@moretea-labs/forge 1.8.1 → 1.8.2

package/supervisor/store.ts

@@ -1,8 +1,9 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { mkdirSync } from 'node:fs';
 import { resolveWorkflowSupervisorForgeHome, workflowSupervisorDatabasePathValue, workflowSupervisorRootPath } from './paths';
-import type { WorkflowEffectKind, WorkflowEffectOutcome, WorkflowSupervisorCompletion, WorkflowSupervisorContinuationProof, WorkflowSupervisorDiscoverySnapshot, WorkflowSupervisorDiscoveredConversation, WorkflowSupervisorEffect, WorkflowSupervisorTask, WorkflowSupervisorTaskInput, WorkflowSupervisorTaskStall, WorkflowSupervisorTerminalState } from './types';
+import { validateSupervisorObjective } from './protocol';
+import type { WorkflowEffectKind, WorkflowEffectOutcome, WorkflowSupervisorCompletion, WorkflowSupervisorContinuationProof, WorkflowSupervisorDiscoverySnapshot, WorkflowSupervisorDiscoveredConversation, WorkflowSupervisorEffect, WorkflowSupervisorTask, WorkflowSupervisorTaskInput, WorkflowSupervisorTaskStall, WorkflowSupervisorTerminalState, WorkflowSupervisorPreflightComposerObservation } from './types';
 export type { WorkflowSupervisorTaskStall } from './types';
 
 interface Statement { get(...params: unknown[]): unknown; all(...params: unknown[]): unknown[]; run(...params: unknown[]): unknown; finalize?(): void }
@@ -53,6 +54,10 @@ function json(value: unknown): string {
   return JSON.stringify(value);
 }
 
+export function workflowSupervisorCompletionContractSha256(contract: Record<string, unknown>): string {
+  return createHash('sha256').update(json(contract)).digest('hex');
+}
+
 export { resolveWorkflowSupervisorForgeHome } from './paths';
 export function workflowSupervisorRoot(forgeHome?: string): string {
   const root = workflowSupervisorRootPath(forgeHome);
@@ -91,6 +96,10 @@ function openDatabase(forgeHome?: string): Database {
       kind TEXT NOT NULL, effect_id TEXT, completion_fingerprint TEXT, payload_json TEXT NOT NULL, occurred_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS events_task_order ON events(task_id, event_id);
+    -- Terminal probes run for every task on the polling/reconciliation paths.
+    -- Index only terminal facts so an open task does not rescan its whole log.
+    CREATE INDEX IF NOT EXISTS events_terminal_task_order ON events(task_id, event_id)
+      WHERE kind IN ('terminal_done','terminal_needs_user','terminal_stopped');
     CREATE INDEX IF NOT EXISTS events_effect_kind_order ON events(effect_id, kind, event_id);
     CREATE TABLE IF NOT EXISTS discovered_conversations (
       source TEXT NOT NULL, conversation_id TEXT NOT NULL, canonical_url TEXT NOT NULL, title TEXT,
@@ -143,6 +152,7 @@ function completionFromRow(row: Record<string, unknown>): WorkflowSupervisorComp
   };
 }
 function parsedObject(value: unknown): Record<string, unknown> {
+  if (value && typeof value === 'object' && !Array.isArray(value)) return value as Record<string, unknown>;
   try { const parsed = JSON.parse(String(value)); return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed as Record<string, unknown> : {}; }
   catch { return {}; }
 }
@@ -151,7 +161,12 @@ function storedGeneration(value: unknown): number {
   return Number.isInteger(generation) && generation > 0 ? generation : 1;
 }
 function latestNotAppliedProofEventId(db: Database, effectId: string): number {
-  const notApplied = statement(db, "SELECT event_id FROM events WHERE effect_id = ? AND kind = 'effect_not_applied' ORDER BY event_id DESC LIMIT 1", (s) => s.get(effectId)) as { event_id?: number } | undefined;
+  // Delayed negative evidence from an older generation must not authorize
+  // another Send while the latest generation is outcome-unknown. Apply this
+  // read-side fence to journals written by earlier releases as well.
+  const dispatch = statement(db, "SELECT event_id,payload_json FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' ORDER BY event_id DESC LIMIT 1", (s) => s.get(effectId)) as { event_id?: number; payload_json?: string } | undefined;
+  if (!dispatch?.event_id) return 0;
+  const notApplied = statement(db, "SELECT event_id FROM events WHERE effect_id = ? AND kind = 'effect_not_applied' AND event_id > ? AND json_extract(payload_json,'$.dispatch_generation') = ? ORDER BY event_id DESC LIMIT 1", (s) => s.get(effectId, dispatch.event_id, storedGeneration(dispatch.payload_json))) as { event_id?: number } | undefined;
   return Number(notApplied?.event_id ?? 0);
 }
 
@@ -192,6 +207,15 @@ function oldestUnappliedEffect(db: Database, taskId: string): WorkflowSupervisor
       SELECT 1 FROM events applied WHERE applied.effect_id = e.effect_id AND applied.kind = 'effect_applied'
     ) AND NOT EXISTS (
       SELECT 1 FROM events superseded WHERE superseded.effect_id = e.effect_id AND superseded.kind = 'effect_outcome_unknown_superseded'
+    ) AND NOT (
+      e.kind = 'recovery' AND NOT EXISTS (
+        SELECT 1 FROM events started
+        WHERE started.effect_id = e.effect_id AND started.kind = 'effect_dispatch_started'
+      ) AND EXISTS (
+        SELECT 1 FROM completions completed
+        WHERE completed.task_id = e.task_id
+          AND e.origin_key = 'provider-recovery:' || completed.source_effect_id
+      )
     ) ORDER BY e.created_at, e.effect_id LIMIT 1`, (s) => s.get(taskId)) as Record<string, unknown> | undefined;
   return row ? effectFromRow(row) : undefined;
 }
@@ -312,6 +336,12 @@ function unknownObservationDelayMs(count: number): number {
   );
 }
 
+function unknownObservationDue(db: Database, effectId: string, afterEventId: number, nowMs: number): boolean {
+  const observation = effectUnknownObservationLedger(db, effectId, afterEventId);
+  return observation.sameFingerprintCount === 0
+    || nowMs - observation.lastOccurredAtMs >= unknownObservationDelayMs(observation.sameFingerprintCount);
+}
+
 function effectDispatchLedger(db: Database, effectId: string): EffectDispatchLedger {
   const rows = statement(db, "SELECT event_id,payload_json,occurred_at FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' ORDER BY event_id", (s) => s.all(effectId)) as Array<{ event_id?: number; payload_json?: string; occurred_at?: string }>;
   const last = rows[rows.length - 1];
@@ -330,9 +360,9 @@ function effectDispatchLedger(db: Database, effectId: string): EffectDispatchLed
   };
 }
 /** Derived entirely from the Supervisor effect event log; no second retry authority. */
-function effectPreflightFailureReleaseIds(db: Database, effectId: string): string[] {
-  const rows = statement(db, "SELECT payload_json FROM events WHERE effect_id = ? AND kind = 'effect_preflight_rejected' ORDER BY event_id", (s) => s.all(effectId)) as Array<{ payload_json?: string }>;
-  return rows.map((row) => String(parsedObject(row.payload_json).active_release_id ?? 'unidentified-runtime'));
+function effectPreflightFailureReleaseIds(db: Database, effectId: string): Array<{ eventId: number; releaseId: string }> {
+  const rows = statement(db, "SELECT event_id,payload_json FROM events WHERE effect_id = ? AND kind = 'effect_preflight_rejected' ORDER BY event_id", (s) => s.all(effectId)) as Array<{ event_id?: number; payload_json?: string }>;
+  return rows.map((row) => ({ eventId: Number(row.event_id ?? 0), releaseId: String(parsedObject(row.payload_json).active_release_id ?? 'unidentified-runtime') }));
 }
 
 export class WorkflowSupervisorStore {
@@ -350,8 +380,18 @@ export class WorkflowSupervisorStore {
 
   private preflightBlocked(db: Database, effectId: string): boolean {
     const tried = effectPreflightFailureReleaseIds(db, effectId);
-    return tried.length >= WORKFLOW_SUPERVISOR_MAX_PREFLIGHT_RELEASE_ATTEMPTS
-      || tried.includes(this.activeReleaseId()?.trim() || 'unidentified-runtime');
+    const releaseId = this.activeReleaseId()?.trim() || 'unidentified-runtime';
+    const lastFailure = tried.filter((entry) => entry.releaseId === releaseId).at(-1);
+    // Three failed releases exhaust automatic re-preparation, not an
+    // operator's single explicit post-repair proof. The same durable event
+    // ledger still enforces one rearm at most and re-blocks after its failure.
