@staix/agent-hub 0.25.0 → 0.26.0

package/src/cli/upgrade.ts

@@ -9,8 +9,8 @@ import { databaseBusySite, isDatabaseBusy, RecoveryDatabaseBusy } from "../hub/r
 import { Database } from "bun:sqlite";
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { REGISTRY_DB_BUSY_TIMEOUT_MS, PROJECT_COLUMNS, projectFromRow, type Project } from "../hub/registry.ts";
+import { isAbsolute, join } from "node:path";
+import { Registry, REGISTRY_DB_BUSY_TIMEOUT_MS, PROJECT_COLUMNS, projectFromRow, type Project } from "../hub/registry.ts";
 import { hubHome } from "../hub/project.ts";
 import { readRecoveryWaits } from "./recovery-waits.ts";
 import { acquireRecoveryLock, claimRunner, coordinatorCurrent, operationIdPattern, readOperation, recoveryCommand, recoveryLock, releaseRecoveryLock, writeOperation } from "../hub/recovery-store.ts";
@@ -27,6 +27,7 @@ const projectDefinition = (peer: string, root?: string) => {
 
 export interface RecoveryPeer {
   id: string;
+  controlProtocol?: number;
   /** Read-only source observation; never consumed as restoration arguments. */
   observation?: { kind: string; attached: boolean; sessionDigest?: string };
   /** Captured stable module/instance identity; never a portable current-owner proof. */
@@ -42,6 +43,8 @@ export interface Inspection {
   instanceId?: string;
   version?: string;
   protocol?: number;
+  protocolMin?: number;
+  protocolMax?: number;
   peers: RecoveryPeer[];
   /** `waiting` (#272): what the running hub says keeps it from being quiet (busy peers, pending approvals); display only. */
   recovery?: { operationId?: string; phase?: string; ready?: boolean; waiting?: string[] };
@@ -65,6 +68,8 @@ export interface PlannedProject {
 }
 export interface UpgradePlan {
   schema: 1;
+  /** Present for new CLI operations; absent only on retained legacy machine-wide plans. */
+  scope?: { projectRoot: string };
   kind: "restart" | "upgrade";
   version: string;
   integrity?: string;
@@ -122,7 +127,7 @@ export interface RecoveryOperation {
    * #227: 2 marks a stop-and-archive recorded on an operation whose coordinator predates #215. Every older runner and
    * abort refuses a schema other than 1 before it takes the lock or claims the runner, so none can advance it.
    */
-  schema: 1 | 2;
+  schema: 1 | 2 | 3;
   id: string;
   plan: UpgradePlan;
   createdAt: number;
@@ -417,20 +422,47 @@ export function planFingerprint(plan: Omit<UpgradePlan, "fingerprint">): string
   return createHash("sha256").update(JSON.stringify(stable)).digest("hex");
 }
 
+/** A scoped receipt cannot expand into a second project, even when read by a later coordinator. */
+export function recoveryScope(plan: Pick<UpgradePlan, "scope" | "projects">): string | undefined {
+  if (plan.scope === undefined) return undefined;
+  const scope = plan.scope;
+  if (!scope || typeof scope !== "object" || Array.isArray(scope) || Object.keys(scope).length !== 1 || !Object.hasOwn(scope, "projectRoot")
+    || typeof scope.projectRoot !== "string" || !isAbsolute(scope.projectRoot) || !Array.isArray(plan.projects)
+    || plan.projects.length !== 1 || plan.projects[0]?.project.root !== scope.projectRoot)
+    throw new Error("reviewed project recovery scope is invalid");
+  return scope.projectRoot;
+}
+function sealScopedPlan(op: RecoveryOperation): void {
+  if (op.schema !== 3) return;
+  const seen = new WeakSet<object>();
+  const freeze = (value: unknown): void => {
+    if (!value || typeof value !== "object" || seen.has(value)) return;
+    seen.add(value);
+    for (const item of Object.values(value)) freeze(item);
+    Object.freeze(value);
+  };
+  freeze(op.plan);
+  Object.defineProperty(op, "plan", { value: op.plan, enumerable: true, writable: false, configurable: false });
+}
+
 export function createOperation(plan: UpgradePlan, sourceRoot: string, home = hubHome(), delegation?: RecoveryDelegation, operationId: string = randomUUID()): RecoveryOperation {
   if (!operationIdPattern.test(operationId)) throw new Error("invalid recovery operation ID");
-  if (plan.blockers.length || plan.projects.some((p) => p.blockers.length)) throw new Error("upgrade plan has blockers; no runtimes were changed");
   if (!plan.projects.length) throw new Error("no running projects to recover");
+  if (plan.blockers.length || plan.projects.some((p) => p.blockers.length)) throw new Error("upgrade plan has blockers; no runtimes were changed");
   const { fingerprint, ...body } = plan;
   if (planFingerprint(body) !== fingerprint) throw new Error("upgrade plan fingerprint is invalid");
+  const scope = recoveryScope(plan);
   const id = operationId;
   const op: RecoveryOperation = {
-    schema: 1, id, plan, sourceRoot, createdAt: Date.now(), updatedAt: Date.now(), phase: "pending", step: "stage",
+    schema: scope === undefined ? 1 : 3, id, plan, sourceRoot, createdAt: Date.now(), updatedAt: Date.now(), phase: "pending", step: "stage",
     projects: plan.projects.map((p) => ({ id: p.project.id, phase: "pending", terminals: {} })),
   };
   if (delegation) appendRecoveryDelegation(op, delegation, op.createdAt);
-  writeOperation(id, op, home);
-  acquireRecoveryLock(id, home);
+  sealScopedPlan(op);
+  // Publish the nonterminal receipt and its hold atomically with capture pruning's inventory.
+  const registry = new Registry(join(home, "registry.db"));
+  try { registry.runtimeCaptureLocked(() => { writeOperation(id, op, home); acquireRecoveryLock(id, home, scope); }); }
+  finally { registry.close(); }
   return op;
 }
 
