjectionError, WorkPullRequestLinkError, WorkStoreError, WorkTransactionConflictError } from "./errors.js";
+import { WorkAdmissionConflictError, WorkAgentBindingAuthorityError, WorkAgentBindingConflictError, WorkCheckpointConflictError, WorkCoordinatorHandoffConflictError, WorkDecisionAuthorityConflictError, WorkDecisionHandoffConflictError, WorkDecisionRevisionConflictError, WorkGoalAbandonmentConflictError, WorkGoalAgentTargetConflictError, WorkGoalBindingRequiresAgentError, WorkGoalLaneActiveError, WorkGoalOwnerMismatchError, WorkGoalReassignmentConflictError, WorkGoalRevisionConflictError, WorkGoalTerminalError, WorkLaneClaimConflictError, WorkLaneGoalConflictError, WorkLaneOperationConflictError, WorkProjectionError, WorkPullRequestLinkError, WorkStoreError, WorkTransactionConflictError } from "./errors.js";
 import { validateGoalFamilyHistory } from "./goal-family.js";
 import { agentBindingAdmissionError, workAgentBindingLaneOperationMaxBytes, workAgentBindingLaneOperationMaxRecords, workAgentBindingMaximumSnapshotBytes, workAgentBindingSnapshotEnvelopeMaxBytes, workMaximumSnapshotBytesForHistory } from "./internal/agent-binding-admission.js";
 import { AgentBindingGoalEventRow, AgentBindingLaneOperationRow, agentBindingReadbackError, AgentBindingRow, decodeAgentBindingGoalEvent, decodeAgentBindingRow, laneOperationReadbackError } from "./internal/agent-binding-readback.js";
 import { CoordinatorCommandRow, CoordinatorLifecycleDispatchRow, CoordinatorLifecycleEventRow, coordinatorLifecycleRunningAt, CoordinatorRouteDiscriminatorRow, coordinatorRouteRequiresWorkLink, requireCoordinatorFailedLunaAuthority, requireCoordinatorLifecycleAuthority, requireCoordinatorRouteAuthority, requireCoordinatorRouteBinding } from "./internal/coordinator-authority.js";
 import { currentDecisionHandoffEquivalent, CurrentMetadataWorkLink, decodePreviousDecisionHandoff, previousDecisionHandoffEquivalent, PreviousWorkDecisionHandoff, upgradePreviousDecisionHandoff, workDispatchLineageContainedBy, workDispatchLineageEquivalent } from "./internal/decision-handoff-migration.js";
 import { workHistoryError } from "./internal/history-validation.js";
-import { WorkAdmissionTarget, WorkAgentBinding, WorkAgentBindingRequest, WorkCoordinatorSessionId, WorkDecisionHandoff, WorkDispatchHandoff, WorkExistingGoalRecovery, WorkGoal, WorkGoalCheckpoint, WorkGoalId, WorkGoalReassigned, WorkGoalReassignment, workHistoryMaxEvents, WorkLaneClaim, WorkLaneClaimed, WorkProspectiveAdmission, WorkPullRequestLink, WorkRecoveryTarget, workSnapshotMaxGoals } from "./model.js";
+import { LaneOperationLedgerRow, LaneOperationTotalsRow, planLegacyLaneOperations, resolveLegacyLaneClaim } from "./internal/legacy-lane-claim.js";
+import { enforcesOneHandoffPerSession, SessionIndexDefinition, sessionIndexDefinitionQuery } from "./internal/session-index.js";
+import { goalActivityLimit, terminalCandidates, terminalCheckpoint, withoutBlockers } from "./internal/terminal-reconcile.js";
+import { admissionEvidence, isTerminalWorkState, WorkAdmissionTarget, WorkAgentBinding, WorkAgentBindingRequest, WorkCoordinatorSessionId, WorkDecisionHandoff, WorkDispatchHandoff, WorkExistingGoalRecovery, WorkGoal, WorkGoalAbandoned, WorkGoalAbandonment, WorkGoalCheckpoint, WorkGoalId, WorkGoalReassigned, WorkGoalReassignment, workHistoryMaxEvents, WorkLaneClaim, WorkLaneClaimed, WorkObservationEnvelope, workObservationMaxSkewMillis, WorkObservationSubject, WorkObservedAdmission, WorkObservedFact, workObservedFactMaxBytes, workObservedFactMaxRecords, WorkObservedFailure, WorkProspectiveAdmission, WorkPullRequestLink, workReconcilerHeadroom, WorkRecoveryTarget, workSnapshotMaxGoals } from "./model.js";
+import { asciiLower, canonicalSubject, observationSubject, reconcilerEventPrefix } from "./observed.js";
 const StoredEventRow = Schema.Struct({ record: Schema.String });
 const StoredEventRows = Schema.Array(StoredEventRow);
 const StoredEventWithTransactionRow = Schema.Struct({
@@ -138,544 +142,498 @@ const legacyDecisionEquivalent = Schema.toEquivalence(LegacyDecisionRecord);
 const TransactionId = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(256), Schema.isPattern(/^(?:[^\uD800-\uDFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF])*$/));
 const storeError = (operation) => (cause) => new WorkStoreError({ cause, operation });
 const fromPrivateDatabaseError = (error) => new WorkStoreError({ cause: error.cause, operation: error.operation });
+/**
+ * Files written before the session index was unique carry a plain index under
+ * the same name, which `CREATE UNIQUE INDEX IF NOT EXISTS` leaves in place.
+ * Replace it, failing closed when two handoffs already share a session. Runs
+ * inside `WorkStore.open`'s schema transaction, so a failure leaves the plain
+ * index in place.
+ */
+const requireUniqueSessionIndex = (database) => {
+    const sessionIndex = Schema.decodeUnknownSync(Schema.Array(SessionIndexDefinition))(database.prepare(sessionIndexDefinitionQuery).all())[0];
+    if (sessionIndex === undefined || enforcesOneHandoffPerSession(sessionIndex))
+        return;
+    // NULL sessions never collide under a UNIQUE index, so they are not duplicates.
+    const duplicateGroups = `SELECT session_id AS sessionId, COUNT(*) AS rows, group_concat(handoff_id) AS handoffIds
+    FROM work_decision_handoffs WHERE session_id IS NOT NULL
+    GROUP BY session_id HAVING COUNT(*) > 1`;
+    const duplicates = database.prepare(`${duplicateGroups} LIMIT 10`).all();
+    if (duplicates.length > 0) {
+        const total = database.prepare(`SELECT COUNT(*) AS sessions FROM (${duplicateGroups})`).get();
+        throw new WorkStoreError({ cause: { duplicates, total }, operation: "open.migrate.session-index" });
+    }
+    database.exec(`
+    DROP INDEX work_decision_handoffs_session;
+    CREATE UNIQUE INDEX work_decision_handoffs_session ON work_decision_handoffs (session_id);
+  `);
+};
+/**
+ * Upgrades pre-session Work tables in place. Runs inside `WorkStore.open`'s
+ * schema transaction, so a failure here or in a later schema step leaves the
+ * file as it was.
+ */
 const migrateLegacyAuthorityTables = (database) => {
-    let transaction = false;
-    try {
-        database.exec("BEGIN IMMEDIATE");
-        transaction = true;
-        const columns = (table) => Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare(`PRAGMA table_info(${table})`).all()).map(({ name }) => name);
-        const laneColumns = columns("work_lane_claims");
-        const decisionColumns = columns("work_decision_handoffs");
-        const tables = Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all()).map(({ name }) => name);
-        const coordinatorDispatchColumns = tables.includes("orchestrator_dispatches")
-            ? columns("orchestrator_dispatches")
+    const columns = (table) => Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare(`PRAGMA table_info(${table})`).all()).map(({ name }) => name);
+    const laneColumns = columns("work_lane_claims");
+    const decisionColumns = columns("work_decision_handoffs");
+    const tables = Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all()).map(({ name }) => name);
+    const coordinatorDispatchColumns = tables.includes("orchestrator_dispatches")
+        ? columns("orchestrator_dispatches")
+        : [];
+    const requireBindingCompanions = (binding, operation) => {
+        const laneInput = tables.includes("work_lane_operations")
+            ? database.prepare(`SELECT operation_id AS operationId, lane_id AS laneId, goal_id AS goalId,
+           phase, revision, record
+         FROM work_lane_operations WHERE operation_id = ?`).get(binding.lane.operationId)
+            : undefined;
+        const checkpointInput = tables.includes("work_goal_events")
+            ? database.prepare(`SELECT event_id AS eventId, goal_id AS goalId, occurred_at AS occurredAt, record
+         FROM work_goal_events WHERE event_id = ?`).get(binding.checkpoint.eventId)
+            : undefined;
+        const error = agentBindingReadbackError(binding, laneInput === undefined ? undefined : Schema.decodeUnknownSync(AgentBindingLaneOperationRow)(laneInput), checkpointInput === undefined
+            ? undefined
+            : Schema.decodeUnknownSync(AgentBindingGoalEventRow)(checkpointInput), operation);
+        if (error !== undefined)
+            throw error;
+    };
+    const coordinatorTablesPresent = {
+        dispatch: tables.includes("orchestrator_dispatches"),
+        event: tables.includes("orchestrator_events"),
+        metadata: tables.includes("orchestrator_dispatch_metadata")
+    };
+    const requireCoordinatorSchema = (operation) => {
+        const present = Object.values(coordinatorTablesPresent).filter(Boolean).length;
+        if (present !== 0 && present !== 3) {
+            throw new WorkStoreError({ cause: coordinatorTablesPresent, operation: `${operation}.schema` });
+        }
+        return present === 3;
+    };
+    requireCoordinatorSchema("open.migrate");
+    const readCoordinatorLifecycle = (dispatchRequestId) => ({
+        dispatchRows: Schema.decodeUnknownSync(Schema.Array(CoordinatorLifecycleDispatchRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId,
+         activity_idempotency_key AS activityIdempotencyKey, command,
+         accepted_at AS acceptedAt, status
+       FROM orchestrator_dispatches WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId)),
+        eventRows: Schema.decodeUnknownSync(Schema.Array(CoordinatorLifecycleEventRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, sequence, type,
+         activity_idempotency_key AS activityIdempotencyKey,
+         occurred_at AS occurredAt, detail, result
+       FROM orchestrator_events WHERE dispatch_request_id = ?
+       ORDER BY sequence ASC LIMIT 5`).all(dispatchRequestId))
+    });
+    const routeStorageAuthority = (dispatchRequestId, operation) => {
+        if (!coordinatorDispatchColumns.includes("is_routed")) {
+            return { _tag: "legacy_without_routed_discriminator" };
+        }
+        const rows = Schema.decodeUnknownSync(Schema.Array(CoordinatorRouteDiscriminatorRow))(database.prepare(`SELECT is_routed AS isRouted FROM orchestrator_dispatches
+         WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId));
+        const row = rows[0];
+        if (rows.length !== 1 || row === undefined) {
+            throw new WorkStoreError({ cause: { dispatchRequestId, rows }, operation });
+        }
+        return { _tag: "routed_discriminator", isRouted: row.isRouted };
+    };
+    const requireLinkedParentAuthority = (linkedRequestId, operation) => {
+        if (linkedRequestId === null)
+            return;
+        const metadataRows = Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
+         FROM orchestrator_dispatch_metadata WHERE dispatch_request_id = ? LIMIT 2`).all(linkedRequestId));
+        const metadata = metadataRows[0];
+        if (metadataRows.length !== 1 || metadata === undefined || metadata.workLink !== null) {
+            throw new WorkStoreError({ cause: { linkedRequestId, metadataRows }, operation });
+        }
+        const lifecycle = readCoordinatorLifecycle(linkedRequestId);
+        requireCoordinatorFailedLunaAuthority(lifecycle.dispatchRows, lifecycle.eventRows, metadata.route, routeStorageAuthority(linkedRequestId, operation), operation);
+    };
+    const requireMetadataAuthority = (dispatchRequestId, routeText, lineage, operation) => {
+        const commandRows = Schema.decodeUnknownSync(Schema.Array(CoordinatorCommandRow))(database.prepare(`SELECT activity_idempotency_key AS activityIdempotencyKey, command FROM orchestrator_dispatches
+         WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId));
+        const commandRow = commandRows[0];
+        if (commandRows.length !== 1 || commandRow === undefined) {
+            throw new WorkStoreError({ cause: { commandRows, dispatchRequestId }, operation });
+        }
+        const route = requireCoordinatorRouteAuthority(commandRow.command, commandRow.activityIdempotencyKey, routeText, lineage, routeStorageAuthority(dispatchRequestId, operation), operation);
+        requireLinkedParentAuthority(route.linkedRequestId, `${operation}.parent`);
+    };
+    const requireLifecycleAuthority = (dispatchRequestId, expectedRunningAt, operation) => {
+        if (!requireCoordinatorSchema(operation))
+            return;
+        const lifecycle = readCoordinatorLifecycle(dispatchRequestId);
+        requireCoordinatorLifecycleAuthority(lifecycle.dispatchRows, lifecycle.eventRows, expectedRunningAt, operation);
+    };
+    const requireCurrentAgentBindingAuthority = (dispatchRequestId, handoff, operation) => {
+        const lifecycle = readCoordinatorLifecycle(dispatchRequestId);
+        const runningAt = coordinatorLifecycleRunningAt(lifecycle.dispatchRows, lifecycle.eventRows, `${operation}.lifecycle`);
+        const bindingRows = tables.includes("work_agent_bindings")
+            ? Schema.decodeUnknownSync(Schema.Array(AgentBindingRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, lane_id AS laneId,
+             expected_revision AS expectedRevision, revision, agent_id AS agentId, host, record
+           FROM work_agent_bindings WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId))
             : [];
-        const requireBindingCompanions = (binding, operation) => {
-            const laneInput = tables.includes("work_lane_operations")
-                ? database.prepare(`SELECT operation_id AS operationId, lane_id AS laneId, goal_id AS goalId,
+        if (runningAt === null && bindingRows.length === 0)
+            return;
+        const bindingRow = bindingRows[0];
+        if (runningAt === null || bindingRows.length !== 1 || bindingRow === undefined) {
+            throw new WorkStoreError({ cause: { bindingRows, lifecycle }, operation });
+        }
+        const decoded = decodeAgentBindingRow(bindingRow, { dispatchRequestId, laneId: handoff.laneId }, operation);
+        if (decoded._tag === "invalid")
+            throw decoded.error;
+        if (decoded.binding.request.expectedRevision !== handoff.expectedRevision ||
+            decoded.binding.lane.goalId !== handoff.goalId ||
+            decoded.binding.checkpoint.occurredAt !== runningAt) {
+            throw new WorkStoreError({ cause: { binding: decoded.binding, handoff, runningAt }, operation });
+        }
+        requireBindingCompanions(decoded.binding, operation);
+        const currentLaneRows = Schema.decodeUnknownSync(Schema.Array(LaneRow))(database.prepare(`SELECT lane_id AS laneId, goal_id AS goalId, operation_id AS operationId,
+           phase, revision, record
+         FROM work_lane_claims WHERE lane_id = ? LIMIT 2`).all(decoded.binding.lane.laneId));
+        const currentLaneRow = currentLaneRows[0];
+        if (currentLaneRows.length !== 1 || currentLaneRow === undefined) {
+            throw new WorkStoreError({
+                cause: { binding: decoded.binding, currentLaneRows },
+                operation: `${operation}.lane-revision`
+            });
+        }
+        let currentLane;
+        try {
+            currentLane = Schema.decodeUnknownSync(WorkLaneClaimed)(JSON.parse(currentLaneRow.record));
+        }
+        catch (cause) {
+            throw new WorkStoreError({ cause, operation: `${operation}.lane-revision` });
+        }
+        const currentLaneSchema = laneColumns.includes("goal_id");
+        const currentOperationRows = currentLaneSchema
+            ? Schema.decodeUnknownSync(Schema.Array(AgentBindingLaneOperationRow))(database.prepare(`SELECT operation_id AS operationId, lane_id AS laneId, goal_id AS goalId,
              phase, revision, record
-           FROM work_lane_operations WHERE operation_id = ?`).get(binding.lane.operationId)
-                : undefined;
-            const checkpointInput = tables.includes("work_goal_events")
-                ? database.prepare(`SELECT event_id AS eventId, goal_id AS goalId, occurred_at AS occurredAt, record
-           FROM work_goal_events WHERE event_id = ?`).get(binding.checkpoint.eventId)
-                : undefined;
-            const error = agentBindingReadbackError(binding, laneInput === undefined ? undefined : Schema.decodeUnknownSync(AgentBindingLaneOperationRow)(laneInput), checkpointInput === undefined
-                ? undefined
-                : Schema.decodeUnknownSync(AgentBindingGoalEventRow)(checkpointInput), operation);
-            if (error !== undefined)
-                throw error;
-        };
-        const coordinatorTablesPresent = {
-            dispatch: tables.includes("orchestrator_dispatches"),
-            event: tables.includes("orchestrator_events"),
-            metadata: tables.includes("orchestrator_dispatch_metadata")
-        };
-        const requireCoordinatorSchema = (operation) => {
-            const present = Object.values(coordinatorTablesPresent).filter(Boolean).length;
-            if (present !== 0 && present !== 3) {
-                throw new WorkStoreError({ cause: coordinatorTablesPresent, operation: `${operation}.schema` });
-            }
-            return present === 3;
-        };
-        requireCoordinatorSchema("open.migrate");
-        const readCoordinatorLifecycle = (dispatchRequestId) => ({
-            dispatchRows: Schema.decodeUnknownSync(Schema.Array(CoordinatorLifecycleDispatchRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId,
-           activity_idempotency_key AS activityIdempotencyKey, command,
-           accepted_at AS acceptedAt, status
-         FROM orchestrator_dispatches WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId)),
-            eventRows: Schema.decodeUnknownSync(Schema.Array(CoordinatorLifecycleEventRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, sequence, type,
-           activity_idempotency_key AS activityIdempotencyKey,
-           occurred_at AS occurredAt, detail, result
-         FROM orchestrator_events WHERE dispatch_request_id = ?