+    const rearm = statement(db, "SELECT event_id FROM events WHERE effect_id = ? AND kind = 'effect_preflight_operator_rearmed' ORDER BY event_id DESC LIMIT 1", (s) => s.get(effectId)) as { event_id?: number } | undefined;
+    const rearmedEventId = Number(rearm?.event_id ?? 0);
+    if (tried.length >= WORKFLOW_SUPERVISOR_MAX_PREFLIGHT_RELEASE_ATTEMPTS) {
+      return rearmedEventId <= (tried.at(-1)?.eventId ?? 0);
+    }
+    if (!lastFailure) return false;
+    return rearmedEventId <= lastFailure.eventId;
   }
 
   close(): void {
@@ -423,6 +463,7 @@ export class WorkflowSupervisorStore {
   }
 
   registerTask(input: WorkflowSupervisorTaskInput): WorkflowSupervisorTask {
+    validateSupervisorObjective(input.objective);
     return this.transaction((db) => {
       const createdAt = now();
       statement(db, 'INSERT OR IGNORE INTO tasks VALUES (?, ?, ?, ?, ?, ?, ?, ?)', (s) => s.run(input.taskId, input.conversationId, input.conversationUrl, input.objective, json(input.completionContract), json(input.continuationPolicy), json(input.userBlockerPolicy), createdAt));
@@ -468,6 +509,14 @@ export class WorkflowSupervisorStore {
         && task.conversationId === input.conversationId
         && task.conversationUrl === input.conversationUrl;
       if (bootstrapUpgrade) {
+        const existingWorkId = boundedText(task.completionContract.work_id);
+        const existingRequirementId = boundedText(task.completionContract.requirement_id);
+        const incomingWorkId = boundedText(input.completionContract.work_id);
+        const incomingRequirementId = boundedText(input.completionContract.requirement_id);
+        if ((existingWorkId && incomingWorkId !== existingWorkId)
+          || (existingRequirementId && incomingRequirementId !== existingRequirementId)) {
+          throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_CONFLICT');
+        }
         statement(db, `UPDATE tasks
           SET objective = ?, completion_contract_json = ?, continuation_policy_json = ?, user_blocker_policy_json = ?
           WHERE task_id = ?`, (s) => s.run(
@@ -525,32 +574,62 @@ export class WorkflowSupervisorStore {
     requestId: string;
     authorizedBy: string;
     refreshEffect?: { effectId: string; expectedPrompt: string; prompt: string };
-  }): { task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean; objectiveSha256: string; refreshedEffect?: WorkflowSupervisorEffect } {
+    semanticBinding?: { workId?: string; requirementId?: string; expectedCompletionContractSha256: string };
+  }): { task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean; objectiveSha256: string; completionContractSha256: string; semanticBindingChanged: boolean; refreshedEffect?: WorkflowSupervisorEffect } {
     return this.transaction((db) => {
-      const objective = input.objective.trim();
-      if (!objective || objective.length > 8_000) throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_INVALID');
+      const objective = validateSupervisorObjective(input.objective);
       if (!/^[0-9a-f]{64}$/i.test(input.expectedObjectiveSha256)) throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_REVISION_EXPECTED_SHA_INVALID');
       if (!input.requestId.trim()) throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_REVISION_REQUEST_REQUIRED');
       const targetSha = objectiveSha256(objective);
+      const semanticBinding = input.semanticBinding;
+      const workId = boundedText(semanticBinding?.workId);
+      const requirementId = boundedText(semanticBinding?.requirementId);
+      if (semanticBinding) {
+        if (Boolean(workId) === Boolean(requirementId)) throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_TARGET_INVALID');
+        if (!/^[0-9a-f]{64}$/i.test(semanticBinding.expectedCompletionContractSha256)) {
+          throw new Error('WORKFLOW_SUPERVISOR_COMPLETION_CONTRACT_REVISION_EXPECTED_SHA_INVALID');
+        }
+      }
+      const semanticBindingKind = workId ? 'work' : requirementId ? 'requirement' : undefined;
+      const semanticBindingId = workId ?? requirementId;
       const eventKey = `task-objective-revise:${input.taskId}:${input.requestId}`;
+      const bindingEventKey = `task-semantic-binding-revise:${input.taskId}:${input.requestId}`;
       const existingEvent = statement(db, 'SELECT payload_json FROM events WHERE event_key = ?', (s) => s.get(eventKey)) as { payload_json?: string } | undefined;
+      const existingBindingEvent = statement(db, 'SELECT payload_json FROM events WHERE event_key = ?', (s) => s.get(bindingEventKey)) as { payload_json?: string } | undefined;
       if (existingEvent) {
         const payload = parsedObject(existingEvent.payload_json);
-        if (boundedText(payload.objective_sha256) !== targetSha) throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_REVISION_REQUEST_CONFLICT');
+        if (boundedText(payload.objective_sha256) !== targetSha
+          || boundedText(payload.semantic_binding_id) !== semanticBindingId
+          || boundedText(payload.semantic_binding_kind) !== semanticBindingKind
+          || Boolean(existingBindingEvent) !== Boolean(semanticBinding)) {
+          throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_REVISION_REQUEST_CONFLICT');
+        }
+        if (existingBindingEvent) {
+          const bindingPayload = parsedObject(existingBindingEvent.payload_json);
+          if (boundedText(bindingPayload.completion_contract_sha256) !== boundedText(payload.completion_contract_sha256)
+            || boundedText(bindingPayload.semantic_binding_id) !== semanticBindingId
+            || boundedText(bindingPayload.semantic_binding_kind) !== semanticBindingKind) {
+            throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_REVISION_REQUEST_CONFLICT');
+          }
+        }
         const taskRow = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
         if (!taskRow) throw new Error('WORKFLOW_SUPERVISOR_TASK_UNKNOWN');
+        const deduplicatedTask = taskFromRow(taskRow);
         const refreshedEffectId = boundedText(payload.refreshed_effect_id);
         const refreshedRow = refreshedEffectId
           ? statement(db, 'SELECT * FROM effects WHERE effect_id = ?', (s) => s.get(refreshedEffectId)) as Record<string, unknown> | undefined
           : undefined;
         return {
-          task: taskFromRow(taskRow),
+          task: deduplicatedTask,
           changed: payload.changed === true,
           deduplicated: true,
           objectiveSha256: targetSha,
+          completionContractSha256: workflowSupervisorCompletionContractSha256(deduplicatedTask.completionContract),
+          semanticBindingChanged: payload.semantic_binding_changed === true,
           ...(refreshedRow ? { refreshedEffect: effectFromRow(refreshedRow) } : {}),
         };
       }
+      if (existingBindingEvent) throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_REVISION_REQUEST_CONFLICT');
       const row = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
       if (!row) throw new Error('WORKFLOW_SUPERVISOR_TASK_UNKNOWN');
       const terminal = statement(db, "SELECT kind FROM events WHERE task_id = ? AND kind IN ('terminal_done','terminal_needs_user','terminal_stopped') ORDER BY event_id DESC LIMIT 1", (s) => s.get(input.taskId)) as { kind?: string } | undefined;
@@ -559,6 +638,31 @@ export class WorkflowSupervisorStore {
       const currentSha = objectiveSha256(task.objective);
       if (currentSha !== input.expectedObjectiveSha256.toLowerCase()) throw new Error('WORKFLOW_SUPERVISOR_OBJECTIVE_REVISION_CONFLICT');
 
+      const currentContractSha = workflowSupervisorCompletionContractSha256(task.completionContract);
+      let nextCompletionContract = task.completionContract;
+      let completionContractSha = currentContractSha;
+      let semanticBindingChanged = false;
+      if (semanticBinding) {
+        if (task.completionContract.kind !== 'model_semantic_completion') {
+          throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_REVISION_KIND_UNSUPPORTED');
+        }
+        const currentWorkId = boundedText(task.completionContract.work_id);
+        const currentRequirementId = boundedText(task.completionContract.requirement_id);
+        if ((currentWorkId || currentRequirementId)
+          && (currentWorkId !== workId || currentRequirementId !== requirementId)) {
+          throw new Error('WORKFLOW_SUPERVISOR_SEMANTIC_BINDING_CONFLICT');
+        }
+        if (currentContractSha !== semanticBinding.expectedCompletionContractSha256.toLowerCase()) {
+          throw new Error('WORKFLOW_SUPERVISOR_COMPLETION_CONTRACT_REVISION_CONFLICT');
+        }
+        nextCompletionContract = {
+          ...task.completionContract,
+          ...(workId ? { work_id: workId } : { requirement_id: requirementId }),
+        };