@@ -488,7 +520,9 @@ function validateReceipt(id: string, op: RecoveryOperation, historical = false):
   // Cleanup validates owned historical facts; this mode never authorizes restore, fresh or reattach.
   const options = historical ? { authority: "historical" as const } : {};
   const decode = (value: unknown) => decodeRestoreReceipt(value, options);
-  if (!(op.schema === 1 || (op.schema === 2 && op.disposition)) || op.id !== id) throw new Error("unsupported operation receipt");
+  const scope = recoveryScope(op.plan);
+  if (!(scope === undefined ? op.schema === 1 || (op.schema === 2 && op.disposition) : op.schema === 3) || op.id !== id)
+    throw new Error("unsupported operation receipt");
   validateRecoveryDelegations(op);
   if (op.targetFeatures !== undefined && (!Array.isArray(op.targetFeatures) || !op.targetFeatures.every(feature => typeof feature === "string" && feature.length > 0) || !op.targetRoot || !op.targetDigest)) throw new Error("invalid target features");
   const { fingerprint, ...reviewed } = op.plan;
@@ -584,13 +618,22 @@ async function authorizeRecoveryDriver(driver: RecoveryDriver, op: RecoveryOpera
   await driver.authorize(op, phase);
 }
 
-/** Closed effect ports only. Inspection stays read-only; person drivers keep their existing behavior. */
-export function guardedRecoveryDriver(driver: RecoveryDriver, operation: () => RecoveryOperation): RecoveryDriver {
-  if (driver.conductorPeer === undefined) return driver;
+function scopedRecoveryCurrent(operation: () => RecoveryOperation, scope: string | undefined, id: string, home: string): (() => void) | undefined {
+  if (scope === undefined) return undefined;
+  return () => {
+    if (recoveryScope(operation().plan) !== scope || recoveryLock(home, scope) !== id) throw new Error("project recovery scope or hold changed");
+  };
+}
+
+/** Closed effect ports only. Scoped operations also fence their project hold; inspection stays read-only. */
+export function guardedRecoveryDriver(driver: RecoveryDriver, operation: () => RecoveryOperation, current?: () => void): RecoveryDriver {
+  if (driver.conductorPeer === undefined && !current) return driver;
   const guard = <A extends unknown[], R>(action: (...args: A) => Promise<R>) => async (...args: A): Promise<R> => {
+    current?.();
     await authorizeRecoveryDriver(driver, operation(), "effect");
+    current?.();
     try { return await action(...args); }
-    finally { await authorizeRecoveryDriver(driver, operation(), "effect"); }
+    finally { await authorizeRecoveryDriver(driver, operation(), "effect"); current?.(); }
   };
   return {
     ...driver,
@@ -619,14 +662,19 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
   // mutable phase. A concurrent runner may have completed the operation meanwhile.
   let op = readOperation<RecoveryOperation>(id, home);
   validateReceipt(id, op);
+  const scope = recoveryScope(op.plan);
+  sealScopedPlan(op);
   if (driver.conductorPeer !== undefined) await authorizeRecoveryDriver(driver, op, "run");
-  acquireRecoveryLock(id, home);
+  const scopeCurrent = scopedRecoveryCurrent(() => op, scope, id, home);
+  acquireRecoveryLock(id, home, scope);
   const releaseRunner = claimRunner(id, home);
   try {
     op = readOperation<RecoveryOperation>(id, home);
+    if (recoveryScope(op.plan) !== scope) throw new Error("project recovery scope changed while claiming its runner");
+    sealScopedPlan(op);
     validateReceipt(id, op);
     if (op.phase === "completed" || op.phase === "cancelled") {
-      if (recoveryLock(home) === id) releaseRecoveryLock(id, home);
+      if (recoveryLock(home, scope) === id) releaseRecoveryLock(id, home, scope);
       releaseRunner();
       return op;
     }
@@ -636,7 +684,7 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
       writeOperation(id, op, home);
     }
   } catch (error) { releaseRunner(); throw error; }
-  driver = guardedRecoveryDriver(driver, () => op);
+  driver = guardedRecoveryDriver(driver, () => op, scopeCurrent);
   let targetFeatures: readonly string[] = [];
   const save = () => { op.updatedAt = driver.now(); writeOperation(id, op, home); };
   const step = (value: string) => { op.step = value; save(); };
@@ -843,8 +891,8 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
         progress.phase = "peers-restored"; save();
       }
     }
-    // Claude is deliberately a shared final phase: no project-level plugin isolation is claimed.
-    if (op.plan.kind === "upgrade" && !op.pluginInstalled) {
+    // Legacy receipts keep their shared installation steps; project upgrades leave global tools alone.
+    if (scope === undefined && op.plan.kind === "upgrade" && !op.pluginInstalled) {
       step("install-plugin"); await driver.installPlugin(op); op.pluginInstalled = true; save();
     }
     for (let i = 0; i < op.projects.length; i++) {
@@ -866,10 +914,10 @@ export async function runRecovery(id: string, driver: RecoveryDriver, home = hub
       progress.phase = "verified"; save();
     }
     if (driver.refreshManager) { step("refresh-manager"); await driver.refreshManager(op); }
-    if (op.plan.kind === "upgrade" && !op.globalInstalled) {
+    if (scope === undefined && op.plan.kind === "upgrade" && !op.globalInstalled) {
       step("install-global"); await driver.installGlobal(op); op.globalInstalled = true; save();
     }
-    releaseRecoveryLock(id, home); op.phase = "completed"; step("completed");
+    releaseRecoveryLock(id, home, scope); op.phase = "completed"; step("completed");
   } catch (error) {
     // #215: every runner error ends with the choices status shows, read from every open source, never only this one.
     const presentationError = error instanceof RecoveryPresentationError ? error