-         ORDER BY sequence ASC LIMIT 5`).all(dispatchRequestId))
+           FROM work_lane_operations WHERE operation_id = ? LIMIT 2`).all(currentLane.operationId))
+            : [];
+        const currentOperationError = currentLaneSchema
+            ? laneOperationReadbackError(currentLane, currentOperationRows.length === 1 ? currentOperationRows[0] : undefined, `${operation}.lane-revision`)
+            : undefined;
+        if (currentLane.laneId !== currentLaneRow.laneId ||
+            currentLane.goalId !== currentLaneRow.goalId ||
+            currentLane.operationId !== currentLaneRow.operationId ||
+            currentLane.phase !== currentLaneRow.phase ||
+            currentLane.revision !== currentLaneRow.revision ||
+            currentLane.laneId !== decoded.binding.lane.laneId ||
+            currentLane.goalId !== decoded.binding.lane.goalId ||
+            currentLane.revision < decoded.binding.lane.revision ||
+            (currentLaneSchema && currentLane.revision === decoded.binding.lane.revision &&
+                !Equal.equals(currentLane, decoded.binding.lane)) ||
+            currentOperationError !== undefined) {
+            throw new WorkStoreError({
+                cause: { binding: decoded.binding, currentLane, currentLaneRow, currentOperationError },
+                operation: `${operation}.lane-revision`
+            });
+        }
+    };
+    const dispatches = tables.includes("work_dispatch_handoffs")
+        ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
+           lane_id AS laneId, occurred_at AS occurredAt, lineage, record
+         FROM work_dispatch_handoffs`).all())
+        : [];
+    const decisionIdentities = decisionColumns.length > 0
+        ? Schema.decodeUnknownSync(Schema.Array(DecisionIdentityRow))(database.prepare("SELECT handoff_id AS handoffId FROM work_decision_handoffs").all())
+        : [];
+    const orphanDispatch = dispatches.find(({ handoffId }) => !decisionIdentities.some((decision) => decision.handoffId === handoffId));
+    if (orphanDispatch !== undefined) {
+        throw new WorkStoreError({
+            cause: { decisionIdentities, dispatch: orphanDispatch },
+            operation: "open.migrate.dispatch-decision"
+        });
+    }
+    if (tables.includes("orchestrator_dispatch_metadata")) {
+        const linkedMetadata = Schema.decodeUnknownSync(Schema.Array(MetadataHandoffIdentityRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId,
+           CASE WHEN work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
+           CASE WHEN json_valid(work_link) AND json_type(work_link, '$.handoff.id') = 'text'
+             THEN json_extract(work_link, '$.handoff.id') END AS handoffId,
+           route
+         FROM orchestrator_dispatch_metadata AS metadata
+         WHERE work_link IS NOT NULL OR EXISTS (
+           SELECT 1 FROM orchestrator_dispatch_metadata AS linked
+           WHERE linked.dispatch_request_id = metadata.dispatch_request_id
+             AND linked.work_link IS NOT NULL
+         ) OR (json_valid(route) AND json_extract(route, '$.model') = 'gpt-5.6-sol')
+         LIMIT ${workDecisionMaxRecords + 1}`).all());
+        if (linkedMetadata.length > workDecisionMaxRecords) {
+            throw new WorkStoreError({ cause: linkedMetadata.length, operation: "open.migrate.metadata-capacity" });
+        }
+        const metadataCounts = new Map();
+        const dispatchCounts = new Map();
+        const decisionCounts = new Map();
+        for (const metadata of linkedMetadata) {
+            metadataCounts.set(metadata.dispatchRequestId, (metadataCounts.get(metadata.dispatchRequestId) ?? 0) + 1);
+        }
+        for (const dispatch of dispatches) {
+            const identity = JSON.stringify([dispatch.dispatchRequestId, dispatch.handoffId]);
+            dispatchCounts.set(identity, (dispatchCounts.get(identity) ?? 0) + 1);
+        }
+        for (const decision of decisionIdentities) {
+            decisionCounts.set(decision.handoffId, (decisionCounts.get(decision.handoffId) ?? 0) + 1);
+        }
+        const invalidMetadata = linkedMetadata.find((metadata) => {
+            if (metadata.route === null)
+                return true;
+            const requiresWorkLink = coordinatorRouteRequiresWorkLink(metadata.route, routeStorageAuthority(metadata.dispatchRequestId, "open.migrate.metadata-decision"), "open.migrate.metadata-decision");
+            if (!requiresWorkLink)
+                return metadata.hasWorkLink === 1;
+            const dispatchIdentity = JSON.stringify([metadata.dispatchRequestId, metadata.handoffId]);
+            return (metadata.handoffId === null || metadataCounts.get(metadata.dispatchRequestId) !== 1 ||
+                dispatchCounts.get(dispatchIdentity) !== 1 || decisionCounts.get(metadata.handoffId) !== 1);
         });
-        const routeStorageAuthority = (dispatchRequestId, operation) => {
-            if (!coordinatorDispatchColumns.includes("is_routed")) {
-                return { _tag: "legacy_without_routed_discriminator" };
+        if (invalidMetadata !== undefined) {
+            throw new WorkStoreError({
+                cause: { decisionIdentities, dispatches, linkedMetadata, metadata: invalidMetadata },
+                operation: "open.migrate.metadata-decision"
+            });
+        }
+    }
+    const lanes = laneColumns.length > 0 && !laneColumns.includes("goal_id")
+        ? Schema.decodeUnknownSync(Schema.Array(LegacyLaneStoredRow))(database.prepare("SELECT lane_id AS laneId, revision, record FROM work_lane_claims").all()).map((row) => {
+            const legacy = Schema.decodeUnknownSync(LegacyLaneRecord)(JSON.parse(row.record));
+            if (legacy.laneId !== row.laneId || legacy.revision !== row.revision) {
+                throw new WorkStoreError({ cause: { legacy, row }, operation: "open.migrate.lane-identity" });
             }
-            const rows = Schema.decodeUnknownSync(Schema.Array(CoordinatorRouteDiscriminatorRow))(database.prepare(`SELECT is_routed AS isRouted FROM orchestrator_dispatches
-           WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId));
-            const row = rows[0];
-            if (rows.length !== 1 || row === undefined) {
-                throw new WorkStoreError({ cause: { dispatchRequestId, rows }, operation });
+            return Schema.decodeUnknownSync(WorkLaneClaimed)({
+                ...legacy,
+                goalId: legacy.laneId,
+                operationId: legacy.laneId
+            });
+        })
+        : [];
+    // Lanes the running bindings of legacy handoffs recorded; see resolveLegacyLaneClaim.
+    const bindingLanes = [];
+    const decisions = decisionColumns.length > 0 && !decisionColumns.includes("session_id")
+        ? Schema.decodeUnknownSync(Schema.Array(LegacyDecisionStoredRow))(database.prepare("SELECT handoff_id AS handoffId, record FROM work_decision_handoffs").all()).map((row) => {
+            const legacy = Schema.decodeUnknownSync(LegacyDecisionRecord)(JSON.parse(row.record));
+            if (legacy.id !== row.handoffId) {
+                throw new WorkStoreError({ cause: { legacy, row }, operation: "open.migrate.handoff-identity" });
             }
-            return { _tag: "routed_discriminator", isRouted: row.isRouted };
-        };
-        const requireLinkedParentAuthority = (linkedRequestId, operation) => {
-            if (linkedRequestId === null)
-                return;
-            const metadataRows = Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
-           FROM orchestrator_dispatch_metadata WHERE dispatch_request_id = ? LIMIT 2`).all(linkedRequestId));
-            const metadata = metadataRows[0];
-            if (metadataRows.length !== 1 || metadata === undefined || metadata.workLink !== null) {
-                throw new WorkStoreError({ cause: { linkedRequestId, metadataRows }, operation });
+            const matchingDispatches = dispatches.filter(({ handoffId }) => handoffId === legacy.id);
+            const dispatch = matchingDispatches[0];
+            const lane = lanes.find(({ laneId }) => laneId === legacy.laneId);
+            if (lane === undefined) {
+                throw new WorkStoreError({ cause: legacy, operation: "open.migrate.handoff-lane" });
             }
-            const lifecycle = readCoordinatorLifecycle(linkedRequestId);
-            requireCoordinatorFailedLunaAuthority(lifecycle.dispatchRows, lifecycle.eventRows, metadata.route, routeStorageAuthority(linkedRequestId, operation), operation);
-        };
-        const requireMetadataAuthority = (dispatchRequestId, routeText, lineage, operation) => {
-            const commandRows = Schema.decodeUnknownSync(Schema.Array(CoordinatorCommandRow))(database.prepare(`SELECT activity_idempotency_key AS activityIdempotencyKey, command FROM orchestrator_dispatches
-           WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId));
-            const commandRow = commandRows[0];
-            if (commandRows.length !== 1 || commandRow === undefined) {
-                throw new WorkStoreError({ cause: { commandRows, dispatchRequestId }, operation });
+            const dispatchIds = dispatch === undefined
+                ? []
+                : Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage));
+            if (matchingDispatches.length !== 1 || dispatch === undefined) {
+                throw new WorkStoreError({
+                    cause: { legacy, matchingDispatches },
+                    operation: "open.migrate.legacy-dispatch-cardinality"
+                });
+            }
+            const dispatchHandoff = Schema.decodeUnknownSync(LegacyDecisionRecord)(JSON.parse(dispatch.record));
+            if (dispatch.laneId !== legacy.laneId || dispatch.occurredAt !== legacy.occurredAt ||
+                !legacyDecisionEquivalent(dispatchHandoff, legacy)) {
+                throw new WorkStoreError({
+                    cause: { dispatch, dispatchHandoff, legacy },
+                    operation: "open.migrate.legacy-dispatch-authority"
+                });
+            }
+            if (tables.includes("orchestrator_dispatch_metadata")) {
+                const metadataRows = Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
+           FROM orchestrator_dispatch_metadata WHERE dispatch_request_id = ? LIMIT 2`).all(dispatch.dispatchRequestId));
+                const metadata = metadataRows[0];
+                if (metadataRows.length !== 1 || metadata === undefined) {
+                    throw new WorkStoreError({
+                        cause: { dispatch, metadataRows },
+                        operation: "open.migrate.legacy-metadata-authority"
+                    });
+                }
+                if (metadata.workLink === null) {
+                    throw new WorkStoreError({
+                        cause: { dispatch, metadata },
+                        operation: "open.migrate.legacy-metadata-authority"
+                    });
+                }
+                const workLink = Schema.decodeUnknownSync(LegacyMetadataWorkLink)(JSON.parse(metadata.workLink));
+                requireMetadataAuthority(dispatch.dispatchRequestId, metadata.route, workLink.lineage, "open.migrate.legacy-metadata-authority");
+                if (!legacyDecisionEquivalent(workLink.handoff, legacy) ||
+                    !workDispatchLineageEquivalent(workLink.lineage, dispatchIds)) {
+                    throw new WorkStoreError({
+                        cause: { legacy, workLink },
+                        operation: "open.migrate.legacy-metadata-authority"
+                    });
+                }
             }
-            const route = requireCoordinatorRouteAuthority(commandRow.command, commandRow.activityIdempotencyKey, routeText, lineage, routeStorageAuthority(dispatchRequestId, operation), operation);
-            requireLinkedParentAuthority(route.linkedRequestId, `${operation}.parent`);
-        };
-        const requireLifecycleAuthority = (dispatchRequestId, expectedRunningAt, operation) => {
-            if (!requireCoordinatorSchema(operation))
-                return;
-            const lifecycle = readCoordinatorLifecycle(dispatchRequestId);
-            requireCoordinatorLifecycleAuthority(lifecycle.dispatchRows, lifecycle.eventRows, expectedRunningAt, operation);
-        };
-        const requireCurrentAgentBindingAuthority = (dispatchRequestId, handoff, operation) => {
-            const lifecycle = readCoordinatorLifecycle(dispatchRequestId);
-            const runningAt = coordinatorLifecycleRunningAt(lifecycle.dispatchRows, lifecycle.eventRows, `${operation}.lifecycle`);
             const bindingRows = tables.includes("work_agent_bindings")
                 ? Schema.decodeUnknownSync(Schema.Array(AgentBindingRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, lane_id AS laneId,
                expected_revision AS expectedRevision, revision, agent_id AS agentId, host, record
-             FROM work_agent_bindings WHERE dispatch_request_id = ? LIMIT 2`).all(dispatchRequestId))
+             FROM work_agent_bindings
+             WHERE dispatch_request_id = ?`).all(dispatch.dispatchRequestId))
                 : [];
-            if (runningAt === null && bindingRows.length === 0)
-                return;
             const bindingRow = bindingRows[0];
-            if (runningAt === null || bindingRows.length !== 1 || bindingRow === undefined) {
-                throw new WorkStoreError({ cause: { bindingRows, lifecycle }, operation });
-            }
-            const decoded = decodeAgentBindingRow(bindingRow, { dispatchRequestId, laneId: handoff.laneId }, operation);
-            if (decoded._tag === "invalid")
-                throw decoded.error;
-            if (decoded.binding.request.expectedRevision !== handoff.expectedRevision ||
-                decoded.binding.lane.goalId !== handoff.goalId ||
-                decoded.binding.checkpoint.occurredAt !== runningAt) {
-                throw new WorkStoreError({ cause: { binding: decoded.binding, handoff, runningAt }, operation });
-            }
-            requireBindingCompanions(decoded.binding, operation);
-            const currentLaneRows = Schema.decodeUnknownSync(Schema.Array(LaneRow))(database.prepare(`SELECT lane_id AS laneId, goal_id AS goalId, operation_id AS operationId,
-             phase, revision, record
-           FROM work_lane_claims WHERE lane_id = ? LIMIT 2`).all(decoded.binding.lane.laneId));
-            const currentLaneRow = currentLaneRows[0];
-            if (currentLaneRows.length !== 1 || currentLaneRow === undefined) {
+            if (bindingRows.length !== 1 || bindingRow === undefined) {
                 throw new WorkStoreError({
-                    cause: { binding: decoded.binding, currentLaneRows },
-                    operation: `${operation}.lane-revision`
+                    cause: { bindingRows, dispatch, legacy },
+                    operation: "open.migrate.legacy-handoff-revision"
                 });
             }
-            let currentLane;
-            try {
-                currentLane = Schema.decodeUnknownSync(WorkLaneClaimed)(JSON.parse(currentLaneRow.record));
-            }
-            catch (cause) {
-                throw new WorkStoreError({ cause, operation: `${operation}.lane-revision` });
+            const bindingDecision = decodeAgentBindingRow(bindingRow, { dispatchRequestId: dispatch.dispatchRequestId, laneId: legacy.laneId }, "open.migrate.legacy-agent-binding");
+            if (bindingDecision._tag === "invalid")
+                throw bindingDecision.error;
+            if (bindingDecision.binding.lane.goalId !== legacy.goalId) {
+                throw new WorkStoreError({
+                    cause: { binding: bindingDecision.binding, legacy },
+                    operation: "open.migrate.legacy-agent-binding.goal"
+                });
             }
-            const currentLaneSchema = laneColumns.includes("goal_id");
-            const currentOperationRows = currentLaneSchema
-                ? Schema.decodeUnknownSync(Schema.Array(AgentBindingLaneOperationRow))(database.prepare(`SELECT operation_id AS operationId, lane_id AS laneId, goal_id AS goalId,
-               phase, revision, record
-             FROM work_lane_operations WHERE operation_id = ? LIMIT 2`).all(currentLane.operationId))
-                : [];
-            const currentOperationError = currentLaneSchema
-                ? laneOperationReadbackError(currentLane, currentOperationRows.length === 1 ? currentOperationRows[0] : undefined, `${operation}.lane-revision`)
-                : undefined;
-            if (currentLane.laneId !== currentLaneRow.laneId ||
-                currentLane.goalId !== currentLaneRow.goalId ||
-                currentLane.operationId !== currentLaneRow.operationId ||
-                currentLane.phase !== currentLaneRow.phase ||
-                currentLane.revision !== currentLaneRow.revision ||
-                currentLane.laneId !== decoded.binding.lane.laneId ||
-                currentLane.goalId !== decoded.binding.lane.goalId ||
-                currentLane.revision < decoded.binding.lane.revision ||
-                (currentLaneSchema && currentLane.revision === decoded.binding.lane.revision &&
-                    !Equal.equals(currentLane, decoded.binding.lane)) ||
-                currentOperationError !== undefined) {
+            if (lane.revision < bindingDecision.binding.lane.revision) {
                 throw new WorkStoreError({
-                    cause: { binding: decoded.binding, currentLane, currentLaneRow, currentOperationError },
-                    operation: `${operation}.lane-revision`
+                    cause: { binding: bindingDecision.binding, lane, legacy },
+                    operation: "open.migrate.legacy-handoff-lane-revision"
                 });
             }
-        };
-        const dispatches = tables.includes("work_dispatch_handoffs")
-            ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
-             lane_id AS laneId, occurred_at AS occurredAt, lineage, record
-           FROM work_dispatch_handoffs`).all())
-            : [];
-        const decisionIdentities = decisionColumns.length > 0
-            ? Schema.decodeUnknownSync(Schema.Array(DecisionIdentityRow))(database.prepare("SELECT handoff_id AS handoffId FROM work_decision_handoffs").all())
-            : [];
-        const orphanDispatch = dispatches.find(({ handoffId }) => !decisionIdentities.some((decision) => decision.handoffId === handoffId));
-        if (orphanDispatch !== undefined) {
-            throw new WorkStoreError({
-                cause: { decisionIdentities, dispatch: orphanDispatch },
-                operation: "open.migrate.dispatch-decision"
+            bindingLanes.push(bindingDecision.binding.lane);
+            requireBindingCompanions(bindingDecision.binding, "open.migrate.legacy-agent-binding");
+            requireLifecycleAuthority(bindingDecision.binding.request.dispatchRequestId, bindingDecision.binding.checkpoint.occurredAt, "open.migrate.legacy-agent-binding.lifecycle");
+            return Schema.decodeUnknownSync(WorkDecisionHandoff)({
+                ...legacy,
+                contextDelta: legacy.summary,
+                expectedRevision: bindingDecision.binding.request.expectedRevision,
+                sessionId: legacy.id,
+                dispatchIds,
+                blockers: [],
+                evidenceRefs: [],
+                version: "herdr.work.decision.v2"
             });
+        })
+        : [];
+    const migratedClaims = lanes.map((lane) => resolveLegacyLaneClaim(lane, bindingLanes));
+    if (laneColumns.length > 0 && !laneColumns.includes("goal_id")) {
+        database.exec("ALTER TABLE work_lane_claims ADD COLUMN goal_id TEXT");
+        database.exec("ALTER TABLE work_lane_claims ADD COLUMN operation_id TEXT");
+        database.exec("ALTER TABLE work_lane_claims ADD COLUMN phase TEXT");
+        const update = database.prepare("UPDATE work_lane_claims SET goal_id = ?, operation_id = ?, phase = ?, record = ? WHERE lane_id = ?");
+        // An existing lane-operation ledger is not backfilled later, so record each
+        // migrated claim's operation here; the claim's readback requires it.