+        completionContractSha = workflowSupervisorCompletionContractSha256(nextCompletionContract);
+        semanticBindingChanged = completionContractSha !== currentContractSha;
+      }
+
       let refreshedEffect: WorkflowSupervisorEffect | undefined;
       if (input.refreshEffect) {
         const effectRow = statement(db, 'SELECT * FROM effects WHERE effect_id = ?', (s) => s.get(input.refreshEffect!.effectId)) as Record<string, unknown> | undefined;
@@ -579,6 +683,26 @@ export class WorkflowSupervisorStore {
 
       const changed = task.objective !== objective;
       if (changed) statement(db, 'UPDATE tasks SET objective = ? WHERE task_id = ?', (s) => s.run(objective, input.taskId));
+      if (semanticBindingChanged) {
+        statement(db, 'UPDATE tasks SET completion_contract_json = ? WHERE task_id = ?', (s) => s.run(json(nextCompletionContract), input.taskId));
+      }
+      if (semanticBinding) {
+        statement(db, 'INSERT INTO events(task_id,event_key,kind,payload_json,occurred_at) VALUES (?,?,?,?,?)', (s) => s.run(
+          input.taskId,
+          bindingEventKey,
+          'task_semantic_binding_revised',
+          json({
+            request_id: input.requestId,
+            authorized_by: input.authorizedBy,
+            semantic_binding_kind: semanticBindingKind,
+            semantic_binding_id: semanticBindingId,
+            previous_completion_contract_sha256: currentContractSha,
+            completion_contract_sha256: completionContractSha,
+            changed: semanticBindingChanged,
+          }),
+          now(),
+        ));
+      }
       statement(db, 'INSERT INTO events(task_id,event_key,kind,payload_json,occurred_at) VALUES (?,?,?,?,?)', (s) => s.run(
         input.taskId,
         eventKey,
@@ -589,16 +713,120 @@ export class WorkflowSupervisorStore {
           previous_objective_sha256: currentSha,
           objective_sha256: targetSha,
           changed,
+          completion_contract_sha256: completionContractSha,
+          ...(semanticBinding ? {
+            semantic_binding_kind: semanticBindingKind,
+            semantic_binding_id: semanticBindingId,
+            semantic_binding_changed: semanticBindingChanged,
+          } : {}),
           ...(refreshedEffect ? { refreshed_effect_id: refreshedEffect.effectId } : {}),
         }),
         now(),
       ));
       const updatedTask = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
       if (!updatedTask) throw new Error('WORKFLOW_SUPERVISOR_TASK_PERSIST_FAILED');
-      return { task: taskFromRow(updatedTask), changed, deduplicated: false, objectiveSha256: targetSha, ...(refreshedEffect ? { refreshedEffect } : {}) };
+      return {
+        task: taskFromRow(updatedTask), changed, deduplicated: false, objectiveSha256: targetSha,
+        completionContractSha256: completionContractSha, semanticBindingChanged,
+        ...(refreshedEffect ? { refreshedEffect } : {}),
+      };
     });
   }
   getTask(taskId: string): WorkflowSupervisorTask | undefined { return this.read((db) => { const row = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(taskId)); return row ? taskFromRow(row as Record<string, unknown>) : undefined; }); }
+  bindScheduledWake(input: { taskId: string; repoId: string; workId: string; scheduleId: string }): { task: WorkflowSupervisorTask; changed: boolean; deduplicated: boolean } {
+    const scheduleId = boundedText(input.scheduleId);
+    if (!scheduleId || scheduleId.length > 512) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_ID_INVALID');
+    return this.transaction((db) => {
+      const row = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
+      if (!row) throw new Error('WORKFLOW_SUPERVISOR_TASK_UNKNOWN');
+      const task = taskFromRow(row);
+      if (statement(db, "SELECT 1 FROM events WHERE task_id=? AND kind IN ('terminal_done','terminal_needs_user','terminal_stopped') LIMIT 1", (s) => s.get(input.taskId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_TASK_TERMINAL');
+      }
+      if (task.completionContract.repo_id !== input.repoId || task.completionContract.work_id !== input.workId) {
+        throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_WORK_IDENTITY_MISMATCH');
+      }
+      if (task.continuationPolicy.kind !== 'forge_goal_outer_turn') throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_OUTER_TURN_REQUIRED');
+      const existingScheduleId = boundedText(task.continuationPolicy.scheduled_wake_schedule_id);
+      if (existingScheduleId) {
+        if (existingScheduleId !== scheduleId) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_BINDING_CONFLICT');
+        return { task, changed: false, deduplicated: true };
+      }
+      const continuationPolicy = { ...task.continuationPolicy, scheduled_wake_schedule_id: scheduleId };
+      statement(db, 'UPDATE tasks SET continuation_policy_json = ? WHERE task_id = ?', (s) => s.run(json(continuationPolicy), input.taskId));
+      statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,payload_json,occurred_at) VALUES (?,?,?,?,?)', (s) => s.run(
+        input.taskId, `scheduled-wake-bound:${input.taskId}:${scheduleId}`, 'scheduled_wake_bound',
+        json({ repo_id: input.repoId, work_id: input.workId, schedule_id: scheduleId, attestation: 'exact_work_schedule_binding' }), now()));
+      const updated = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
+      if (!updated) throw new Error('WORKFLOW_SUPERVISOR_TASK_PERSIST_FAILED');
+      return { task: taskFromRow(updated), changed: true, deduplicated: false };
+    });
+  }
+  refreshUndispatchedEffectPrompt(input: { taskId: string; effectId: string; expectedPrompt: string; prompt: string }): boolean {
+    if (!input.prompt.trim()) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_PROMPT_REQUIRED');
+    return this.transaction((db) => {
+      const row = statement(db, 'SELECT * FROM effects WHERE effect_id = ?', (s) => s.get(input.effectId)) as Record<string, unknown> | undefined;
+      if (!row || String(row.task_id) !== input.taskId) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_TASK_MISMATCH');
+      if (String(row.prompt_text) !== input.expectedPrompt) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_PROMPT_CHANGED');
+      const dispatched = statement(db, "SELECT 1 FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' LIMIT 1", (s) => s.get(input.effectId));
+      const applied = statement(db, "SELECT 1 FROM events WHERE effect_id = ? AND kind = 'effect_applied' LIMIT 1", (s) => s.get(input.effectId));
+      if (dispatched || applied) return false;
+      statement(db, 'UPDATE effects SET prompt_text = ? WHERE effect_id = ? AND prompt_text = ?', (s) => s.run(input.prompt, input.effectId, input.expectedPrompt));
+      return true;
+    });
+  }
+  reserveScheduledWake(input: { taskId: string; scheduleId: string; occurrenceId: string; effectId: string; prompt: string }): { effect: WorkflowSupervisorEffect; deduplicated: boolean } {
+    const scheduleId = boundedText(input.scheduleId);
+    const occurrenceId = boundedText(input.occurrenceId);
+    if (!scheduleId || scheduleId.length > 512) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_ID_INVALID');
+    if (!occurrenceId || occurrenceId.length > 512) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_OCCURRENCE_ID_INVALID');
+    return this.transaction((db) => {
+      const row = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
+      if (!row) throw new Error('WORKFLOW_SUPERVISOR_TASK_UNKNOWN');
+      const task = taskFromRow(row);
+      if (task.continuationPolicy.kind !== 'forge_goal_outer_turn'
+        || task.continuationPolicy.scheduled_wake_schedule_id !== scheduleId) {
+        throw new Error('WORKFLOW_SUPERVISOR_SCHEDULE_BINDING_MISMATCH');
+      }
+      const originKey = `scheduled-wake:${scheduleId}:${occurrenceId}`;
+      const priorRow = statement(db, 'SELECT * FROM effects WHERE origin_key = ?', (s) => s.get(originKey)) as Record<string, unknown> | undefined;
+      if (priorRow) {
+        const prior = effectFromRow(priorRow);
+        if (prior.taskId !== input.taskId || prior.effectId !== input.effectId || prior.kind !== 'continuation' || !prior.sourceCompletionFingerprint) {
+          throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_IDENTITY_CONFLICT');
+        }
+        return { effect: prior, deduplicated: true };
+      }
+      if (statement(db, "SELECT 1 FROM events WHERE task_id=? AND kind IN ('terminal_done','terminal_needs_user','terminal_stopped') LIMIT 1", (s) => s.get(input.taskId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_TASK_TERMINAL');
+      }
+      if (oldestUnappliedEffect(db, input.taskId)) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_CAUSAL_OBLIGATION_PENDING');
+      const awaitingReceipt = statement(db, `SELECT 1 AS ok FROM effects e
+        WHERE e.task_id = ?