@@ -936,12 +984,18 @@ export async function reattachRecovery(id: string, peer: string, driver: Recover
     return { progress, planned, marker, native };
   };
   selection(); // Finished or unrelated operations must not acquire a new lock merely to refuse.
-  acquireRecoveryLock(id, home);
+  const scope = recoveryScope(op.plan);
+  sealScopedPlan(op);
+  const scopeCurrent = scopedRecoveryCurrent(() => op, scope, id, home);
+  acquireRecoveryLock(id, home, scope);
   const releaseRunner = claimRunner(id, home);
+  driver = guardedRecoveryDriver(driver, () => op, scopeCurrent);
   let attempted = false;
   const save = () => { op.updatedAt = driver.now(); writeOperation(id, op, home); };
   try {
     op = readOperation<RecoveryOperation>(id, home);
+    if (recoveryScope(op.plan) !== scope) throw new Error("project recovery scope changed while claiming its runner");
+    sealScopedPlan(op);
     validateReceipt(id, op);
     const { progress, planned, marker, native } = selection();
     const expected = structuredClone(marker.binding);
@@ -985,16 +1039,21 @@ export async function reattachRecovery(id: string, peer: string, driver: Recover
 export async function abortRecovery(id: string, driver: RecoveryDriver, home = hubHome()): Promise<void> {
   let op = readOperation<RecoveryOperation>(id, home);
   validateReceipt(id, op, true);
+  const scope = recoveryScope(op.plan);
+  sealScopedPlan(op);
   if (driver.conductorPeer !== undefined) await authorizeRecoveryDriver(driver, op, "abort");
-  acquireRecoveryLock(id, home);
+  const scopeCurrent = scopedRecoveryCurrent(() => op, scope, id, home);
+  acquireRecoveryLock(id, home, scope);
   const releaseRunner = claimRunner(id, home);
   try {
     // Re-read after the exclusive runner claim so cancellation cannot act on a
     // stale pending/prepared receipt after another runner advanced it.
     op = readOperation<RecoveryOperation>(id, home);
+    if (recoveryScope(op.plan) !== scope) throw new Error("project recovery scope changed while claiming its runner");
+    sealScopedPlan(op);
     validateReceipt(id, op, true);
     if (op.phase === "completed" || op.phase === "cancelled") {
-      if (recoveryLock(home) === id) releaseRecoveryLock(id, home);
+      if (recoveryLock(home, scope) === id) releaseRecoveryLock(id, home, scope);
       return;
     }
     if (driver.conductorPeer !== undefined) await authorizeRecoveryDriver(driver, op, "abort");
@@ -1002,7 +1061,7 @@ export async function abortRecovery(id: string, driver: RecoveryDriver, home = h
       appendRecoveryDelegation(op, { peer: (driver.conductorPeer ?? driver.liveTestPeer)!, command: "recovery abort" }, driver.now());
       writeOperation(id, op, home);
     }
-    driver = guardedRecoveryDriver(driver, () => op);
+    driver = guardedRecoveryDriver(driver, () => op, scopeCurrent);
     if (abandoned(op)) writeOperation(id, op, home);
     const { fingerprint, ...body } = op.plan;
     if (fingerprint !== planFingerprint(body)) throw new Error("operation plan changed");
@@ -1017,7 +1076,7 @@ export async function abortRecovery(id: string, driver: RecoveryDriver, home = h
     }
     delete op.error; delete op.failure; delete op.blockedReattachment; delete op.presentationCause;
     op.phase = "cancelled"; op.step = "cancelled"; op.updatedAt = driver.now();
-    writeOperation(id, op, home); releaseRecoveryLock(id, home);
+    writeOperation(id, op, home); releaseRecoveryLock(id, home, scope);
   } catch (error) {
     if (isDatabaseBusy(error)) throw new RecoveryDatabaseBusy();
     throw error;
@@ -1037,15 +1096,18 @@ export async function disposeRecovery(id: string, choice: { fresh: string } | {
   if (driver.liveTestPeer && "fresh" in choice && repairedFreshSession(op, choice.fresh) !== false) throw new Error(LIVE_TEST_PERSON_REFUSAL);
   // A finished operation owns no lock: never take one only to refuse.
   if (op.phase === "completed" || op.phase === "cancelled") throw new Error(`operation is already ${op.phase}`);
-  acquireRecoveryLock(id, home);
+  const scope = recoveryScope(op.plan);
+  sealScopedPlan(op);
+  const scopeCurrent = scopedRecoveryCurrent(() => op, scope, id, home);
+  acquireRecoveryLock(id, home, scope);
   const releaseRunner = claimRunner(id, home);
   try {
-    try { op = readOperation<RecoveryOperation>(id, home); validateReceipt(id, op, "stop" in choice); }
+    try { op = readOperation<RecoveryOperation>(id, home); validateReceipt(id, op, "stop" in choice); if (recoveryScope(op.plan) !== scope) throw new Error("project recovery scope changed while claiming its runner"); sealScopedPlan(op); }
     catch (error) { if (driver.liveTestPeer && "fresh" in choice) throw new Error(LIVE_TEST_PERSON_REFUSAL); throw error; }
     if (driver.liveTestPeer && "fresh" in choice && repairedFreshSession(op, choice.fresh) !== false) throw new Error(LIVE_TEST_PERSON_REFUSAL);
     if (op.phase === "completed" || op.phase === "cancelled") {
       // Another runner finished it while this one waited: leave no lock behind, as resume and abort do.
-      if (recoveryLock(home) === id) releaseRecoveryLock(id, home);
+      if (recoveryLock(home, scope) === id) releaseRecoveryLock(id, home, scope);
       throw new Error(`operation is already ${op.phase}`);
     }
     if (driver.liveTestPeer) {
@@ -1155,7 +1217,7 @@ export async function disposeRecovery(id: string, choice: { fresh: string } | {
     }
     delete op.error; delete op.failure;
     op.phase = "cancelled"; op.step = "disposed: stop-and-archive (abandoned, not completed)"; op.updatedAt = driver.now();
-    writeOperation(id, op, home); releaseRecoveryLock(id, home);
+    writeOperation(id, op, home); releaseRecoveryLock(id, home, scope);
     return op;
   } finally { releaseRunner(); }
 }

