@openrig/cli 0.5.0 → 0.5.2

package/daemon/dist/db/migrations/063_occupant_generation_stamps.d.ts

@@ -0,0 +1,24 @@
+import type { Migration } from "../migrate.js";
+/**
+ * GHOST-STAGE (e/Class-B) — occupant-generation stamps on the durable seat-ROLE stores.
+ *
+ * Class-B stores (queue_items, watchdog_jobs) are keyed by seat NAME (member@rig), which continues
+ * across a handover — so a name-scoped drop would neutralize the SUCCESSOR's own legitimate role
+ * entries. Only an entry bound to the RETIRING generation's specific in-flight work is a ghost. These
+ * columns carry the occupant-generation (atom-B `generation_uuid`) of the CONTEXT-BINDING act, so the
+ * invalidator can discriminate the retiree's entries from the successor's by generation, not name.
+ *
+ * Stamp the binding act, not merely INSERT (orch ruling): an item MINTED by seat-A gen-X but CLAIMED
+ * by seat-B gen-Y needs the CLAIMANT's generation for the ghost test — minting-gen alone re-creates
+ * the false-positive.
+ *   - queue_items.minting_generation_uuid    — set at INSERT (the creating occupant's gen).
+ *   - queue_items.claimed_by_generation_uuid — set at CLAIM, cleared at release (the CLAIMANT's gen;
+ *                                              THIS is the queue-item ghost discriminator).
+ *   - watchdog_jobs.registered_by_generation_uuid — set at arm (the registering occupant's gen).
+ *
+ * All NULLABLE + no default: pre-063 rows and un-stamped writers stay NULL, and a NULL generation is
+ * UNKNOWN → the invalidator's gen predicate never matches it (never dropped/released on unknown —
+ * note-2). Additive ALTERs; defensive column-detect reads keep pre-063 fixtures degrading cleanly.
+ */
+export declare const occupantGenerationStampsSchema: Migration;
+//# sourceMappingURL=063_occupant_generation_stamps.d.ts.map

package/daemon/dist/db/migrations/063_occupant_generation_stamps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"063_occupant_generation_stamps.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/063_occupant_generation_stamps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAO5C,CAAC"}

package/daemon/dist/db/migrations/063_occupant_generation_stamps.js

@@ -0,0 +1,30 @@
+/**
+ * GHOST-STAGE (e/Class-B) — occupant-generation stamps on the durable seat-ROLE stores.
+ *
+ * Class-B stores (queue_items, watchdog_jobs) are keyed by seat NAME (member@rig), which continues
+ * across a handover — so a name-scoped drop would neutralize the SUCCESSOR's own legitimate role
+ * entries. Only an entry bound to the RETIRING generation's specific in-flight work is a ghost. These
+ * columns carry the occupant-generation (atom-B `generation_uuid`) of the CONTEXT-BINDING act, so the
+ * invalidator can discriminate the retiree's entries from the successor's by generation, not name.
+ *
+ * Stamp the binding act, not merely INSERT (orch ruling): an item MINTED by seat-A gen-X but CLAIMED
+ * by seat-B gen-Y needs the CLAIMANT's generation for the ghost test — minting-gen alone re-creates
+ * the false-positive.
+ *   - queue_items.minting_generation_uuid    — set at INSERT (the creating occupant's gen).
+ *   - queue_items.claimed_by_generation_uuid — set at CLAIM, cleared at release (the CLAIMANT's gen;
+ *                                              THIS is the queue-item ghost discriminator).
+ *   - watchdog_jobs.registered_by_generation_uuid — set at arm (the registering occupant's gen).
+ *
+ * All NULLABLE + no default: pre-063 rows and un-stamped writers stay NULL, and a NULL generation is
+ * UNKNOWN → the invalidator's gen predicate never matches it (never dropped/released on unknown —
+ * note-2). Additive ALTERs; defensive column-detect reads keep pre-063 fixtures degrading cleanly.
+ */
+export const occupantGenerationStampsSchema = {
+    name: "063_occupant_generation_stamps.sql",
+    sql: `
+    ALTER TABLE queue_items ADD COLUMN minting_generation_uuid TEXT;
+    ALTER TABLE queue_items ADD COLUMN claimed_by_generation_uuid TEXT;
+    ALTER TABLE watchdog_jobs ADD COLUMN registered_by_generation_uuid TEXT;
+  `,
+};
+//# sourceMappingURL=063_occupant_generation_stamps.js.map