+        // Without a ledger, schema creation below creates it and backfills every
+        // claim, so the same bound applies to an empty ledger.
+        const hasLedger = tables.includes("work_lane_operations");
+        const operations = planLegacyLaneOperations(migratedClaims.map(({ lane }) => lane), new Map(hasLedger
+            ? migratedClaims.flatMap(({ lane }) => {
+                const matches = database.prepare(`SELECT operation_id AS operationId, lane_id AS laneId, goal_id AS goalId, phase, revision, record
+               FROM work_lane_operations WHERE CAST(operation_id AS TEXT) = ?`).all(lane.operationId);
+                const rows = Schema.decodeUnknownSync(Schema.Array(LaneOperationLedgerRow))(matches);
+                // A key stored as a blob, or twice, is a collision even when its bytes match.
+                const found = rows.find(({ operationId }) => operationId !== lane.operationId) ?? rows[0];
+                return found === undefined ? [] : [[lane.operationId, found]];
+            })
+            : []), hasLedger
+            ? Schema.decodeUnknownSync(LaneOperationTotalsRow)(database.prepare(`SELECT COUNT(*) AS count, COALESCE(SUM(
+               length(CAST(operation_id AS BLOB)) + length(CAST(record AS BLOB))), 0) AS bytes
+             FROM work_lane_operations`).get())
+            : { bytes: 0, count: 0 }, { bytes: workLaneOperationMaxBytes, records: workLaneOperationMaxRecords });
+        if (operations._tag === "collision") {
+            throw new WorkStoreError({ cause: operations, operation: "open.migrate.lane-operation-collision" });
         }
-        if (tables.includes("orchestrator_dispatch_metadata")) {
-            const linkedMetadata = Schema.decodeUnknownSync(Schema.Array(MetadataHandoffIdentityRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId,
-             CASE WHEN work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
-             CASE WHEN json_valid(work_link) AND json_type(work_link, '$.handoff.id') = 'text'
-               THEN json_extract(work_link, '$.handoff.id') END AS handoffId,
-             route
-           FROM orchestrator_dispatch_metadata AS metadata
-           WHERE work_link IS NOT NULL OR EXISTS (
-             SELECT 1 FROM orchestrator_dispatch_metadata AS linked
-             WHERE linked.dispatch_request_id = metadata.dispatch_request_id
-               AND linked.work_link IS NOT NULL
-           ) OR (json_valid(route) AND json_extract(route, '$.model') = 'gpt-5.6-sol')
-           LIMIT ${workDecisionMaxRecords + 1}`).all());
-            if (linkedMetadata.length > workDecisionMaxRecords) {
-                throw new WorkStoreError({ cause: linkedMetadata.length, operation: "open.migrate.metadata-capacity" });
-            }
-            const metadataCounts = new Map();
-            const dispatchCounts = new Map();
-            const decisionCounts = new Map();
-            for (const metadata of linkedMetadata) {
-                metadataCounts.set(metadata.dispatchRequestId, (metadataCounts.get(metadata.dispatchRequestId) ?? 0) + 1);
+        if (operations._tag === "capacity") {
+            throw new WorkStoreError({ cause: operations, operation: "open.migrate.lane-operation-capacity" });
+        }
+        for (const { lane } of migratedClaims) {
+            update.run(lane.goalId, lane.operationId, lane.phase, JSON.stringify(lane), lane.laneId);
+        }
+        if (hasLedger && operations.inserts.length > 0) {
+            const recordOperation = database.prepare(`INSERT INTO work_lane_operations
+           (operation_id, lane_id, goal_id, phase, revision, record) VALUES (?, ?, ?, ?, ?, ?)`);
+            for (const lane of operations.inserts) {
+                recordOperation.run(lane.operationId, lane.laneId, lane.goalId, lane.phase, lane.revision, JSON.stringify(lane));
             }
+        }
+    }
+    if (decisionColumns.length > 0 && !decisionColumns.includes("session_id")) {
+        database.exec("ALTER TABLE work_decision_handoffs ADD COLUMN session_id TEXT");
+        const update = database.prepare("UPDATE work_decision_handoffs SET session_id = ?, record = ? WHERE handoff_id = ?");
+        for (const decision of decisions)
+            update.run(decision.sessionId, JSON.stringify(decision), decision.id);
+        if (dispatches.length > 0) {
+            const updateDispatch = database.prepare("UPDATE work_dispatch_handoffs SET record = ? WHERE dispatch_request_id = ?");
+            const updateMetadata = tables.includes("orchestrator_dispatch_metadata")
+                ? database.prepare("UPDATE orchestrator_dispatch_metadata SET work_link = ? WHERE dispatch_request_id = ?")
+                : null;
             for (const dispatch of dispatches) {
-                const identity = JSON.stringify([dispatch.dispatchRequestId, dispatch.handoffId]);
-                dispatchCounts.set(identity, (dispatchCounts.get(identity) ?? 0) + 1);
-            }
-            for (const decision of decisionIdentities) {
-                decisionCounts.set(decision.handoffId, (decisionCounts.get(decision.handoffId) ?? 0) + 1);
-            }
-            const invalidMetadata = linkedMetadata.find((metadata) => {
-                if (metadata.route === null)
-                    return true;
-                const requiresWorkLink = coordinatorRouteRequiresWorkLink(metadata.route, routeStorageAuthority(metadata.dispatchRequestId, "open.migrate.metadata-decision"), "open.migrate.metadata-decision");
-                if (!requiresWorkLink)
-                    return metadata.hasWorkLink === 1;
-                const dispatchIdentity = JSON.stringify([metadata.dispatchRequestId, metadata.handoffId]);
-                return (metadata.handoffId === null || metadataCounts.get(metadata.dispatchRequestId) !== 1 ||
-                    dispatchCounts.get(dispatchIdentity) !== 1 || decisionCounts.get(metadata.handoffId) !== 1);
-            });
-            if (invalidMetadata !== undefined) {
-                throw new WorkStoreError({
-                    cause: { decisionIdentities, dispatches, linkedMetadata, metadata: invalidMetadata },
-                    operation: "open.migrate.metadata-decision"
-                });
+                const decision = decisions.find(({ id }) => id === dispatch.handoffId);
+                if (decision === undefined)
+                    continue;
+                updateDispatch.run(JSON.stringify(decision), dispatch.dispatchRequestId);
+                updateMetadata?.run(JSON.stringify({ handoff: decision, lineage: decision.dispatchIds }), dispatch.dispatchRequestId);
             }
         }
-        const lanes = laneColumns.length > 0 && !laneColumns.includes("goal_id")
-            ? Schema.decodeUnknownSync(Schema.Array(LegacyLaneStoredRow))(database.prepare("SELECT lane_id AS laneId, revision, record FROM work_lane_claims").all()).map((row) => {
-                const legacy = Schema.decodeUnknownSync(LegacyLaneRecord)(JSON.parse(row.record));
-                if (legacy.laneId !== row.laneId || legacy.revision !== row.revision) {
-                    throw new WorkStoreError({ cause: { legacy, row }, operation: "open.migrate.lane-identity" });
-                }
-                return Schema.decodeUnknownSync(WorkLaneClaimed)({
-                    ...legacy,
-                    goalId: legacy.laneId,
-                    operationId: legacy.laneId
-                });
-            })
-            : [];
-        const decisions = decisionColumns.length > 0 && !decisionColumns.includes("session_id")
-            ? Schema.decodeUnknownSync(Schema.Array(LegacyDecisionStoredRow))(database.prepare("SELECT handoff_id AS handoffId, record FROM work_decision_handoffs").all()).map((row) => {
-                const legacy = Schema.decodeUnknownSync(LegacyDecisionRecord)(JSON.parse(row.record));
-                if (legacy.id !== row.handoffId) {
-                    throw new WorkStoreError({ cause: { legacy, row }, operation: "open.migrate.handoff-identity" });
-                }
-                const matchingDispatches = dispatches.filter(({ handoffId }) => handoffId === legacy.id);
-                const dispatch = matchingDispatches[0];
-                const lane = lanes.find(({ laneId }) => laneId === legacy.laneId);
-                if (lane === undefined) {
-                    throw new WorkStoreError({ cause: legacy, operation: "open.migrate.handoff-lane" });
-                }
-                const dispatchIds = dispatch === undefined
-                    ? []
-                    : Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage));
-                if (matchingDispatches.length !== 1 || dispatch === undefined) {
-                    throw new WorkStoreError({
-                        cause: { legacy, matchingDispatches },
-                        operation: "open.migrate.legacy-dispatch-cardinality"
-                    });
-                }
-                const dispatchHandoff = Schema.decodeUnknownSync(LegacyDecisionRecord)(JSON.parse(dispatch.record));
-                if (dispatch.laneId !== legacy.laneId || dispatch.occurredAt !== legacy.occurredAt ||
-                    !legacyDecisionEquivalent(dispatchHandoff, legacy)) {
-                    throw new WorkStoreError({
-                        cause: { dispatch, dispatchHandoff, legacy },
-                        operation: "open.migrate.legacy-dispatch-authority"
-                    });
-                }
-                if (tables.includes("orchestrator_dispatch_metadata")) {
-                    const metadataRows = Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
-             FROM orchestrator_dispatch_metadata WHERE dispatch_request_id = ? LIMIT 2`).all(dispatch.dispatchRequestId));
-                    const metadata = metadataRows[0];
-                    if (metadataRows.length !== 1 || metadata === undefined) {
+    }
+    if (decisionColumns.length > 0) {
+        const storedDecisions = Schema.decodeUnknownSync(Schema.Array(DecisionRow))(database.prepare(`SELECT handoff_id AS handoffId, session_id AS sessionId, lane_id AS laneId,
+           occurred_at AS occurredAt, record
+         FROM work_decision_handoffs`).all());
+        const updateDecision = database.prepare("UPDATE work_decision_handoffs SET record = ? WHERE handoff_id = ?");
+        const updateDispatch = tables.includes("work_dispatch_handoffs")
+            ? database.prepare("UPDATE work_dispatch_handoffs SET record = ? WHERE handoff_id = ?")
+            : null;
+        const updateMetadata = tables.includes("orchestrator_dispatch_metadata")
+            ? database.prepare(`UPDATE orchestrator_dispatch_metadata SET work_link = ?