package/src/hub/autonomy-defaults.ts

@@ -3,8 +3,10 @@ import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openS
 import { isAbsolute, join, relative } from "node:path";
 import { canonicalPath } from "./project.ts";
 import { insideRoot } from "./path-policy.ts";
+import { checkStartAgents } from "./start-agents.ts";
 
-export interface AutonomyDefaultsRead { enabled: boolean; fingerprint: string; notice?: string }
+/** `startAgents` is the machine default of `start.agents` (#608), present only when `ahub setup` chose one. */
+export interface AutonomyDefaultsRead { enabled: boolean; fingerprint: string; notice?: string; startAgents?: string[] }
 const MAX_BYTES = 4096;
 const same = (a: Stats, b: Stats) => a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
 const refusal = () => new Error("machine autonomy defaults are unsafe or changed; nothing was written");
@@ -30,26 +32,49 @@ function capture(home: string, roots: readonly string[]): { stat?: Stats; text?:
     return { stat: after, text, fingerprint: createHash("sha256").update(`${after.dev}:${after.ino}:${after.ctimeMs}:`).update(text).digest("hex") };
   } finally { closeSync(fd); }
 }
+interface DefaultsDocument { autonomy?: boolean; startAgents?: string[] }
+/** The file's content, or the refusal. `{schema:1}` alone and any key but schema, autonomy and start are refused. */
+function parseDefaults(text: string): DefaultsDocument {
+  const raw: unknown = JSON.parse(text);
+  const document = raw && typeof raw === "object" && !Array.isArray(raw) ? raw as Record<string, unknown> : undefined;
+  if (!document || Object.keys(document).some(key => !["schema", "autonomy", "start"].includes(key)) || document.schema !== 1) throw refusal();
+  if (document.autonomy !== undefined && typeof document.autonomy !== "boolean") throw refusal();
+  let startAgents: string[] | undefined;
+  if (document.start !== undefined) {
+    const start = document.start;
+    if (!start || typeof start !== "object" || Array.isArray(start) || Object.keys(start).some(key => key !== "agents")) throw refusal();
+    try { startAgents = checkStartAgents((start as Record<string, unknown>).agents); } catch { throw refusal(); }
+  }
+  if (document.autonomy === undefined && startAgents === undefined) throw refusal();
+  return { ...(document.autonomy === undefined ? {} : { autonomy: document.autonomy }), ...(startAgents ? { startAgents } : {}) };
+}
 /** Missing or untrusted machine files never change the shipped ask default. */
 export function readAutonomyDefaults(home: string, roots: readonly string[] = []): AutonomyDefaultsRead {
   try {
     const held = capture(home, roots);
     if (held.text === undefined) return { enabled: false, fingerprint: held.fingerprint };
-    const raw: unknown = JSON.parse(held.text);
-    const document = raw && typeof raw === "object" && !Array.isArray(raw) ? raw as Record<string, unknown> : undefined;
-    if (!document || Object.keys(document).some(key => !["schema", "autonomy"].includes(key)) || document.schema !== 1 || typeof document.autonomy !== "boolean") throw refusal();
-    return { enabled: document.autonomy, fingerprint: held.fingerprint };
+    const document = parseDefaults(held.text);
+    return { enabled: document.autonomy === true, fingerprint: held.fingerprint, ...(document.startAgents ? { startAgents: document.startAgents } : {}) };
   } catch { return { enabled: false, fingerprint: "untrusted", notice: "Machine autonomy defaults ignored: defaults.json must be an owner-only regular file with a valid schema, outside project roots." }; }
 }
-/** Person CLI only. Exact prior evidence is rechecked after confirmation and before replacement. */
+/** Person CLI only. Exact prior evidence is rechecked after confirmation and before replacement. The other half of the file (the start set) is kept. */
 export function writeAutonomyDefaults(home: string, enabled: boolean, expected: string, roots: readonly string[] = []): void {
+  writeDefaults(home, expected, roots, kept => ({ schema: 1, autonomy: enabled, ...(kept.startAgents ? { start: { agents: kept.startAgents } } : {}) }));
+}
+/** Person CLI only (`ahub setup`): the machine default of `start.agents`. The autonomy half of the file is kept, and absent stays absent. */
+export function writeMachineStartAgents(home: string, agents: readonly string[], expected: string, roots: readonly string[] = []): void {
+  const checked = checkStartAgents([...agents]);
+  writeDefaults(home, expected, roots, kept => ({ schema: 1, ...(kept.autonomy === undefined ? {} : { autonomy: kept.autonomy }), start: { agents: checked } }));
+}
+function writeDefaults(home: string, expected: string, roots: readonly string[], build: (kept: DefaultsDocument) => Record<string, unknown>): void {
   const before = capture(home, roots);
   if (before.fingerprint !== expected) throw refusal();
+  const kept = before.text === undefined ? {} : parseDefaults(before.text);
   const parent = location(home, roots, true)!;
   const file = join(home, "defaults.json"), temporary = join(home, `.defaults.${randomUUID()}.tmp`);
   try {
     const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    try { writeFileSync(fd, `${JSON.stringify({ schema: 1, autonomy: enabled }, null, 2)}\n`); fsyncSync(fd); }
+    try { writeFileSync(fd, `${JSON.stringify(build(kept), null, 2)}\n`); fsyncSync(fd); }
     finally { closeSync(fd); }
     const current = lstatSync(home);
     if (current.dev !== parent.dev || current.ino !== parent.ino || capture(home, roots).fingerprint !== expected) throw refusal();

