@staix/agent-hub 0.23.1 → 0.25.0

package/src/hub/board.ts

@@ -1,3 +1,6 @@
+import { canonicalJson } from "./packs.ts";
+import { parseComparisonPlan, comparisonPlanHash, evaluatorIdentityHash, parseExperimentProtocol, protocolHash, parseExperimentAttempt, parseExperimentEvent, parseExperimentHostEvidence, experimentStatus, projectExperimentWithObservations,
+  type ComparisonPlanV1, type ExperimentProtocolRecord, type ExperimentAttemptRecord, type ExperimentEventRecord, type ExperimentWriteFence, type DeclaredExperimentEventInput, type ExperimentHostEvidence, type ExperimentStatus } from "./research-experiments.ts";
 import type { InvocationRow } from "./invocations.ts";
 import { HOST_CODE_SYMBOLS, parseTaskCodeSymbols, type TaskCodeSymbols } from "./task-code-symbols.ts";
 import { createHash } from "node:crypto";
@@ -7,13 +10,114 @@ import type { ReviewerPoolReason } from "./reviewer-pool.ts";
 import type { GitHubSource } from "./github-import.ts";
 import { Database } from "bun:sqlite";
 import { planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
-import { HUB, type PeerId } from "./envelope.ts";
+import { HUB, USER, type PeerId } from "./envelope.ts";
 import type { SweepRecord } from "./task-sweep.ts";
 import { HUB_DB_BUSY_TIMEOUT_MS } from "./db-timeout.ts";
 import type { SdlcReceipt } from "./sdlc.ts";
 import { parseReviewFindings, type ReviewFindingSet } from "./review-findings.ts";
 import { parseDeliverableRecords, type DeliverableRecord } from "./deliverables.ts";
 import type { CostPlan, ReviewCost } from "./cost-governance.ts";
+import { campaignHash, parseResearchCampaign, parseResearchHandoff, type ResearchCampaignContract, type ResearchCampaignStatus, type ResearchUnit, type ResearchHandoffV1, type ResearchHandoffRecord } from "./research-campaign.ts";
+
+export interface ResearchCampaignRecord {
+  id: string;
+  project: string;
+  parentTaskId: number;
+  revision: number;
+  status: ResearchCampaignStatus;
+  contract: ResearchCampaignContract;
+  hash: string;
+  private: boolean;
+  createdBy: PeerId;
+  createdAt: number;
+  approvedBy?: PeerId;
+  approvedAt?: number;
+  closedBy?: PeerId;
+  closedAt?: number;
+  closedReason?: string;
+  dispatchVersion?: 1;
+  eligibleOwners?: string[];
+}
+export interface ResearchUnitBinding {
+  campaignId: string;
+  revision: number;
+  unitId: string;
+  taskId: number;
+  round: number;
+  purpose: ResearchUnit["purpose"];
+  adopted: boolean;
+}
+export interface PreparedResearchUnit {
+  unitId: string;
+  create?: Parameters<Board["propose"]>[1];
+  adopt?: { taskId: number; flowRevision: number };
+  reuse?: { taskId: number; flowRevision: number };
+}
+
+interface ResearchCampaignRow {
+  id: string; project: string; parent_task_id: number; revision: number; status: string; body: string | null; body_sha256: string; private: number;
+  created_by: string; created_at: number; approved_by: string | null; approved_at: number | null;
+  closed_by: string | null; closed_at: number | null; closed_reason: string | null;
+}
+interface ResearchHandoffRow { campaign_id: string; unit_id: string; seq: number; revision: number; task_id: number; body: string | null; by_peer: string; at: number; private: number }
+interface ResearchUnitRow { campaign_id: string; revision: number; unit_id: string; task_id: number; round: number; purpose: string; adopted: number }
+const RESEARCH_CAMPAIGN_SELECT = "SELECT id,project,parent_task_id,revision,status,CASE WHEN length(CAST(body AS BLOB)) <= 65536 THEN body END AS body,body_sha256,private,created_by,created_at,approved_by,approved_at,closed_by,closed_at,closed_reason FROM research_campaigns";
+const researchFailure = (): Error => new Error("research campaign state is invalid, changed or corrupt");
+const researchId = (value: unknown): value is string => typeof value === "string" && value.length === 15 && /^rc-[0-9a-f]{12}$/.test(value);
+const researchInteger = (value: unknown, minimum = 1): value is number => typeof value === "number" && Number.isSafeInteger(value) && value >= minimum;
+const researchText = (value: unknown, max = 512): value is string => typeof value === "string" && value.length > 0 && value.length <= max && Buffer.byteLength(value, "utf8") <= max && Buffer.from(value, "utf8").toString("utf8") === value;
+function checkedResearchCampaign(record: ResearchCampaignRecord): ResearchCampaignRecord {
+  if (!researchId(record.id) || !researchText(record.project) || !researchInteger(record.parentTaskId) || !researchInteger(record.revision) ||
+    !["draft", "approved", "superseded", "closed"].includes(record.status) || typeof record.private !== "boolean" || !researchText(record.createdBy) || !researchInteger(record.createdAt, 0)) throw researchFailure();
+  const contract = parseResearchCampaign(record.contract), hash = campaignHash(contract);
+  if (record.hash !== hash || (record.approvedBy === undefined) !== (record.approvedAt === undefined) ||
+    record.approvedBy !== undefined && (!researchText(record.approvedBy) || !researchInteger(record.approvedAt, 0)) ||
+    (record.closedBy === undefined) !== (record.closedAt === undefined) || (record.closedBy === undefined) !== (record.closedReason === undefined) ||
+    record.closedBy !== undefined && (!researchText(record.closedBy) || !researchInteger(record.closedAt, 0) || !researchText(record.closedReason, 4096)) ||
+    ["approved", "superseded"].includes(record.status) && record.approvedBy === undefined || record.status === "closed" && record.closedBy === undefined ||
+    record.status !== "closed" && record.closedBy !== undefined || record.status === "draft" && record.approvedBy !== undefined) throw researchFailure();
+  return { ...record, contract, hash };
+}
+function researchCampaignFromRow(row: ResearchCampaignRow): ResearchCampaignRecord {
+  try {
+    if (typeof row.body !== "string" || ![0, 1].includes(row.private)) throw researchFailure();
+    return checkedResearchCampaign({ id: row.id, project: row.project, parentTaskId: row.parent_task_id, revision: row.revision, status: row.status as ResearchCampaignStatus,
+      contract: JSON.parse(row.body) as ResearchCampaignContract, hash: row.body_sha256, private: row.private === 1, createdBy: row.created_by, createdAt: row.created_at,
+      ...(row.approved_by !== null ? { approvedBy: row.approved_by } : {}), ...(row.approved_at !== null ? { approvedAt: row.approved_at } : {}),
+      ...(row.closed_by !== null ? { closedBy: row.closed_by } : {}), ...(row.closed_at !== null ? { closedAt: row.closed_at } : {}), ...(row.closed_reason !== null ? { closedReason: row.closed_reason } : {}) });
+  } catch { throw researchFailure(); }
+}
+
+export interface ExperimentComparisonPlanRecord {
+  hash: string;
+  project: string;
+  recordedForTaskId: number;
+  plan: ComparisonPlanV1;
+  by: PeerId;
+  at: number;
+  private: boolean;
+}
+export interface ExperimentProtocolApproval { protocolHash: string; evaluatorHash: string; approvedBy: PeerId; at: number }
+export type ExperimentProtocolContext = { state: "unknown" } | { state: "predeclared" } | { state: "post-hoc"; priorFinal: { attemptId: string; endSeq: number } };
+interface ExperimentComparisonPlanRow { row_id?: number; hash: string; project: string; campaign_id: string; campaign_revision: number; task_id: number; body: string | null; by_peer: string; at: number; private: number }
+interface ExperimentProtocolApprovalRow { protocol_hash: string; evaluator_hash: string; approved_by: string; at: number }
+interface ExperimentProtocolContextRow { protocol_hash: string; prior_attempt_id: string | null; prior_end_seq: number | null; context_sha256: string }
+const EXPERIMENT_PLAN_SELECT = "SELECT rowid AS row_id,hash,project,campaign_id,campaign_revision,task_id,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,by_peer,at,private FROM research_plans";
+
+interface ExperimentProtocolRow { hash: string; project: string; campaign_id: string; campaign_revision: number; task_id: number; body: string | null; by_peer: string; at: number; private: number }
+interface ExperimentAttemptRow { row_id?: number; attempt_id: string; project: string; campaign_id: string; campaign_revision: number; protocol_hash: string; task_id: number; idempotency_key: string; body: string | null; body_sha256: string; by_peer: string; at: number; private: number }
+interface ExperimentEventRow { attempt_id: string; project: string; seq: number; idempotency_key: string; kind: string; body: string | null; body_sha256: string; by_peer: string; at: number; private: number }
+interface ExperimentObservationRow { attempt_id: string; event_seq: number; body: string | null; body_sha256: string }
+const EXPERIMENT_PROTOCOL_SELECT = "SELECT hash,project,campaign_id,campaign_revision,task_id,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,by_peer,at,private FROM research_protocols";
+const EXPERIMENT_ATTEMPT_SELECT = "SELECT rowid AS row_id,attempt_id,project,campaign_id,campaign_revision,protocol_hash,task_id,idempotency_key,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,body_sha256,by_peer,at,private FROM research_attempts";
+const EXPERIMENT_EVENT_SELECT = "SELECT attempt_id,project,seq,idempotency_key,kind,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,body_sha256,by_peer,at,private FROM research_attempt_events";
+const experimentFailure = (): Error => new Error("experiment state is invalid, changed or corrupt");
+const experimentHash = (value: unknown): string => createHash("sha256").update(canonicalJson(value)).digest("hex");
+const experimentHashValid = (value: unknown): value is string => typeof value === "string" && value.length === 64 && /^[0-9a-f]{64}$/.test(value);
+const experimentIdValid = (value: unknown): value is string => typeof value === "string" && /^ra-[0-9a-f]{12}$/.test(value);
+const experimentPage = (after: number, limit: number): void => {
+  if (!researchInteger(after, 0) || !researchInteger(limit) || limit > 50) throw experimentFailure();
+};
 
 export const CLASSES = ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] as const;
 export type TaskClass = (typeof CLASSES)[number];
@@ -174,6 +278,11 @@ function plannerMetadata(planner: unknown, reason?: PlannerReason): Pick<History
   if (reason !== undefined && !["rotation", "named", "kept", "none"].includes(reason)) throw new Error("invalid planner reason");
   return { planner: plannerValue(planner), ...(reason === undefined ? {} : { plannerReason: reason }) };
 }
+/** #604: what this project handed to another project, and the last state that project reported (agent-hub#1030 design 4). */
+export interface HandoffOutboundRow { remoteProject: string; remoteTask: number; originPeer: string; localTask: number | null; title: string; state: string; pr: number | null; head: string | null; updatedAt: number }
+const handoffOutboundFromRow = (row: Record<string, unknown>): HandoffOutboundRow => ({ remoteProject: String(row.remote_project), remoteTask: Number(row.remote_task), originPeer: String(row.origin_peer),
+  localTask: row.local_task === null ? null : Number(row.local_task), title: String(row.title), state: String(row.last_state), pr: row.pr === null ? null : Number(row.pr), head: row.head === null ? null : String(row.head), updatedAt: Number(row.updated_at) });
+
 export interface Task extends PlanningFields {
   offer?: TaskOffer;
   cancelled?: TaskCancellation;
@@ -354,6 +463,761 @@ export class Board {
     this.db.run("CREATE INDEX IF NOT EXISTS releases_planner_present ON releases(planner) WHERE planner IS NOT NULL");
     if (!(this.db.query("PRAGMA table_info(releases)").all() as { name: string }[]).some(row => row.name === "train")) this.db.run("ALTER TABLE releases ADD COLUMN train TEXT");
 
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_campaigns (
+      id TEXT NOT NULL, project TEXT NOT NULL, parent_task_id INTEGER NOT NULL, revision INTEGER NOT NULL,
+      status TEXT NOT NULL, body TEXT NOT NULL, body_sha256 TEXT NOT NULL, private INTEGER NOT NULL,
+      created_by TEXT NOT NULL, created_at INTEGER NOT NULL, approved_by TEXT, approved_at INTEGER,
+      closed_by TEXT, closed_at INTEGER, closed_reason TEXT, PRIMARY KEY(id,revision))`);
+    this.db.run("CREATE UNIQUE INDEX IF NOT EXISTS research_campaigns_active_parent ON research_campaigns(project,parent_task_id) WHERE status='approved'");
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_units (
+      campaign_id TEXT NOT NULL, revision INTEGER NOT NULL, unit_id TEXT NOT NULL, task_id INTEGER NOT NULL,
+      round INTEGER NOT NULL, purpose TEXT NOT NULL, adopted INTEGER NOT NULL, PRIMARY KEY(campaign_id,revision,unit_id))`);
+    this.db.run("CREATE INDEX IF NOT EXISTS research_units_task ON research_units(task_id)");
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_dispatch (
+      campaign_id TEXT NOT NULL, revision INTEGER NOT NULL, version INTEGER NOT NULL, eligible_owners TEXT,
+      PRIMARY KEY(campaign_id,revision))`);
+    // #603: the owner whose queued offer a study hold made the bus discard, kept so approving the study offers the retained task again after a restart.