package/daemon/dist/db/migrations/063_occupant_generation_stamps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"063_occupant_generation_stamps.js","sourceRoot":"","sources":["../../../src/db/migrations/063_occupant_generation_stamps.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,oCAAoC;IAC1C,GAAG,EAAE;;;;GAIJ;CACF,CAAC"}

package/daemon/dist/db/migrations/064_projection_manifest.d.ts

@@ -0,0 +1,20 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P20 — the PROJECTION MANIFEST: what the projector last WROTE to each target,
+ * so a divergent target can be discriminated operator-modified (protect) vs
+ * stale-projection (safe overwrite). Follows P17 (overwrite-with-loud-warning,
+ * the manifest-less default): P17 sees only "target ≠ source" and cannot tell an
+ * operator edit from a stale projection; this table adds the third data point —
+ * last_hash = the content hash the projector last wrote to target_path.
+ *
+ * One row per projected target, keyed by absolute path. Per-row upserts are
+ * transactional (nodes launch concurrently → a whole-file JSON manifest would
+ * race; a DB table does not). Recorded ON WRITE only (idempotent: re-projecting
+ * identical content is a no-op → no row change).
+ *
+ * (Number 064: next-free at authoring on fold-64 base — 061 is P7's lifecycle
+ * table folding separately, 060/062/063 are other lanes. The desk owns the final
+ * migration-number union at restack; own-table semantics are the ruling.)
+ */
+export declare const projectionManifestSchema: Migration;
+//# sourceMappingURL=064_projection_manifest.d.ts.map

package/daemon/dist/db/migrations/064_projection_manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"064_projection_manifest.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/064_projection_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAWtC,CAAC"}

package/daemon/dist/db/migrations/064_projection_manifest.js

@@ -0,0 +1,30 @@
+/**
+ * P20 — the PROJECTION MANIFEST: what the projector last WROTE to each target,
+ * so a divergent target can be discriminated operator-modified (protect) vs
+ * stale-projection (safe overwrite). Follows P17 (overwrite-with-loud-warning,
+ * the manifest-less default): P17 sees only "target ≠ source" and cannot tell an
+ * operator edit from a stale projection; this table adds the third data point —
+ * last_hash = the content hash the projector last wrote to target_path.
+ *
+ * One row per projected target, keyed by absolute path. Per-row upserts are
+ * transactional (nodes launch concurrently → a whole-file JSON manifest would
+ * race; a DB table does not). Recorded ON WRITE only (idempotent: re-projecting
+ * identical content is a no-op → no row change).
+ *
+ * (Number 064: next-free at authoring on fold-64 base — 061 is P7's lifecycle
+ * table folding separately, 060/062/063 are other lanes. The desk owns the final
+ * migration-number union at restack; own-table semantics are the ruling.)
+ */
+export const projectionManifestSchema = {
+    name: "064_projection_manifest.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS projection_manifest (
+      target_path TEXT PRIMARY KEY,
+      last_hash   TEXT NOT NULL,
+      written_at  TEXT NOT NULL,
+      source_spec TEXT,
+      category    TEXT
+    );
+  `,
+};
+//# sourceMappingURL=064_projection_manifest.js.map

package/daemon/dist/db/migrations/064_projection_manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"064_projection_manifest.js","sourceRoot":"","sources":["../../../src/db/migrations/064_projection_manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,IAAI,EAAE,6BAA6B;IACnC,GAAG,EAAE;;;;;;;;GAQJ;CACF,CAAC"}

package/daemon/dist/db/migrations/065_identity_provenance.d.ts

@@ -0,0 +1,15 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P21 — the CLAIMED-era vs DERIVED-era audit boundary (plan §4). Adds a NULLABLE `identity_provenance`
+ * column to the identity-carrying audit stores so a consumer can tell an actor that was verified by the
+ * transport chokepoint from a pre-P21 claimed-era row. The chokepoint writes `transport:v1`; **absence
+ * IS the claimed-era marker** — no backfill, no re-labeling (the house absent-never-fabricated doctrine).
+ * The boundary is per-ROW truth, not a timestamp: surfaces flip at different folds and each row stays
+ * individually honest. Consumers render a NULL row as "recorded (pre-verification era)", never "verified".
+ *
+ * This migration lands the column on `mission_control_actions` (I1 scope-approve + I2 mission-control
+ * both write it). Later increments extend the same era-stamp to their stores (queue_transitions,
+ * inbox/outbox, stream_items, chat_messages) — nullable + additive, same contract.
+ */
+export declare const identityProvenanceSchema: Migration;
+//# sourceMappingURL=065_identity_provenance.d.ts.map