+         WHERE dispatch_request_id = ?`)
+            : null;
+        const previousDecisions = storedDecisions.flatMap((row) => {
+            const input = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Json))(row.record);
+            const previous = decodePreviousDecisionHandoff(input);
+            const handoffDispatches = tables.includes("work_dispatch_handoffs")
+                ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
+               lane_id AS laneId, occurred_at AS occurredAt, lineage, record
+             FROM work_dispatch_handoffs WHERE handoff_id = ?`).all(row.handoffId))
+                : [];
+            switch (previous._tag) {
+                case "current": {
+                    if (previous.value.id !== row.handoffId || previous.value.sessionId !== row.sessionId ||
+                        previous.value.laneId !== row.laneId || previous.value.occurredAt !== row.occurredAt) {
                         throw new WorkStoreError({
-                            cause: { dispatch, metadataRows },
-                            operation: "open.migrate.legacy-metadata-authority"
+                            cause: { handoff: previous.value, row },
+                            operation: "open.migrate.handoff-identity"
                         });
                     }
-                    if (metadata.workLink === null) {
+                    if (handoffDispatches.length > 1) {
                         throw new WorkStoreError({
-                            cause: { dispatch, metadata },
-                            operation: "open.migrate.legacy-metadata-authority"
+                            cause: { handoffDispatches, row },
+                            operation: "open.migrate.dispatch-cardinality"
                         });
                     }
-                    const workLink = Schema.decodeUnknownSync(LegacyMetadataWorkLink)(JSON.parse(metadata.workLink));
-                    requireMetadataAuthority(dispatch.dispatchRequestId, metadata.route, workLink.lineage, "open.migrate.legacy-metadata-authority");
-                    if (!legacyDecisionEquivalent(workLink.handoff, legacy) ||
-                        !workDispatchLineageEquivalent(workLink.lineage, dispatchIds)) {
+                    const linkedMetadata = tables.includes("orchestrator_dispatch_metadata")
+                        ? Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
+                 FROM orchestrator_dispatch_metadata
+                 WHERE work_link IS NOT NULL
+                   AND CASE WHEN json_valid(work_link)
+                     THEN json_extract(work_link, '$.handoff.id') END = ?`).all(row.handoffId))
+                        : [];
+                    if (tables.includes("orchestrator_dispatch_metadata") &&
+                        (linkedMetadata.length !== handoffDispatches.length ||
+                            linkedMetadata.some((metadata) => !handoffDispatches.some(({ dispatchRequestId }) => dispatchRequestId === metadata.dispatchRequestId)))) {
                         throw new WorkStoreError({
-                            cause: { legacy, workLink },
-                            operation: "open.migrate.legacy-metadata-authority"
+                            cause: { handoffDispatches, linkedMetadata, row },
+                            operation: "open.migrate.metadata-authority"
                         });
                     }
-                }
-                const bindingRows = tables.includes("work_agent_bindings")
-                    ? Schema.decodeUnknownSync(Schema.Array(AgentBindingRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, lane_id AS laneId,
-                 expected_revision AS expectedRevision, revision, agent_id AS agentId, host, record
-               FROM work_agent_bindings
-               WHERE dispatch_request_id = ?`).all(dispatch.dispatchRequestId))
-                    : [];
-                const bindingRow = bindingRows[0];
-                if (bindingRows.length !== 1 || bindingRow === undefined) {
-                    throw new WorkStoreError({
-                        cause: { bindingRows, dispatch, legacy },
-                        operation: "open.migrate.legacy-handoff-revision"
-                    });
-                }
-                const bindingDecision = decodeAgentBindingRow(bindingRow, { dispatchRequestId: dispatch.dispatchRequestId, laneId: legacy.laneId }, "open.migrate.legacy-agent-binding");
-                if (bindingDecision._tag === "invalid")
-                    throw bindingDecision.error;
-                if (bindingDecision.binding.lane.goalId !== legacy.goalId) {
-                    throw new WorkStoreError({
-                        cause: { binding: bindingDecision.binding, legacy },
-                        operation: "open.migrate.legacy-agent-binding.goal"
-                    });
-                }
-                if (lane.revision < bindingDecision.binding.lane.revision) {
-                    throw new WorkStoreError({
-                        cause: { binding: bindingDecision.binding, lane, legacy },
-                        operation: "open.migrate.legacy-handoff-lane-revision"
-                    });
-                }
-                requireBindingCompanions(bindingDecision.binding, "open.migrate.legacy-agent-binding");
-                requireLifecycleAuthority(bindingDecision.binding.request.dispatchRequestId, bindingDecision.binding.checkpoint.occurredAt, "open.migrate.legacy-agent-binding.lifecycle");
-                return Schema.decodeUnknownSync(WorkDecisionHandoff)({
-                    ...legacy,
-                    contextDelta: legacy.summary,
-                    expectedRevision: bindingDecision.binding.request.expectedRevision,
-                    sessionId: legacy.id,
-                    dispatchIds,
-                    blockers: [],
-                    evidenceRefs: [],
-                    version: "herdr.work.decision.v2"
-                });
-            })
-            : [];
-        if (laneColumns.length > 0 && !laneColumns.includes("goal_id")) {
-            database.exec("ALTER TABLE work_lane_claims ADD COLUMN goal_id TEXT");
-            database.exec("ALTER TABLE work_lane_claims ADD COLUMN operation_id TEXT");
-            database.exec("ALTER TABLE work_lane_claims ADD COLUMN phase TEXT");
-            const update = database.prepare("UPDATE work_lane_claims SET goal_id = ?, operation_id = ?, phase = ?, record = ? WHERE lane_id = ?");
-            for (const lane of lanes)
-                update.run(lane.goalId, lane.operationId, lane.phase, JSON.stringify(lane), lane.laneId);
-        }
-        if (decisionColumns.length > 0 && !decisionColumns.includes("session_id")) {
-            database.exec("ALTER TABLE work_decision_handoffs ADD COLUMN session_id TEXT");
-            const update = database.prepare("UPDATE work_decision_handoffs SET session_id = ?, record = ? WHERE handoff_id = ?");
-            for (const decision of decisions)
-                update.run(decision.sessionId, JSON.stringify(decision), decision.id);
-            if (dispatches.length > 0) {
-                const updateDispatch = database.prepare("UPDATE work_dispatch_handoffs SET record = ? WHERE dispatch_request_id = ?");
-                const updateMetadata = tables.includes("orchestrator_dispatch_metadata")
-                    ? database.prepare("UPDATE orchestrator_dispatch_metadata SET work_link = ? WHERE dispatch_request_id = ?")
-                    : null;
-                for (const dispatch of dispatches) {
-                    const decision = decisions.find(({ id }) => id === dispatch.handoffId);
-                    if (decision === undefined)
-                        continue;
-                    updateDispatch.run(JSON.stringify(decision), dispatch.dispatchRequestId);
-                    updateMetadata?.run(JSON.stringify({ handoff: decision, lineage: decision.dispatchIds }), dispatch.dispatchRequestId);
-                }
-            }
-        }
-        if (decisionColumns.length > 0) {
-            const storedDecisions = Schema.decodeUnknownSync(Schema.Array(DecisionRow))(database.prepare(`SELECT handoff_id AS handoffId, session_id AS sessionId, lane_id AS laneId,
-             occurred_at AS occurredAt, record
-           FROM work_decision_handoffs`).all());
-            const updateDecision = database.prepare("UPDATE work_decision_handoffs SET record = ? WHERE handoff_id = ?");
-            const updateDispatch = tables.includes("work_dispatch_handoffs")
-                ? database.prepare("UPDATE work_dispatch_handoffs SET record = ? WHERE handoff_id = ?")
-                : null;
-            const updateMetadata = tables.includes("orchestrator_dispatch_metadata")
-                ? database.prepare(`UPDATE orchestrator_dispatch_metadata SET work_link = ?
-           WHERE dispatch_request_id = ?`)
-                : null;
-            const previousDecisions = storedDecisions.flatMap((row) => {
-                const input = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Json))(row.record);
-                const previous = decodePreviousDecisionHandoff(input);
-                const handoffDispatches = tables.includes("work_dispatch_handoffs")
-                    ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
-                 lane_id AS laneId, occurred_at AS occurredAt, lineage, record
-               FROM work_dispatch_handoffs WHERE handoff_id = ?`).all(row.handoffId))
-                    : [];
-                switch (previous._tag) {
-                    case "current": {
-                        if (previous.value.id !== row.handoffId || previous.value.sessionId !== row.sessionId ||
-                            previous.value.laneId !== row.laneId || previous.value.occurredAt !== row.occurredAt) {
-                            throw new WorkStoreError({
-                                cause: { handoff: previous.value, row },
-                                operation: "open.migrate.handoff-identity"
-                            });
-                        }
-                        if (handoffDispatches.length > 1) {
-                            throw new WorkStoreError({
-                                cause: { handoffDispatches, row },
-                                operation: "open.migrate.dispatch-cardinality"
-                            });
-                        }
-                        const linkedMetadata = tables.includes("orchestrator_dispatch_metadata")
-                            ? Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
-                   FROM orchestrator_dispatch_metadata
-                   WHERE work_link IS NOT NULL
-                     AND CASE WHEN json_valid(work_link)
-                       THEN json_extract(work_link, '$.handoff.id') END = ?`).all(row.handoffId))
-                            : [];
-                        if (tables.includes("orchestrator_dispatch_metadata") &&
-                            (linkedMetadata.length !== handoffDispatches.length ||
-                                linkedMetadata.some((metadata) => !handoffDispatches.some(({ dispatchRequestId }) => dispatchRequestId === metadata.dispatchRequestId)))) {
-                            throw new WorkStoreError({
-                                cause: { handoffDispatches, linkedMetadata, row },
-                                operation: "open.migrate.metadata-authority"
-                            });
-                        }
-                        for (const dispatch of handoffDispatches) {
-                            const dispatchAuthority = (() => {
-                                try {
-                                    return {
-                                        handoff: Schema.decodeUnknownSync(WorkDecisionHandoff)(JSON.parse(dispatch.record)),
-                                        lineage: Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage))
-                                    };
-                                }
-                                catch (cause) {
-                                    throw new WorkStoreError({ cause, operation: "open.migrate.decode-dispatch-authority" });
-                                }
-                            })();
-                            if (dispatch.laneId !== previous.value.laneId ||
-                                dispatch.occurredAt !== previous.value.occurredAt ||
-                                !currentDecisionHandoffEquivalent(dispatchAuthority.handoff, previous.value) ||
-                                !workDispatchLineageContainedBy(dispatchAuthority.lineage, previous.value.dispatchIds)) {
-                                throw new WorkStoreError({
-                                    cause: { dispatch, dispatchAuthority, handoff: previous.value },
-                                    operation: "open.migrate.dispatch-authority"
-                                });
+                    for (const dispatch of handoffDispatches) {
+                        const dispatchAuthority = (() => {
+                            try {
+                                return {
+                                    handoff: Schema.decodeUnknownSync(WorkDecisionHandoff)(JSON.parse(dispatch.record)),
+                                    lineage: Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage))
+                                };
                             }
-                            if (!tables.includes("orchestrator_dispatch_metadata"))
-                                continue;
-                            const metadata = linkedMetadata.find(({ dispatchRequestId }) => dispatchRequestId === dispatch.dispatchRequestId);
-                            if (metadata?.workLink === null || metadata?.workLink === undefined) {
-                                throw new WorkStoreError({
-                                    cause: { dispatch, metadata },
-                                    operation: "open.migrate.metadata-authority"
-                                });
+                            catch (cause) {
+                                throw new WorkStoreError({ cause, operation: "open.migrate.decode-dispatch-authority" });
                             }
-                            const workLink = (() => {
-                                try {
-                                    return Schema.decodeUnknownSync(CurrentMetadataWorkLink)(JSON.parse(metadata.workLink));
-                                }
-                                catch (cause) {
-                                    throw new WorkStoreError({ cause, operation: "open.migrate.decode-metadata-authority" });
-                                }
-                            })();
-                            requireMetadataAuthority(dispatch.dispatchRequestId, metadata.route, workLink.lineage, "open.migrate.metadata-authority");
-                            if (!currentDecisionHandoffEquivalent(workLink.handoff, previous.value) ||
-                                !workDispatchLineageEquivalent(workLink.lineage, dispatchAuthority.lineage)) {
-                                throw new WorkStoreError({
-                                    cause: { handoff: previous.value, workLink },
-                                    operation: "open.migrate.metadata-authority"
-                                });
-                            }
-                            requireCurrentAgentBindingAuthority(dispatch.dispatchRequestId, previous.value, "open.migrate.current-agent-binding");
+                        })();
+                        if (dispatch.laneId !== previous.value.laneId ||
+                            dispatch.occurredAt !== previous.value.occurredAt ||
+                            !currentDecisionHandoffEquivalent(dispatchAuthority.handoff, previous.value) ||
+                            !workDispatchLineageContainedBy(dispatchAuthority.lineage, previous.value.dispatchIds)) {
+                            throw new WorkStoreError({
+                                cause: { dispatch, dispatchAuthority, handoff: previous.value },
+                                operation: "open.migrate.dispatch-authority"
+                            });
                         }
-                        return [];
-                    }
-                    case "invalid":
-                        throw new WorkStoreError({
-                            cause: previous.cause,
-                            operation: "open.migrate.invalid-handoff"
-                        });
-                    case "previous":
-                        return [{ previous: previous.value, row }];
-                }
-            });
-            for (const { previous, row } of previousDecisions) {
-                const laneRevision = Schema.decodeUnknownSync(LaneRevisionRow)(database.prepare("SELECT revision FROM work_lane_claims WHERE lane_id = ?").get(row.laneId));
-                const handoffDispatches = tables.includes("work_dispatch_handoffs")
-                    ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
-                 lane_id AS laneId, occurred_at AS occurredAt, lineage, record
-               FROM work_dispatch_handoffs WHERE handoff_id = ?`).all(row.handoffId))
-                    : [];
-                if (handoffDispatches.length > 1) {
-                    throw new WorkStoreError({
-                        cause: { handoffDispatches, row },
-                        operation: "open.migrate.dispatch-cardinality"
-                    });
-                }
-                const linkedMetadata = tables.includes("orchestrator_dispatch_metadata")
-                    ? Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
-               FROM orchestrator_dispatch_metadata
-               WHERE work_link IS NOT NULL
-                 AND CASE WHEN json_valid(work_link)
-                   THEN json_extract(work_link, '$.handoff.id') END = ?`).all(row.handoffId))
-                    : [];
-                if (tables.includes("orchestrator_dispatch_metadata") &&
-                    (linkedMetadata.length !== handoffDispatches.length ||
-                        linkedMetadata.some((metadata) => !handoffDispatches.some(({ dispatchRequestId }) => dispatchRequestId === metadata.dispatchRequestId)))) {
-                    throw new WorkStoreError({
-                        cause: { handoffDispatches, linkedMetadata, row },
-                        operation: "open.migrate.metadata-authority"
-                    });
-                }
-                const bindingRows = tables.includes("work_agent_bindings") && tables.includes("work_dispatch_handoffs")
-                    ? Schema.decodeUnknownSync(Schema.Array(AgentBindingRow))(database.prepare(`SELECT binding.dispatch_request_id AS dispatchRequestId, binding.lane_id AS laneId,
-                 binding.expected_revision AS expectedRevision, binding.revision,
-                 binding.agent_id AS agentId, binding.host, binding.record
-               FROM work_agent_bindings binding
-               JOIN work_dispatch_handoffs dispatch
-                 ON dispatch.dispatch_request_id = binding.dispatch_request_id
-               WHERE dispatch.handoff_id = ?`).all(row.handoffId))
-                    : [];
-                const bindingRow = bindingRows[0];
-                const handoffDispatch = bindingRow === undefined
-                    ? undefined
-                    : handoffDispatches.find(({ dispatchRequestId }) => dispatchRequestId === bindingRow.dispatchRequestId);
-                if (bindingRows.length !== 1 || bindingRow === undefined || handoffDispatch === undefined) {
-                    throw new WorkStoreError({ cause: { bindingRows, row }, operation: "open.migrate.handoff-revision" });
-                }
-                const bindingDecision = decodeAgentBindingRow(bindingRow, { dispatchRequestId: handoffDispatch.dispatchRequestId, laneId: previous.laneId }, "open.migrate.agent-binding");
-                if (bindingDecision._tag === "invalid")
-                    throw bindingDecision.error;
-                if (laneRevision.revision < bindingDecision.binding.lane.revision) {
-                    throw new WorkStoreError({
-                        cause: { binding: bindingDecision.binding, laneRevision, previous },
-                        operation: "open.migrate.handoff-lane-revision"
-                    });
-                }
-                if (bindingDecision.binding.lane.goalId !== previous.goalId) {
-                    throw new WorkStoreError({
-                        cause: { binding: bindingDecision.binding, previous },
-                        operation: "open.migrate.agent-binding.goal"
-                    });
-                }
-                requireBindingCompanions(bindingDecision.binding, "open.migrate.agent-binding");
-                requireLifecycleAuthority(bindingDecision.binding.request.dispatchRequestId, bindingDecision.binding.checkpoint.occurredAt, "open.migrate.agent-binding.lifecycle");
-                const verifiedDispatches = handoffDispatches.map((dispatch) => {
-                    const dispatchHandoff = Schema.decodeUnknownSync(PreviousWorkDecisionHandoff)(JSON.parse(dispatch.record));
-                    const lineage = Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage));
-                    if (dispatch.laneId !== previous.laneId || dispatch.occurredAt !== previous.occurredAt ||
-                        !previousDecisionHandoffEquivalent(dispatchHandoff, previous) ||
-                        !workDispatchLineageContainedBy(lineage, previous.dispatchIds)) {
-                        throw new WorkStoreError({
-                            cause: { dispatch, dispatchHandoff, previous },
-                            operation: "open.migrate.dispatch-authority"
-                        });
-                    }
-                    if (tables.includes("orchestrator_dispatch_metadata")) {
+                        if (!tables.includes("orchestrator_dispatch_metadata"))