package/src/hub/board.ts

@@ -1,5 +1,6 @@
+import { parseAttemptReceipt, parseResearchRunners, verifyAttemptReceipt, type AttemptReceiptV1 } from "./research-runner.ts";
 import { canonicalJson } from "./packs.ts";
-import { parseComparisonPlan, comparisonPlanHash, evaluatorIdentityHash, parseExperimentProtocol, protocolHash, parseExperimentAttempt, parseExperimentEvent, parseExperimentHostEvidence, experimentStatus, projectExperimentWithObservations,
+import { parseComparisonPlan, comparisonPlanHash, evaluatorIdentityHash, parseExperimentProtocol, protocolHash, parseExperimentAttempt, parseExperimentEvent, parseExperimentHostEvidence, experimentStatus, projectExperimentWithObservations, declaredExperimentEvents,
   type ComparisonPlanV1, type ExperimentProtocolRecord, type ExperimentAttemptRecord, type ExperimentEventRecord, type ExperimentWriteFence, type DeclaredExperimentEventInput, type ExperimentHostEvidence, type ExperimentStatus } from "./research-experiments.ts";
 import type { InvocationRow } from "./invocations.ts";
 import { HOST_CODE_SYMBOLS, parseTaskCodeSymbols, type TaskCodeSymbols } from "./task-code-symbols.ts";
@@ -8,11 +9,11 @@ import { planFingerprint } from "./plan-conformance.ts";
 import type { PlannerReason } from "./routing.ts";
 import type { ReviewerPoolReason } from "./reviewer-pool.ts";
 import type { GitHubSource } from "./github-import.ts";
-import { Database } from "bun:sqlite";
+import type { Database } from "./db-schema.ts";
+import { openHubDatabase, advanceHubDbSchema } from "./db-schema.ts";
 import { planningPatch, type PlanningFields, type Release, type ReleaseState } from "./planning.ts";
 import { HUB, USER, type PeerId } from "./envelope.ts";
 import type { SweepRecord } from "./task-sweep.ts";
-import { HUB_DB_BUSY_TIMEOUT_MS } from "./db-timeout.ts";
 import type { SdlcReceipt } from "./sdlc.ts";
 import { parseReviewFindings, type ReviewFindingSet } from "./review-findings.ts";
 import { parseDeliverableRecords, type DeliverableRecord } from "./deliverables.ts";
@@ -107,6 +108,12 @@ const EXPERIMENT_PLAN_SELECT = "SELECT rowid AS row_id,hash,project,campaign_id,
 interface ExperimentProtocolRow { hash: string; project: string; campaign_id: string; campaign_revision: number; task_id: number; body: string | null; by_peer: string; at: number; private: number }
 interface ExperimentAttemptRow { row_id?: number; attempt_id: string; project: string; campaign_id: string; campaign_revision: number; protocol_hash: string; task_id: number; idempotency_key: string; body: string | null; body_sha256: string; by_peer: string; at: number; private: number }
 interface ExperimentEventRow { attempt_id: string; project: string; seq: number; idempotency_key: string; kind: string; body: string | null; body_sha256: string; by_peer: string; at: number; private: number }
+export interface RunnerReceiptRecord {
+  receipt: AttemptReceiptV1; signature: string; publicKey: string; keyHash: string; bodyHash: string;
+  seq: number; by: PeerId; at: number; private: boolean;
+}
+interface RunnerReceiptRow { receipt_id: string; project: string; attempt_id: string; event_seq: number; body: string | null; body_sha256: string; by_peer: string; at: number; private: number }
+const RUNNER_RECEIPT_SELECT = "SELECT receipt_id,project,attempt_id,event_seq,CASE WHEN length(CAST(body AS BLOB))<=131072 THEN body END AS body,body_sha256,by_peer,at,private FROM research_runner_receipts";
 interface ExperimentObservationRow { attempt_id: string; event_seq: number; body: string | null; body_sha256: string }
 const EXPERIMENT_PROTOCOL_SELECT = "SELECT hash,project,campaign_id,campaign_revision,task_id,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,by_peer,at,private FROM research_protocols";
 const EXPERIMENT_ATTEMPT_SELECT = "SELECT rowid AS row_id,attempt_id,project,campaign_id,campaign_revision,protocol_hash,task_id,idempotency_key,CASE WHEN length(CAST(body AS BLOB))<=65536 THEN body END AS body,body_sha256,by_peer,at,private FROM research_attempts";
@@ -212,6 +219,8 @@ export interface HistoryEntry {
   evidenceOnly?: true;
   /** Structured review report bound to the reviewed artifact, stored in the existing history JSON. */
   reviewFindings?: ReviewFindingSet;
+  /** Immutable artifact head of this verdict, including when lifecycle gates are off. */
+  reviewedHead?: string;
   /**
    * #509a: the files a `done`, a lifecycle record or an approval bound, with the content hashes the hub computed. An approval carries the hashes
    * it was given at review time, so a later edit reads as "deliverable changed since review". Full paths live here; every view goes through
@@ -403,8 +412,7 @@ export class Board {
   }
 
   constructor(path: string) {
-    this.db = new Database(path, { create: true });
-    this.db.run(`PRAGMA busy_timeout = ${HUB_DB_BUSY_TIMEOUT_MS}`);
+    this.db = openHubDatabase(path, { create: true });
     this.db.run("PRAGMA journal_mode = WAL");
     this.db.run(`CREATE TABLE IF NOT EXISTS tasks (
       id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, detail TEXT NOT NULL DEFAULT '', class TEXT NOT NULL,
@@ -505,6 +513,10 @@ export class Board {
     this.db.run(`CREATE TABLE IF NOT EXISTS research_attempt_observations (
       attempt_id TEXT NOT NULL, event_seq INTEGER NOT NULL, body TEXT NOT NULL, body_sha256 TEXT NOT NULL,
       PRIMARY KEY(attempt_id,event_seq))`);
+    this.db.run(`CREATE TABLE IF NOT EXISTS research_runner_receipts (
+      receipt_id TEXT PRIMARY KEY, project TEXT NOT NULL, attempt_id TEXT NOT NULL, event_seq INTEGER NOT NULL,
+      body TEXT NOT NULL, body_sha256 TEXT NOT NULL, by_peer TEXT NOT NULL, at INTEGER NOT NULL, private INTEGER NOT NULL,
+      UNIQUE(attempt_id,event_seq))`);
     this.db.run(`CREATE TABLE IF NOT EXISTS research_plans (
       hash TEXT PRIMARY KEY, project TEXT NOT NULL, campaign_id TEXT NOT NULL, campaign_revision INTEGER NOT NULL,
       task_id INTEGER NOT NULL, body TEXT NOT NULL, by_peer TEXT NOT NULL, at INTEGER NOT NULL, private INTEGER NOT NULL)`);
@@ -867,7 +879,7 @@ export class Board {
   }
 
   hasResearchState(): boolean {
-    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_campaigns) OR EXISTS(SELECT 1 FROM research_units) OR EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) AS present").get() as { present: number }).present === 1;
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_campaigns) OR EXISTS(SELECT 1 FROM research_units) OR EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) OR EXISTS(SELECT 1 FROM research_runner_receipts) AS present").get() as { present: number }).present === 1;
   }
 
   /** A consistent, streaming digest includes metadata and body hashes, not merely row counts. */
@@ -1104,6 +1116,15 @@ export class Board {
       if (typeof row.body !== "string" || !researchInteger(row.seq) || !researchInteger(row.at, 0) || !researchText(row.by_peer) || ![0, 1].includes(row.private) || !researchText(row.idempotency_key, 64)) throw experimentFailure();
       const attempt = this.experimentAttempt(row.attempt_id), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
       if (!attempt || !protocol || row.project !== attempt.project) throw experimentFailure();
+      if (row.kind === "attestation") {
+        const raw = JSON.parse(row.body), body = raw?.body, receipt = typeof body?.receiptId === "string" && this.runnerReceipt(body.receiptId);
+        if (!receipt || raw.kind !== "attestation" || Object.keys(raw).length !== 2 || Object.keys(body).length !== 1 || receipt.receipt.attemptId !== row.attempt_id || receipt.seq !== row.seq || receipt.at !== row.at
+          || receipt.by !== row.by_peer || row.body_sha256 !== experimentHash({ kind: "attestation", body }) || row.idempotency_key !== `rr-${receipt.bodyHash.slice(0, 61)}`
+          || this.db.query("SELECT 1 FROM research_attempt_observations WHERE attempt_id=? AND event_seq=?").get(row.attempt_id, row.seq)) throw experimentFailure();
+        return { attemptId: row.attempt_id, idempotencyKey: row.idempotency_key,
+          event: { kind: "attestation", body: { receiptId: receipt.receipt.receiptId }, seq: row.seq, at: row.at, provenance: "runner-attested" },
+          bodyHash: row.body_sha256, by: row.by_peer, private: row.private === 1 || attempt.private || receipt.private, observations: [] };
+      }
       const input = parseExperimentEvent(JSON.parse(row.body), protocol.protocol);
       if (input.kind !== row.kind || experimentHash(input) !== row.body_sha256) throw experimentFailure();
       const event = { ...input, seq: row.seq, at: row.at, provenance: "declared" as const };
@@ -1147,6 +1168,87 @@ export class Board {
     });
   }
 