package/daemon/dist/db/migrations/065_identity_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"065_identity_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/065_identity_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAKtC,CAAC"}

package/daemon/dist/db/migrations/065_identity_provenance.js

@@ -0,0 +1,19 @@
+/**
+ * P21 — the CLAIMED-era vs DERIVED-era audit boundary (plan §4). Adds a NULLABLE `identity_provenance`
+ * column to the identity-carrying audit stores so a consumer can tell an actor that was verified by the
+ * transport chokepoint from a pre-P21 claimed-era row. The chokepoint writes `transport:v1`; **absence
+ * IS the claimed-era marker** — no backfill, no re-labeling (the house absent-never-fabricated doctrine).
+ * The boundary is per-ROW truth, not a timestamp: surfaces flip at different folds and each row stays
+ * individually honest. Consumers render a NULL row as "recorded (pre-verification era)", never "verified".
+ *
+ * This migration lands the column on `mission_control_actions` (I1 scope-approve + I2 mission-control
+ * both write it). Later increments extend the same era-stamp to their stores (queue_transitions,
+ * inbox/outbox, stream_items, chat_messages) — nullable + additive, same contract.
+ */
+export const identityProvenanceSchema = {
+    name: "065_identity_provenance.sql",
+    sql: `
+    ALTER TABLE mission_control_actions ADD COLUMN identity_provenance TEXT;
+  `,
+};
+//# sourceMappingURL=065_identity_provenance.js.map

package/daemon/dist/db/migrations/065_identity_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"065_identity_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/065_identity_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,IAAI,EAAE,6BAA6B;IACnC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/db/migrations/066_watchdog_target_generation.d.ts

@@ -0,0 +1,17 @@
+import type { Migration } from "../migrate.js";
+/**
+ * GHOST-STAGE (i-c) — opt-in TARGET-generation stamp on watchdog_jobs.
+ *
+ * The registration-side ghost (a RETIRED registerer's job firing post-handover) is already closed by
+ * migration 063 + `dropArmedByRegisteringGeneration`. This column is the FIRE-TIME complement: a
+ * GENERATION-bound wake (opt-in) records the occupant-generation it is meant FOR, so the wake-issuer
+ * (WatchdogPolicyEngine) can refuse to fire it at a target that has since been handed over to a
+ * DIFFERENT live generation (the P12 `occupant_tenures` gen-check at deliver time).
+ *
+ * NULLABLE, no default: a NULL `target_generation_uuid` = ROLE-bound (fire at whoever occupies the
+ * seat NAME — the legitimate common case, fires UNCHANGED). Only a non-NULL stamp opts a job into the
+ * fire-time gen-gate. Additive ALTER; the repository's defensive column-detect keeps pre-066 fixtures
+ * degrading cleanly (writers leave it NULL, the gate no-ops → deliver).
+ */
+export declare const watchdogTargetGenerationSchema: Migration;
+//# sourceMappingURL=066_watchdog_target_generation.d.ts.map

package/daemon/dist/db/migrations/066_watchdog_target_generation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"066_watchdog_target_generation.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/066_watchdog_target_generation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAK5C,CAAC"}