+          AND EXISTS (SELECT 1 FROM events applied WHERE applied.effect_id = e.effect_id AND applied.kind = 'effect_applied')
+          AND NOT EXISTS (SELECT 1 FROM completions c WHERE c.task_id = e.task_id AND c.source_effect_id = e.effect_id)
+        LIMIT 1`, (s) => s.get(input.taskId));
+      if (awaitingReceipt) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_CAUSAL_OBLIGATION_PENDING');
+      const latestRow = statement(db, "SELECT c.* FROM completions c WHERE c.task_id = ? ORDER BY COALESCE((SELECT MAX(completion_event.event_id) FROM events completion_event WHERE completion_event.task_id = c.task_id AND completion_event.completion_fingerprint = c.completion_fingerprint AND completion_event.kind = 'assistant_completion'), c.rowid) DESC LIMIT 1", (s) => s.get(input.taskId)) as Record<string, unknown> | undefined;
+      if (!latestRow) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_NOT_WAITING');
+      const completion = completionFromRow(latestRow);
+      if (completion.action !== 'WAIT') throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_NOT_WAITING');
+      const consumed = statement(db, 'SELECT * FROM effects WHERE task_id = ? AND source_completion_fingerprint = ?', (s) => s.get(input.taskId, completion.completionFingerprint)) as Record<string, unknown> | undefined;
+      if (consumed) throw new Error('WORKFLOW_SUPERVISOR_SCHEDULED_WAKE_ALREADY_CONSUMED');
+      const effect = this.reserveEffectWithin(db, {
+        taskId: input.taskId,
+        effectId: input.effectId,
+        kind: 'continuation',
+        originKey,
+        sourceCompletionFingerprint: completion.completionFingerprint,
+        prompt: input.prompt,
+      });
+      statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,completion_fingerprint,payload_json,occurred_at) VALUES (?,?,?,?,?,?,?)', (s) => s.run(
+        input.taskId, `scheduled-wake-committed:${scheduleId}:${occurrenceId}`, 'scheduled_wake_reserved', effect.effectId,
+        completion.completionFingerprint, json({ schedule_id: scheduleId, occurrence_id: occurrenceId, source_completion_fingerprint: completion.completionFingerprint }), now()));
+      return { effect, deduplicated: false };
+    });
+  }
   bindBootstrapConversation(taskId: string, conversationId: string, conversationUrl: string): WorkflowSupervisorTask {
     return this.transaction((db) => {
       const row = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(taskId)) as Record<string, unknown> | undefined;
@@ -674,12 +902,12 @@ export class WorkflowSupervisorStore {
       WHERE c.action = 'CONTINUE'
         AND NOT EXISTS (SELECT 1 FROM effects successor WHERE successor.origin_key = 'completion:' || c.completion_fingerprint)
         AND NOT EXISTS (SELECT 1 FROM events terminal WHERE terminal.task_id = c.task_id AND terminal.kind IN ('terminal_done','terminal_needs_user','terminal_stopped'))
-      ORDER BY c.committed_at DESC, c.completion_fingerprint DESC LIMIT ?`, (s) => s.all(boundedLimit))
+      ORDER BY COALESCE((SELECT MAX(completion_event.event_id) FROM events completion_event WHERE completion_event.task_id = c.task_id AND completion_event.completion_fingerprint = c.completion_fingerprint AND completion_event.kind = 'assistant_completion'), c.rowid) DESC LIMIT ?`, (s) => s.all(boundedLimit))
       .map((row) => completionFromRow(row as Record<string, unknown>)));
   }
   getCompletionByResponseSha256(taskId: string, responseSha256: string): WorkflowSupervisorCompletion | undefined {
     return this.read((db) => {
-      const rows = statement(db, 'SELECT * FROM completions WHERE task_id = ? AND response_sha256 = ? ORDER BY committed_at, completion_fingerprint LIMIT 2', (s) => s.all(taskId, responseSha256)) as Record<string, unknown>[];
+      const rows = statement(db, 'SELECT * FROM completions WHERE task_id = ? AND response_sha256 = ? ORDER BY committed_at, rowid LIMIT 2', (s) => s.all(taskId, responseSha256)) as Record<string, unknown>[];
       if (rows.length > 1) throw new Error('WORKFLOW_SUPERVISOR_RESPONSE_COMPLETION_AMBIGUOUS');
       return rows[0] ? completionFromRow(rows[0]) : undefined;
     });
@@ -687,12 +915,13 @@ export class WorkflowSupervisorStore {
   /** The only replay candidate when no applied effect is awaiting a receipt. */
   getLatestCompletion(taskId: string): WorkflowSupervisorCompletion | undefined {
     return this.read((db) => {
-      const row = statement(db, 'SELECT * FROM completions WHERE task_id = ? ORDER BY committed_at DESC, completion_fingerprint DESC LIMIT 1', (s) => s.get(taskId)) as Record<string, unknown> | undefined;
+      const row = statement(db, "SELECT c.* FROM completions c WHERE c.task_id = ? ORDER BY COALESCE((SELECT MAX(completion_event.event_id) FROM events completion_event WHERE completion_event.task_id = c.task_id AND completion_event.completion_fingerprint = c.completion_fingerprint AND completion_event.kind = 'assistant_completion'), c.rowid) DESC LIMIT 1", (s) => s.get(taskId)) as Record<string, unknown> | undefined;
       return row ? completionFromRow(row) : undefined;
     });
   }
   continuationProof(input: { repoId?: string; activeReleaseId: string; notBefore: string }): WorkflowSupervisorContinuationProof | undefined {
-    if (!Number.isFinite(Date.parse(input.notBefore))) throw new Error('WORKFLOW_SUPERVISOR_PROOF_BOUNDARY_INVALID');
+    const notBeforeMs = Date.parse(input.notBefore);
+    if (!Number.isFinite(notBeforeMs)) throw new Error('WORKFLOW_SUPERVISOR_PROOF_BOUNDARY_INVALID');
     const activeReleaseId = boundedText(input.activeReleaseId);
     if (!activeReleaseId) throw new Error('WORKFLOW_SUPERVISOR_PROOF_RELEASE_REQUIRED');
     return this.read((db) => {
@@ -701,46 +930,108 @@ export class WorkflowSupervisorStore {
         const task = taskFromRow(taskRow);
         const taskRepoId = boundedText(task.completionContract.repo_id) ?? boundedText(task.continuationPolicy.repo_id);
         if (input.repoId?.trim() && taskRepoId !== input.repoId.trim()) continue;
-        const completionRows = statement(db, 'SELECT * FROM completions WHERE task_id = ? AND committed_at >= ? ORDER BY committed_at, completion_fingerprint', (s) => s.all(task.taskId, input.notBefore)) as Record<string, unknown>[];
+        const completionRows = statement(db, "SELECT c.* FROM completions c WHERE c.task_id = ? AND c.committed_at >= ? ORDER BY COALESCE((SELECT MAX(completion_event.event_id) FROM events completion_event WHERE completion_event.task_id = c.task_id AND completion_event.completion_fingerprint = c.completion_fingerprint AND completion_event.kind = 'assistant_completion'), c.rowid) ASC", (s) => s.all(task.taskId, input.notBefore)) as Record<string, unknown>[];
         const completions = completionRows.map(completionFromRow);
-        // Release acceptance proves continuation liveness, not semantic task completion.