+  private runnerReceiptFromRow(row: RunnerReceiptRow): RunnerReceiptRecord {
+    try {
+      if (typeof row.body !== "string" || !researchInteger(row.event_seq) || !researchInteger(row.at, 0) || !researchText(row.by_peer) || ![0, 1].includes(row.private)) throw experimentFailure();
+      const raw = JSON.parse(row.body);
+      if (!raw || Object.keys(raw).sort().join(",") !== "publicKey,receipt,signature") throw experimentFailure();
+      const receipt = parseAttemptReceipt(raw.receipt);
+      const runner = parseResearchRunners({ [receipt.runner]: { publicKey: raw.publicKey, projects: [receipt.projectId], revoked: false } })[receipt.runner]!;
+      if (typeof raw.signature !== "string" || raw.signature.length !== 88 || Buffer.from(raw.signature, "base64").length !== 64
+        || Buffer.from(raw.signature, "base64").toString("base64") !== raw.signature) throw experimentFailure();
+      const body = { receipt, signature: raw.signature as string, publicKey: runner.publicKey };
+      const attempt = this.experimentAttempt(receipt.attemptId), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+      if (!attempt || !protocol || row.receipt_id !== receipt.receiptId || row.attempt_id !== receipt.attemptId || row.project !== receipt.projectId || row.project !== attempt.project
+        || receipt.protocolHash !== attempt.attempt.protocolHash || experimentHash(body) !== row.body_sha256
+        || receipt.codeCommit !== undefined && "commit" in protocol.protocol.code && receipt.codeCommit !== protocol.protocol.code.commit) throw experimentFailure();
+      const event = this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND seq=?`).get(row.attempt_id, row.event_seq) as ExperimentEventRow | null;
+      const expectedEvent = { kind: "attestation", body: { receiptId: receipt.receiptId } };
+      if (!event || event.kind !== "attestation" || typeof event.body !== "string" || event.body !== canonicalJson(expectedEvent)
+        || event.body_sha256 !== experimentHash(expectedEvent) || event.project !== row.project || event.by_peer !== row.by_peer || event.at !== row.at
+        || event.idempotency_key !== `rr-${row.body_sha256.slice(0, 61)}` || ![0, 1].includes(event.private)
+        || this.db.query("SELECT 1 FROM research_attempt_observations WHERE attempt_id=? AND event_seq=?").get(row.attempt_id, row.event_seq)) throw experimentFailure();
+      return { ...body, keyHash: createHash("sha256").update(Buffer.from(runner.publicKey, "base64")).digest("hex"), bodyHash: row.body_sha256,
+        seq: row.event_seq, by: row.by_peer, at: row.at, private: row.private === 1 || event.private === 1 || attempt.private };
+    } catch { throw experimentFailure(); }
+  }
+
+  runnerReceipt(id: string): RunnerReceiptRecord | undefined {
+    const row = this.db.query(`${RUNNER_RECEIPT_SELECT} WHERE receipt_id=?`).get(id) as RunnerReceiptRow | null;
+    return row ? this.runnerReceiptFromRow(row) : undefined;
+  }
+
+  runnerReceipts(attemptId: string): RunnerReceiptRecord[] {
+    if (!this.experimentAttempt(attemptId)) throw experimentFailure();
+    // ponytail: at most 64 signed receipts per attempt; paginate only with a reviewed evidence-page contract.
+    const rows = this.db.query(`${RUNNER_RECEIPT_SELECT} WHERE attempt_id=? ORDER BY event_seq LIMIT 65`).all(attemptId) as RunnerReceiptRow[];
+    if (rows.length > 64) throw experimentFailure();
+    return rows.map(row => this.runnerReceiptFromRow(row));
+  }
+
+  appendRunnerReceipt(record: Pick<RunnerReceiptRecord, "receipt" | "signature" | "publicKey" | "by" | "at" | "private">, expectedLastSeq: number, fence: ExperimentWriteFence): RunnerReceiptRecord {
+    const receipt = parseAttemptReceipt(record.receipt), attempt = this.experimentAttempt(receipt.attemptId), protocol = attempt && this.experimentProtocol(attempt.attempt.protocolHash);
+    if (!attempt || !protocol || record.by !== fence.owner && record.by !== USER || !researchInteger(record.at, 0) || typeof record.private !== "boolean" || !researchInteger(expectedLastSeq, 0)) throw experimentFailure();
+    const body = { receipt, signature: record.signature, publicKey: record.publicKey }, bodyHash = experimentHash(body);
+    return this.atomic(() => {
+      const { campaign } = this.experimentFence(fence);