package/daemon/dist/db/migrations/066_watchdog_target_generation.js

@@ -0,0 +1,21 @@
+/**
+ * GHOST-STAGE (i-c) — opt-in TARGET-generation stamp on watchdog_jobs.
+ *
+ * The registration-side ghost (a RETIRED registerer's job firing post-handover) is already closed by
+ * migration 063 + `dropArmedByRegisteringGeneration`. This column is the FIRE-TIME complement: a
+ * GENERATION-bound wake (opt-in) records the occupant-generation it is meant FOR, so the wake-issuer
+ * (WatchdogPolicyEngine) can refuse to fire it at a target that has since been handed over to a
+ * DIFFERENT live generation (the P12 `occupant_tenures` gen-check at deliver time).
+ *
+ * NULLABLE, no default: a NULL `target_generation_uuid` = ROLE-bound (fire at whoever occupies the
+ * seat NAME — the legitimate common case, fires UNCHANGED). Only a non-NULL stamp opts a job into the
+ * fire-time gen-gate. Additive ALTER; the repository's defensive column-detect keeps pre-066 fixtures
+ * degrading cleanly (writers leave it NULL, the gate no-ops → deliver).
+ */
+export const watchdogTargetGenerationSchema = {
+    name: "066_watchdog_target_generation.sql",
+    sql: `
+    ALTER TABLE watchdog_jobs ADD COLUMN target_generation_uuid TEXT;
+  `,
+};
+//# sourceMappingURL=066_watchdog_target_generation.js.map

package/daemon/dist/db/migrations/066_watchdog_target_generation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"066_watchdog_target_generation.js","sourceRoot":"","sources":["../../../src/db/migrations/066_watchdog_target_generation.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,oCAAoC;IAC1C,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/db/migrations/067_i3_identity_provenance.d.ts

@@ -0,0 +1,12 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P21 I3 — extend the CLAIMED-era vs DERIVED-era audit boundary (plan §4, migration 065) to the
+ * QUEUE-SPINE identity-carrying stores. Adds the same NULLABLE `identity_provenance` column to
+ * `queue_transitions`, `inbox_entries`, `outbox_entries`, and `stream_items`. The I3 routes' transport
+ * chokepoint writes `transport:v1`; **absence IS the claimed-era marker** — no backfill, no re-labeling
+ * (the house absent-never-fabricated doctrine). The boundary is per-ROW truth, not a timestamp: each
+ * store's rows stay individually honest as I3's surfaces flip at their folds. Additive + nullable —
+ * identical contract to 065's `mission_control_actions` column.
+ */
+export declare const i3IdentityProvenanceSchema: Migration;
+//# sourceMappingURL=067_i3_identity_provenance.d.ts.map

package/daemon/dist/db/migrations/067_i3_identity_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"067_i3_identity_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/067_i3_identity_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAQxC,CAAC"}

package/daemon/dist/db/migrations/067_i3_identity_provenance.js

@@ -0,0 +1,19 @@
+/**
+ * P21 I3 — extend the CLAIMED-era vs DERIVED-era audit boundary (plan §4, migration 065) to the
+ * QUEUE-SPINE identity-carrying stores. Adds the same NULLABLE `identity_provenance` column to
+ * `queue_transitions`, `inbox_entries`, `outbox_entries`, and `stream_items`. The I3 routes' transport
+ * chokepoint writes `transport:v1`; **absence IS the claimed-era marker** — no backfill, no re-labeling
+ * (the house absent-never-fabricated doctrine). The boundary is per-ROW truth, not a timestamp: each
+ * store's rows stay individually honest as I3's surfaces flip at their folds. Additive + nullable —
+ * identical contract to 065's `mission_control_actions` column.
+ */
+export const i3IdentityProvenanceSchema = {
+    name: "067_i3_identity_provenance.sql",
+    sql: `
+    ALTER TABLE queue_transitions ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE inbox_entries ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE outbox_entries ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE stream_items ADD COLUMN identity_provenance TEXT;
+  `,
+};
+//# sourceMappingURL=067_i3_identity_provenance.js.map

package/daemon/dist/db/migrations/067_i3_identity_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"067_i3_identity_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/067_i3_identity_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAc;IACnD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/daemon/dist/db/migrations/068_enforcer_decisions.d.ts