+    this.db.run("CREATE TABLE IF NOT EXISTS research_dropped_offers (task_id INTEGER PRIMARY KEY, owner TEXT NOT NULL)");
+    // #604 (agent-hub#1030): cross-project handoff. `task_handoff_origin` is the TARGET's record of where a task came from (one row per task it created for another project); `task_handoff_outbound`
+    // is the ORIGIN's record of what it handed to another project and the last state that project reported. Both are additive: a daemon without `task_handoff` never reads them, so a target
+    // lacking the feature is refused at recovery while either holds a row.
+    this.db.run("CREATE TABLE IF NOT EXISTS task_handoff_origin (task_id INTEGER PRIMARY KEY, project_id TEXT NOT NULL, peer TEXT NOT NULL, origin_task INTEGER, at INTEGER NOT NULL)");
+    this.db.run(`CREATE TABLE IF NOT EXISTS task_handoff_outbound (remote_project TEXT NOT NULL, remote_task INTEGER NOT NULL, origin_peer TEXT NOT NULL, local_task INTEGER,
+      title TEXT NOT NULL, last_state TEXT NOT NULL, pr INTEGER, head TEXT, updated_at INTEGER NOT NULL, PRIMARY KEY(remote_project, remote_task))`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_handoffs (
+      campaign_id TEXT NOT NULL, unit_id TEXT NOT NULL, seq INTEGER NOT NULL, revision INTEGER NOT NULL,
+      task_id INTEGER NOT NULL, body TEXT NOT NULL, by_peer TEXT NOT NULL, at INTEGER NOT NULL, private INTEGER NOT NULL,
+      PRIMARY KEY(campaign_id,unit_id,seq))`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_protocols (
+      hash TEXT PRIMARY KEY, project TEXT NOT NULL, campaign_id TEXT NOT NULL, campaign_revision INTEGER NOT NULL, task_id INTEGER NOT NULL, body TEXT NOT NULL,
+      by_peer TEXT NOT NULL, at INTEGER NOT NULL, private INTEGER NOT NULL)`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_attempts (
+      attempt_id TEXT PRIMARY KEY, project TEXT NOT NULL, campaign_id TEXT NOT NULL, campaign_revision INTEGER NOT NULL, protocol_hash TEXT NOT NULL, task_id INTEGER NOT NULL,
+      idempotency_key TEXT NOT NULL, body TEXT NOT NULL, body_sha256 TEXT NOT NULL, by_peer TEXT NOT NULL,
+      at INTEGER NOT NULL, private INTEGER NOT NULL, UNIQUE(project,idempotency_key))`);
+    this.db.run("CREATE INDEX IF NOT EXISTS research_attempts_campaign ON research_attempts(project,campaign_id)");
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_attempt_events (
+      attempt_id TEXT NOT NULL, project TEXT NOT NULL, seq INTEGER NOT NULL, idempotency_key TEXT NOT NULL,
+      kind TEXT NOT NULL, body TEXT NOT NULL, body_sha256 TEXT NOT NULL, by_peer TEXT NOT NULL,
+      at INTEGER NOT NULL, private INTEGER NOT NULL, PRIMARY KEY(attempt_id,seq), UNIQUE(project,idempotency_key))`);
+    this.db.run("CREATE UNIQUE INDEX IF NOT EXISTS research_attempt_one_end ON research_attempt_events(attempt_id) WHERE kind='end'");
+    this.db.run("CREATE INDEX IF NOT EXISTS research_attempt_private_event ON research_attempt_events(attempt_id) WHERE private=1");
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_attempt_observations (
+      attempt_id TEXT NOT NULL, event_seq INTEGER NOT NULL, body TEXT NOT NULL, body_sha256 TEXT NOT NULL,
+      PRIMARY KEY(attempt_id,event_seq))`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_plans (
+      hash TEXT PRIMARY KEY, project TEXT NOT NULL, campaign_id TEXT NOT NULL, campaign_revision INTEGER NOT NULL,
+      task_id INTEGER NOT NULL, body TEXT NOT NULL, by_peer TEXT NOT NULL, at INTEGER NOT NULL, private INTEGER NOT NULL)`);
+    this.db.run("CREATE INDEX IF NOT EXISTS research_plans_campaign ON research_plans(project,campaign_id)");
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_protocol_approvals (
+      protocol_hash TEXT PRIMARY KEY, evaluator_hash TEXT NOT NULL, approved_by TEXT NOT NULL, at INTEGER NOT NULL)`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_protocol_context (
+      protocol_hash TEXT PRIMARY KEY, prior_attempt_id TEXT, prior_end_seq INTEGER, context_sha256 TEXT NOT NULL)`);
+
+  }
+
+  /** #604: a handoff row exists in either direction, so a recovery target must know `task_handoff`. */
+  hasHandoffState(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM task_handoff_origin) OR EXISTS(SELECT 1 FROM task_handoff_outbound) AS present").get() as { present: number }).present === 1;
+  }
+
+  /** TARGET side: where one of this project's tasks came from. The origin peer is a record, never a roster peer or an actor. */
+  handoffOrigin(taskId: number): { projectId: string; peer: string; originTask: number | null; at: number } | undefined {
+    const row = this.db.query("SELECT project_id, peer, origin_task, at FROM task_handoff_origin WHERE task_id=?").get(taskId) as { project_id: string; peer: string; origin_task: number | null; at: number } | null;
+    return row ? { projectId: row.project_id, peer: row.peer, originTask: row.origin_task, at: row.at } : undefined;
+  }
+  setHandoffOrigin(taskId: number, origin: { projectId: string; peer: string; originTask?: number }): void {
+    this.db.query("INSERT INTO task_handoff_origin(task_id, project_id, peer, origin_task, at) VALUES(?,?,?,?,?) ON CONFLICT(task_id) DO NOTHING").run(taskId, origin.projectId, origin.peer, origin.originTask ?? null, Date.now());
+  }
+
+  /** ORIGIN side: what this project handed to another one. Keyed by the target project and its task id, so a repeated event updates one row. */
+  handoffOutbound(): HandoffOutboundRow[] {
+    return (this.db.query("SELECT remote_project, remote_task, origin_peer, local_task, title, last_state, pr, head, updated_at FROM task_handoff_outbound ORDER BY updated_at DESC, remote_project, remote_task LIMIT 200").all() as Record<string, unknown>[]).map(handoffOutboundFromRow);
+  }
+  handoffOutboundFor(remoteProject: string, remoteTask: number): HandoffOutboundRow | undefined {
+    const row = this.db.query("SELECT remote_project, remote_task, origin_peer, local_task, title, last_state, pr, head, updated_at FROM task_handoff_outbound WHERE remote_project=? AND remote_task=?").get(remoteProject, remoteTask) as Record<string, unknown> | null;
+    return row ? handoffOutboundFromRow(row) : undefined;
+  }
+  recordHandoffOutbound(row: { remoteProject: string; remoteTask: number; originPeer: string; localTask?: number; title: string; state: string; pr?: number; head?: string }): void {
+    this.db.query(`INSERT INTO task_handoff_outbound(remote_project, remote_task, origin_peer, local_task, title, last_state, pr, head, updated_at) VALUES(?,?,?,?,?,?,?,?,?)