+      if (attempt.project !== fence.project || attempt.attempt.taskId !== fence.taskId || protocol.protocol.campaignId !== campaign.id || protocol.protocol.campaignRevision !== campaign.revision) throw experimentFailure();
+      const prior = this.runnerReceipt(receipt.receiptId);
+      if (prior) {
+        if (prior.bodyHash !== bodyHash || canonicalJson({ receipt: prior.receipt, signature: prior.signature, publicKey: prior.publicKey }) !== canonicalJson(body)) throw new Error("receiptId already records different signed bytes");
+        return prior;
+      }
+      verifyAttemptReceipt(receipt, record.signature, { runners: { [receipt.runner]: { publicKey: record.publicKey, projects: [fence.project], revoked: false } }, projectId: fence.project,
+        attempt: { id: attempt.attemptId, projectId: attempt.project, protocolHash: attempt.attempt.protocolHash, ...("commit" in protocol.protocol.code ? { codeCommit: protocol.protocol.code.commit } : {}) } });
+      if (this.runnerReceipts(attempt.attemptId).length >= 64) throw new Error("an attempt supports at most 64 runner receipts");
+      if (this.experimentLastSeq(attempt.attemptId) !== expectedLastSeq || !researchInteger(expectedLastSeq + 1)) throw new Error("experiment event sequence changed");
+      const seq = expectedLastSeq + 1, event = { kind: "attestation", body: { receiptId: receipt.receiptId } };
+      // The first attestation is incompatible with older event readers, so both writes and the format floor commit together.
+      advanceHubDbSchema(this.db, 2, "0.26.0");
+      this.taskWrite(() => this.db.query("INSERT INTO research_attempt_events(attempt_id,project,seq,idempotency_key,kind,body,body_sha256,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?,?)")
+        .run(attempt.attemptId, fence.project, seq, `rr-${bodyHash.slice(0, 61)}`, "attestation", canonicalJson(event), experimentHash(event), record.by, record.at, record.private || attempt.private ? 1 : 0));
+      this.taskWrite(() => this.db.query("INSERT INTO research_runner_receipts(receipt_id,project,attempt_id,event_seq,body,body_sha256,by_peer,at,private) VALUES(?,?,?,?,?,?,?,?,?)")
+        .run(receipt.receiptId, fence.project, attempt.attemptId, seq, canonicalJson(body), bodyHash, record.by, record.at, record.private || attempt.private ? 1 : 0));
+      if (record.private || attempt.private) this.taskWrite(() => this.db.query("UPDATE research_attempts SET private=1 WHERE attempt_id=? AND private=0").run(attempt.attemptId));
+      return this.runnerReceipt(receipt.receiptId)!;
+    });
+  }
+
+  hasRunnerReceipts(): boolean {
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_runner_receipts) OR EXISTS(SELECT 1 FROM research_attempt_events WHERE kind='attestation') AS present").get() as { present: number }).present === 1;
+  }
+
+  runnerReceiptIntegrity(): { count: number; digest: string } {
+    return this.db.transaction(() => {
+      if (this.db.query("SELECT 1 FROM research_attempt_events AS e LEFT JOIN research_runner_receipts AS r ON r.attempt_id=e.attempt_id AND r.event_seq=e.seq WHERE e.kind='attestation' AND r.receipt_id IS NULL LIMIT 1").get()) throw experimentFailure();
+      const digest = createHash("sha256").update("agent-hub.runner-receipts-integrity/v1\n"); let count = 0;
+      for (const row of this.db.query(`${RUNNER_RECEIPT_SELECT} ORDER BY receipt_id`).iterate() as Iterable<RunnerReceiptRow>) {
+        digest.update(canonicalJson(this.runnerReceiptFromRow(row))).update("\n"); count++;
+      }
+      return { count, digest: digest.digest("hex") };
+    }).deferred();
+  }
+
   experimentLastSeq(attemptId: string): number {
     if (!this.experimentAttempt(attemptId)) throw experimentFailure();
     const last = this.db.query("SELECT MAX(seq) AS seq,COUNT(*) AS count FROM research_attempt_events WHERE attempt_id=?").get(attemptId) as { seq: number | null; count: number };
@@ -1177,7 +1279,7 @@ export class Board {
     if (endRows.length > 1) throw experimentFailure();
     const end = endRows[0], start = !end && this.db.query(`${EXPERIMENT_EVENT_SELECT} WHERE attempt_id=? AND kind='start' ORDER BY seq LIMIT 1`).get(attemptId) as ExperimentEventRow | null;
     const events = end ? [this.experimentEventFromRow(end).event] : start ? [this.experimentEventFromRow(start).event] : [];
-    return experimentStatus(events, this.get(attempt.attempt.taskId)?.state);
+    return experimentStatus(declaredExperimentEvents(events), this.get(attempt.attempt.taskId)?.state);
   }
 