@@ -0,0 +1,4 @@
+import type { Migration } from "../migrate.js";
+/** W4 — durable, attributable human hold/authorize decisions for enforcers. */
+export declare const enforcerDecisionsSchema: Migration;
+//# sourceMappingURL=068_enforcer_decisions.d.ts.map

package/daemon/dist/db/migrations/068_enforcer_decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"068_enforcer_decisions.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/068_enforcer_decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,SAqCrC,CAAC"}

package/daemon/dist/db/migrations/068_enforcer_decisions.js

@@ -0,0 +1,40 @@
+/** W4 — durable, attributable human hold/authorize decisions for enforcers. */
+export const enforcerDecisionsSchema = {
+    name: "068_enforcer_decisions.sql",
+    sql: `
+    CREATE TABLE enforcer_decisions (
+      decision_id TEXT PRIMARY KEY,
+      enforcer_kind TEXT NOT NULL,
+      session_name TEXT NOT NULL,
+      generation_uuid TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK (direction IN ('hold', 'authorize')),
+      automatic_reason TEXT,
+      reason TEXT NOT NULL,
+      actor_session TEXT NOT NULL,
+      identity_provenance TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      expires_at TEXT,
+      active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
+      release_kind TEXT,
+      released_at TEXT,
+      released_by_session TEXT,
+      release_identity_provenance TEXT,
+      release_reason TEXT,
+      consumed_at TEXT,
+      consumed_by_enforcer_kind TEXT,
+      lifted_reason TEXT,
+      attempt_outcome TEXT,
+      attempt_failure_reason TEXT,
+      last_observed_at TEXT,
+      last_observed_outcome TEXT
+    );
+
+    CREATE UNIQUE INDEX idx_enforcer_decisions_one_active
+      ON enforcer_decisions(enforcer_kind, session_name, generation_uuid)
+      WHERE active = 1;
+
+    CREATE INDEX idx_enforcer_decisions_lookup
+      ON enforcer_decisions(enforcer_kind, session_name, direction, active, generation_uuid);
+  `,
+};
+//# sourceMappingURL=068_enforcer_decisions.js.map

package/daemon/dist/db/migrations/068_enforcer_decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"068_enforcer_decisions.js","sourceRoot":"","sources":["../../../src/db/migrations/068_enforcer_decisions.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAc;IAChD,IAAI,EAAE,4BAA4B;IAClC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCJ;CACF,CAAC"}

package/daemon/dist/db/migrations/069_applied_launch_observations.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const appliedLaunchObservationsSchema: Migration;
+//# sourceMappingURL=069_applied_launch_observations.d.ts.map

package/daemon/dist/db/migrations/069_applied_launch_observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"069_applied_launch_observations.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/069_applied_launch_observations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAK/C,eAAO,MAAM,+BAA+B,EAAE,SAa7C,CAAC"}

package/daemon/dist/db/migrations/069_applied_launch_observations.js

@@ -0,0 +1,18 @@
+// W3 permission-drift visibility: an APPLIED launch observation is a separate,
+// generation-keyed fact. The occupant-tenure ledger stays append-only and is
+// never repurposed as mutable observation storage.
+export const appliedLaunchObservationsSchema = {
+    name: "069_applied_launch_observations.sql",
+    sql: `
+    CREATE TABLE applied_launch_observations (
+      generation_uuid TEXT PRIMARY KEY REFERENCES occupant_tenures(generation_uuid) ON DELETE CASCADE,
+      runtime         TEXT NOT NULL,
+      axis            TEXT NOT NULL,
+      observation_state TEXT NOT NULL CHECK (observation_state IN ('observed', 'unknown')),
+      value           TEXT,
+      reason          TEXT,
+      observed_at     TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `,
+};
+//# sourceMappingURL=069_applied_launch_observations.js.map

package/daemon/dist/db/migrations/069_applied_launch_observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"069_applied_launch_observations.js","sourceRoot":"","sources":["../../../src/db/migrations/069_applied_launch_observations.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,6EAA6E;AAC7E,mDAAmD;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAc;IACxD,IAAI,EAAE,qCAAqC;IAC3C,GAAG,EAAE;;;;;;;;;;GAUJ;CACF,CAAC"}

package/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const appliedLaunchObservationInvalidationsSchema: Migration;
+//# sourceMappingURL=070_applied_launch_observation_invalidations.d.ts.map

package/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"070_applied_launch_observation_invalidations.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/070_applied_launch_observation_invalidations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI/C,eAAO,MAAM,2CAA2C,EAAE,SAQzD,CAAC"}