+      ON CONFLICT(remote_project, remote_task) DO UPDATE SET last_state=excluded.last_state, pr=COALESCE(excluded.pr, pr), head=COALESCE(excluded.head, head), updated_at=excluded.updated_at`)
+      .run(row.remoteProject, row.remoteTask, row.originPeer, row.localTask ?? null, row.title, row.state, row.pr ?? null, row.head ?? null, Date.now());
+  }
+  /** A digest over both tables, so a recovery that restores or loses a row is seen. */
+  handoffIntegrity(): { origins: number; outbound: number; digest: string } {
+    return this.db.transaction(() => {
+      const digest = createHash("sha256").update("agent-hub.handoff-integrity/v1\n");
+      let origins = 0, outbound = 0;
+      for (const row of this.db.query("SELECT task_id, project_id, peer, origin_task, at FROM task_handoff_origin ORDER BY task_id").iterate()) { digest.update(JSON.stringify(row)).update("\n"); origins++; }
+      for (const row of this.db.query("SELECT remote_project, remote_task, origin_peer, local_task, title, last_state, pr, head, updated_at FROM task_handoff_outbound ORDER BY remote_project, remote_task").iterate()) { digest.update(JSON.stringify(row)).update("\n"); outbound++; }
+      return { origins, outbound, digest: digest.digest("hex") };
+    })();
+  }
+
+  /** #601: the ids of a project's campaigns, oldest first, for `ahub study show` with no id. A read: no row is written. */
+  researchCampaignIds(project: string): string[] {
+    if (!researchText(project)) throw researchFailure();
+    return (this.db.query("SELECT DISTINCT id FROM research_campaigns WHERE project=? ORDER BY id").all(project) as { id: string }[]).map(row => row.id);
+  }
+
+  /**
+   * One page of a project's campaign ids, in id order: at most `limit` (never more than 50, the spec's readback bound) strictly after the cursor `after`. `next` is the last id of a full page that
+   * has more behind it, to pass as the next `after`; absent when this is the last page. The query itself carries the bound, so a project with many drafts costs one page, not all of them.
+   */
+  researchCampaignPage(project: string, after?: string, limit = 50): { ids: string[]; next?: string } {
+    if (!researchText(project) || after !== undefined && !researchId(after) || !Number.isSafeInteger(limit) || limit < 1) throw researchFailure();
+    const size = Math.min(limit, 50);
+    const rows = this.db.query("SELECT DISTINCT id FROM research_campaigns WHERE project=? AND id>? ORDER BY id LIMIT ?").all(project, after ?? "", size + 1) as { id: string }[];
+    const ids = rows.slice(0, size).map(row => row.id);
+    return rows.length > size ? { ids, next: ids[ids.length - 1]! } : { ids };
+  }
+
+  researchCampaign(id: string, revision?: number): ResearchCampaignRecord | undefined {
+    if (!researchId(id) || revision !== undefined && !researchInteger(revision)) throw researchFailure();
+    const row = (revision === undefined
+      ? this.db.query(`${RESEARCH_CAMPAIGN_SELECT} WHERE id=? ORDER BY revision DESC LIMIT 1`).get(id)
+      : this.db.query(`${RESEARCH_CAMPAIGN_SELECT} WHERE id=? AND revision=?`).get(id, revision)) as ResearchCampaignRow | null;
+    if (!row) return undefined;
+    const campaign = researchCampaignFromRow(row);
+    const dispatch = this.db.query("SELECT version,CASE WHEN length(CAST(eligible_owners AS BLOB))<=32768 OR eligible_owners IS NULL THEN eligible_owners ELSE '!' END AS eligible_owners FROM research_dispatch WHERE campaign_id=? AND revision=?")
+      .get(id, campaign.revision) as { version: number; eligible_owners: string | null } | null;
+    if (!dispatch) return campaign;
+    if (dispatch.version !== 1 || campaign.approvedBy === undefined) throw researchFailure();
+    let owners: string[] | undefined;
+    if (dispatch.eligible_owners !== null) {
+      try { owners = JSON.parse(dispatch.eligible_owners) as string[]; } catch { throw researchFailure(); }
+      if (!Array.isArray(owners) || owners.length < 1 || owners.length > 256 || owners.some(owner => !researchText(owner, 64) || !/^[a-z][a-z0-9_-]{0,63}$/.test(owner)) || new Set(owners).size !== owners.length) throw researchFailure();
+    }
+    if (!!campaign.contract.budget?.hardCap.length !== !!owners?.length) throw researchFailure();
+    return { ...campaign, dispatchVersion: 1, ...(owners ? { eligibleOwners: owners } : {}) };
+  }
+
+  private researchBindings(campaign: ResearchCampaignRecord): ResearchUnitBinding[] {
+    const rows = this.db.query("SELECT campaign_id,revision,unit_id,task_id,round,purpose,adopted FROM research_units WHERE campaign_id=? AND revision=? ORDER BY unit_id LIMIT 33").all(campaign.id, campaign.revision) as ResearchUnitRow[];
+    const expected = new Map(campaign.contract.units.map(unit => [unit.id, unit]));
+    if (rows.length > 32 || rows.length !== (campaign.approvedBy === undefined ? 0 : expected.size)) throw researchFailure();
+    const tasks = new Set<number>();
+    return rows.map(row => {
+      const unit = expected.get(row.unit_id);
+      if (!unit || row.campaign_id !== campaign.id || row.revision !== campaign.revision || !researchInteger(row.task_id) || tasks.has(row.task_id) ||
+        row.round !== unit.round || row.purpose !== unit.purpose || ![0, 1].includes(row.adopted) || (row.adopted === 1) !== (unit.adoptTaskId !== undefined) ||
+        unit.adoptTaskId !== undefined && unit.adoptTaskId !== row.task_id) throw researchFailure();
+      tasks.add(row.task_id);
+      return { campaignId: row.campaign_id, revision: row.revision, unitId: row.unit_id, taskId: row.task_id, round: row.round, purpose: unit.purpose, adopted: row.adopted === 1 };
+    });
+  }
+
+  researchCampaignBindings(id: string, revision: number): ResearchUnitBinding[] {
+    const campaign = this.researchCampaign(id, revision);
+    return campaign ? this.researchBindings(campaign) : [];
+  }
+
+  /** Most recent persisted association, including a unit omitted from intervening revisions. */
+  researchLatestUnitBinding(campaignId: string, unitId: string): ResearchUnitBinding | undefined {
+    if (!researchId(campaignId) || typeof unitId !== "string" || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(unitId)) throw researchFailure();
+    const row = this.db.query("SELECT revision FROM research_units WHERE campaign_id=? AND unit_id=? ORDER BY revision DESC LIMIT 1")
+      .get(campaignId, unitId) as { revision: number } | null;
+    if (!row) return undefined;
+    const campaign = this.researchCampaign(campaignId, row.revision);
+    if (!campaign) throw researchFailure();
+    const binding = this.researchBindings(campaign).find(unit => unit.unitId === unitId);
+    if (!binding) throw researchFailure();
+    return binding;
+  }
+
+  /** Lifetime unit association, including superseded/closed revisions; never reinterpret a task as another unit. */
+  researchTaskBinding(taskId: number): ResearchUnitBinding | undefined {
+    if (!researchInteger(taskId)) throw researchFailure();
+    const row = this.db.query("SELECT campaign_id,revision FROM research_units WHERE task_id=? ORDER BY campaign_id,revision,unit_id LIMIT 1").get(taskId) as { campaign_id: string; revision: number } | null;
+    if (!row) return undefined;
+    const campaign = this.researchCampaign(row.campaign_id, row.revision);
+    if (!campaign) throw researchFailure();
+    const binding = this.researchBindings(campaign).find(unit => unit.taskId === taskId);
+    if (!binding) throw researchFailure();
+    return binding;
+  }
+
+  /** Resolve lifetime membership against the latest revision; an omitted unit or a draft never inherits old dispatch approval. */
+  researchDispatchBinding(taskId: number): { campaign: ResearchCampaignRecord; binding?: ResearchUnitBinding } | undefined {
+    if (!researchInteger(taskId)) throw researchFailure();
+    const rows = this.db.query("SELECT DISTINCT campaign_id FROM research_units WHERE task_id=? ORDER BY campaign_id LIMIT 2").all(taskId) as { campaign_id: string }[];
+    if (!rows.length) return undefined;
+    if (rows.length !== 1) throw researchFailure();
+    const campaign = this.researchCampaign(rows[0]!.campaign_id);
+    if (!campaign) throw researchFailure();
+    const binding = this.researchBindings(campaign).find(unit => unit.taskId === taskId);
+    return { campaign, ...(binding ? { binding } : {}) };
+  }
+
+  private researchHandoffFromRow(row: ResearchHandoffRow): ResearchHandoffRecord {
+    try {
+      if (typeof row.body !== "string" || Buffer.byteLength(row.body, "utf8") > 65536 || !researchInteger(row.seq) || !researchInteger(row.at, 0) || !researchText(row.by_peer) || ![0, 1].includes(row.private)) throw researchFailure();
+      const handoff = parseResearchHandoff(JSON.parse(row.body)), campaign = this.researchCampaign(row.campaign_id, row.revision);
+      const unit = campaign?.contract.units.find(value => value.id === row.unit_id);
+      const binding = campaign && this.researchBindings(campaign).find(value => value.unitId === row.unit_id);
+      if (!campaign || !unit || !binding || handoff.campaignId !== row.campaign_id || handoff.revision !== row.revision || handoff.unitId !== row.unit_id || handoff.taskId !== row.task_id || binding.taskId !== row.task_id ||
+        handoff.evidence.some(entry => !unit.sourceIds.includes(entry.sourceId)) || handoff.contradictions.some(entry => entry.sourceIds.some(source => !unit.sourceIds.includes(source)))) throw researchFailure();
+      return { handoff, seq: row.seq, by: row.by_peer, at: row.at, private: row.private === 1 || campaign.private };
+    } catch { throw researchFailure(); }
+  }
+
+  /** At most one latest handoff per unit; history remains append-only and older stable-unit evidence survives a revision. */
+  researchHandoffs(campaignId: string, revision?: number): ResearchHandoffRecord[] {
+    const campaign = this.researchCampaign(campaignId, revision);
+    if (!campaign) return [];
+    const rows = this.db.query(`SELECT campaign_id,unit_id,seq,revision,task_id,
+      CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,by_peer,at,private
+      FROM research_handoffs AS h WHERE campaign_id=? AND revision<=? AND unit_id IN (${campaign.contract.units.map(() => "?").join(",")}) AND seq=(SELECT MAX(seq) FROM research_handoffs AS old WHERE old.campaign_id=h.campaign_id AND old.unit_id=h.unit_id AND old.revision<=?) ORDER BY unit_id LIMIT 33`)
+      .all(campaignId, campaign.revision, ...campaign.contract.units.map(unit => unit.id), campaign.revision) as ResearchHandoffRow[];
+    if (rows.length > 32) throw researchFailure();
+    return rows.map(row => this.researchHandoffFromRow(row)).filter(row => campaign.contract.units.some(unit => unit.id === row.handoff.unitId));
+  }
+
+  /** Caller authority/privacy screening belongs to Tasks; the transaction re-checks every persisted binding and ownership fact. */
+  recordResearchHandoff(input: ResearchHandoffV1, project: string, by: PeerId, at: number, expectedTaskFlow: number): ResearchHandoffRecord {
+    const handoff = parseResearchHandoff(input);
+    if (!researchText(project) || !researchText(by) || !researchInteger(at, 0) || !researchInteger(expectedTaskFlow, 0)) throw researchFailure();
+    return this.atomic(() => {
+      const current = this.researchDispatchBinding(handoff.taskId), campaign = current?.campaign, binding = current?.binding;
+      const task = this.get(handoff.taskId), unit = campaign?.contract.units.find(value => value.id === handoff.unitId);
+      if (!campaign || campaign.id !== handoff.campaignId || campaign.revision !== handoff.revision || campaign.status !== "approved" || campaign.project !== project || !binding || binding.unitId !== handoff.unitId || !unit ||
+        !task || task.owner !== by || task.state !== "in_progress" || task.history.length !== expectedTaskFlow ||
+        handoff.evidence.some(entry => !unit.sourceIds.includes(entry.sourceId)) || handoff.contradictions.some(entry => entry.sourceIds.some(source => !unit.sourceIds.includes(source)))) throw researchFailure();
+      const last = this.db.query("SELECT MAX(seq) AS seq FROM research_handoffs WHERE campaign_id=? AND unit_id=?").get(campaign.id, unit.id) as { seq: number | null };
+      const seq = (last.seq ?? 0) + 1;
+      if (!researchInteger(seq)) throw researchFailure();
+      const privateRecord = campaign.private || task.signals.some(signal => signal === "pii" || signal === "pii_path");
+      this.taskWrite(() => this.db.query("INSERT INTO research_handoffs(campaign_id,unit_id,seq,revision,task_id,body,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?)")