-        // Requiring DONE here deadlocks a long-running Supervisor goal against its own known-good gate.
-        for (let index = 0; index + 1 < completions.length; index += 1) {
+        // The bounded release canary task must prove C -> C -> accepted D.
+        // Long-running production tasks may remain open; any disposable task can supply this proof.
+        for (let index = 0; index + 2 < completions.length; index += 1) {
+          if (index + 3 !== completions.length) continue;
           const first = completions[index]!;
           const second = completions[index + 1]!;
-          if (first.action !== 'CONTINUE' || second.action !== 'CONTINUE') continue;
-          const rows = [first, second].map((completion) => statement(db, 'SELECT * FROM effects WHERE effect_id = ?', (s) => s.get(completion.sourceEffectId)) as Record<string, unknown> | undefined);
+          const third = completions[index + 2]!;
+          if (first.action !== 'CONTINUE' || second.action !== 'CONTINUE' || third.action !== 'DONE') continue;
+          const rows = [first, second, third].map((completion) => statement(db, 'SELECT * FROM effects WHERE effect_id = ?', (s) => s.get(completion.sourceEffectId)) as Record<string, unknown> | undefined);
           if (rows.some((row) => !row)) continue;
-          const [firstEffect, secondEffect] = rows.map((row) => effectFromRow(row!)) as [WorkflowSupervisorEffect, WorkflowSupervisorEffect];
-          if (secondEffect.sourceCompletionFingerprint !== first.completionFingerprint) continue;
+          const [firstEffect, secondEffect, thirdEffect] = rows.map((row) => effectFromRow(row!)) as [WorkflowSupervisorEffect, WorkflowSupervisorEffect, WorkflowSupervisorEffect];
+          if (
+            [firstEffect, secondEffect, thirdEffect].some((effect) => effect.taskId !== task.taskId)
+            || secondEffect.sourceCompletionFingerprint !== first.completionFingerprint
+            || thirdEffect.sourceCompletionFingerprint !== second.completionFingerprint
+          ) continue;
           const runtimeInstanceIds: string[] = [];
           let valid = true;
-          for (const effect of [firstEffect, secondEffect]) {
-            const dispatchRows = statement(db, "SELECT payload_json FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' AND occurred_at >= ? ORDER BY event_id", (s) => s.all(effect.effectId, input.notBefore)) as Array<{ payload_json?: string }>;
-            if (dispatchRows.length !== 1) { valid = false; break; }
-            const evidence = parsedObject(dispatchRows[0]?.payload_json);
+          let thirdCompletionEventId = 0;
+          for (const [completionIndex, completion, effect] of [
+            [0, first, firstEffect],
+            [1, second, secondEffect],
+            [2, third, thirdEffect],
+          ] as const) {
+            const dispatchRows = statement(db, "SELECT event_id,payload_json,occurred_at FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' ORDER BY event_id", (s) => s.all(effect.effectId)) as Array<{ event_id?: number; payload_json?: string; occurred_at?: string }>;
+            if (
+              dispatchRows.length !== 1
+              || !Number.isFinite(Date.parse(String(dispatchRows[0]?.occurred_at ?? '')))
+              || Date.parse(String(dispatchRows[0]?.occurred_at ?? '')) < notBeforeMs
+            ) { valid = false; break; }
+            const dispatch = dispatchRows[0]!;
+            const evidence = parsedObject(dispatch.payload_json);
             if (boundedText(evidence.active_release_id) !== activeReleaseId) { valid = false; break; }
             const runtimeInstanceId = boundedText(evidence.runtime_instance_id);
             if (!runtimeInstanceId) { valid = false; break; }
             runtimeInstanceIds.push(runtimeInstanceId);
-            const applied = statement(db, "SELECT 1 AS ok FROM events WHERE effect_id = ? AND kind = 'effect_applied' AND occurred_at >= ? LIMIT 1", (s) => s.get(effect.effectId, input.notBefore));
+            const appliedRows = statement(db, "SELECT event_id,occurred_at FROM events WHERE effect_id = ? AND kind = 'effect_applied' ORDER BY event_id", (s) => s.all(effect.effectId)) as Array<{ event_id?: number; occurred_at?: string }>;
+            const applied = appliedRows.find((row) => {
+              const occurredAtMs = Date.parse(String(row.occurred_at ?? ''));
+              return Number(row.event_id ?? 0) > Number(dispatch.event_id ?? 0)
+                && Number.isFinite(occurredAtMs)
+                && occurredAtMs >= notBeforeMs;
+            });
             if (!applied) { valid = false; break; }
+            const completionEvents = statement(db, "SELECT event_id,occurred_at FROM events WHERE task_id = ? AND completion_fingerprint = ? AND kind = 'assistant_completion' ORDER BY event_id", (s) => s.all(task.taskId, completion.completionFingerprint)) as Array<{ event_id?: number; occurred_at?: string }>;
+            if (
+              completionEvents.length !== 1
+              || !Number.isFinite(Date.parse(String(completionEvents[0]?.occurred_at ?? '')))
+              || Date.parse(String(completionEvents[0]?.occurred_at ?? '')) < notBeforeMs
+              || Number(completionEvents[0]?.event_id ?? 0) <= Number(applied.event_id ?? 0)
+            ) { valid = false; break; }
+            if (completionIndex === 2) thirdCompletionEventId = Number(completionEvents[0]?.event_id ?? 0);
           }
-          const minimumRuntimeInstances = task.continuationPolicy.kind === 'standalone_supervisor' ? 1 : 2;
+          const minimumRuntimeInstances = 2;
           if (!valid || new Set(runtimeInstanceIds).size < minimumRuntimeInstances) continue;
+          const terminalRows = statement(db, "SELECT event_id,occurred_at FROM events WHERE task_id = ? AND completion_fingerprint = ? AND kind = 'terminal_done' ORDER BY event_id", (s) => s.all(task.taskId, third.completionFingerprint)) as Array<{ event_id?: number; occurred_at?: string }>;
+          const latestTerminal = statement(db, "SELECT kind,completion_fingerprint FROM events WHERE task_id = ? AND kind IN ('terminal_done','terminal_needs_user','terminal_stopped') ORDER BY event_id DESC LIMIT 1", (s) => s.get(task.taskId)) as { kind?: string; completion_fingerprint?: string } | undefined;
+          if (
+            terminalRows.length !== 1
+            || !Number.isFinite(Date.parse(String(terminalRows[0]?.occurred_at ?? '')))
+            || Date.parse(String(terminalRows[0]?.occurred_at ?? '')) < notBeforeMs
+            || Number(terminalRows[0]?.event_id ?? 0) <= thirdCompletionEventId
+            || latestTerminal?.kind !== 'terminal_done'
+            || latestTerminal.completion_fingerprint !== third.completionFingerprint
+          ) continue;
           return {
             taskId: task.taskId, conversationId: task.conversationId, activeReleaseId,
-            actions: ['CONTINUE', 'CONTINUE'],
-            completionFingerprints: [first.completionFingerprint, second.completionFingerprint],
-            sourceEffectIds: [first.sourceEffectId, second.sourceEffectId],
+            actions: ['CONTINUE', 'CONTINUE', 'DONE'],
+            completionFingerprints: [first.completionFingerprint, second.completionFingerprint, third.completionFingerprint],
+            sourceEffectIds: [first.sourceEffectId, second.sourceEffectId, third.sourceEffectId],
             runtimeInstanceIds: [...new Set(runtimeInstanceIds)],
-            firstCommittedAt: first.committedAt, lastCommittedAt: second.committedAt,
+            firstCommittedAt: first.committedAt, lastCommittedAt: third.committedAt,
           };
         }
       }
       return undefined;
     });
   }
+  /**
+   * Exact persisted pre-Send editor evidence. ProseMirror may introduce a
+   * mid-body line break; only the observed prior exact digest grants recovery.