package/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.js

@@ -0,0 +1,12 @@
+// W3 cutover truth: once a generation's process is physically gone, no delayed
+// startup/restore completion may recreate its applied-launch observation.
+export const appliedLaunchObservationInvalidationsSchema = {
+    name: "070_applied_launch_observation_invalidations.sql",
+    sql: `
+    CREATE TABLE applied_launch_observation_invalidations (
+      generation_uuid TEXT PRIMARY KEY REFERENCES occupant_tenures(generation_uuid) ON DELETE CASCADE,
+      invalidated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `,
+};
+//# sourceMappingURL=070_applied_launch_observation_invalidations.js.map

package/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"070_applied_launch_observation_invalidations.js","sourceRoot":"","sources":["../../../src/db/migrations/070_applied_launch_observation_invalidations.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2CAA2C,GAAc;IACpE,IAAI,EAAE,kDAAkD;IACxD,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/daemon/dist/db/migrations/071_drop_enforcer_decisions.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const dropEnforcerDecisionsSchema: Migration;
+//# sourceMappingURL=071_drop_enforcer_decisions.d.ts.map

package/daemon/dist/db/migrations/071_drop_enforcer_decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"071_drop_enforcer_decisions.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/071_drop_enforcer_decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAa/C,eAAO,MAAM,2BAA2B,EAAE,SAKzC,CAAC"}

package/daemon/dist/db/migrations/071_drop_enforcer_decisions.js

@@ -0,0 +1,18 @@
+// Unbuild of the W4 compaction-enforcement suite (founder-ruled, over-engineering audit).
+//
+// FORWARD-ONLY BY RULING: 068_enforcer_decisions is APPLIED on live DBs and 069/070 sit above it,
+// so its migration file stays as history and is NOT deleted — removing it would leave an applied
+// ledger row with no migration and two migrations above the gap. This drops the table instead, so
+// schema_migrations keeps an honest record of both the create and the drop.
+//
+// IF EXISTS is load-bearing, not defensive noise: 068 is excluded from the shared full-test DB
+// fixture (test-app.ts migrationsForFullTestDbExclusions), so on that fixture this migration runs
+// against a database where enforcer_decisions was never created. The indexes are dropped with the
+// table by SQLite.
+export const dropEnforcerDecisionsSchema = {
+    name: "071_drop_enforcer_decisions.sql",
+    sql: `
+    DROP TABLE IF EXISTS enforcer_decisions;
+  `,
+};
+//# sourceMappingURL=071_drop_enforcer_decisions.js.map

package/daemon/dist/db/migrations/071_drop_enforcer_decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"071_drop_enforcer_decisions.js","sourceRoot":"","sources":["../../../src/db/migrations/071_drop_enforcer_decisions.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,4EAA4E;AAC5E,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,mBAAmB;AACnB,MAAM,CAAC,MAAM,2BAA2B,GAAc;IACpD,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/domain/agent-activity-store.d.ts