+        .run(campaign.id, unit.id, seq, campaign.revision, task.id, JSON.stringify(handoff), by, at, privateRecord ? 1 : 0));
+      this.update(task.id, by, "study handoff", {}, `${campaign.id} revision ${campaign.revision}; evidence ${handoff.evidence.length}`, {}, expectedTaskFlow);
+      return { handoff, seq, by, at, private: privateRecord };
+    });
+  }
+
+  hasResearchDispatchState(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_campaigns) OR EXISTS(SELECT 1 FROM research_units) OR EXISTS(SELECT 1 FROM research_dispatch) OR EXISTS(SELECT 1 FROM research_handoffs) AS present").get() as { present: number }).present === 1;
+  }
+
+  /** #603: a persisted study re-offer needs a target that knows `research_dropped_offers`; `research_dispatch` alone does not (the additive floor rule). */
+  hasResearchDroppedOffers(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_dropped_offers) AS present").get() as { present: number }).present === 1;
+  }
+
+  researchDispatchIntegrity(): { activations: number; handoffs: number; digest: string } {
+    return this.db.transaction(() => {
+      const digest = createHash("sha256").update("agent-hub.research-dispatch-integrity/v1\n");
+      let activations = 0, handoffs = 0;
+      for (const row of this.db.query("SELECT campaign_id,revision,version,eligible_owners FROM research_dispatch ORDER BY campaign_id,revision").iterate() as Iterable<{ campaign_id: string; revision: number; version: number; eligible_owners: string | null }>) {
+        const campaign = this.researchCampaign(row.campaign_id, row.revision);
+        if (!campaign || campaign.dispatchVersion !== 1) throw researchFailure();
+        digest.update(JSON.stringify(row)).update("\n"); activations++;
+      }
+      for (const row of this.db.query("SELECT campaign_id,unit_id,seq,revision,task_id,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,by_peer,at,private FROM research_handoffs ORDER BY campaign_id,unit_id,seq").iterate() as Iterable<ResearchHandoffRow>) {
+        const record = this.researchHandoffFromRow(row);
+        digest.update(JSON.stringify(record)).update("\n"); handoffs++;
+      }
+      // Dropped-offer rows join the digest only when there are any, so a project without one keeps the digest it always had.
+      for (const row of this.db.query("SELECT task_id,owner FROM research_dropped_offers ORDER BY task_id").iterate() as Iterable<{ task_id: number; owner: string }>) {
+        this.droppedOfferRow(row);
+        digest.update("dropped-offer\n").update(JSON.stringify(row)).update("\n");
+      }
+      return { activations, handoffs, digest: digest.digest("hex") };
+    })();
+  }
+
+  /** A row names a task bound to a research unit in some revision (the drop happens while a newer draft has no binding yet) and a peer id; anything else is corrupt state. */
+  private droppedOfferRow(row: { task_id: number; owner: string }): { taskId: number; owner: string } {
+    if (!researchInteger(row.task_id) || !researchText(row.owner, 64) || !/^[a-z][a-z0-9_-]{0,63}$/.test(row.owner) || !this.db.query("SELECT 1 FROM research_units WHERE task_id=? LIMIT 1").get(row.task_id)) throw researchFailure();
+    return { taskId: row.task_id, owner: row.owner };
+  }
+
+  /** #603: remember that a study hold discarded this owner's queued offer for the task. One row per task; a later drop replaces it. */
+  recordResearchDroppedOffer(taskId: number, owner: string): void {
+    this.droppedOfferRow({ task_id: taskId, owner });
+    this.db.query("INSERT INTO research_dropped_offers(task_id,owner) VALUES(?,?) ON CONFLICT(task_id) DO UPDATE SET owner=excluded.owner").run(taskId, owner);
+  }
+
+  researchDroppedOffer(taskId: number): string | undefined {
+    if (!researchInteger(taskId)) throw researchFailure();
+    const row = this.db.query("SELECT task_id,owner FROM research_dropped_offers WHERE task_id=?").get(taskId) as { task_id: number; owner: string } | null;
+    return row ? this.droppedOfferRow(row).owner : undefined;
+  }
+
+  clearResearchDroppedOffer(taskId: number): void {
+    if (!researchInteger(taskId)) throw researchFailure();
+    this.db.query("DELETE FROM research_dropped_offers WHERE task_id=?").run(taskId);
+  }
+
+  /** Bodies are append-only; a new revision cannot change its project's or parent's identity or lower privacy. */
+  saveResearchCampaignDraft(record: ResearchCampaignRecord, expectedLatest: number | undefined, expectedParentFlow: number): ResearchCampaignRecord {
+    const checked = checkedResearchCampaign(record);
+    if (checked.status !== "draft" || checked.approvedBy !== undefined || checked.closedBy !== undefined ||
+      expectedLatest !== undefined && !researchInteger(expectedLatest) || checked.revision !== (expectedLatest ?? 0) + 1 || !researchInteger(expectedParentFlow, 0)) throw researchFailure();
+    return this.atomic(() => {
+      const parent = this.get(checked.parentTaskId), latest = this.researchCampaign(checked.id);
+      if (!parent || parent.history.length !== expectedParentFlow || latest?.revision !== expectedLatest || latest &&
+        (latest.project !== checked.project || latest.parentTaskId !== checked.parentTaskId || latest.status === "closed")) throw researchFailure();
+      const stored = { ...checked, private: checked.private || latest?.private === true };
+      this.taskWrite(() => this.db.query("INSERT INTO research_campaigns(id,project,parent_task_id,revision,status,body,body_sha256,private,created_by,created_at) VALUES(?,?,?,?,?,?,?,?,?,?)")
+        .run(stored.id, stored.project, stored.parentTaskId, stored.revision, "draft", JSON.stringify(stored.contract), stored.hash, stored.private ? 1 : 0, stored.createdBy, stored.createdAt));
+      this.update(parent.id, stored.createdBy, latest ? "study revised" : "study drafted", {}, `${stored.id} revision ${stored.revision}`, {}, expectedParentFlow);
+      return this.researchCampaign(stored.id, stored.revision)!;
+    });
+  }
+
+  /** An approved replay recreates nothing; only monotone privacy tightening may write, without task history or approval changes. */
+  activateCampaign(id: string, revision: number, project: string, by: PeerId, at: number, prepared: readonly PreparedResearchUnit[], expectedParentFlow: number, privateRecord = false, dispatch?: { eligibleOwners?: readonly string[] }): { campaign: ResearchCampaignRecord; bindings: ResearchUnitBinding[]; children: Task[] } {
+    if (!researchText(project) || !researchText(by) || !researchInteger(at, 0) || typeof privateRecord !== "boolean") throw researchFailure();
+    return this.atomic(() => {
+      const campaign = this.researchCampaign(id, revision);
+      if (!campaign || campaign.project !== project) throw researchFailure();
+      if (campaign.status === "approved") {
+        const bindings = this.researchBindings(campaign);
+        if (privateRecord && !campaign.private) this.taskWrite(() => this.db.query("UPDATE research_campaigns SET private=1 WHERE id=? AND revision=? AND private=0").run(id, revision));
+        return { campaign: this.researchCampaign(id, revision)!, bindings, children: [] };
+      }
+      const owners = dispatch?.eligibleOwners === undefined ? undefined : [...dispatch.eligibleOwners];
+      if (owners && (owners.length < 1 || owners.length > 256 || owners.some(owner => !researchText(owner, 64) || !/^[a-z][a-z0-9_-]{0,63}$/.test(owner)) || new Set(owners).size !== owners.length) ||
+        dispatch !== undefined && !!campaign.contract.budget?.hardCap.length !== !!owners?.length) throw researchFailure();
+      const parent = this.get(campaign.parentTaskId), latest = this.researchCampaign(id);
+      const activeRow = this.db.query("SELECT revision FROM research_campaigns WHERE id=? AND status='approved' LIMIT 1").get(id) as { revision: number } | null;
+      const active = activeRow ? this.researchCampaign(id, activeRow.revision) : undefined;
+      if (campaign.status !== "draft" || latest?.revision !== revision || !researchInteger(expectedParentFlow, 0) || !parent || parent.history.length !== expectedParentFlow) throw researchFailure();
+      if (this.db.query("SELECT 1 FROM research_campaigns WHERE project=? AND parent_task_id=? AND status='approved' AND id<>? LIMIT 1").get(project, campaign.parentTaskId, id)) throw new Error("another research campaign is active for this parent");
+      if (this.researchBindings(campaign).length || prepared.length !== campaign.contract.units.length) throw researchFailure();
+      const inputs = new Map<string, PreparedResearchUnit>(), units = new Map(campaign.contract.units.map(unit => [unit.id, unit]));
+      const mapped = new Map<string, number>(), retained = new Map<string, Task>(), children: Task[] = [];
+      const isPrivate = campaign.private || privateRecord;
+      for (const entry of prepared) {
+        const unit = units.get(entry.unitId);
+        if (!unit || inputs.has(entry.unitId) || [entry.create, entry.adopt, entry.reuse].filter(value => value !== undefined).length !== 1) throw researchFailure();
+        inputs.set(entry.unitId, entry);
+        const prior = this.researchLatestUnitBinding(id, unit.id);
+        if (prior) {
+          const previous = this.researchCampaign(id, prior.revision), previousUnit = previous?.contract.units.find(value => value.id === unit.id);
+          if (!entry.reuse || entry.reuse.taskId !== prior.taskId || !researchInteger(entry.reuse.flowRevision, 0) || prior.revision >= revision ||
+            !previous || previous.project !== project || previous.parentTaskId !== campaign.parentTaskId || JSON.stringify(previousUnit) !== JSON.stringify(unit))
+            throw new Error("a bound research unit must retain its task and definition; changed work requires a fresh unit id");
+          const task = this.get(prior.taskId);
+          if (!task || task.history.length !== entry.reuse.flowRevision || isPrivate && !task.signals.some(signal => signal === "pii" || signal === "pii_path")) throw researchFailure();
+          mapped.set(unit.id, task.id); retained.set(unit.id, task);
+        } else if (entry.reuse) {
+          throw researchFailure();
+        } else if (entry.adopt) {
+          if (unit.adoptTaskId !== entry.adopt.taskId || !researchInteger(entry.adopt.flowRevision, 0)) throw researchFailure();
+          const task = this.get(entry.adopt.taskId);
+          if (!task || task.history.length !== entry.adopt.flowRevision || task.draft || !task.history.some(history => history.event === "draft approved") ||
+            isPrivate && !task.signals.some(signal => signal === "pii" || signal === "pii_path")) throw researchFailure();
+          if (this.db.query("SELECT 1 FROM research_units WHERE task_id=? AND (campaign_id<>? OR unit_id<>?) LIMIT 1").get(task.id, id, unit.id)) throw new Error("intake task is already bound to another research unit");
+          mapped.set(unit.id, task.id); retained.set(unit.id, task);
+        } else {
+          const create = entry.create!;