+                            continue;
                         const metadata = linkedMetadata.find(({ dispatchRequestId }) => dispatchRequestId === dispatch.dispatchRequestId);
                         if (metadata?.workLink === null || metadata?.workLink === undefined) {
                             throw new WorkStoreError({
@@ -683,116 +641,227 @@ const migrateLegacyAuthorityTables = (database) => {
                                 operation: "open.migrate.metadata-authority"
                             });
                         }
-                        const workLink = Schema.decodeUnknownSync(PreviousMetadataWorkLink)(JSON.parse(metadata.workLink));
+                        const workLink = (() => {
+                            try {
+                                return Schema.decodeUnknownSync(CurrentMetadataWorkLink)(JSON.parse(metadata.workLink));
+                            }
+                            catch (cause) {
+                                throw new WorkStoreError({ cause, operation: "open.migrate.decode-metadata-authority" });
+                            }
+                        })();
                         requireMetadataAuthority(dispatch.dispatchRequestId, metadata.route, workLink.lineage, "open.migrate.metadata-authority");
-                        if (!previousDecisionHandoffEquivalent(workLink.handoff, previous) ||
-                            !workDispatchLineageEquivalent(workLink.lineage, lineage)) {
+                        if (!currentDecisionHandoffEquivalent(workLink.handoff, previous.value) ||
+                            !workDispatchLineageEquivalent(workLink.lineage, dispatchAuthority.lineage)) {
                             throw new WorkStoreError({
-                                cause: { previous, workLink },
+                                cause: { handoff: previous.value, workLink },
                                 operation: "open.migrate.metadata-authority"
                             });
                         }
+                        requireCurrentAgentBindingAuthority(dispatch.dispatchRequestId, previous.value, "open.migrate.current-agent-binding");
                     }
-                    return { dispatch, lineage };
-                });
-                const migrated = upgradePreviousDecisionHandoff(previous, bindingDecision.binding.request.expectedRevision);
-                if (migrated.id !== row.handoffId || migrated.sessionId !== row.sessionId ||
-                    migrated.laneId !== row.laneId || migrated.occurredAt !== row.occurredAt) {
-                    throw new WorkStoreError({ cause: { migrated, row }, operation: "open.migrate.handoff-identity" });
-                }
-                const encoded = JSON.stringify(migrated);
-                updateDecision.run(encoded, row.handoffId);
-                updateDispatch?.run(encoded, row.handoffId);
-                for (const { dispatch, lineage } of verifiedDispatches) {
-                    updateMetadata?.run(JSON.stringify({ handoff: migrated, lineage }), dispatch.dispatchRequestId);
+                    return [];
                 }
+                case "invalid":
+                    throw new WorkStoreError({
+                        cause: previous.cause,
+                        operation: "open.migrate.invalid-handoff"
+                    });
+                case "previous":
+                    return [{ previous: previous.value, row }];
+            }
+        });
+        for (const { previous, row } of previousDecisions) {
+            const laneRevision = Schema.decodeUnknownSync(LaneRevisionRow)(database.prepare("SELECT revision FROM work_lane_claims WHERE lane_id = ?").get(row.laneId));
+            const handoffDispatches = tables.includes("work_dispatch_handoffs")
+                ? Schema.decodeUnknownSync(Schema.Array(LegacyDispatchStoredRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, handoff_id AS handoffId,
+               lane_id AS laneId, occurred_at AS occurredAt, lineage, record
+             FROM work_dispatch_handoffs WHERE handoff_id = ?`).all(row.handoffId))
+                : [];
+            if (handoffDispatches.length > 1) {
+                throw new WorkStoreError({
+                    cause: { handoffDispatches, row },
+                    operation: "open.migrate.dispatch-cardinality"
+                });
+            }
+            const linkedMetadata = tables.includes("orchestrator_dispatch_metadata")
+                ? Schema.decodeUnknownSync(Schema.Array(MetadataWorkLinkRow))(database.prepare(`SELECT dispatch_request_id AS dispatchRequestId, route, work_link AS workLink
+             FROM orchestrator_dispatch_metadata
+             WHERE work_link IS NOT NULL
+               AND CASE WHEN json_valid(work_link)
+                 THEN json_extract(work_link, '$.handoff.id') END = ?`).all(row.handoffId))
+                : [];
+            if (tables.includes("orchestrator_dispatch_metadata") &&
+                (linkedMetadata.length !== handoffDispatches.length ||
+                    linkedMetadata.some((metadata) => !handoffDispatches.some(({ dispatchRequestId }) => dispatchRequestId === metadata.dispatchRequestId)))) {
+                throw new WorkStoreError({
+                    cause: { handoffDispatches, linkedMetadata, row },
+                    operation: "open.migrate.metadata-authority"
+                });
+            }
+            const bindingRows = tables.includes("work_agent_bindings") && tables.includes("work_dispatch_handoffs")
+                ? Schema.decodeUnknownSync(Schema.Array(AgentBindingRow))(database.prepare(`SELECT binding.dispatch_request_id AS dispatchRequestId, binding.lane_id AS laneId,
+               binding.expected_revision AS expectedRevision, binding.revision,
+               binding.agent_id AS agentId, binding.host, binding.record
+             FROM work_agent_bindings binding
+             JOIN work_dispatch_handoffs dispatch
+               ON dispatch.dispatch_request_id = binding.dispatch_request_id
+             WHERE dispatch.handoff_id = ?`).all(row.handoffId))
+                : [];
+            const bindingRow = bindingRows[0];
+            const handoffDispatch = bindingRow === undefined
+                ? undefined
+                : handoffDispatches.find(({ dispatchRequestId }) => dispatchRequestId === bindingRow.dispatchRequestId);
+            if (bindingRows.length !== 1 || bindingRow === undefined || handoffDispatch === undefined) {
+                throw new WorkStoreError({ cause: { bindingRows, row }, operation: "open.migrate.handoff-revision" });
             }
-            if (decisions.length > 0 || previousDecisions.length > 0) {
-                const migratedLedger = Schema.decodeUnknownSync(LedgerBytesRow)(database.prepare(`SELECT COALESCE(SUM(
-               length(CAST(handoff_id AS BLOB)) + length(CAST(record AS BLOB))
-             ), 0) AS bytes
-             FROM work_decision_handoffs`).get());
-                if (migratedLedger.bytes > workDecisionMaxBytes) {
+            const bindingDecision = decodeAgentBindingRow(bindingRow, { dispatchRequestId: handoffDispatch.dispatchRequestId, laneId: previous.laneId }, "open.migrate.agent-binding");
+            if (bindingDecision._tag === "invalid")
+                throw bindingDecision.error;
+            if (laneRevision.revision < bindingDecision.binding.lane.revision) {
+                throw new WorkStoreError({
+                    cause: { binding: bindingDecision.binding, laneRevision, previous },
+                    operation: "open.migrate.handoff-lane-revision"
+                });
+            }
+            if (bindingDecision.binding.lane.goalId !== previous.goalId) {
+                throw new WorkStoreError({
+                    cause: { binding: bindingDecision.binding, previous },
+                    operation: "open.migrate.agent-binding.goal"
+                });
+            }
+            requireBindingCompanions(bindingDecision.binding, "open.migrate.agent-binding");
+            requireLifecycleAuthority(bindingDecision.binding.request.dispatchRequestId, bindingDecision.binding.checkpoint.occurredAt, "open.migrate.agent-binding.lifecycle");
+            const verifiedDispatches = handoffDispatches.map((dispatch) => {
+                const dispatchHandoff = Schema.decodeUnknownSync(PreviousWorkDecisionHandoff)(JSON.parse(dispatch.record));
+                const lineage = Schema.decodeUnknownSync(WorkDispatchHandoff.fields.lineage)(JSON.parse(dispatch.lineage));
+                if (dispatch.laneId !== previous.laneId || dispatch.occurredAt !== previous.occurredAt ||
+                    !previousDecisionHandoffEquivalent(dispatchHandoff, previous) ||
+                    !workDispatchLineageContainedBy(lineage, previous.dispatchIds)) {
                     throw new WorkStoreError({
-                        cause: migratedLedger,
-                        operation: "open.migrate.handoff-capacity"
+                        cause: { dispatch, dispatchHandoff, previous },
+                        operation: "open.migrate.dispatch-authority"
                     });
                 }
-            }
-        }
-        if (tables.includes("orchestrator_dispatch_metadata") && coordinatorDispatchColumns.includes("is_routed")) {
-            const pageSize = 512;
-            let cursor = null;
-            while (true) {
-                const input = cursor === null
-                    ? database.prepare(`SELECT CAST(metadata.rowid AS TEXT) AS rowId,
-                 metadata.dispatch_request_id AS dispatchRequestId,
-                 dispatch.activity_idempotency_key AS activityIdempotencyKey,
-                 dispatch.command, dispatch.is_routed AS isRouted,
-                 CASE WHEN metadata.work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
-                 metadata.route
-               FROM orchestrator_dispatch_metadata AS metadata
-               LEFT JOIN orchestrator_dispatches AS dispatch
-                 ON dispatch.dispatch_request_id = metadata.dispatch_request_id
-               ORDER BY metadata.rowid ASC LIMIT ?`).all(pageSize)
-                    : database.prepare(`SELECT CAST(metadata.rowid AS TEXT) AS rowId,
-                 metadata.dispatch_request_id AS dispatchRequestId,
-                 dispatch.activity_idempotency_key AS activityIdempotencyKey,
-                 dispatch.command, dispatch.is_routed AS isRouted,
-                 CASE WHEN metadata.work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
-                 metadata.route
-               FROM orchestrator_dispatch_metadata AS metadata
-               LEFT JOIN orchestrator_dispatches AS dispatch
-                 ON dispatch.dispatch_request_id = metadata.dispatch_request_id
-               WHERE metadata.rowid > CAST(? AS INTEGER)
-               ORDER BY metadata.rowid ASC LIMIT ?`).all(cursor, pageSize);
-                const rows = Schema.decodeUnknownSync(Schema.Array(CoordinatorMetadataRouteRow))(input);
-                for (const row of rows) {
-                    try {
-                        const isLegacyUnroutedOrphan = row.activityIdempotencyKey === null && row.command === null &&
-                            row.isRouted === null && row.route === null && row.hasWorkLink === 0;
-                        if (isLegacyUnroutedOrphan)
-                            continue;
-                        if (row.activityIdempotencyKey === null || row.command === null ||
-                            row.route === null || row.isRouted === null) {
-                            throw new WorkStoreError({ cause: row, operation: "open.migrate.metadata-route" });
-                        }
-                        requireCoordinatorRouteBinding(row.command, row.activityIdempotencyKey, row.route, row.hasWorkLink === 1, { _tag: "routed_discriminator", isRouted: row.isRouted }, "open.migrate.metadata-route");
+                if (tables.includes("orchestrator_dispatch_metadata")) {
+                    const metadata = linkedMetadata.find(({ dispatchRequestId }) => dispatchRequestId === dispatch.dispatchRequestId);
+                    if (metadata?.workLink === null || metadata?.workLink === undefined) {
+                        throw new WorkStoreError({
+                            cause: { dispatch, metadata },
+                            operation: "open.migrate.metadata-authority"
+                        });
                     }
-                    catch (cause) {
-                        if (Schema.is(WorkStoreError)(cause))
-                            throw cause;
-                        throw new WorkStoreError({ cause, operation: "open.migrate.metadata-route" });
+                    const workLink = Schema.decodeUnknownSync(PreviousMetadataWorkLink)(JSON.parse(metadata.workLink));
+                    requireMetadataAuthority(dispatch.dispatchRequestId, metadata.route, workLink.lineage, "open.migrate.metadata-authority");
+                    if (!previousDecisionHandoffEquivalent(workLink.handoff, previous) ||
+                        !workDispatchLineageEquivalent(workLink.lineage, lineage)) {
+                        throw new WorkStoreError({
+                            cause: { previous, workLink },
+                            operation: "open.migrate.metadata-authority"
+                        });
                     }
                 }
-                const last = rows.at(-1);
-                if (rows.length < pageSize || last === undefined)
-                    break;
-                cursor = last.rowId;
+                return { dispatch, lineage };
+            });
+            const migrated = upgradePreviousDecisionHandoff(previous, bindingDecision.binding.request.expectedRevision);
+            if (migrated.id !== row.handoffId || migrated.sessionId !== row.sessionId ||
+                migrated.laneId !== row.laneId || migrated.occurredAt !== row.occurredAt) {
+                throw new WorkStoreError({ cause: { migrated, row }, operation: "open.migrate.handoff-identity" });
+            }
+            const encoded = JSON.stringify(migrated);
+            updateDecision.run(encoded, row.handoffId);
+            updateDispatch?.run(encoded, row.handoffId);
+            for (const { dispatch, lineage } of verifiedDispatches) {
+                updateMetadata?.run(JSON.stringify({ handoff: migrated, lineage }), dispatch.dispatchRequestId);
             }
-            const invalidRoutedMetadata = Schema.decodeUnknownSync(Schema.Array(RoutedMetadataCardinalityRow))(database.prepare(`SELECT dispatch.dispatch_request_id AS dispatchRequestId,
-               COUNT(metadata.dispatch_request_id) AS metadataCount
-             FROM orchestrator_dispatches AS dispatch
-             LEFT JOIN orchestrator_dispatch_metadata AS metadata
-               ON metadata.dispatch_request_id = dispatch.dispatch_request_id
-             WHERE dispatch.is_routed = 1
-             GROUP BY dispatch.dispatch_request_id
-             HAVING COUNT(metadata.dispatch_request_id) <> 1
-             LIMIT 1`).all())[0];
-            if (invalidRoutedMetadata !== undefined) {
+        }
+        if (decisions.length > 0 || previousDecisions.length > 0) {
+            const migratedLedger = Schema.decodeUnknownSync(LedgerBytesRow)(database.prepare(`SELECT COALESCE(SUM(
+             length(CAST(handoff_id AS BLOB)) + length(CAST(record AS BLOB))
+           ), 0) AS bytes
+           FROM work_decision_handoffs`).get());
+            if (migratedLedger.bytes > workDecisionMaxBytes) {
                 throw new WorkStoreError({
-                    cause: invalidRoutedMetadata,
-                    operation: "open.migrate.routed-metadata"
+                    cause: migratedLedger,
+                    operation: "open.migrate.handoff-capacity"
                 });
             }
         }
-        database.exec("COMMIT");
-        transaction = false;
     }
-    catch (error) {
-        if (transaction)
-            database.exec("ROLLBACK");
-        throw error;
+    // Reported after capacity: lane CAS allows one binding per revision, so
+    // several mean the file is inconsistent rather than merely large.
+    const ambiguousClaims = migratedClaims.filter(({ _tag }) => _tag === "ambiguous");
+    if (ambiguousClaims.length > 0) {
+        throw new WorkStoreError({ cause: { claims: ambiguousClaims }, operation: "open.migrate.lane-binding-ambiguous" });
+    }
+    const mismatchedClaims = migratedClaims.filter(({ _tag }) => _tag === "mismatch");
+    if (mismatchedClaims.length > 0) {
+        throw new WorkStoreError({ cause: { claims: mismatchedClaims }, operation: "open.migrate.lane-binding-mismatch" });
+    }
+    if (tables.includes("orchestrator_dispatch_metadata") && coordinatorDispatchColumns.includes("is_routed")) {
+        const pageSize = 512;
+        let cursor = null;
+        while (true) {
+            const input = cursor === null
+                ? database.prepare(`SELECT CAST(metadata.rowid AS TEXT) AS rowId,
+               metadata.dispatch_request_id AS dispatchRequestId,
+               dispatch.activity_idempotency_key AS activityIdempotencyKey,
+               dispatch.command, dispatch.is_routed AS isRouted,
+               CASE WHEN metadata.work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
+               metadata.route
+             FROM orchestrator_dispatch_metadata AS metadata
+             LEFT JOIN orchestrator_dispatches AS dispatch
+               ON dispatch.dispatch_request_id = metadata.dispatch_request_id
+             ORDER BY metadata.rowid ASC LIMIT ?`).all(pageSize)
+                : database.prepare(`SELECT CAST(metadata.rowid AS TEXT) AS rowId,
+               metadata.dispatch_request_id AS dispatchRequestId,
+               dispatch.activity_idempotency_key AS activityIdempotencyKey,
+               dispatch.command, dispatch.is_routed AS isRouted,
+               CASE WHEN metadata.work_link IS NULL THEN 0 ELSE 1 END AS hasWorkLink,
+               metadata.route
+             FROM orchestrator_dispatch_metadata AS metadata
+             LEFT JOIN orchestrator_dispatches AS dispatch
+               ON dispatch.dispatch_request_id = metadata.dispatch_request_id
+             WHERE metadata.rowid > CAST(? AS INTEGER)
+             ORDER BY metadata.rowid ASC LIMIT ?`).all(cursor, pageSize);
+            const rows = Schema.decodeUnknownSync(Schema.Array(CoordinatorMetadataRouteRow))(input);
+            for (const row of rows) {
+                try {
+                    const isLegacyUnroutedOrphan = row.activityIdempotencyKey === null && row.command === null &&
+                        row.isRouted === null && row.route === null && row.hasWorkLink === 0;
+                    if (isLegacyUnroutedOrphan)
+                        continue;
+                    if (row.activityIdempotencyKey === null || row.command === null ||
+                        row.route === null || row.isRouted === null) {
+                        throw new WorkStoreError({ cause: row, operation: "open.migrate.metadata-route" });
+                    }
+                    requireCoordinatorRouteBinding(row.command, row.activityIdempotencyKey, row.route, row.hasWorkLink === 1, { _tag: "routed_discriminator", isRouted: row.isRouted }, "open.migrate.metadata-route");
+                }
+                catch (cause) {
+                    if (Schema.is(WorkStoreError)(cause))
+                        throw cause;
+                    throw new WorkStoreError({ cause, operation: "open.migrate.metadata-route" });
+                }
+            }
+            const last = rows.at(-1);
+            if (rows.length < pageSize || last === undefined)
+                break;
+            cursor = last.rowId;
+        }
+        const invalidRoutedMetadata = Schema.decodeUnknownSync(Schema.Array(RoutedMetadataCardinalityRow))(database.prepare(`SELECT dispatch.dispatch_request_id AS dispatchRequestId,
+             COUNT(metadata.dispatch_request_id) AS metadataCount
+           FROM orchestrator_dispatches AS dispatch
+           LEFT JOIN orchestrator_dispatch_metadata AS metadata
+             ON metadata.dispatch_request_id = dispatch.dispatch_request_id
+           WHERE dispatch.is_routed = 1
+           GROUP BY dispatch.dispatch_request_id
+           HAVING COUNT(metadata.dispatch_request_id) <> 1
+           LIMIT 1`).all())[0];
+        if (invalidRoutedMetadata !== undefined) {
+            throw new WorkStoreError({
+                cause: invalidRoutedMetadata,
+                operation: "open.migrate.routed-metadata"
+            });
+        }
     }
 };
 const readTransactionLedgerTotals = (database) => Schema.decodeUnknownSync(TransactionLedgerTotalsRow)(database.prepare(`SELECT transaction_count AS transactionCount, transaction_bytes AS transactionBytes
@@ -801,6 +870,7 @@ const readDecisionLedgerTotals = (database) => Schema.decodeUnknownSync(Decision
        FROM work_decision_totals WHERE singleton = 1`).get());
 const readLaneOperationLedgerTotals = (database) => Schema.decodeUnknownSync(LaneOperationLedgerTotalsRow)(database.prepare(`SELECT operation_count AS operationCount, operation_bytes AS operationBytes
        FROM work_lane_operation_totals WHERE singleton = 1`).get());
+const ObservationIdRow = Schema.Struct({ observationId: Schema.String });
 const ReassignmentRow = Schema.Struct({ approvalJobId: Schema.String, goalId: Schema.String, record: Schema.String });
 /** Applies a reassignment's agent choice; `keep` is only reached when the goal has no target. */
 const withReassignedAgent = (goal, toAgent) => {
@@ -953,11 +1023,11 @@ const admissionState = (database, target) => {
         (claim.worktree === target.worktree && claim.laneId !== target.laneId)) ||
         authority.latest.some(({ request }) => request.worker.agentId === target.worker.agentId && request.laneId !== target.laneId) ||
         // A session id stays claimed by its lane even after a reassignment supersedes that binding.