@@ -9,6 +9,11 @@ export interface HookActivityInput {
     hookEvent: string;
     subtype?: string | null;
     occurredAt?: string | null;
+    /** W2a-1 — the EMITTING occupant's generation, CARRIED source-bound on the hook (the producer/relay
+     *  supplies it at fire time; the route ingests it). NOT inferred from record-time state — that
+     *  inference mis-attributes a delayed prior-occupant hook to the live occupant. Absent on a legacy,
+     *  excluded, or no-tenure emitting path ⇒ stamped null ⇒ unresolved at read (never false-fresh). */
+    generation?: string | null;
 }
 export type RecordHookActivityResult = {
     ok: true;
@@ -24,12 +29,24 @@ interface AgentActivityStoreDeps {
     eventBus: EventBus;
     now?: () => Date;
     freshnessMs?: number;
+    /** W2a-1 — resolve the LIVE occupant generation for a node (the shipped occupant-tenure
+     *  generation_uuid), or null when UNKNOWN. Injected (not self-constructed) so the store stays
+     *  decoupled from SessionRegistry and unit-testable with a fake. When ABSENT the store applies no
+     *  generation gate — legacy clock-only freshness — so the existing callers are unchanged until the
+     *  producer wiring injects the real resolver. Resolution is SYNCHRONOUS (a better-sqlite3 read),
+     *  which is why the gate lives inline in the sync read path with no signature churn to 9 callers. */
+    resolveOccupantGeneration?: (nodeId: string) => string | null;
+    /** Confirm that a carried generation is registered for this node. A side-effect-free reservation
+     * that never committed must remain unresolvable, not become positive mismatch evidence. */
+    isRegisteredOccupantGeneration?: (nodeId: string, generation: string) => boolean;
 }
 export declare class AgentActivityStore {
     readonly db: Database.Database;
     private readonly eventBus;
     private readonly now;
     private readonly freshnessMs;
+    private readonly resolveOccupantGeneration?;
+    private readonly isRegisteredOccupantGeneration?;
     constructor(deps: AgentActivityStoreDeps);
     recordHookEvent(input: HookActivityInput): RecordHookActivityResult;
     getLatestForNode(input: {
@@ -37,6 +54,28 @@ export declare class AgentActivityStore {
         sessionName?: string | null;
         now?: Date;
     }): AgentActivity | null;
+    /** W2a-1 — the dead-tenure verdict: the claim's occupant generation is REGISTERED FOR THIS NODE and
+     *  DIFFERENT from the live generation. The membership gate runs before this helper, so an uncommitted
+     *  reservation can never manufacture a positive dead-tenure finding.
+     *  It must not be honored as the live seat. Returns unknown + `generation_mismatch`,
+     *  stale:true (detection fires), provenance `resolved` (both generations WERE resolved — they simply
+     *  differ). This is the ONLY generation case that abstains; a null on either side is UNRESOLVED
+     *  provenance and is DELIVERED labelled, never routed here. */
+    private generationMismatch;
+    /** W2a-1 — the UNRESOLVABLE-provenance verdict (ABSENCE of evidence, not a dead-tenure finding).
+     *  State UNKNOWN + a distinct reason + stale:true so no consumer reads it as verified-live (fresh is
+     *  a positive liveness claim). The STORE delivers the row carrying generationProvenance:"unresolved"
+     *  at the ACTIVITY layer; turning that label into a still-flowing CONSUMER row is the tap FOLLOW-ON
+     *  (verify-demotion, qitem-20260808183747-f7f04662) — the unchanged tap still discards it in the
+     *  INTERIM (a bounded regression, mint-race-transient exposure; mm2 has no occupant_tenures table
+     *  until 0.5.1). Kept DISTINCT from generationMismatch: ignorance and evidence get different verdicts,
+     *  and the paths must not collapse — at the store now, and at the tap when the follow-on lands. */
+    private generationUnresolved;
+    /** W2a-1 — the resolver-EXCEPTION verdict: the live-generation resolver threw (a transient ledger/db
+     *  fault). DEGRADE to unknown + a DISTINCT reason (`generation_resolver_error`) + stale:true, so the
+     *  read never crashes and the claim is never rendered fresh; provenance `unresolved`. Kept separate
+     *  from a clean null (unresolvable) so a resolver FAULT is distinguishable from an honest ABSENCE. */
+    private generationDegraded;
     resolveSession(input: {
         sessionName?: string | null;
         nodeId?: string | null;

package/daemon/dist/domain/agent-activity-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-activity-store.d.ts","sourceRoot":"","sources":["../../src/domain/agent-activity-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,0BAA0B,GAAG,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,UAAU,sBAAsB;IAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAaD,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,IAAI,EAAE,sBAAsB;IAOxC,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,wBAAwB;IAwCnE,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,aAAa,GAAG,IAAI;IAqCxB,cAAc,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUzL,OAAO,CAAC,eAAe;CAwBxB"}
+{"version":3,"file":"agent-activity-store.d.ts","sourceRoot":"","sources":["../../src/domain/agent-activity-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;wGAGoG;IACpG,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,0BAA0B,GAAG,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,UAAU,sBAAsB;IAC9B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;yGAKqG;IACrG,yBAAyB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC9D;+FAC2F;IAC3F,8BAA8B,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;CAClF;AAaD,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAoC;IAC/E,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAkD;gBAEtF,IAAI,EAAE,sBAAsB;IASxC,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,wBAAwB;IAkDnE,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,aAAa,GAAG,IAAI;IA8FxB;;;;;;mEAM+D;IAC/D,OAAO,CAAC,kBAAkB;IAa1B;;;;;;;uGAOmG;IACnG,OAAO,CAAC,oBAAoB;IAiB5B;;;0GAGsG;IACtG,OAAO,CAAC,kBAAkB;IAa1B,cAAc,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUzL,OAAO,CAAC,eAAe;CAwBxB"}