+          if (unit.adoptTaskId !== undefined || typeof create.title !== "string" || !create.title.trim() || create.title.length > 300 || !CLASSES.includes(create.class) || create.draft ||
+            isPrivate && !create.signals?.includes("pii")) throw researchFailure();
+        }
+      }
+      const pending = campaign.contract.units.filter(unit => !mapped.has(unit.id));
+      while (pending.length) {
+        const next = pending.findIndex(unit => unit.dependsOn.every(dependency => mapped.has(dependency)));
+        if (next < 0) throw researchFailure();
+        const unit = pending.splice(next, 1)[0]!, create = inputs.get(unit.id)!.create!;
+        const deps = [...new Set([...(create.deps ?? []), ...unit.dependsOn.map(dependency => mapped.get(dependency)!)])];
+        if (deps.some(dependency => !researchInteger(dependency) || !this.get(dependency))) throw researchFailure();
+        const child = this.propose(by, { ...create, deps, backlog: true, draft: false });
+        mapped.set(unit.id, child.id); children.push(child);
+      }
+      for (const [unitId, task] of retained) if (units.get(unitId)!.dependsOn.some(dependency => !task.deps?.includes(mapped.get(dependency)!))) throw new Error("retained research task dependencies differ from the campaign");
+      for (const unit of campaign.contract.units) {
+        const taskId = mapped.get(unit.id)!;
+        if (this.db.query("SELECT 1 FROM research_units WHERE task_id=? AND (campaign_id<>? OR unit_id<>?) LIMIT 1").get(taskId, id, unit.id)) throw researchFailure();
+        this.taskWrite(() => this.db.query("INSERT INTO research_units(campaign_id,revision,unit_id,task_id,round,purpose,adopted) VALUES(?,?,?,?,?,?,?)")
+          .run(id, revision, unit.id, taskId, unit.round, unit.purpose, unit.adoptTaskId !== undefined ? 1 : 0));
+      }
+      this.taskWrite(() => this.db.query("UPDATE research_campaigns SET status='superseded',private=MAX(private,?) WHERE id=? AND project=? AND status='approved'").run(isPrivate ? 1 : 0, id, project));
+      this.taskWrite(() => this.db.query("UPDATE research_campaigns SET status='approved',approved_by=?,approved_at=?,private=? WHERE id=? AND revision=? AND status='draft'")
+        .run(by, at, isPrivate ? 1 : 0, id, revision));
+      if (dispatch !== undefined) this.taskWrite(() => this.db.query("INSERT INTO research_dispatch(campaign_id,revision,version,eligible_owners) VALUES(?,?,1,?)")
+        .run(id, revision, owners === undefined ? null : JSON.stringify(owners)));
+      const nextUnits = new Set(campaign.contract.units.map(unit => unit.id));
+      const nextEdges = new Set(campaign.contract.units.flatMap(unit => unit.dependsOn.map(dependency => `${unit.id}:${dependency}`)));
+      const omittedUnits = active?.contract.units.filter(unit => !nextUnits.has(unit.id)).length ?? 0;
+      const omittedEdges = active?.contract.units.flatMap(unit => unit.dependsOn.map(dependency => `${unit.id}:${dependency}`)).filter(edge => !nextEdges.has(edge)).length ?? 0;
+      this.update(parent.id, by, "study approved", {}, `${id} revision ${revision}; omitted units ${omittedUnits}, dependencies ${omittedEdges}`, {}, expectedParentFlow);
+      const approved = this.researchCampaign(id, revision)!;
+      return { campaign: approved, bindings: this.researchBindings(approved), children };
+    });
+  }
+
+  closeCampaign(id: string, revision: number, project: string, by: PeerId, at: number, reason: string, expectedParentFlow: number, privateRecord = false): ResearchCampaignRecord {
+    if (!researchText(project) || !researchText(by) || !researchInteger(at, 0) || !researchText(reason, 4096) || typeof privateRecord !== "boolean") throw researchFailure();
+    return this.atomic(() => {
+      const campaign = this.researchCampaign(id, revision), latest = this.researchCampaign(id);
+      if (!campaign || campaign.project !== project || latest?.revision !== revision) throw researchFailure();
+      if (campaign.status === "closed") {
+        if (privateRecord && !campaign.private) this.taskWrite(() => this.db.query("UPDATE research_campaigns SET private=1 WHERE id=? AND revision=? AND private=0").run(id, revision));
+        return this.researchCampaign(id, revision)!;
+      }
+      const parent = this.get(campaign.parentTaskId);
+      if (!researchInteger(expectedParentFlow, 0) || !parent || parent.history.length !== expectedParentFlow) throw researchFailure();
+      this.taskWrite(() => this.db.query("UPDATE research_campaigns SET status='closed',closed_by=?,closed_at=?,closed_reason=?,private=MAX(private,?) WHERE id=? AND project=? AND (revision=? OR status='approved')")
+        .run(by, at, reason, campaign.private || privateRecord ? 1 : 0, id, project, revision));
+      this.update(parent.id, by, "study closed", {}, `${id} revision ${revision}`, {}, expectedParentFlow);
+      return this.researchCampaign(id, revision)!;
+    });
+  }
+
+  hasResearchState(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_campaigns) OR EXISTS(SELECT 1 FROM research_units) OR EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) AS present").get() as { present: number }).present === 1;
+  }
+
+  /** A consistent, streaming digest includes metadata and body hashes, not merely row counts. */
+  researchIntegrity(): { campaigns: number; units: number; revision: number; digest: string } {
+    return this.db.transaction(() => {
+      const digest = createHash("sha256").update("agent-hub.research-integrity/v1\n");
+      let campaigns = 0, units = 0, revision = 0;
+      for (const row of this.db.query(`${RESEARCH_CAMPAIGN_SELECT} ORDER BY id,revision`).iterate() as Iterable<ResearchCampaignRow>) {
+        const campaign = researchCampaignFromRow(row), bindings = this.researchBindings(campaign);
+        const { contract: _body, ...metadata } = campaign;
+        digest.update(JSON.stringify(metadata)).update("\n");
+        for (const binding of bindings) digest.update(JSON.stringify(binding)).update("\n");
+        campaigns++; units += bindings.length; revision = Math.max(revision, campaign.revision);
+      }
+      if ((this.db.query("SELECT COUNT(*) AS count FROM research_units").get() as { count: number }).count !== units) throw researchFailure();
+      return { campaigns, units, revision, digest: digest.digest("hex") };
+    })();
+  }
+
+  private experimentFence(fence: ExperimentWriteFence): { task: Task; campaign: ResearchCampaignRecord } {
+    if (!researchText(fence.project) || !researchInteger(fence.taskId) || !researchInteger(fence.taskFlowRevision, 0) || !researchText(fence.owner) ||
+      !researchId(fence.campaignId) || !researchInteger(fence.campaignRevision) || !experimentHashValid(fence.campaignHash)) throw experimentFailure();
+    const task = this.get(fence.taskId), current = this.researchDispatchBinding(fence.taskId), campaign = current?.campaign;
+    if (!task || task.owner !== fence.owner || task.state !== "in_progress" || task.history.length !== fence.taskFlowRevision || !campaign || !current?.binding ||
+      campaign.project !== fence.project || campaign.id !== fence.campaignId || campaign.revision !== fence.campaignRevision || campaign.hash !== fence.campaignHash || campaign.status !== "approved") throw experimentFailure();
+    return { task, campaign };
+  }
+
+  experimentProtocol(hash: string): ExperimentProtocolRecord | undefined {
+    if (!experimentHashValid(hash)) throw experimentFailure();
+    const row = this.db.query(`${EXPERIMENT_PROTOCOL_SELECT} WHERE hash=?`).get(hash) as ExperimentProtocolRow | null;
+    if (!row) return undefined;
+    try {
+      if (typeof row.body !== "string" || !researchText(row.project) || !researchInteger(row.task_id) || !researchText(row.by_peer) || !researchInteger(row.at, 0) || ![0, 1].includes(row.private)) throw experimentFailure();
+      const protocol = parseExperimentProtocol(JSON.parse(row.body));
+      if (protocolHash(protocol) !== row.hash || protocol.campaignId !== row.campaign_id || protocol.campaignRevision !== row.campaign_revision) throw experimentFailure();
+      const campaign = this.researchCampaign(protocol.campaignId, protocol.campaignRevision), task = this.get(row.task_id);
+      if (!campaign || campaign.project !== row.project || !task || !this.researchCampaignBindings(campaign.id, campaign.revision).some(binding => binding.taskId === task.id) ||
+        protocol.inputs.some(input => !campaign.contract.sourceIds.includes(input.sourceId))) throw experimentFailure();
+      return { hash: row.hash, project: row.project, recordedForTaskId: row.task_id, protocol, by: row.by_peer, at: row.at, private: row.private === 1 || campaign.private || task.signals.some(signal => signal === "pii" || signal === "pii_path") };
+    } catch { throw experimentFailure(); }
+  }
+
+  saveExperimentProtocol(record: ExperimentProtocolRecord, fence: ExperimentWriteFence): ExperimentProtocolRecord {
+    const protocol = parseExperimentProtocol(record.protocol), hash = protocolHash(protocol);
+    if (hash !== record.hash || record.project !== fence.project || record.recordedForTaskId !== fence.taskId || record.by !== fence.owner || !researchInteger(record.at, 0) || typeof record.private !== "boolean") throw experimentFailure();
+    return this.atomic(() => {
+      const { task, campaign } = this.experimentFence(fence);
+      if (protocol.campaignId !== campaign.id || protocol.campaignRevision !== campaign.revision || protocol.inputs.some(input => !campaign.contract.sourceIds.includes(input.sourceId))) throw experimentFailure();
+      if (protocol.variantOf !== undefined) {
+        const baseline = this.experimentProtocol(protocol.variantOf);
+        if (!baseline || baseline.project !== record.project || baseline.protocol.campaignId !== campaign.id || baseline.protocol.campaignRevision !== campaign.revision || baseline.protocol.role !== "baseline") throw experimentFailure();
+      }
+      if (protocol.supersedes !== undefined) {
+        const previous = this.experimentProtocol(protocol.supersedes);
+        if (!previous || previous.project !== record.project || previous.protocol.campaignId !== campaign.id || previous.protocol.lineage !== protocol.lineage) throw experimentFailure();
+      }
+      const priv = record.private || campaign.private || task.signals.some(signal => signal === "pii" || signal === "pii_path");
+      const previous = this.experimentProtocol(hash);
+      if (previous) {
+        if (previous.project !== record.project || previous.recordedForTaskId !== record.recordedForTaskId || canonicalJson(previous.protocol) !== canonicalJson(protocol)) throw experimentFailure();
+        if (priv) this.taskWrite(() => this.db.query("UPDATE research_protocols SET private=1 WHERE hash=? AND private=0").run(hash));
+        return this.experimentProtocol(hash)!;
+      }
+      // Capture recording order in this transaction, never from caller or wall-clock timestamps. Legacy rows are not backfilled.