   // ponytail: exact counts validate all campaign attempts on each show (linear in attempt count). Upgrade to a transactional status projection maintained on event and task-state changes.
@@ -1194,7 +1296,7 @@ export class Board {
   }
 
   hasResearchExperimentState(): boolean {
-    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) AS present").get() as { present: number }).present === 1;
+    return (this.db.query("SELECT EXISTS(SELECT 1 FROM research_protocols) OR EXISTS(SELECT 1 FROM research_attempts) OR EXISTS(SELECT 1 FROM research_attempt_events) OR EXISTS(SELECT 1 FROM research_attempt_observations) OR EXISTS(SELECT 1 FROM research_runner_receipts) AS present").get() as { present: number }).present === 1;
   }
 
   researchExperimentsIntegrity(): { protocols: number; attempts: number; events: number; observations: number; digest: string } {
@@ -1352,19 +1454,26 @@ export class Board {
 
   /** The only way a task changes. Validates the move, records who did what, returns the new row. */
   /** A `plan` in the patch replaces the old one whole: a new plan is the owner's current intent, not an addition. */
-  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "planner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "invocation" | "plannerReason" | "planAuthor" | "selfReview" | "profile" | "sweep" | "reason" | "from" | "capacity" | "conductorManual" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewScope" | "evidenceOnly" | "reviewFindings" | "unmetCriteria" | "deliverables" | "checkKey" | "missingKeys" | "claim" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
+  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "planner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "invocation" | "plannerReason" | "planAuthor" | "selfReview" | "profile" | "sweep" | "reason" | "from" | "capacity" | "conductorManual" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewScope" | "evidenceOnly" | "reviewedHead" | "reviewFindings" | "unmetCriteria" | "deliverables" | "checkKey" | "missingKeys" | "claim" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
     const task = this.get(id);
     if (!task) throw new Error(`no task #${id}`);
     if (expectedFlowRevision !== undefined && (!Number.isSafeInteger(expectedFlowRevision) || expectedFlowRevision < 0 || task.history.length !== expectedFlowRevision)) throw new Error("task flow revision changed");
     const untouchedReturn = event === "backlog returned untouched" && patch.state === "backlog" && patch.owner === null && patch.reviewer === null
       && ["proposed", "in_progress"].includes(task.state) && expectedFlowRevision !== undefined && !!note?.trim() && !taskHasWorkEvidence(task);
     // A new delivered head with a configured check is owner work again until that check finishes.
-    const reviewCheck = event === "done (checking)" && task.state === "in_review" && patch.state === "in_progress"
-      && expectedFlowRevision !== undefined && (by === task.owner || by === "user") && patch.owner === undefined && patch.reviewer === undefined
+    const reviewCheck = task.sdlc?.merge?.state !== "merged" && event === "done (checking)" && ["in_review", "approved"].includes(task.state) && patch.state === "in_progress"
+      && expectedFlowRevision !== undefined && (by === task.owner || by === "user") && patch.owner === undefined && (patch.reviewer === undefined || task.state === "approved" && !task.reviewer && patch.reviewer === "user")
       && typeof patch.refs?.commit === "string" && /^[a-f0-9]{40}$/.test(patch.refs.commit)
       && patch.refs.commit !== (task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead);
+    const approvalReopen = task.state === "approved" && task.sdlc?.merge?.state !== "merged" && expectedFlowRevision !== undefined
+      && patch.owner === undefined && (
+        event === "done" && patch.state === "in_review" && (by === task.owner || by === "user")
+          && typeof patch.refs?.commit === "string" && /^[a-f0-9]{40}$/.test(patch.refs.commit)
+          && patch.refs.commit !== (task.refs.commit ?? task.sdlc?.head ?? task.sdlc?.localHead)
+        || event === "changes_requested" && patch.state === "changes_requested" && (by === task.reviewer || by === "user"));
+    if (extra.reviewedHead !== undefined && (!/^[a-f0-9]{40}$/.test(extra.reviewedHead) || !["approved", "changes_requested"].includes(event))) throw new Error("invalid verdict head");
     if (task.draft && patch.state && patch.state !== "backlog" && patch.state !== "cancelled") throw new Error(`task #${id} is an intake draft; the person approves it first`);
-    if (patch.state && patch.state !== task.state && !MOVES[task.state].includes(patch.state) && !untouchedReturn && !reviewCheck) {
+    if (patch.state && patch.state !== task.state && !MOVES[task.state].includes(patch.state) && !untouchedReturn && !reviewCheck && !approvalReopen) {
       throw new Error(`task #${id} is ${task.state}: cannot move to ${patch.state}`);
     }
     const planner = Object.hasOwn(patch, "planner") ? plannerValue(patch.planner) : task.planner ?? null;
@@ -1417,7 +1526,14 @@ export class Board {
     // Disabling reporting must not let plan or repository refs edits/reverts resurrect prior consent.
     const repositoryRefsChanged = patch.refs !== undefined && JSON.stringify([task.refs.repo, task.refs.paths]) !== JSON.stringify([next.refs.repo, next.refs.paths]);
     const departureInvalidated = extra.planDepartureInvalidated === true || hasDeparture && (planChanged || repositoryRefsChanged);
-    const history = [...task.history, { at: Date.now(), by, event, ...(extra.invocation ? { invocation: extra.invocation } : {}), ...plannerHistory, ...authorHistory, ...(extra.selfReview === true ? { selfReview: true as const } : {}), ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.conductorManual === true ? { conductorManual: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(unmetCriteria?.length ? { unmetCriteria } : {}), ...(deliverables ? { deliverables } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewScope === "code" ? { reviewScope: "code" as const } : {}), ...(extra.evidenceOnly === true && event === "changes_requested" ? { evidenceOnly: true as const } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}), ...(["check passed", "check failed"].includes(event) && typeof extra.checkKey === "string" && /^[a-z][a-z0-9_]{0,47}$/.test(extra.checkKey) ? { checkKey: extra.checkKey } : {}), ...(["check passed", "check failed"].includes(event) && Number.isSafeInteger(extra.missingKeys) && extra.missingKeys! >= 0 && extra.missingKeys! <= 100_000 ? { missingKeys: extra.missingKeys } : {}), ...(event === "claim verdict" && extra.claim ? { claim: extra.claim } : {}) }];
+    // Older verdict rows kept their bound head only on the receipt. Preserve it atomically before reopening drops that receipt.
+    const priorApproval = task.history.findLastIndex(entry => entry.event === "approved");
+    const priorHead = task.sdlc?.reviewedHead;
+    const backfill = (approvalReopen || reviewCheck && task.state === "approved") && priorApproval >= 0
+      && priorHead !== undefined && /^[a-f0-9]{40}$/.test(priorHead);
+    const previousHistory = backfill ? task.history.map((entry, index) => index === priorApproval && !entry.reviewedHead
+      ? { ...entry, reviewedHead: entry.reviewFindings?.head ?? priorHead } : entry) : task.history;
+    const history = [...previousHistory, { at: Date.now(), by, event, ...(extra.invocation ? { invocation: extra.invocation } : {}), ...plannerHistory, ...authorHistory, ...(extra.selfReview === true ? { selfReview: true as const } : {}), ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.conductorManual === true ? { conductorManual: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(extra.reviewedHead ? { reviewedHead: extra.reviewedHead } : {}), ...(unmetCriteria?.length ? { unmetCriteria } : {}), ...(deliverables ? { deliverables } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewScope === "code" ? { reviewScope: "code" as const } : {}), ...(extra.evidenceOnly === true && event === "changes_requested" ? { evidenceOnly: true as const } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}), ...(["check passed", "check failed"].includes(event) && typeof extra.checkKey === "string" && /^[a-z][a-z0-9_]{0,47}$/.test(extra.checkKey) ? { checkKey: extra.checkKey } : {}), ...(["check passed", "check failed"].includes(event) && Number.isSafeInteger(extra.missingKeys) && extra.missingKeys! >= 0 && extra.missingKeys! <= 100_000 ? { missingKeys: extra.missingKeys } : {}), ...(event === "claim verdict" && extra.claim ? { claim: extra.claim } : {}) }];
     this.taskWrite(() => {
       const result = this.db.query("UPDATE tasks SET state = ?, owner = ?, reviewer = ?, reserved = ?, refs = ?, plan = ?, rejections = ?, signals = ?, history = ?, sdlc = ?, task_role = ?, cancelled = ?, updated = ?, planner = ? WHERE id = ?")
         .run(next.state, next.owner, next.reviewer, next.reserved ?? null, JSON.stringify(next.refs), JSON.stringify(next.plan ?? {}), next.rejections, JSON.stringify(next.signals), JSON.stringify(history), next.sdlc ? JSON.stringify(next.sdlc) : null, next.role ?? null, next.cancelled ? JSON.stringify(next.cancelled) : null, Date.now(), planner, id);