-        bindings.some(({ request }) => (request.prospectiveAdmission?.sessionId === target.sessionId && request.laneId !== target.laneId) ||
+        bindings.some(({ request }) => (admissionEvidence(request)?.sessionId === target.sessionId && request.laneId !== target.laneId) ||
             (request.existingGoalRecovery?.sessionId === target.sessionId && request.laneId !== target.laneId)) || authority.ambiguousLanes.has(target.laneId);
     const exact = goal !== undefined && lane !== undefined && binding !== undefined &&
-        goal.goal.id === target.goalId && goal.goal.state !== "completed" &&
-        goal.goal.state !== "deployed" && goal.goal.goalFamily?.role === "canonical" &&
+        goal.goal.id === target.goalId && !isTerminalWorkState(goal.goal.state) &&
+        goal.goal.goalFamily?.role === "canonical" &&
         goal.goal.goalFamily.canonicalGoalId === target.goalId &&
         Equal.equals(goal.goal.owner, target.owner) &&
         lane.goalId === target.goalId && lane.head === target.head &&
@@ -965,9 +1035,9 @@ const admissionState = (database, target) => {
         lane.phase !== "shipped" && Equal.equals(lane.owner, target.owner) &&
         binding.lane.laneId === target.laneId &&
         Equal.equals(binding.request.worker, target.worker) &&
-        (binding.request.prospectiveAdmission === undefined || (binding.request.prospectiveAdmission.sessionId === target.sessionId &&
-            binding.request.prospectiveAdmission.workAssignment === target.expectedWork &&
-            binding.request.prospectiveAdmission.baseHead === target.baseHead)) &&
+        (admissionEvidence(binding.request) === undefined || (admissionEvidence(binding.request)?.sessionId === target.sessionId &&
+            admissionEvidence(binding.request)?.workAssignment === target.expectedWork &&
+            admissionEvidence(binding.request)?.baseHead === target.baseHead)) &&
         (binding.request.existingGoalRecovery === undefined ||
             (binding.request.existingGoalRecovery.sessionId === target.sessionId &&
                 binding.request.existingGoalRecovery.workAssignment === target.expectedWork &&
@@ -994,7 +1064,7 @@ const admissionState = (database, target) => {
         entry.goalFamily?.canonicalGoalId === target.goalId ||
         entry.agentHierarchy?.agent.agentId === target.worker.agentId) || lanes.entries.some(({ claim }) => claim.laneId === target.laneId || claim.goalId === target.goalId ||
         claim.worktree === target.worktree) || authority.latest.some(({ request }) => request.worker.agentId === target.worker.agentId) ||
-        bindings.some(({ request }) => request.prospectiveAdmission?.sessionId === target.sessionId ||
+        bindings.some(({ request }) => admissionEvidence(request)?.sessionId === target.sessionId ||
             request.existingGoalRecovery?.sessionId === target.sessionId);
     if (conflicts) {
         return { _tag: "conflict", target, reason: "durable PR, goal, lane, worker, or worktree is already bound" };
@@ -1131,8 +1201,7 @@ const recoveryState = (database, target) => {
         goal.connectTarget !== null ||
         (goal.agentHierarchy !== undefined && goal.agentHierarchy !== null) ||
         (goal.review?.url !== null && goal.review?.url !== undefined && goal.review.url !== target.reviewUrl) ||
-        goal.state === "completed" ||
-        goal.state === "deployed")) {
+        isTerminalWorkState(goal.state))) {
         return conflict("canonical goal history is linked, terminal, or belongs to another owner");
     }
     const bindingRows = Schema.decodeUnknownSync(AgentBindingRows)(database
@@ -1165,7 +1234,7 @@ const recoveryState = (database, target) => {
         operations.claims.some(({ goalId, laneId, worktree }) => goalId === target.goalId || laneId === target.laneId || worktree === target.worktree) ||
         bindings.some(({ request }) => request.laneId === target.laneId ||
             request.worker.agentId === target.worker.agentId ||
-            request.prospectiveAdmission?.sessionId === target.sessionId ||
+            admissionEvidence(request)?.sessionId === target.sessionId ||
             request.existingGoalRecovery?.sessionId === target.sessionId) ||
         decisions.some(({ record }) => {
             const handoff = Schema.decodeUnknownSync(WorkDecisionHandoff)(JSON.parse(record));
@@ -1193,6 +1262,140 @@ const readRecoveryState = (database, target) => {
         throw cause;
     }
 };
+const ReassignmentApprovalRow = Schema.Struct({ approvalJobId: Schema.String, goalId: Schema.String });
+const ReconcilerEventRow = Schema.Struct({ eventId: Schema.String, goalId: Schema.String });
+const ObservedFactRow = Schema.Struct({
+    subject: Schema.String,
+    observationId: Schema.String,
+    observedAt: Schema.Number,
+    confirmedAt: Schema.Number,
+    record: Schema.String
+});
+const StoredFactRow = Schema.Struct({ observationId: Schema.String, confirmedAt: Schema.Number });
+const FactTotalsRow = Schema.Struct({ count: Schema.Number, bytes: Schema.Number });
+const EvictionRow = Schema.Struct({ subject: Schema.String, bytes: Schema.Number });
+const canonicalObservation = (observation) => observation._tag === "agent"
+    ? { ...observation, host: asciiLower(observation.host) }
+    : { ...observation, repository: asciiLower(observation.repository) };
+/**
+ * Applies each observation in one transaction, then evicts the oldest rows
+ * until facts and failures are each within their bounds.
+ *
+ * - The same facts again keep their first-seen time and move `confirmed_at`.
+ * - Different facts replace the stored ones, unless the stored ones were
+ *   confirmed at or after this observation (then it is stale).
+ * - A good read ends the subject's run of failures. A failure starts a run,
+ *   or keeps the running one's `since`; one older than the last good read is stale.
+ */
+const writeObservations = (database, prepared) => {
+    database.exec("BEGIN IMMEDIATE");
+    try {
+        const readFact = database.prepare(`SELECT observation_id AS observationId, confirmed_at AS confirmedAt
+       FROM work_observed_facts WHERE subject = ?`);
+        const upsertFact = database.prepare(`INSERT INTO work_observed_facts (subject, observation_id, observed_at, confirmed_at, record)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (subject) DO UPDATE SET observation_id = excluded.observation_id,
+         observed_at = excluded.observed_at, confirmed_at = excluded.confirmed_at, record = excluded.record`);
+        const confirmFact = database.prepare("UPDATE work_observed_facts SET confirmed_at = max(confirmed_at, ?) WHERE subject = ?");
+        // A good read ends a run of failures only if it is newer than the run's
+        // latest failure.
+        const clearFailures = database.prepare("DELETE FROM work_observed_failures WHERE subject = ? AND last_at <= ?");
+        // We keep only the run's first and latest failure, so a run split by a
+        // delayed good read restarts at its latest failure: a real failed read.
+        const trimFailures = database.prepare("UPDATE work_observed_failures SET since = last_at WHERE subject = ? AND since <= ? AND last_at > ?");
+        const endFailures = {
+            run: (subject, observedAt) => {
+                clearFailures.run(subject, observedAt);
+                trimFailures.run(subject, observedAt, observedAt);
+            }
+        };
+        // `since` is the earliest failure of the run; source and reason come from
+        // the latest one, whatever order the failures arrive in.
+        const recordFailure = database.prepare(`INSERT INTO work_observed_failures (subject, source, reason, since, last_at) VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (subject) DO UPDATE SET
+         since = min(since, excluded.since),
+         source = CASE WHEN excluded.last_at >= last_at THEN excluded.source ELSE source END,
+         reason = CASE WHEN excluded.last_at >= last_at THEN excluded.reason ELSE reason END,
+         last_at = max(last_at, excluded.last_at)`);
+        const outcomes = prepared.map((item) => {
+            if (item._tag === "future")
+                return { _tag: "stale", subject: item.subject };
+            const row = readFact.get(item.subject);
+            const stored = row === undefined ? undefined : Schema.decodeUnknownSync(StoredFactRow)(row);
+            if (item._tag === "unknown") {
+                if (stored !== undefined && stored.confirmedAt >= item.observedAt) {
+                    return { _tag: "stale", subject: item.subject };
+                }
+                recordFailure.run(item.subject, item.source, item.reason, item.observedAt, item.observedAt);
+                return { _tag: "unknown", reason: item.reason, subject: item.subject };
+            }
+            if (stored?.observationId === item.observationId) {
+                confirmFact.run(item.observedAt, item.subject);
+                endFailures.run(item.subject, item.observedAt);
+                return { _tag: "unchanged", subject: item.subject };
+            }
+            if (stored !== undefined && stored.confirmedAt >= item.observedAt)
+                return { _tag: "stale", subject: item.subject };
+            upsertFact.run(item.subject, item.observationId, item.observedAt, item.observedAt, item.record);
+            endFailures.run(item.subject, item.observedAt);
+            return { _tag: "stored", subject: item.subject };
+        });
+        // Totals are read once and kept current as rows go, so eviction is one
+        // indexed lookup and delete per row, not a full rescan per row.
+        const evict = (table, age, payload) => {
+            const size = `length(CAST(subject AS BLOB)) + length(CAST(${payload} AS BLOB))`;
+            const totals = Schema.decodeUnknownSync(FactTotalsRow)(database.prepare(`SELECT COUNT(*) AS count, COALESCE(SUM(${size}), 0) AS bytes FROM ${table}`).get());
+            const oldest = database.prepare(`SELECT subject, ${size} AS bytes FROM ${table} ORDER BY ${age} ASC, subject ASC LIMIT 1`);
+            const remove = database.prepare(`DELETE FROM ${table} WHERE subject = ?`);
+            let { bytes, count } = totals;
+            let evicted = 0;
+            while (count > workObservedFactMaxRecords || bytes > workObservedFactMaxBytes) {
+                const row = Schema.decodeUnknownSync(EvictionRow)(oldest.get());
+                remove.run(row.subject);
+                count -= 1;
+                bytes -= row.bytes;
+                evicted += 1;
+            }
+            return evicted;
+        };
+        // The least recently read rows go first: a fact by its last confirmation,
+        // a failure by its latest failed read.
+        const evicted = evict("work_observed_facts", "confirmed_at", "record") +
+            evict("work_observed_failures", "last_at", "reason");
+        database.exec("COMMIT");
+        return { evicted, outcomes };
+    }
+    catch (cause) {
+        if (database.isTransaction)
+            database.exec("ROLLBACK");
+        throw cause;
+    }
+};
+const admissionSummary = (provenance) => provenance._tag === "approved"
+    ? `Prospective admission of an existing owner by approved Fleet job ${provenance.approvalJobId}`
+    : `Admission of an observed worker by the reconciler from observation ${provenance.observationId}`;
+/** The binding-request key that records how a worker was admitted. */
+const admissionRecord = (provenance, evidence) => provenance._tag === "approved"
+    ? {
+        prospectiveAdmission: {
+            ...evidence,
+            approvalJobId: provenance.approvalJobId,
+            approvalActor: provenance.approvalActor
+        }
+    }
+    : { observedAdmission: { ...evidence, actor: "reconciler", observationId: provenance.observationId } };
+/** Whether a stored binding was admitted by exactly this provenance and absence evidence (an exact replay). */
+const sameAdmission = (request, expectedAbsenceToken, provenance) => {
+    if (provenance._tag === "approved") {
+        const stored = request.prospectiveAdmission;
+        return stored !== undefined &&
+            stored.expectedAbsenceToken === expectedAbsenceToken &&
+            stored.approvalJobId === provenance.approvalJobId && stored.approvalActor === provenance.approvalActor;
+    }
+    const stored = request.observedAdmission;
+    return stored !== undefined &&
+        stored.expectedAbsenceToken === expectedAbsenceToken && stored.observationId === provenance.observationId;
+};
 export class WorkStore {
     #database;
     #cryptoService;
@@ -1209,9 +1412,14 @@ export class WorkStore {
         const opened = yield* openPrivateSqlite(path, {
             busyTimeoutMillis: workStoreBusyTimeoutMillis,
             initialize: (database) => {
-                migrateLegacyAuthorityTables(database);
-                const hadLaneOperationLedger = database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'work_lane_operations'").get() !== undefined;
-                database.exec(`
+                // One transaction: legacy migration and schema creation succeed or fail
+                // together, and their statements share one commit instead of syncing
+                // the file once each.
+                database.exec("BEGIN IMMEDIATE");
+                try {
+                    migrateLegacyAuthorityTables(database);
+                    const hadLaneOperationLedger = database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'work_lane_operations'").get() !== undefined;
+                    database.exec(`
         CREATE TABLE IF NOT EXISTS work_goal_events (
           event_id TEXT PRIMARY KEY,
           goal_id TEXT NOT NULL,
@@ -1291,6 +1499,13 @@ export class WorkStore {
           goal_id TEXT NOT NULL,
           record TEXT NOT NULL
         );
+        -- One row per approved abandonment, committed with the goal checkpoint whose
+        -- event id equals its approval job id, so work_goal_events bounds it too.