+      const priorFinal = this.experimentPriorFinal(record.project, campaign.id, protocol.lineage);
+      this.taskWrite(() => this.db.query("INSERT INTO research_protocols(hash,project,campaign_id,campaign_revision,task_id,body,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?)")
+        .run(hash, record.project, campaign.id, campaign.revision, task.id, canonicalJson(protocol), record.by, record.at, priv ? 1 : 0));
+      this.taskWrite(() => this.db.query("INSERT INTO research_protocol_context(protocol_hash,prior_attempt_id,prior_end_seq,context_sha256) VALUES(?,?,?,?)")
+        .run(hash, priorFinal?.attemptId ?? null, priorFinal?.endSeq ?? null, experimentHash({ protocolHash: hash, priorFinal: priorFinal ?? null })));
+      return this.experimentProtocol(hash)!;
+    });
+  }
+
+  experimentComparisonPlan(hash: string): ExperimentComparisonPlanRecord | undefined {
+    if (!experimentHashValid(hash)) throw experimentFailure();
+    const row = this.db.query(`${EXPERIMENT_PLAN_SELECT} WHERE hash=?`).get(hash) as ExperimentComparisonPlanRow | null;
+    return row ? this.experimentComparisonPlanFromRow(row) : undefined;
+  }
+
+  private experimentComparisonPlanFromRow(row: ExperimentComparisonPlanRow): ExperimentComparisonPlanRecord {
+    try {
+      if (typeof row.body !== "string" || !researchText(row.project) || !researchInteger(row.task_id) || !researchText(row.by_peer) || !researchInteger(row.at, 0) || ![0, 1].includes(row.private)) throw experimentFailure();
+      const plan = parseComparisonPlan(JSON.parse(row.body)), campaign = this.researchCampaign(row.campaign_id, row.campaign_revision), task = this.get(row.task_id);
+      if (comparisonPlanHash(plan) !== row.hash || plan.campaignId !== row.campaign_id || !campaign || campaign.project !== row.project || !task ||
+        !this.researchCampaignBindings(campaign.id, campaign.revision).some(binding => binding.taskId === task.id) || plan.fixed.inputs.some(input => !campaign.contract.sourceIds.includes(input.sourceId))) throw experimentFailure();
+      return { hash: row.hash, project: row.project, recordedForTaskId: row.task_id, plan, by: row.by_peer, at: row.at,
+        private: row.private === 1 || campaign.private || task.signals.some(signal => signal === "pii" || signal === "pii_path") };
+    } catch { throw experimentFailure(); }
+  }
+
+  saveExperimentComparisonPlan(record: ExperimentComparisonPlanRecord, fence: ExperimentWriteFence): ExperimentComparisonPlanRecord {
+    const plan = parseComparisonPlan(record.plan), hash = comparisonPlanHash(plan);
+    if (hash !== record.hash || record.project !== fence.project || record.recordedForTaskId !== fence.taskId || record.by !== fence.owner || !researchInteger(record.at, 0) || typeof record.private !== "boolean") throw experimentFailure();
+    return this.atomic(() => {
+      const { task, campaign } = this.experimentFence(fence);
+      if (plan.campaignId !== campaign.id || plan.fixed.inputs.some(input => !campaign.contract.sourceIds.includes(input.sourceId))) throw experimentFailure();
+      const priv = record.private || campaign.private || task.signals.some(signal => signal === "pii" || signal === "pii_path"), previous = this.experimentComparisonPlan(hash);
+      if (previous) {
+        if (previous.project !== record.project || previous.recordedForTaskId !== record.recordedForTaskId || canonicalJson(previous.plan) !== canonicalJson(plan)) throw experimentFailure();
+        if (priv) this.taskWrite(() => this.db.query("UPDATE research_plans SET private=1 WHERE hash=? AND private=0").run(hash));
+        return this.experimentComparisonPlan(hash)!;
+      }
+      this.taskWrite(() => this.db.query("INSERT INTO research_plans(hash,project,campaign_id,campaign_revision,task_id,body,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?)")
+        .run(hash, record.project, campaign.id, campaign.revision, task.id, canonicalJson(plan), record.by, record.at, priv ? 1 : 0));
+      return this.experimentComparisonPlan(hash)!;
+    });
+  }
+
+  experimentComparisonPlans(project: string, campaignId: string, afterRow = 0, limit = 50): { rows: ExperimentComparisonPlanRecord[]; afterRow: number; done: boolean } {
+    if (!researchText(project) || !researchId(campaignId)) throw experimentFailure(); experimentPage(afterRow, limit);
+    const campaign = this.researchCampaign(campaignId); if (!campaign || campaign.project !== project) throw experimentFailure();
+    const page = this.db.query(`${EXPERIMENT_PLAN_SELECT} WHERE project=? AND campaign_id=? AND rowid>? ORDER BY rowid LIMIT ?`).all(project, campaignId, afterRow, limit + 1) as ExperimentComparisonPlanRow[];
+    return { rows: page.slice(0, limit).map(row => this.experimentComparisonPlanFromRow(row)), afterRow: page.slice(0, limit).at(-1)?.row_id ?? afterRow, done: page.length <= limit };
+  }
+
+  experimentProtocolApproval(hash: string): ExperimentProtocolApproval | undefined {
+    const protocol = this.experimentProtocol(hash); if (!protocol) throw experimentFailure();
+    const row = this.db.query("SELECT protocol_hash,evaluator_hash,approved_by,at FROM research_protocol_approvals WHERE protocol_hash=?").get(hash) as ExperimentProtocolApprovalRow | null;
+    if (!row) return undefined;
+    if (row.protocol_hash !== hash || row.evaluator_hash !== evaluatorIdentityHash(protocol.protocol) || row.approved_by !== USER || !researchInteger(row.at, 0)) throw experimentFailure();
+    return { protocolHash: hash, evaluatorHash: row.evaluator_hash, approvedBy: row.approved_by, at: row.at };
+  }
+
+  /** Explicit approval names one immutable historical or current protocol; nothing copies to a changed protocol. */
+  approveExperimentProtocol(project: string, hash: string, evaluatorHash: string, by: PeerId, at: number): ExperimentProtocolApproval {
+    if (by !== USER || !researchText(project) || !experimentHashValid(hash) || !experimentHashValid(evaluatorHash) || !researchInteger(at, 0)) throw experimentFailure();
+    return this.atomic(() => {
+      const protocol = this.experimentProtocol(hash);
+      if (!protocol || protocol.project !== project || evaluatorIdentityHash(protocol.protocol) !== evaluatorHash) throw experimentFailure();
+      const previous = this.experimentProtocolApproval(hash); if (previous) return previous;
+      this.taskWrite(() => this.db.query("INSERT INTO research_protocol_approvals(protocol_hash,evaluator_hash,approved_by,at) VALUES(?,?,?,?)").run(hash, evaluatorHash, by, at));
+      return this.experimentProtocolApproval(hash)!;
+    });
+  }
+
+  // ponytail: first insertion streams ended attempts until a matching lineage is found; index lineage/phase if campaign histories become large.