+   */
+  preSendComposerObservation(effectId: string): WorkflowSupervisorPreflightComposerObservation | undefined {
+    return this.read((db) => {
+      const sql = "SELECT e.payload_json FROM events e JOIN effects fx ON fx.effect_id = e.effect_id "
+        + "WHERE e.effect_id = ? AND e.kind = 'effect_preflight_rejected' "
+        + "AND e.event_id < (SELECT MIN(t.event_id) FROM events t WHERE t.task_id = fx.task_id AND t.kind = 'terminal_stopped') "
+        + "ORDER BY e.event_id DESC LIMIT 1";
+      const row = statement(db, sql, (query) => query.get(effectId)) as { payload_json?: string } | undefined;
+      const data = parsedObject(row?.payload_json);
+      const editor = parsedObject(data.composer_observation);
+      if (data.send_clicked !== false || data.attestation !== 'computer_prepare_returned_before_supervisor_send_intent'
+        || editor.classification !== 'current_effect' || editor.selectorVersion !== 'visible-single-v2'
+        || !Number.isInteger(editor.chars) || Number(editor.chars) < 1
+        || typeof editor.fingerprint !== 'string' || !/^[a-f0-9]{24}$/.test(editor.fingerprint)) return undefined;
+      return { chars: Number(editor.chars), fingerprint: editor.fingerprint,
+        classification: 'current_effect', selectorVersion: 'visible-single-v2' };
+    });
+  }
+
   latestEffectDispatch(effectId: string): { eventId: number; generation: number; evidence: Record<string, unknown> } | undefined {
     return this.read((db) => {
       const row = statement(db, "SELECT event_id,payload_json FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_started' ORDER BY event_id DESC LIMIT 1", (s) => s.get(effectId)) as { event_id?: number; payload_json?: string } | undefined;
@@ -781,11 +1072,7 @@ export class WorkflowSupervisorStore {
       }
       const retryAuthorized = latestNotAppliedProofEventId(db, effect.effectId) > ledger.lastEventId;
       if (!retryAuthorized) {
-        const unknownLedger = effectUnknownObservationLedger(db, effect.effectId, ledger.lastEventId);
-        if (unknownLedger.sameFingerprintCount > 0
-          && nowMs - unknownLedger.lastOccurredAtMs < unknownObservationDelayMs(unknownLedger.sameFingerprintCount)) {
-          return undefined;
-        }
+        if (!unknownObservationDue(db, effect.effectId, ledger.lastEventId, nowMs)) return undefined;
         return { effect, mode: 'reconcile', generation: ledger.lastGeneration };
       }
       if (ledger.generations >= WORKFLOW_SUPERVISOR_MAX_DISPATCH_GENERATIONS + ledger.budgetRefunds) return undefined;
@@ -826,7 +1113,19 @@ export class WorkflowSupervisorStore {
     const pending = this.currentUnappliedEffect(taskId);
     if (pending) {
       const ledger = this.read((db) => ({ ...effectDispatchLedger(db, pending.effectId), proof: latestNotAppliedProofEventId(db, pending.effectId), preflightBlocked: this.preflightBlocked(db, pending.effectId) }));
-      if (ledger.preflightBlocked) return { state: 'spaced', effectId: pending.effectId, reason: 'pre_send_infrastructure_blocked' };
+      if (ledger.preflightBlocked) {
+        const failure = this.read((db) => statement(db,
+          "SELECT payload_json FROM events WHERE effect_id = ? AND kind = 'effect_preflight_rejected' ORDER BY event_id DESC LIMIT 1",
+          (s) => s.get(pending.effectId)) as { payload_json?: string } | undefined);
+        const record = parsedObject(failure?.payload_json);
+        const reasonCode = boundedText(record.reason)?.slice(0, 256);
+        const diagnostic = record.composer_observation;
+        const preflightComposerObservation = diagnostic && typeof diagnostic === 'object' && !Array.isArray(diagnostic)
+          ? diagnostic as WorkflowSupervisorPreflightComposerObservation : undefined;
+        return { state: 'spaced', effectId: pending.effectId, reason: 'pre_send_infrastructure_blocked',
+          ...(reasonCode ? { preflightReasonCode: reasonCode } : {}),
+          ...(preflightComposerObservation ? { preflightComposerObservation } : {}) };
+      }
       const ceiling = WORKFLOW_SUPERVISOR_MAX_DISPATCH_GENERATIONS + ledger.budgetRefunds;
       const retryAuthorized = ledger.generations === 0 || ledger.proof > ledger.lastEventId;
       // An exhausted retry ceiling is the operator-facing state: no amount of
@@ -845,13 +1144,92 @@ export class WorkflowSupervisorStore {
     if (this.hasAppliedEffectAwaitingCompletion(taskId)) {
       return { state: 'spaced', ...(leaf ? { effectId: leaf.effectId } : {}), reason: 'awaiting_completion_receipt' };
     }
+    const waiting = this.read((db) => {
+      const taskRow = statement(db, 'SELECT * FROM tasks WHERE task_id = ?', (s) => s.get(taskId)) as Record<string, unknown> | undefined;
+      if (!taskRow) return undefined;
+      const task = taskFromRow(taskRow);
+      const scheduleId = boundedText(task.continuationPolicy.scheduled_wake_schedule_id);
+      if (!scheduleId) return undefined;
+      const latest = statement(db, "SELECT c.completion_fingerprint, c.action FROM completions c WHERE c.task_id = ? ORDER BY COALESCE((SELECT MAX(completion_event.event_id) FROM events completion_event WHERE completion_event.task_id = c.task_id AND completion_event.completion_fingerprint = c.completion_fingerprint AND completion_event.kind = 'assistant_completion'), c.rowid) DESC LIMIT 1", (s) => s.get(taskId)) as { completion_fingerprint?: string; action?: string } | undefined;
+      return latest?.action === 'WAIT' && latest.completion_fingerprint
+        ? { state: 'waiting' as const, scheduleId, completionFingerprint: latest.completion_fingerprint }
+        : undefined;
+    });
+    if (waiting) return waiting;
     return { state: 'inert' };
   }
   /**
-   * Explicit operator authority to continue a *mechanically proven* un-applied
-   * effect after its retry ceiling. The proof is the dispatch owner's persisted
-   * pre-send negative result, never page absence, so this can never replay a
-   * submitted mutation. Idempotent per request id and bounded per effect.
+   * Consecutive genuinely failed task-local attempts since the last durable
+   * provider progress or conversation move. Counts across failure codes and
+   * Runtime restarts; an unknown submission observation is NOT a failed send.
+   * This is a projection of the existing Supervisor journal, not another
+   * mutable retry or delivery authority.
+   */
+  automaticConversationFailureEvidence(taskId: string): { count: number; latestEventId: number; lastFailureAtMs: number } {
+    return this.read((db) => {
+      const row = statement(db, `SELECT COUNT(*) AS total, COALESCE(MAX(event_id),0) AS latest_id, MAX(occurred_at) AS last_at
+        FROM events WHERE task_id = ? AND kind IN (
+          'effect_preflight_rejected', 'assistant_provider_failed',
+          'assistant_recovery_exhausted', 'browser_delivery_attempt_failed'
+        ) AND event_id > COALESCE((
+          SELECT MAX(event_id) FROM events WHERE task_id = ?
+            AND kind IN ('effect_applied','assistant_completion','conversation_migrated')
+        ),0)`, (s) => s.get(taskId, taskId)) as { total?: number; latest_id?: number; last_at?: string };
+      return { count: Number(row?.total ?? 0), latestEventId: Number(row?.latest_id ?? 0),
+        lastFailureAtMs: Date.parse(row?.last_at ?? '') || 0 };
+    });
+  }
+
+  /** Journal one attempted task-local Computer operation, never a guessed Send. */
+  recordBrowserDeliveryAttemptFailure(input: { taskId: string; conversationId: string; code: string; effectId?: string }): void {
+    this.transaction((db) => {
+      const task = statement(db, 'SELECT conversation_id FROM tasks WHERE task_id = ?', (s) => s.get(input.taskId)) as { conversation_id?: string } | undefined;
+      // An old tab or pre-migration provider result cannot charge the new chat.