+        CREATE TABLE IF NOT EXISTS work_goal_abandonments (
+          approval_job_id TEXT PRIMARY KEY,
+          goal_id TEXT NOT NULL,
+          record TEXT NOT NULL
+        );
         CREATE TABLE IF NOT EXISTS work_decision_handoffs (
           handoff_id TEXT PRIMARY KEY,
           session_id TEXT NOT NULL UNIQUE,
@@ -1314,22 +1529,45 @@ export class WorkStore {
         END;
         CREATE INDEX IF NOT EXISTS work_decision_handoffs_lane_time
           ON work_decision_handoffs (lane_id, occurred_at, handoff_id);
-        CREATE INDEX IF NOT EXISTS work_decision_handoffs_session
+        CREATE UNIQUE INDEX IF NOT EXISTS work_decision_handoffs_session
           ON work_decision_handoffs (session_id);
+        CREATE TABLE IF NOT EXISTS work_observed_facts (
+          subject TEXT PRIMARY KEY,
+          observation_id TEXT NOT NULL,
+          observed_at INTEGER NOT NULL,
+          confirmed_at INTEGER NOT NULL,
+          record TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS work_observed_facts_age
+          ON work_observed_facts (confirmed_at, subject);
+        CREATE TABLE IF NOT EXISTS work_reconciler_events (
+          event_id TEXT PRIMARY KEY,
+          goal_id TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS work_observed_failures (
+          subject TEXT PRIMARY KEY,
+          source TEXT NOT NULL,
+          reason TEXT NOT NULL,
+          since INTEGER NOT NULL,
+          last_at INTEGER NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS work_observed_failures_age
+          ON work_observed_failures (last_at, subject);
       `);
-                const columns = Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare("PRAGMA table_info(work_goal_events)").all());
-                if (!columns.some(({ name }) => name === "transaction_id")) {
-                    database.exec("ALTER TABLE work_goal_events ADD COLUMN transaction_id TEXT");
-                }
-                if (!hadLaneOperationLedger) {
-                    database.exec(`
+                    requireUniqueSessionIndex(database);
+                    const columns = Schema.decodeUnknownSync(Schema.Array(Schema.Struct({ name: Schema.String })))(database.prepare("PRAGMA table_info(work_goal_events)").all());
+                    if (!columns.some(({ name }) => name === "transaction_id")) {
+                        database.exec("ALTER TABLE work_goal_events ADD COLUMN transaction_id TEXT");
+                    }
+                    if (!hadLaneOperationLedger) {
+                        database.exec(`
           INSERT OR IGNORE INTO work_lane_operations
             (operation_id, lane_id, goal_id, phase, revision, record)
           SELECT operation_id, lane_id, goal_id, phase, revision, record
           FROM work_lane_claims
         `);
-                }
-                database.exec(`
+                    }
+                    database.exec(`
         INSERT OR IGNORE INTO work_lane_operation_totals
           (singleton, operation_count, operation_bytes)
         SELECT 1, COUNT(*), COALESCE(SUM(
@@ -1337,7 +1575,7 @@ export class WorkStore {
         ), 0)
         FROM work_lane_operations
       `);
-                database.exec(`
+                    database.exec(`
         INSERT OR IGNORE INTO work_goal_transaction_totals
           (singleton, transaction_count, transaction_bytes)
         SELECT 1, COUNT(*), COALESCE(SUM(
@@ -1345,7 +1583,7 @@ export class WorkStore {
         ), 0)
         FROM work_goal_transactions
       `);
-                database.exec(`
+                    database.exec(`
         INSERT OR REPLACE INTO work_decision_totals
           (singleton, decision_count, decision_bytes)
         SELECT 1, COUNT(*), COALESCE(SUM(
@@ -1353,6 +1591,15 @@ export class WorkStore {
         ), 0)
         FROM work_decision_handoffs
       `);
+                    database.exec("COMMIT");
+                }
+                catch (error) {
+                    // SQLite may already have rolled back (SQLITE_FULL, IOERR); a second
+                    // ROLLBACK would throw and replace the real error.
+                    if (database.isTransaction)
+                        database.exec("ROLLBACK");
+                    throw error;
+                }
             }
         }).pipe(Effect.mapError(fromPrivateDatabaseError));
         return new WorkStore(path, opened, cryptoService);
@@ -1869,6 +2116,155 @@ export class WorkStore {
             return yield* decision.error;
         return decision.result;
     });
+    /**
+     * Applies an approved `work.abandon` job: the goal, owned by exactly the
+     * approved owner and still at the approved head, becomes `abandoned` with its
+     * blocker cleared and a status activity naming the job. A goal with an
+     * active lane, or already finished, is refused; nothing else is written. An
+     * exact replay of the job returns the stored result.
+     */
+    abandon = Effect.fn("WorkStore.abandon")(function* (request) {
+        const decoded = yield* Schema.decodeUnknownEffect(WorkGoalAbandonment)(request).pipe(Effect.mapError(storeError("abandon.decode")));
+        const jobId = decoded.approvalJobId;
+        const observedAt = yield* Clock.currentTimeMillis;
+        yield* this.secureFiles();
+        const decision = yield* Effect.try({
+            try: () => {
+                let transaction = false;
+                const reject = (error) => {
+                    this.#database.exec("ROLLBACK");
+                    transaction = false;
+                    return { _tag: "rejected", error };
+                };
+                try {
+                    this.#database.exec("BEGIN IMMEDIATE");
+                    transaction = true;
+                    const priorRaw = this.#database
+                        .prepare(`SELECT approval_job_id AS approvalJobId, goal_id AS goalId, record
+               FROM work_goal_abandonments WHERE approval_job_id = ?`)
+                        .get(jobId);
+                    if (priorRaw !== undefined) {
+                        const row = Schema.decodeUnknownSync(ReassignmentRow)(priorRaw);
+                        const prior = Schema.decodeUnknownSync(WorkGoalAbandoned)(JSON.parse(row.record));
+                        if (row.approvalJobId !== prior.abandonment.approvalJobId || row.goalId !== prior.abandonment.goalId) {
+                            return reject(new WorkStoreError({ cause: { prior, row }, operation: "abandon.replay.identity-mismatch" }));
+                        }
+                        if (!Equal.equals(prior.abandonment, decoded)) {
+                            return reject(new WorkGoalAbandonmentConflictError({ approvalJobId: jobId, reason: "payload_mismatch" }));
+                        }
+                        this.#database.exec("ROLLBACK");
+                        transaction = false;
+                        return { _tag: "abandoned", result: prior };
+                    }
+                    const collision = this.#database
+                        .prepare(`SELECT 1 FROM work_goal_events WHERE event_id = ?
+               UNION ALL SELECT 1 FROM work_lane_operations WHERE operation_id = ?
+               UNION ALL SELECT 1 FROM work_agent_bindings WHERE dispatch_request_id = ? LIMIT 1`)
+                        .get(jobId, jobId, jobId);
+                    if (collision !== undefined) {
+                        return reject(new WorkGoalAbandonmentConflictError({ approvalJobId: jobId, reason: "identifier_in_use" }));
+                    }
+                    const eventRows = Schema.decodeUnknownSync(Schema.Array(AgentBindingGoalEventRow))(this.#database
+                        .prepare(`SELECT event_id AS eventId, goal_id AS goalId, occurred_at AS occurredAt, record
+                 FROM work_goal_events ORDER BY occurred_at ASC, event_id ASC LIMIT ?`)
+                        .all(workHistoryMaxEvents + 1));
+                    const history = [];
+                    for (const row of eventRows) {
+                        const event = decodeAgentBindingGoalEvent(row, "abandon.history");
+                        if (event._tag === "invalid")
+                            return reject(event.error);
+                        history.push(event.checkpoint);
+                    }
+                    const head = history.filter(({ goal }) => goal.id === decoded.goalId).at(-1);
+                    if (head === undefined ||
+                        head.eventId !== decoded.expectedGoalEventId ||
+                        head.goal.updatedAt !== decoded.expectedGoalUpdatedAt) {
+                        return reject(new WorkGoalRevisionConflictError({
+                            goalId: decoded.goalId,
+                            expectedEventId: decoded.expectedGoalEventId,
+                            expectedUpdatedAt: decoded.expectedGoalUpdatedAt,
+                            actualEventId: head?.eventId ?? null,
+                            actualUpdatedAt: head?.goal.updatedAt ?? null
+                        }));
+                    }
+                    if (!Equal.equals(head.goal.owner, decoded.owner)) {
+                        return reject(new WorkGoalOwnerMismatchError({
+                            goalId: decoded.goalId,
+                            laneId: null,
+                            expectedOwner: { id: decoded.owner.id, name: decoded.owner.name },
+                            actualOwner: { id: head.goal.owner.id, name: head.goal.owner.name }
+                        }));
+                    }
+                    if (isTerminalWorkState(head.goal.state)) {
+                        return reject(new WorkGoalTerminalError({ goalId: decoded.goalId, state: head.goal.state }));
+                    }
+                    const ledger = readValidatedLaneLedger(this.#database, "abandon.lane");
+                    if (ledger._tag === "invalid")
+                        return reject(ledger.error);
+                    const active = ledger.entries.find(({ claim }) => claim.goalId === decoded.goalId && claim.phase !== "shipped");
+                    if (active !== undefined) {
+                        return reject(new WorkGoalLaneActiveError({ goalId: decoded.goalId, laneId: active.claim.laneId }));
+                    }
+                    // occurredAt equals updatedAt for every valid checkpoint; both bound the ordering defensively.
+                    const at = Math.max(observedAt, head.occurredAt + 1, head.goal.updatedAt + 1);
+                    const existingActivity = head.goal.activity ?? [];
+                    const goal = Schema.decodeUnknownSync(WorkGoal)({
+                        ...withoutBlockers(head.goal),
+                        state: "abandoned",
+                        // A full activity list keeps the owner's entries and takes no note; the
+                        // checkpoint's event id and the abandonments table still name the job.
+                        activity: existingActivity.length >= goalActivityLimit ? existingActivity : [
+                            ...existingActivity,
+                            {
+                                id: jobId,
+                                kind: "status",
+                                summary: workAbandonActivitySummary(decoded, jobId, decoded.approvalHash),
+                                occurredAt: at
+                            }
+                        ],
+                        updatedAt: at
+                    });
+                    const checkpoint = Schema.decodeUnknownSync(WorkGoalCheckpoint)({
+                        version: "herdr.work.event.v1",
+                        eventId: jobId,
+                        occurredAt: at,
+                        goal
+                    });
+                    const result = Schema.decodeUnknownSync(WorkGoalAbandoned)({ abandonment: decoded, checkpoint });
+                    const familyError = validateGoalFamilyHistory([...history, checkpoint]);
+                    if (familyError !== undefined)
+                        return reject(familyError);
+                    const capacity = agentBindingAdmissionError({
+                        history,
+                        candidate: checkpoint,
+                        operationCount: 0,
+                        operationBytes: 0,
+                        candidateOperationBytes: 0
+                    });
+                    if (capacity !== undefined)
+                        return reject(capacity);
+                    this.#database
+                        .prepare("INSERT INTO work_goal_events (event_id, goal_id, occurred_at, record) VALUES (?, ?, ?, ?)")
+                        .run(checkpoint.eventId, checkpoint.goal.id, checkpoint.occurredAt, JSON.stringify(checkpoint));
+                    this.#database
+                        .prepare("INSERT INTO work_goal_abandonments (approval_job_id, goal_id, record) VALUES (?, ?, ?)")
+                        .run(jobId, decoded.goalId, JSON.stringify(result));
+                    this.#database.exec("COMMIT");
+                    transaction = false;
+                    return { _tag: "abandoned", result };
+                }
+                catch (cause) {
+                    if (transaction)
+                        this.#database.exec("ROLLBACK");
+                    throw cause;
+                }
+            },
+            catch: storeError("abandon.transaction")
+        });
+        if (decision._tag === "rejected")
+            return yield* decision.error;
+        return decision.result;
+    });
     admissionPreflight = Effect.fn("WorkStore.admissionPreflight")(function* (target) {
         const decoded = yield* Schema.decodeUnknownEffect(WorkAdmissionTarget)(target).pipe(Effect.mapError(storeError("admission.preflight.decode")));
         const state = yield* Effect.try({
@@ -1881,8 +2277,27 @@ export class WorkStore {
         const preflight = { _tag: "prospective", target: state.target, absenceToken };
         return preflight;
     });
+    /**
+     * Admits an existing owner after an approved Fleet job. Its absence token is
+     * re-checked inside the write; an exact replay returns the stored link.
+     */
     admitExistingOwner = Effect.fn("WorkStore.admitExistingOwner")(function* (request) {
         const decoded = yield* Schema.decodeUnknownEffect(WorkProspectiveAdmission)(request).pipe(Effect.mapError(storeError("admission.decode")));
+        return yield* this.#admit(decoded, {
+            _tag: "approved",
+            approvalActor: decoded.approvalActor,
+            approvalJobId: decoded.approvalJobId
+        });
+    });
+    /**
+     * Admits a worker the reconciler observed, without an approval: the same
+     * write and checks as `admitExistingOwner`, credited to the observation.
+     */
+    admitObserved = Effect.fn("WorkStore.admitObserved")(function* (request) {
+        const decoded = yield* Schema.decodeUnknownEffect(WorkObservedAdmission)(request).pipe(Effect.mapError(storeError("admission.decode")));
+        return yield* this.#admit(decoded, { _tag: "observed", observationId: decoded.observationId });
+    });
+    #admit = Effect.fn("WorkStore.admit")(function* (decoded, provenance) {
         const target = Schema.decodeUnknownSync(WorkAdmissionTarget)(decoded);
         const now = yield* Clock.currentTimeMillis;
         yield* this.secureFiles();
@@ -1906,13 +2321,10 @@ export class WorkStore {
                     const state = admissionState(this.#database, target);
                     if (state._tag === "existing") {
                         const existing = state.link;
-                        const provenance = existing.binding.request.prospectiveAdmission;
                         this.#database.exec("ROLLBACK");
                         transaction = false;
                         return existing.binding.request.dispatchRequestId === decoded.operationId &&
-                            provenance?.expectedAbsenceToken === decoded.expectedAbsenceToken &&
-                            provenance?.approvalJobId === decoded.approvalJobId &&
-                            provenance.approvalActor === decoded.approvalActor &&
+                            sameAdmission(existing.binding.request, decoded.expectedAbsenceToken, provenance) &&
                             existing.goal.title === decoded.title &&
                             existing.goal.summary === decoded.summary &&
                             existing.goal.detail === decoded.detail
@@ -1955,7 +2367,7 @@ export class WorkStore {
                         activity: [{
                                 id: `${decoded.operationId}.admission`,
                                 kind: "status",
-                                summary: `Prospective admission of an existing owner by approved Fleet job ${decoded.approvalJobId}`,
+                                summary: admissionSummary(provenance),
                                 occurredAt: createdAt
                             }],
                         review: { state: "requested", summary: null, updatedAt: createdAt, url: decoded.reviewUrl },
@@ -1989,14 +2401,12 @@ export class WorkStore {
                             laneId: decoded.laneId,
                             expectedRevision: 0,
                             worker: decoded.worker,
-                            prospectiveAdmission: {
+                            ...admissionRecord(provenance, {
                                 sessionId: decoded.sessionId,
                                 workAssignment: decoded.expectedWork,
                                 baseHead: decoded.baseHead,
-                                expectedAbsenceToken: decoded.expectedAbsenceToken,
-                                approvalJobId: decoded.approvalJobId,
-                                approvalActor: decoded.approvalActor
-                            }
+                                expectedAbsenceToken: decoded.expectedAbsenceToken
+                            })
                         },
                         lane,
                         checkpoint: {
@@ -2043,7 +2453,7 @@ export class WorkStore {
                             _tag: "rejected",
                             error: capacity ?? new WorkProjectionError({
                                 cause: decoded,
-                                detail: "prospective admission exceeds Work capacity",
+                                detail: "admission exceeds Work capacity",
                                 reason: "capacity_exceeded"
                             })
                         };
@@ -2190,7 +2600,7 @@ export class WorkStore {
                     if (currentDecision._tag === "invalid")
                         return reject(currentDecision.error);
                     const current = currentDecision.checkpoint;
-                    if (current.goal.state === "completed") {
+                    if (current.goal.state === "completed" || current.goal.state === "abandoned") {
                         return reject(new WorkAgentBindingAuthorityError({
                             actualRevision: lane.revision,
                             expectedRevision: decoded.expectedRevision,
@@ -2327,8 +2737,26 @@ export class WorkStore {
         const entries = yield* Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({ dispatchRequestId: WorkAgentBindingRequest.fields.dispatchRequestId })))(rows).pipe(Effect.mapError(storeError("agent-binding.lane.rows")));
         return entries.map(({ dispatchRequestId }) => dispatchRequestId);
     });
-    append = Effect.fn("WorkStore.append")(function* (event) {
+    append = (event) => this.appendAt(event, null).pipe(
+    // Only an expected head can raise it; a plain append never checks one.
+    Effect.catchTag("WorkGoalRevisionConflictError", Effect.die));
+    /**
+     * Appends one checkpoint. With `expectedHead`, the goal's latest checkpoint
+     * must still be that one when the write commits (an exact replay always
+     * succeeds), so a writer that planned from the head cannot bury a newer
+     * owner checkpoint.
+     */
+    appendAt = Effect.fn("WorkStore.append")(function* (event, guard) {
         const decoded = yield* Schema.decodeUnknownEffect(WorkGoalCheckpoint)(event).pipe(Effect.mapError(storeError("append.decode")));
+        // The reconciler's event and activity ids are its provenance; no other
+        // writer may use them.
+        if (guard === null && decoded.eventId.startsWith(reconcilerEventPrefix)) {
+            return yield* new WorkProjectionError({
+                cause: decoded.eventId,
+                detail: `event ids starting with ${reconcilerEventPrefix} are reserved for the reconciler`,
+                reason: "malformed"
+            });
+        }
         yield* this.secureFiles();
         const decision = yield* Effect.try({
             try: () => {
@@ -2345,12 +2773,37 @@ export class WorkStore {
                         .prepare(`SELECT record FROM work_goal_events
                  WHERE event_id = ? OR (goal_id = ? AND occurred_at = ?)`)
                         .all(decoded.eventId, decoded.goal.id, decoded.occurredAt)).map(({ record }) => Schema.decodeUnknownSync(WorkGoalCheckpoint)(JSON.parse(record)));
-                    if (collisions.length > 0) {
-                        if (collisions.every((existing) => Equal.equals(existing, decoded))) {
-                            this.#database.exec("ROLLBACK");
-                            transaction = false;
-                            return { _tag: "replayed", event: decoded };
+                    if (collisions.length > 0 && collisions.every((existing) => Equal.equals(existing, decoded))) {
+                        this.#database.exec("ROLLBACK");
+                        transaction = false;
+                        return { _tag: "replayed", event: decoded };
+                    }
+                    if (guard !== null) {
+                        // Planned from this head and this fact: if either moved, the plan is stale.