+  private experimentPriorFinal(project: string, campaignId: string, lineage: string): { attemptId: string; endSeq: number } | undefined {
+    const ends = this.db.query("SELECT e.attempt_id,e.seq FROM research_attempt_events AS e JOIN research_attempts AS a ON a.attempt_id=e.attempt_id WHERE a.project=? AND a.campaign_id=? AND e.kind='end' ORDER BY e.rowid DESC").iterate(project, campaignId) as Iterable<{ attempt_id: string; seq: number }>;
+    for (const end of ends) {
+      const attempt = this.experimentAttempt(end.attempt_id), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+      if (!attempt || !protocol || attempt.project !== project || protocol.protocol.campaignId !== campaignId) throw experimentFailure();
+      const event = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq=?`).get(end.attempt_id, end.seq) as ExperimentEventRow | null;
+      if (!event || this.experimentEventFromRow(event).event.kind !== "end") throw experimentFailure();
+      if (attempt.attempt.phase === "final" && protocol.protocol.lineage === lineage) return { attemptId: attempt.attemptId, endSeq: end.seq };
+    }
+    return undefined;
+  }
+
+  experimentProtocolContext(hash: string): ExperimentProtocolContext {
+    const protocol = this.experimentProtocol(hash); if (!protocol) throw experimentFailure();
+    const row = this.db.query("SELECT protocol_hash,prior_attempt_id,prior_end_seq,context_sha256 FROM research_protocol_context WHERE protocol_hash=?").get(hash) as ExperimentProtocolContextRow | null;
+    if (!row) return { state: "unknown" };
+    if (row.protocol_hash !== hash || (row.prior_attempt_id === null) !== (row.prior_end_seq === null)) throw experimentFailure();
+    if (row.prior_attempt_id === null) {
+      if (row.context_sha256 !== experimentHash({ protocolHash: hash, priorFinal: null })) throw experimentFailure();
+      return { state: "predeclared" };
+    }
+    if (!experimentIdValid(row.prior_attempt_id) || !researchInteger(row.prior_end_seq)) throw experimentFailure();
+    const attempt = this.experimentAttempt(row.prior_attempt_id), previous = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+    const event = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq=?`).get(row.prior_attempt_id, row.prior_end_seq) as ExperimentEventRow | null;
+    const priorFinal = { attemptId: row.prior_attempt_id, endSeq: row.prior_end_seq };
+    if (!attempt || !previous || !event || attempt.project !== protocol.project || attempt.attempt.phase !== "final" || previous.protocol.campaignId !== protocol.protocol.campaignId ||
+      previous.protocol.lineage !== protocol.protocol.lineage || this.experimentEventFromRow(event).event.kind !== "end" || row.context_sha256 !== experimentHash({ protocolHash: hash, priorFinal })) throw experimentFailure();
+    return { state: "post-hoc", priorFinal };
+  }
+
+  hasResearchComparisonState(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_plans) OR EXISTS(SELECT 1 FROM research_protocol_approvals) OR EXISTS(SELECT 1 FROM research_protocol_context) AS present").get() as { present: number }).present === 1;
+  }
+
+  researchComparisonIntegrity(): { plans: number; approvals: number; contexts: number; digest: string } {
+    return this.db.transaction(() => {
+      const digest = createHash("sha256").update("agent-hub.research-comparison-integrity/v1\n");
+      let plans = 0, approvals = 0, contexts = 0;
+      for (const row of this.db.query(`${EXPERIMENT_PLAN_SELECT} ORDER BY hash`).iterate() as Iterable<ExperimentComparisonPlanRow>) {
+        digest.update(canonicalJson({ record: this.experimentComparisonPlanFromRow(row), campaignRevision: row.campaign_revision })).update("\n"); plans++;
+      }
+      for (const row of this.db.query("SELECT protocol_hash,evaluator_hash,approved_by,at FROM research_protocol_approvals ORDER BY protocol_hash").iterate() as Iterable<ExperimentProtocolApprovalRow>) {
+        digest.update(canonicalJson(this.experimentProtocolApproval(row.protocol_hash))).update("\n"); approvals++;
+      }
+      for (const row of this.db.query("SELECT protocol_hash FROM research_protocol_context ORDER BY protocol_hash").iterate() as Iterable<{ protocol_hash: string }>) {
+        digest.update(canonicalJson({ protocolHash: row.protocol_hash, context: this.experimentProtocolContext(row.protocol_hash) })).update("\n"); contexts++;
+      }
+      return { plans, approvals, contexts, digest: digest.digest("hex") };
+    })();
+  }
+
+  experimentAttempt(id: string): ExperimentAttemptRecord | undefined {
+    if (!experimentIdValid(id)) throw experimentFailure();
+    const row = this.db.query(`${EXPERIMENT_ATTEMPT_SELECT} WHERE attempt_id=?`).get(id) as ExperimentAttemptRow | null;
+    return row ? this.experimentAttemptFromRow(row) : undefined;
+  }
+
+  private experimentAttemptFromRow(row: ExperimentAttemptRow): ExperimentAttemptRecord {
+    try {
+      if (!experimentIdValid(row.attempt_id) || typeof row.body !== "string" || !researchText(row.project) || !researchText(row.by_peer) || !researchInteger(row.at, 0) || ![0, 1].includes(row.private)) throw experimentFailure();
+      const attempt = parseExperimentAttempt(JSON.parse(row.body)), protocol = this.experimentProtocol(row.protocol_hash);
+      if (experimentHash(attempt) !== row.body_sha256 || attempt.protocolHash !== row.protocol_hash || attempt.taskId !== row.task_id || attempt.idempotencyKey !== row.idempotency_key ||
+        !protocol || protocol.project !== row.project || protocol.protocol.campaignId !== row.campaign_id || protocol.protocol.campaignRevision !== row.campaign_revision ||
+        !this.researchCampaignBindings(row.campaign_id, row.campaign_revision).some(binding => binding.taskId === attempt.taskId)) throw experimentFailure();
+      const privateEvent = !!this.db.query("SELECT 1 FROM research_attempt_events WHERE attempt_id=? AND private=1 LIMIT 1").get(row.attempt_id);
+      return { attemptId: row.attempt_id, project: row.project, attempt, bodyHash: row.body_sha256, by: row.by_peer, at: row.at, private: row.private === 1 || protocol.private || privateEvent };
+    } catch { throw experimentFailure(); }
+  }
+
+  createExperimentAttempt(record: ExperimentAttemptRecord, fence: ExperimentWriteFence): ExperimentAttemptRecord {
+    const attempt = parseExperimentAttempt(record.attempt), bodyHash = experimentHash(attempt);
+    if (!experimentIdValid(record.attemptId) || record.bodyHash !== bodyHash || record.project !== fence.project || attempt.taskId !== fence.taskId || record.by !== fence.owner || !researchInteger(record.at, 0) || typeof record.private !== "boolean") throw experimentFailure();
+    return this.atomic(() => {
+      const { campaign } = this.experimentFence(fence), protocol = this.experimentProtocol(attempt.protocolHash);
+      const origin = protocol && this.researchDispatchBinding(protocol.recordedForTaskId);
+      if (!protocol || protocol.project !== record.project || protocol.protocol.campaignId !== campaign.id || protocol.protocol.campaignRevision !== campaign.revision ||
+        !origin?.binding || origin.campaign.id !== campaign.id || origin.campaign.revision !== campaign.revision || origin.campaign.status !== "approved") throw experimentFailure();
+      const previous = this.db.query(`${EXPERIMENT_ATTEMPT_SELECT} WHERE project=? AND idempotency_key=?`).get(record.project, attempt.idempotencyKey) as ExperimentAttemptRow | null;
+      if (previous) {
+        const stored = this.experimentAttemptFromRow(previous);
+        if (stored.bodyHash !== bodyHash || canonicalJson(stored.attempt) !== canonicalJson(attempt)) throw new Error("attempt idempotency key already records different data");
+        if (record.private || protocol.private) this.taskWrite(() => this.db.query("UPDATE research_attempts SET private=1 WHERE attempt_id=? AND private=0").run(stored.attemptId));
+        return this.experimentAttempt(stored.attemptId)!;
+      }
+      for (const linked of [attempt.retryOf, attempt.reproducesAttemptId]) if (linked !== undefined) {
+        const prior = this.experimentAttempt(linked), priorProtocol = prior && this.experimentProtocol(prior.attempt.protocolHash);
+        if (!prior || !priorProtocol || prior.project !== record.project || priorProtocol.protocol.campaignId !== campaign.id) throw experimentFailure();
+      }
+      this.taskWrite(() => this.db.query("INSERT INTO research_attempts(attempt_id,project,campaign_id,campaign_revision,protocol_hash,task_id,idempotency_key,body,body_sha256,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)")
+        .run(record.attemptId, record.project, campaign.id, campaign.revision, attempt.protocolHash, attempt.taskId, attempt.idempotencyKey, canonicalJson(attempt), bodyHash, record.by, record.at, record.private || protocol.private ? 1 : 0));
+      return this.experimentAttempt(record.attemptId)!;
+    });
+  }
+
+  private experimentEventFromRow(row: ExperimentEventRow): ExperimentEventRecord {
+    try {
+      if (typeof row.body !== "string" || !researchInteger(row.seq) || !researchInteger(row.at, 0) || !researchText(row.by_peer) || ![0, 1].includes(row.private) || !researchText(row.idempotency_key, 64)) throw experimentFailure();
+      const attempt = this.experimentAttempt(row.attempt_id), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+      if (!attempt || !protocol || row.project !== attempt.project) throw experimentFailure();
+      const input = parseExperimentEvent(JSON.parse(row.body), protocol.protocol);
+      if (input.kind !== row.kind || experimentHash(input) !== row.body_sha256) throw experimentFailure();
+      const event = { ...input, seq: row.seq, at: row.at, provenance: "declared" as const };
+      const observations = (this.db.query("SELECT attempt_id,event_seq,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,body_sha256 FROM research_attempt_observations WHERE attempt_id=? AND event_seq=?").all(row.attempt_id, row.seq) as ExperimentObservationRow[]).map(observed => {
+        if (typeof observed.body !== "string" || observed.attempt_id !== row.attempt_id || observed.event_seq !== row.seq) throw experimentFailure();
+        const observation = parseExperimentHostEvidence(JSON.parse(observed.body));
+        if (experimentHash(observation) !== observed.body_sha256) throw experimentFailure();
+        return { eventSeq: row.seq, observation };
+      });
+      projectExperimentWithObservations(protocol.protocol, [event], observations);
+      return { attemptId: row.attempt_id, idempotencyKey: row.idempotency_key, event, bodyHash: row.body_sha256, by: row.by_peer, private: row.private === 1 || attempt.private, observations };
+    } catch { throw experimentFailure(); }
+  }
+
+  appendExperimentEvent(attemptId: string, key: string, input: DeclaredExperimentEventInput, hostEvidence: readonly ExperimentHostEvidence[], by: PeerId, at: number, priv: boolean, expectedLastSeq: number, fence: ExperimentWriteFence): ExperimentEventRecord {
+    if (!experimentIdValid(attemptId) || !researchText(key, 64) || by !== fence.owner || !researchInteger(at, 0) || typeof priv !== "boolean" || !researchInteger(expectedLastSeq, 0) || !Array.isArray(hostEvidence) || hostEvidence.length > 1) throw experimentFailure();
+    return this.atomic(() => {
+      const { campaign } = this.experimentFence(fence), attempt = this.experimentAttempt(attemptId), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+      if (!attempt || !protocol || attempt.project !== fence.project || attempt.attempt.taskId !== fence.taskId || protocol.protocol.campaignId !== campaign.id || protocol.protocol.campaignRevision !== campaign.revision) throw experimentFailure();
+      const value = parseExperimentEvent(input, protocol.protocol), bodyHash = experimentHash(value);
+      const previous = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE project=? AND idempotency_key=?`).get(fence.project, key) as ExperimentEventRow | null;
+      if (previous) {
+        const stored = this.experimentEventFromRow(previous);
+        if (stored.attemptId !== attemptId || stored.bodyHash !== bodyHash || canonicalJson({ kind: stored.event.kind, body: stored.event.body }) !== canonicalJson(value)) throw new Error("event idempotency key already records different data");
+        if (priv || attempt.private) {
+          this.taskWrite(() => this.db.query("UPDATE research_attempt_events SET private=1 WHERE attempt_id=? AND seq=? AND private=0").run(attemptId, stored.event.seq));
+          this.taskWrite(() => this.db.query("UPDATE research_attempts SET private=1 WHERE attempt_id=? AND private=0").run(attemptId));
+        }
+        return this.experimentEventFromRow(this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq=?`).get(attemptId, stored.event.seq) as ExperimentEventRow);
+      }
+      if (this.experimentLastSeq(attemptId) !== expectedLastSeq || !researchInteger(expectedLastSeq + 1)) throw new Error("experiment event sequence changed");
+      if (value.kind === "end" && this.db.query("SELECT 1 FROM research_attempt_events WHERE attempt_id=? AND kind='end'").get(attemptId)) throw new Error("an experiment attempt has at most one end event");
+      const seq = expectedLastSeq + 1, observations = hostEvidence.map(observation => ({ eventSeq: seq, observation: parseExperimentHostEvidence(observation) }));
+      projectExperimentWithObservations(protocol.protocol, [{ ...value, seq, at, provenance: "declared" }], observations);
+      this.taskWrite(() => this.db.query("INSERT INTO research_attempt_events(attempt_id,project,seq,idempotency_key,kind,body,body_sha256,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?,?)")