+      if (!task || task.conversation_id !== input.conversationId) return;
+      statement(db, 'INSERT INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(
+        input.taskId, `browser-delivery-failed:${input.taskId}:${randomUUID()}`,
+        'browser_delivery_attempt_failed', input.effectId ?? null,
+        json({ conversation_id: input.conversationId, code: input.code.slice(0, 128), phase: 'task_local_pre_mutation' }), now(),
+      ));
+    });
+  }
+
+  /** One operator-approved repair of a proven pre-send failure, never a provider retry refund. */
+  authorizeOperatorPreflightRetry(input: { effectId: string; requestId: string; reason: string; authorizedBy: string }): { deduplicated: boolean } {
+    return this.transaction((db) => {
+      const effect = statement(db, 'SELECT task_id FROM effects WHERE effect_id = ?', (s) => s.get(input.effectId)) as { task_id?: string } | undefined;
+      if (!effect?.task_id) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_UNKNOWN');
+      if (statement(db, "SELECT 1 FROM events WHERE effect_id = ? AND kind IN ('effect_applied','effect_outcome_unknown_superseded') LIMIT 1", (s) => s.get(input.effectId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_PRE_SEND_EFFECT_TERMINAL');
+      }
+      if (effectDispatchLedger(db, input.effectId).generations !== 0) throw new Error('WORKFLOW_SUPERVISOR_PRE_SEND_RECOVERY_SEND_ALREADY_RECORDED');
+      const key = `effect-preflight-operator-rearmed:${input.effectId}:${input.requestId}`;
+      if (statement(db, 'SELECT 1 FROM events WHERE event_key = ?', (s) => s.get(key))) return { deduplicated: true };
+      const failed = effectPreflightFailureReleaseIds(db, input.effectId);
+      const releaseId = this.activeReleaseId()?.trim() || 'unidentified-runtime';
+      // An operator may authorize ONE bounded no-Send re-observation after a
+      // verified repair, including on a successor Runtime after the automatic
+      // three-release cap. Never erase the prior failures or refund Send budget.
+      if (statement(db, "SELECT 1 FROM events WHERE effect_id = ? AND kind = 'effect_preflight_operator_rearmed' LIMIT 1", (s) => s.get(input.effectId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_PRE_SEND_OPERATOR_REARM_EXHAUSTED');
+      }
+      if (!this.preflightBlocked(db, input.effectId)
+        || (failed.length < WORKFLOW_SUPERVISOR_MAX_PREFLIGHT_RELEASE_ATTEMPTS
+          && !failed.some((entry) => entry.releaseId === releaseId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_PRE_SEND_RECOVERY_NOT_BLOCKED');
+      }
+      statement(db, 'INSERT INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(
+        effect.task_id!, key, 'effect_preflight_operator_rearmed', input.effectId,
+        json({ request_id: input.requestId, authorized_by: input.authorizedBy, reason: boundedText(input.reason)?.slice(0, 512), active_release_id: releaseId, attestation: 'operator_authorized_after_proven_no_send' }), now(),
+      ));
+      return { deduplicated: false };
+    });
+  }
+
+  /**
+   * Explicit operator authority to continue a mechanically proven un-applied
+   * send after its retry ceiling, without replaying an outcome-unknown mutation.
+   * This refund path is distinct from zero-generation UI preparation repair.
    */
   authorizeOperatorRetry(input: { effectId: string; requestId: string; reason: string; authorizedBy: string }): { refunds: number; generations: number; deduplicated: boolean } {
     return this.transaction((db) => {
@@ -946,6 +1324,12 @@ export class WorkflowSupervisorStore {
     });
   }
   effectApplied(effectId: string): boolean { return this.read((db) => Boolean(statement(db, "SELECT 1 AS ok FROM events WHERE effect_id = ? AND kind = 'effect_applied' LIMIT 1", (s) => s.get(effectId)))); }
+  bootstrapAppliedReconcileDue(effectId: string): boolean {
+    return this.read((db) => {
+      const dispatch = effectDispatchLedger(db, effectId);
+      return dispatch.generations > 0 && unknownObservationDue(db, effectId, dispatch.lastEventId, this.clockMs());
+    });
+  }
   providerResumeExhausted(effectId: string): boolean { return this.read((db) => Boolean(statement(db, "SELECT 1 AS ok FROM events WHERE effect_id = ? AND kind = 'assistant_recovery_exhausted' LIMIT 1", (s) => s.get(effectId)))); }
   latestAppliedEffectWithoutCompletion(taskId: string): WorkflowSupervisorEffect | undefined {
     return this.read((db) => {
@@ -966,7 +1350,10 @@ export class WorkflowSupervisorStore {
         WHERE e.task_id = ?
           AND EXISTS (SELECT 1 FROM events applied WHERE applied.effect_id = e.effect_id AND applied.kind = 'effect_applied')
           AND NOT EXISTS (SELECT 1 FROM completions c WHERE c.task_id = e.task_id AND c.source_effect_id = e.effect_id)
-          AND NOT EXISTS (SELECT 1 FROM effects child WHERE child.origin_key = 'provider-recovery:' || e.effect_id)
+          AND NOT EXISTS (SELECT 1 FROM effects child
+            WHERE child.origin_key = 'provider-recovery:' || e.effect_id
+              AND EXISTS (SELECT 1 FROM events started
+                WHERE started.effect_id = child.effect_id AND started.kind = 'effect_dispatch_started'))
         ORDER BY (SELECT MAX(event_id) FROM events applied WHERE applied.effect_id = e.effect_id AND applied.kind = 'effect_applied') DESC
         LIMIT 1`, (s) => s.get(taskId)) as Record<string, unknown> | undefined;
       return row ? effectFromRow(row) : undefined;
@@ -1262,12 +1649,16 @@ export class WorkflowSupervisorStore {
       // Other observers can report a transport error while the native sender
       // is still preparing. Only that generation's dispatch owner can prove
       // it returned before clicking Send.
-      return statement(db, "SELECT payload_json FROM events WHERE effect_id=? AND kind='effect_unknown' AND event_id>? AND json_extract(payload_json,'$.surface')='macos-native' ORDER BY event_id LIMIT 1", (s) => s.get(effectId, dispatch.lastEventId)) as { payload_json?: string } | undefined;
+      const unknown = statement(db, "SELECT payload_json FROM events WHERE effect_id=? AND kind='effect_unknown' AND event_id>? AND json_extract(payload_json,'$.surface')='macos-native' ORDER BY event_id LIMIT 1", (s) => s.get(effectId, dispatch.lastEventId)) as { payload_json?: string } | undefined;
+      return unknown ? { ...unknown, dispatch_generation: dispatch.lastGeneration } : undefined;
     });
     const evidence = parsedObject(row?.payload_json);
     const beforeSend = new Set(['composer_missing', 'composer_not_empty', 'composer_selection_unavailable', 'composer_text_insertion_rejected', 'composer_text_unconfirmed', 'composer_submit_mismatch', 'send_button_missing']);
     if (evidence.surface !== 'macos-native' || evidence.reconciliation === true || !beforeSend.has(String(evidence.reason))) return false;
-    this.recordEffectNotAppliedProof(effectId, `operator-pre-send:${requestId}`, { ...evidence, send_clicked: false, requested_by: 'user', request_id: requestId, attestation: 'persisted_native_pre_send_return' });
+    this.recordEffectNotAppliedProof(effectId, `operator-pre-send:${requestId}`, {
+      ...evidence, send_clicked: false, dispatch_generation: row?.dispatch_generation, pre_send_rejection: true,
+      requested_by: 'user', request_id: requestId, attestation: 'persisted_native_pre_send_return',
+    });
     return true;
   }
   private reserveEffectWithin(db: Database, input: { taskId: string; effectId: string; kind: WorkflowEffectKind; originKey: string; sourceCompletionFingerprint?: string; prompt: string }): WorkflowSupervisorEffect {
@@ -1285,8 +1676,8 @@ export class WorkflowSupervisorStore {
     return effect;
   }
 
-  /** Attest that no Send intent was reserved and the provider UI could not prepare. */
-  recordEffectPreparationFailure(effectId: string, reasonCode: string): void {
+  /** Persist a bounded provider pre-send rejection; a started generation requires a durable exact no-click proof first. */
+  recordEffectPreparationFailure(effectId: string, reasonCode: string, composerObservation?: WorkflowSupervisorPreflightComposerObservation): void {
     this.transaction((db) => {
       const effect = statement(db, 'SELECT task_id FROM effects WHERE effect_id = ?', (s) => s.get(effectId)) as { task_id?: string } | undefined;
       if (!effect?.task_id) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_UNKNOWN');
@@ -1296,10 +1687,13 @@ export class WorkflowSupervisorStore {
         throw new Error('WORKFLOW_SUPERVISOR_PRE_SEND_FAILURE_OUTCOME_NOT_PROVEN');
       }
       const activeReleaseId = this.activeReleaseId()?.trim() || 'unidentified-runtime';
-      const key = `effect-preflight-rejected:${effectId}:${activeReleaseId}`;
+      // After one explicit repair the next real preparation failure MUST be
+      // recorded again; otherwise INSERT OR IGNORE could permit infinite retries.