+                        const headRow = this.#database.prepare(`SELECT record FROM work_goal_events WHERE goal_id = ?
+               ORDER BY occurred_at DESC, event_id DESC LIMIT 1`).get(decoded.goal.id);
+                        const head = headRow === undefined ? null : Schema.decodeUnknownSync(WorkGoalCheckpoint)(JSON.parse(Schema.decodeUnknownSync(StoredEventRow)(headRow).record));
+                        const factRow = this.#database.prepare("SELECT observation_id AS observationId FROM work_observed_facts WHERE subject = ?").get(guard.fact.subject);
+                        const fact = factRow === undefined ? null : Schema.decodeUnknownSync(ObservationIdRow)(factRow);
+                        if (head?.eventId !== guard.head.eventId || fact?.observationId !== guard.fact.observationId) {
+                            return reject(new WorkGoalRevisionConflictError({
+                                actualEventId: head?.eventId ?? null,
+                                actualUpdatedAt: head?.goal.updatedAt ?? null,
+                                expectedEventId: guard.head.eventId,
+                                expectedUpdatedAt: guard.head.goal.updatedAt,
+                                goalId: decoded.goal.id
+                            }));
+                        }
+                        const count = Schema.decodeUnknownSync(CountRow)(this.#database.prepare("SELECT COUNT(*) AS count FROM work_goal_events").get()).count;
+                        if (count + 1 > workHistoryMaxEvents - guard.reserve) {
+                            return reject(new WorkProjectionError({
+                                cause: count,
+                                detail: `the reconciler leaves ${guard.reserve} of ${workHistoryMaxEvents} checkpoints free`,
+                                reason: "capacity_exceeded"
+                            }));
                         }
+                    }
+                    if (collisions.length > 0) {
                         return reject(new WorkCheckpointConflictError({
                             eventId: decoded.eventId,
                             goalId: decoded.goal.id,
@@ -2405,6 +2858,11 @@ export class WorkStore {
                         }
                     }
                     const result = this.#database.prepare("INSERT INTO work_goal_events (event_id, goal_id, occurred_at, record) VALUES (?, ?, ?, ?)").run(decoded.eventId, decoded.goal.id, decoded.occurredAt, JSON.stringify(decoded));
+                    // The reconciler's own record of what it wrote: its authorship and its
+                    // once-per-goal rule come from this table, never from an id's spelling.
+                    if (guard !== null) {
+                        this.#database.prepare("INSERT INTO work_reconciler_events (event_id, goal_id) VALUES (?, ?)").run(decoded.eventId, decoded.goal.id);
+                    }
                     this.#database.exec("COMMIT");
                     transaction = false;
                     return { _tag: "inserted", changes: result.changes };
@@ -2436,6 +2894,14 @@ export class WorkStore {
         }
         const transaction = yield* Schema.decodeUnknownEffect(TransactionId)(transactionId).pipe(Effect.mapError(storeError("appendMany.decode.transaction")));
         const decoded = yield* Effect.forEach(events, (event) => Schema.decodeUnknownEffect(WorkGoalCheckpoint)(event).pipe(Effect.mapError(storeError("appendMany.decode.event"))));
+        const reserved = decoded.find(({ eventId }) => eventId.startsWith(reconcilerEventPrefix));
+        if (reserved !== undefined) {
+            return yield* new WorkProjectionError({
+                cause: reserved.eventId,
+                detail: `event ids starting with ${reconcilerEventPrefix} are reserved for the reconciler`,
+                reason: "malformed"
+            });
+        }
         if (decoded.length === 0) {
             return yield* new WorkProjectionError({
                 cause: events,
@@ -2937,7 +3403,7 @@ export class WorkStore {
                             goal.goalFamily?.role !== "canonical" ||
                             goal.goalFamily.canonicalGoalId !== goal.id)
                             return rejectLink("missing_provenance");
-                        if (goal.state === "completed" || goal.state === "deployed")
+                        if (isTerminalWorkState(goal.state))
                             return rejectLink("terminal_goal");
                         if (!Equal.equals(goal.owner, reconciliation.expectedOwner))
                             return rejectLink("owner_mismatch");
@@ -3353,9 +3819,18 @@ export class WorkStore {
                phase, revision, record
              FROM work_lane_operations ORDER BY operation_id ASC
              LIMIT ?`).all(workLaneOperationMaxRecords + 1);
+                    const facts = this.#database.prepare(`SELECT subject, observation_id AS observationId, observed_at AS observedAt,
+               confirmed_at AS confirmedAt, record
+             FROM work_observed_facts ORDER BY subject ASC
+             LIMIT ?`).all(workObservedFactMaxRecords + 1);
+                    const failures = this.#database.prepare(`SELECT subject, source, reason, since, last_at AS lastAt
+             FROM work_observed_failures ORDER BY subject ASC LIMIT ?`).all(workObservedFactMaxRecords + 1);
+                    const reconcilerRows = this.#database.prepare("SELECT event_id AS eventId, goal_id AS goalId FROM work_reconciler_events ORDER BY event_id ASC LIMIT ?").all(workHistoryMaxEvents + 1);
+                    const reassignments = this.#database.prepare(`SELECT approval_job_id AS approvalJobId, goal_id AS goalId FROM work_goal_reassignments
+             UNION ALL SELECT approval_job_id AS approvalJobId, goal_id AS goalId FROM work_goal_abandonments`).all();
                     this.#database.exec("COMMIT");
                     inTransaction = false;
-                    return { bindings, events, laneOperations };
+                    return { bindings, events, facts, failures, laneOperations, reassignments, reconcilerRows };
                 }
                 catch (cause) {
                     if (inTransaction)
@@ -3380,6 +3855,23 @@ export class WorkStore {
         const eventById = new Map(eventRows.map((row) => [row.eventId, row]));
         const laneByOperation = new Map(laneRows.map((row) => [row.operationId, row]));
         let logicalObservedAt = null;
+        // An approved job's activity id is its operation (recovery), the operation
+        // plus `.admission` (prospective admission), or the job id (reassignment).
+        const reassignmentRows = yield* Schema.decodeUnknownEffect(Schema.Array(ReassignmentApprovalRow))(source.reassignments).pipe(Effect.mapError(storeError("snapshot-input.decode-reassignments")));
+        // An approved reassignment or abandonment may be stamped past the clock
+        // (one past a future-dated head); like a binding, it moves logical time so
+        // a default snapshot shows what the approved job wrote.
+        for (const { approvalJobId } of reassignmentRows) {
+            const written = eventById.get(approvalJobId);
+            if (written !== undefined)
+                logicalObservedAt = Math.max(logicalObservedAt ?? 0, written.occurredAt);
+        }
+        const approvals = reassignmentRows.map(({ approvalJobId, goalId }) => ({
+            activityId: approvalJobId,
+            approvalJobId,
+            goalId
+        }));
+        const observedAdmissions = [];
         for (const row of bindingRows) {
             const binding = yield* Effect.try({
                 try: () => Schema.decodeUnknownSync(WorkAgentBinding)(JSON.parse(row.record)),
@@ -3400,8 +3892,173 @@ export class WorkStore {
             if (readbackError !== undefined)
                 return yield* readbackError;
             logicalObservedAt = Math.max(logicalObservedAt ?? 0, binding.checkpoint.occurredAt);
+            const goalId = binding.checkpoint.goal.id;
+            const { dispatchRequestId, existingGoalRecovery, observedAdmission, ownerReassignment, prospectiveAdmission } = binding.request;
+            if (observedAdmission !== undefined) {
+                observedAdmissions.push({ eventId: `${dispatchRequestId}.admission`, goalId });
+            }
+            if (prospectiveAdmission !== undefined) {
+                approvals.push({
+                    activityId: `${dispatchRequestId}.admission`,
+                    approvalJobId: prospectiveAdmission.approvalJobId,
+                    goalId
+                });
+            }
+            if (existingGoalRecovery !== undefined) {
+                approvals.push({ activityId: dispatchRequestId, approvalJobId: existingGoalRecovery.approvalJobId, goalId });
+            }
+            if (ownerReassignment !== undefined) {
+                approvals.push({
+                    activityId: ownerReassignment.approvalJobId,
+                    approvalJobId: ownerReassignment.approvalJobId,
+                    goalId
+                });
+            }
+        }
+        const factRows = yield* Schema.decodeUnknownEffect(Schema.Array(ObservedFactRow))(source.facts).pipe(Effect.mapError(storeError("snapshot-input.decode-fact-rows")));
+        const failures = yield* Schema.decodeUnknownEffect(Schema.Array(WorkObservedFailure))(source.failures).pipe(Effect.mapError(storeError("snapshot-input.decode-failures")));
+        if (factRows.length > workObservedFactMaxRecords || failures.length > workObservedFactMaxRecords) {
+            return yield* new WorkStoreError({ cause: factRows.length, operation: "snapshot-input.fact-capacity" });
+        }
+        const facts = yield* Effect.forEach(factRows, (row) => Effect.try({
+            try: () => Schema.decodeUnknownSync(WorkObservedFact)({
+                confirmedAt: row.confirmedAt,
+                observation: JSON.parse(row.record),
+                observationId: row.observationId,
+                observedAt: row.observedAt,
+                subject: row.subject
+            }),
+            catch: storeError("snapshot-input.decode-fact")
+        }));
+        // A row is filed under its own facts' subject; anything else is a corrupt row.
+        const misfiled = facts.find((fact) => fact.subject !== observationSubject(fact.observation));
+        if (misfiled !== undefined) {
+            return yield* new WorkStoreError({ cause: misfiled.subject, operation: "snapshot-input.fact-subject" });
+        }
+        const reconcilerEvents = yield* Schema.decodeUnknownEffect(Schema.Array(ReconcilerEventRow))(source.reconcilerRows)
+            .pipe(Effect.mapError(storeError("snapshot-input.decode-reconciler-events")));
+        // Each current activity's origin: the checkpoint that started its current
+        // unchanged run. An activity that disappears, or reads differently, starts
+        // a new run, so a later owner rewrite or re-creation is never credited to
+        // whoever wrote an earlier version.
+        const activityOrigins = new Map();
+        const previousByGoal = new Map();
+        const ordered = events.toSorted((left, right) => left.occurredAt - right.occurredAt || (left.eventId < right.eventId ? -1 : left.eventId > right.eventId ? 1 : 0));
+        for (const event of ordered) {
+            const previous = previousByGoal.get(event.goal.id) ?? new Map();
+            const current = new Map((event.goal.activity ?? []).map((activity) => [activity.id, activity]));
+            for (const [id, activity] of current) {
+                const before = previous.get(id);
+                const unchanged = before !== undefined && before.kind === activity.kind &&
+                    before.summary === activity.summary &&
+                    before.occurredAt === activity.occurredAt;
+                if (!unchanged)
+                    activityOrigins.set(`${event.goal.id}\u0000${id}`, { activity, eventId: event.eventId });
+            }
+            previousByGoal.set(event.goal.id, current);
         }
-        return { events, logicalObservedAt };
+        return {
+            activityOrigins,
+            approvals,
+            events,
+            facts,
+            failures,
+            logicalObservedAt,
+            observedAdmissions,
+            reconcilerEvents
+        };
+    });
+    reconcile = Effect.fn("WorkStore.reconcile")(function* () {
+        const source = yield* this.snapshotInput();
+        if (workHistoryMaxEvents - source.events.length < workReconcilerHeadroom) {
+            return yield* new WorkProjectionError({
+                cause: source.events.length,
+                detail: `the reconciler leaves ${workReconcilerHeadroom} of ${workHistoryMaxEvents} checkpoints free`,
+                reason: "capacity_exceeded"
+            });
+        }
+        // A goal is stamped by the reconciler at most once, whatever its facts
+        // look like later: a reopened goal stays the owner's.
+        const stamped = new Map(source.reconcilerEvents.map(({ eventId, goalId }) => [goalId, eventId]));
+        const cryptoService = this.#cryptoService;
+        const now = yield* Clock.currentTimeMillis;
+        const appendAt = (checkpoint, guard) => this.appendAt(checkpoint, guard);
+        return yield* Effect.forEach(terminalCandidates(source.events, source.facts), Effect.fnUntraced(function* (candidate) {
+            const goalId = candidate.head.goal.id;
+            const previous = stamped.get(goalId);
+            if (previous !== undefined)
+                return { _tag: "recorded", eventId: previous, goalId };
+            const digest = yield* cryptoService.digest("SHA-256", utf8.encode(`${candidate.fact.observationId}\u0000${goalId}`)).pipe(Effect.mapError(storeError("reconcile.digest")));
+            const eventId = `${reconcilerEventPrefix}${Hex.encode(digest)}`;
+            const checkpoint = terminalCheckpoint(candidate, eventId, now);
+            // A goal that cannot take its terminal checkpoint (an activity already
+            // holds the reconciler's id, a timestamp past the bound) is left for
+            // its owner: reported as a conflict, never failing the other goals.
+            if (Result.isFailure(checkpoint))
+                return { _tag: "conflict", goalId };
+            return yield* appendAt(checkpoint.success, {
+                fact: { observationId: candidate.fact.observationId, subject: candidate.fact.subject },
+                head: candidate.head,
+                reserve: workReconcilerHeadroom
+            }).pipe(Effect.as({
+                _tag: "applied",
+                eventId,
+                goalId,
+                state: candidate.pullRequest.state === "merged" ? "completed" : "abandoned"
+            }), Effect.catchTag("WorkGoalRevisionConflictError", () => Effect.succeed({ _tag: "conflict", goalId })));
+        }));
+    });
+    observe = Effect.fn("WorkStore.observe")(function* (envelopes) {
+        const decoded = yield* Schema.decodeUnknownEffect(Schema.Array(WorkObservationEnvelope).check(Schema.isMaxLength(workObservedFactMaxRecords)))(envelopes).pipe(Effect.mapError(storeError("observe.decode")));
+        const cryptoService = this.#cryptoService;
+        // An observation from further ahead than clock skew allows would outrank
+        // every real reading until wall time caught up, so it is skipped as stale.
+        const clockNow = yield* Clock.currentTimeMillis;
+        const latestAllowed = clockNow + workObservationMaxSkewMillis;
+        const prepared = yield* Effect.forEach(decoded, Effect.fnUntraced(function* (envelope) {
+            // Composite subjects are bounded on their own; check before anything is written.
+            const subject = yield* Schema.decodeUnknownEffect(WorkObservationSubject)(observationSubject(envelope.observation)).pipe(Effect.mapError(storeError("observe.subject")));
+            if (envelope.observedAt > latestAllowed)
+                return { _tag: "future", subject };
+            if (envelope.observation._tag === "unknown") {
+                if (canonicalSubject(envelope.observation.source, envelope.observation.subject) === null) {
+                    return yield* new WorkStoreError({ cause: envelope.observation, operation: "observe.subject" });
+                }
+                return {
+                    _tag: "unknown",
+                    // Within the skew allowance, a reading from slightly ahead counts
+                    // as now, so it is visible to a snapshot taken now.
+                    observedAt: Math.min(envelope.observedAt, clockNow),
+                    reason: envelope.observation.reason,
+                    source: envelope.observation.source,
+                    subject
+                };
+            }
+            // Case-insensitive identities are lowercased so a spelling change is the
+            // same fact; encoding emits keys in schema field order, so equal facts
+            // give equal text and one id.
+            const record = JSON.stringify(Schema.encodeSync(WorkObservationEnvelope)({
+                ...envelope,
+                observation: canonicalObservation(envelope.observation)
+            })
+                .observation);
+            const digest = yield* cryptoService.digest("SHA-256", utf8.encode(record)).pipe(Effect.mapError(storeError("observe.digest")));
+            return {
+                _tag: "fact",
+                observationId: Hex.encode(digest),
+                observedAt: Math.min(envelope.observedAt, clockNow),
+                record,
+                subject
+            };
+        }));
+        yield* this.secureFiles();
+        const report = yield* Effect.try({
+            try: () => writeObservations(this.#database, prepared),
+            catch: storeError("observe.write")
+        });
+        // The write may have created the WAL siblings; they get the same private mode.
+        yield* this.secureFiles();
+        return report;
     });
     secureFiles() {
         return this.#secureFiles;