+        .run(attemptId, fence.project, seq, key, value.kind, canonicalJson(value), bodyHash, by, at, priv || attempt.private ? 1 : 0));
+      for (const observed of observations) this.taskWrite(() => this.db.query("INSERT INTO research_attempt_observations(attempt_id,event_seq,body,body_sha256) VALUES(?,?,?,?)")
+        .run(attemptId, seq, canonicalJson(observed.observation), experimentHash(observed.observation)));
+      if (priv || attempt.private) this.taskWrite(() => this.db.query("UPDATE research_attempts SET private=1 WHERE attempt_id=? AND private=0").run(attemptId));
+      return this.experimentEventFromRow(this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq=?`).get(attemptId, seq) as ExperimentEventRow);
+    });
+  }
+
+  experimentLastSeq(attemptId: string): number {
+    if (!this.experimentAttempt(attemptId)) throw experimentFailure();
+    const last = this.db.query("SELECT MAX(seq) AS seq,COUNT(*) AS count FROM research_attempt_events WHERE attempt_id=?").get(attemptId) as { seq: number | null; count: number };
+    const seq = last.seq ?? 0;
+    if (!researchInteger(seq, 0) || last.count !== seq) throw experimentFailure();
+    return seq;
+  }
+
+  experimentEvents(attemptId: string, afterSeq = 0, limit = 50): { rows: ExperimentEventRecord[]; afterSeq: number; done: boolean } {
+    if (!this.experimentAttempt(attemptId)) throw experimentFailure(); experimentPage(afterSeq, limit);
+    const page = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq>? ORDER BY seq LIMIT ?`).all(attemptId, afterSeq, limit + 1) as ExperimentEventRow[];
+    const rows = page.slice(0, limit).map(row => this.experimentEventFromRow(row));
+    return { rows, afterSeq: rows.at(-1)?.event.seq ?? afterSeq, done: page.length <= limit };
+  }
+
+  experimentAttempts(project: string, campaignId: string, afterRow = 0, limit = 50): { rows: ExperimentAttemptRecord[]; afterRow: number; done: boolean } {
+    if (!researchText(project) || !researchId(campaignId)) throw experimentFailure(); experimentPage(afterRow, limit);
+    const campaign = this.researchCampaign(campaignId); if (!campaign || campaign.project !== project) throw experimentFailure();
+    const page = this.db.query(`${EXPERIMENT_ATTEMPT_SELECT} WHERE project=? AND rowid>? AND campaign_id=? ORDER BY rowid LIMIT ?`)
+      .all(project, afterRow, campaignId, limit + 1) as ExperimentAttemptRow[];
+    return { rows: page.slice(0, limit).map(row => this.experimentAttemptFromRow(row)), afterRow: page.slice(0, limit).at(-1)?.row_id ?? afterRow, done: page.length <= limit };
+  }
+
+  experimentAttemptStatus(attemptId: string): ExperimentStatus {
+    const attempt = this.experimentAttempt(attemptId);
+    if (!attempt) throw experimentFailure();
+    const endRows = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND kind='end' ORDER BY seq LIMIT 2`).all(attemptId) as ExperimentEventRow[];
+    if (endRows.length > 1) throw experimentFailure();
+    const end = endRows[0], start = !end && this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND kind='start' ORDER BY seq LIMIT 1`).get(attemptId) as ExperimentEventRow | null;
+    const events = end ? [this.experimentEventFromRow(end).event] : start ? [this.experimentEventFromRow(start).event] : [];
+    return experimentStatus(events, this.get(attempt.attempt.taskId)?.state);
+  }
+
+  // ponytail: exact counts validate all campaign attempts on each show (linear in attempt count). Upgrade to a transactional status projection maintained on event and task-state changes.
+  experimentSummary(project: string, campaignId: string): { total: number; statuses: Record<ExperimentStatus, number> } {
+    const campaign = this.researchCampaign(campaignId); if (!campaign || campaign.project !== project) throw experimentFailure();
+    const statuses: Record<ExperimentStatus, number> = { declared: 0, running: 0, succeeded: 0, failed: 0, cancelled: 0, unknown: 0 };
+    let total = 0;
+    for (const row of this.db.query(`${EXPERIMENT_ATTEMPT_SELECT} WHERE project=? AND campaign_id=? ORDER BY rowid`).iterate(project, campaignId) as Iterable<ExperimentAttemptRow>) {
+      const attempt = this.experimentAttemptFromRow(row);
+      // Status needs only the unique terminal event or presence of a start, not an unbounded event read.
+      statuses[this.experimentAttemptStatus(attempt.attemptId)]++; total++;
+    }
+    return { total, statuses };
+  }
+
+  hasResearchExperimentState(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) AS present").get() as { present: number }).present === 1;
+  }
+
+  researchExperimentsIntegrity(): { protocols: number; attempts: number; events: number; observations: number; digest: string } {
+    return this.db.transaction(() => {
+      const digest = createHash("sha256").update("agent-hub.research-experiments-integrity/v1\n");
+      let protocols = 0, attempts = 0, events = 0, observations = 0;
+      for (const row of this.db.query(`${EXPERIMENT_PROTOCOL_SELECT} ORDER BY hash`).iterate() as Iterable<ExperimentProtocolRow>) {
+        digest.update(canonicalJson(this.experimentProtocol(row.hash))).update("\n"); protocols++;
+      }
+      for (const row of this.db.query(`${EXPERIMENT_ATTEMPT_SELECT} ORDER BY attempt_id`).iterate() as Iterable<ExperimentAttemptRow>) {
+        digest.update(canonicalJson(this.experimentAttemptFromRow(row))).update("\n"); attempts++;
+      }
+      let currentAttempt = "", nextSeq = 0, ended = false;
+      for (const row of this.db.query(`${EXPERIMENT_EVENT_SELECT} ORDER BY attempt_id,seq`).iterate() as Iterable<ExperimentEventRow>) {
+        if (row.attempt_id !== currentAttempt) { currentAttempt = row.attempt_id; nextSeq = 1; ended = false; }
+        if (row.seq !== nextSeq++ || row.kind === "end" && ended) throw experimentFailure();
+        if (row.kind === "end") ended = true;
+        const record = this.experimentEventFromRow(row);
+        digest.update(canonicalJson(record)).update("\n"); events++; observations += record.observations.length;
+      }
+      if ((this.db.query("SELECT COUNT(*) AS count FROM research_attempt_observations").get() as { count: number }).count !== observations) throw experimentFailure();
+      return { protocols, attempts, events, observations, digest: digest.digest("hex") };
+    })();
   }
 
   propose(by: PeerId, t: { title: string; detail?: string; class: TaskClass; planner?: PeerId | null; plannerReason?: PlannerReason; profile?: import("./profiles.ts").ProfileName; profileClass?: string; customProfile?: true; role?: string; refs?: TaskRefs; plan?: TaskPlan; deps?: number[]; reserved?: PeerId; signals?: string[]; backlog?: boolean; draft?: boolean; external?: GitHubSource }): Task {
@@ -494,8 +1358,13 @@ export class Board {
     if (expectedFlowRevision !== undefined && (!Number.isSafeInteger(expectedFlowRevision) || expectedFlowRevision < 0 || task.history.length !== expectedFlowRevision)) throw new Error("task flow revision changed");
     const untouchedReturn = event === "backlog returned untouched" && patch.state === "backlog" && patch.owner === null && patch.reviewer === null
       && ["proposed", "in_progress"].includes(task.state) && expectedFlowRevision !== undefined && !!note?.trim() && !taskHasWorkEvidence(task);
+    // A new delivered head with a configured check is owner work again until that check finishes.
+    const reviewCheck = event === "done (checking)" && task.state === "in_review" && patch.state === "in_progress"
+      && expectedFlowRevision !== undefined && (by === task.owner || by === "user") && patch.owner === undefined && patch.reviewer === undefined
+      && typeof patch.refs?.commit === "string" && /^[a-f0-9]{40}$/.test(patch.refs.commit)
+      && patch.refs.commit !== (task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead);
     if (task.draft && patch.state && patch.state !== "backlog" && patch.state !== "cancelled") throw new Error(`task #${id} is an intake draft; the person approves it first`);
-    if (patch.state && patch.state !== task.state && !MOVES[task.state].includes(patch.state) && !untouchedReturn) {
+    if (patch.state && patch.state !== task.state && !MOVES[task.state].includes(patch.state) && !untouchedReturn && !reviewCheck) {
       throw new Error(`task #${id} is ${task.state}: cannot move to ${patch.state}`);
     }
     const planner = Object.hasOwn(patch, "planner") ? plannerValue(patch.planner) : task.planner ?? null;