+      const rearm = statement(db, "SELECT COUNT(*) AS count FROM events WHERE effect_id = ? AND kind = 'effect_preflight_operator_rearmed'", (s) => s.get(effectId)) as { count?: number } | undefined;
+      const key = `effect-preflight-rejected:${effectId}:${activeReleaseId}${Number(rearm?.count ?? 0) > 0 ? ':operator-rearmed' : ''}`;
       statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(
         effect.task_id!, key, 'effect_preflight_rejected', effectId,
-        json({ active_release_id: activeReleaseId, reason: (boundedText(reasonCode) ?? 'COMPUTER_PREPARE_REJECTED').slice(0, 256), send_clicked: false, attestation: 'computer_prepare_returned_before_supervisor_send_intent' }), now(),
+        json({ active_release_id: activeReleaseId, reason: (boundedText(reasonCode) ?? 'COMPUTER_PREPARE_REJECTED').slice(0, 256), send_clicked: false, attestation: 'computer_prepare_returned_before_supervisor_send_intent', ...(composerObservation ? { composer_observation: composerObservation } : {}) }), now(),
       ));
     });
   }
@@ -1309,6 +1703,11 @@ export class WorkflowSupervisorStore {
     return this.transaction((db) => {
       const effect = statement(db, 'SELECT task_id FROM effects WHERE effect_id = ?', (s) => s.get(effectId)) as { task_id?: string } | undefined;
       if (!effect?.task_id) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_UNKNOWN');
+      // Completion and recovery Send compete in this same Store transaction.
+      // A command obtained before a late completion cannot revive its recovery.
+      if (statement(db, `SELECT 1 FROM effects e JOIN completions c
+        ON c.task_id = e.task_id AND e.origin_key = 'provider-recovery:' || c.source_effect_id
+        WHERE e.effect_id = ? AND e.kind = 'recovery' LIMIT 1`, (s) => s.get(effectId))) return false;
       const applied = statement(db, "SELECT 1 AS ok FROM events WHERE effect_id = ? AND kind = 'effect_applied' LIMIT 1", (s) => s.get(effectId));
       if (applied) throw new Error('WORKFLOW_SUPERVISOR_EFFECT_ALREADY_APPLIED');
       const refunds = statement(db, "SELECT event_id FROM events WHERE effect_id = ? AND kind = 'effect_dispatch_budget_refunded'", (s) => s.all(effectId)) as Array<{ event_id?: number }>;
@@ -1353,12 +1752,23 @@ export class WorkflowSupervisorStore {
       const payload = json(proof);
       const existing = statement(db, 'SELECT kind,payload_json FROM events WHERE event_key = ?', (s) => s.get(key)) as { kind?: string; payload_json?: string } | undefined;
       if (existing && (existing.kind !== 'effect_not_applied' || existing.payload_json !== payload)) throw new Error('WORKFLOW_SUPERVISOR_OBSERVATION_ID_CONFLICT');
-      statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(effect.task_id, key, 'effect_not_applied', effectId, payload, now()));
+      if (existing) return; // An identical old receipt is idempotent, not fresh retry authority.
       const ledger = effectDispatchLedger(db, effectId);
+      const proofGeneration = Number(proof.dispatch_generation);
+      if (!Number.isInteger(proofGeneration) || proofGeneration < 1 || proofGeneration !== ledger.lastGeneration) {
+        throw new Error('WORKFLOW_SUPERVISOR_NOT_APPLIED_PROOF_GENERATION_STALE');
+      }
+      statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(effect.task_id, key, 'effect_not_applied', effectId, payload, now()));
+      const legacyRefund = statement(db, 'SELECT event_id FROM events WHERE event_key = ?', (s) => s.get(`effect-dispatch-budget-refund:${effectId}`)) as { event_id?: number } | undefined;
+      const legacyRefundCoversGeneration = proofGeneration === WORKFLOW_SUPERVISOR_MAX_DISPATCH_GENERATIONS && Boolean(legacyRefund);
       if (proof.pre_send_rejection === true
-        && ledger.generations >= WORKFLOW_SUPERVISOR_MAX_DISPATCH_GENERATIONS
-        && ledger.budgetRefunds === 0) {
-        statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(effect.task_id, `effect-dispatch-budget-refund:${effectId}`, 'effect_dispatch_budget_refunded', effectId, json({ reason: 'pre_send_rejection_did_not_reach_provider' }), now()));
+        && Number.isInteger(proofGeneration) && proofGeneration > 0
+        && proofGeneration === ledger.lastGeneration
+        && !legacyRefundCoversGeneration) {
+        statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,payload_json,occurred_at) VALUES (?,?,?,?,?,?)', (s) => s.run(
+          effect.task_id, `effect-dispatch-budget-refund:${effectId}:${proofGeneration}`, 'effect_dispatch_budget_refunded', effectId,
+          json({ reason: 'pre_send_rejection_did_not_reach_provider', dispatch_generation: proofGeneration }), now(),
+        ));
       }
     });
   }
@@ -1376,6 +1786,15 @@ export class WorkflowSupervisorStore {
         throw new Error('WORKFLOW_SUPERVISOR_SOURCE_EFFECT_COMPLETION_CONFLICT');
       }
       const existing = statement(db, 'SELECT completion_fingerprint FROM completions WHERE completion_fingerprint = ?', (s) => s.get(input.completionFingerprint));
+      // Once the recovery has a Send intent, its outcome may be unknown. A
+      // late source reply must not create a parallel successor or rotate away
+      // from that obligation. Exact historical completion replay stays inert.
+      if (!existing && statement(db, `SELECT 1 FROM effects child JOIN events started
+        ON started.effect_id = child.effect_id AND started.kind = 'effect_dispatch_started'
+        WHERE child.task_id = ? AND child.origin_key = ? LIMIT 1`,
+        (s) => s.get(input.taskId, 'provider-recovery:' + input.sourceEffectId))) {
+        throw new Error('WORKFLOW_SUPERVISOR_SOURCE_EFFECT_RECOVERY_DISPATCHED');
+      }
       if (!existing) statement(db, 'INSERT INTO completions VALUES (?,?,?,?,?,?,?,?)', (s) => s.run(input.completionFingerprint, input.taskId, input.sourceEffectId, input.action, input.responseSha256, input.controlBlockSha256, json(input.proposal), input.committedAt));
       statement(db, 'INSERT OR IGNORE INTO events(task_id,event_key,kind,effect_id,completion_fingerprint,payload_json,occurred_at) VALUES (?,?,?,?,?,?,?)', (s) => s.run(input.taskId, `completion:${input.completionFingerprint}`, 'assistant_completion', input.sourceEffectId, input.completionFingerprint, json(input.proposal), input.committedAt));
       let successorEffect: WorkflowSupervisorEffect | undefined;