@tea-agent/loop-agent 0.38.3 → 0.38.4

package/dist/commands/init-upgrade.js

@@ -6,7 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveAdapter } from "../adapters/index.js";
-import { createNpmUpdateClient } from "../cli/update/npm-client.js";
+import { createNpmUpdateClient, } from "../shared/update/npm-client.js";
 import { auditDocs } from "../governance/checks.js";
 import { harnessManifestSchema } from "../governance/manifest-types.js";
 import { isInitRuntimeActive, } from "../shared/runtime-activity.js";
@@ -126,6 +126,7 @@ function controllerStateProjection(state) {
         phase: state.phase,
         status: state.status,
         mergeTasks: cloneJson(state.mergeTasks),
+        queuedMergeTasks: cloneJson(state.queuedMergeTasks),
         ...(state.mergeGuard ? { mergeGuard: cloneJson(state.mergeGuard) } : {}),
         mergeReceipts: cloneJson(state.mergeReceipts),
         humanDecisions: cloneJson(state.humanDecisions),
@@ -202,10 +203,16 @@ function assertStateShape(state, repoRoot, runId) {
         !isControllerIdentity(candidate.controllerIdentity) ||
         !isRecord(candidate.versionGate) ||
         !Array.isArray(candidate.mergeTasks) ||
+        !Array.isArray(candidate.queuedMergeTasks) ||
         !Array.isArray(candidate.mergeReceipts) ||
         !Array.isArray(candidate.humanDecisions) ||
         !Array.isArray(candidate.actionReceipts) ||
-        !isHomeFingerprint(candidate.homeFingerprint)) {
+        !isHomeFingerprint(candidate.homeFingerprint) ||
+        (candidate.modelCatalog !== undefined &&
+            (!isRecord(candidate.modelCatalog) ||
+                candidate.modelCatalog.schemaVersion !== 1 ||
+                !Array.isArray(candidate.modelCatalog.models) ||
+                !Array.isArray(candidate.modelCatalog.eligibleReferences)))) {
         throw new Error("invalid init upgrade state or repoRoot authority");
     }
 }
@@ -432,6 +439,7 @@ async function writeControllerAnchor(input) {
     }
     let authoritativeHomeFingerprint;
     let authoritativeGitignoreMigrationSha256;
+    let authoritativeModelCatalogSha256;
     if (input.initialize) {
         if (await exists(location.file)) {
             throw new Error("init upgrade controller authority anchor already exists");
@@ -440,6 +448,9 @@ async function writeControllerAnchor(input) {
             throw new Error("init upgrade controller home fingerprint is invalid");
         }
         authoritativeHomeFingerprint = cloneJson(input.state.homeFingerprint);
+        authoritativeModelCatalogSha256 = input.state.modelCatalog
+            ? canonicalSha256(input.state.modelCatalog)
+            : undefined;
     }
     else {
         const current = await readControllerAnchor(location.repoRoot, input.state);
@@ -452,6 +463,7 @@ async function writeControllerAnchor(input) {
             throw new Error("init upgrade controller authority gitignore migration digest binding is invalid");
         }
         authoritativeGitignoreMigrationSha256 = digest;
+        authoritativeModelCatalogSha256 = current.modelCatalogSha256;
     }
     await writeJsonAtomic(location.file, {
         schemaVersion: 1,
@@ -459,6 +471,9 @@ async function writeControllerAnchor(input) {
         runId: input.state.runId,
         controllerIdentity: input.state.controllerIdentity,
         homeFingerprint: authoritativeHomeFingerprint,
+        ...(authoritativeModelCatalogSha256 !== undefined
+            ? { modelCatalogSha256: authoritativeModelCatalogSha256 }
+            : {}),
         ...(authoritativeGitignoreMigrationSha256 !== undefined
             ? { gitignoreMigrationSha256: authoritativeGitignoreMigrationSha256 }
             : {}),
@@ -483,6 +498,12 @@ async function readControllerAnchor(repoRoot, state) {
         !sameControllerIdentity(parsed.controllerIdentity, state.controllerIdentity)) {
         throw new Error("init upgrade controller authority anchor binding is invalid");
     }
+    const expectedModelCatalogSha256 = state.modelCatalog
+        ? canonicalSha256(state.modelCatalog)
+        : undefined;
+    if (parsed.modelCatalogSha256 !== expectedModelCatalogSha256) {
+        throw new Error("init upgrade model catalog differs from controller authority");
+    }
     if (!isHomeFingerprint(parsed.homeFingerprint) ||
         !sameJsonValue(parsed.homeFingerprint, state.homeFingerprint)) {
         throw new Error("init upgrade controller authority home fingerprint binding is invalid");
@@ -660,6 +681,7 @@ function toResult(state, verification, gitignoreMigration) {
         status: state.status,
         phase: state.phase,
         controllerIdentity: state.controllerIdentity,
+        versionGate: state.versionGate,
         deterministicActions: state.actionReceipts,
         modelMergeTasks: state.mergeTasks,
         humanDecisions: state.humanDecisions,
@@ -677,12 +699,18 @@ function renderReport(state, verification, gitignoreMigration) {
         `- phase: \`${state.phase}\``,
         `- controller: \`${state.controllerIdentity.portableIdentity}\``,
         `- version gate: \`${state.versionGate.outcome}\``,
+        ...(state.versionGate.failureReason
+            ? [`- version check failure: \`${state.versionGate.failureReason}\``]
+            : []),
+        ...(state.versionGate.diagnostic
+            ? [`- version check diagnostic: ${state.versionGate.diagnostic}`]
+            : []),
         `- version choice: \`${state.versionGate.choice ?? "pending"}\``,
         `- deterministic actions applied: ${state.actionReceipts.length}`,
         `- semantic merges accepted: ${state.mergeReceipts.length}`,
         `- preserved user modifications: ${state.mergeReceipts.length}`,
         `- retired path actions: ${state.actionReceipts.filter((action) => action.type === "migrate-owned-file" || action.type === "remove-owned-file" || action.type === "remove-empty-directory").length}`,
-        `- remaining model merge tasks: ${state.mergeTasks.length}`,
+        `- remaining model merge tasks: ${state.mergeTasks.length + state.queuedMergeTasks.length}`,
         `- remaining human decisions: ${state.humanDecisions.length}`,
         `- gitignore migration assessment: \`.harness/init-upgrades/${state.runId}/gitignore-migration.json\` (index-only untrack guidance; the controller never modifies the Git index)`,
         ...(gitignoreMigration
@@ -836,22 +864,45 @@ async function acquireGlobalLock(input) {
 }
 async function currentVersionGate(input, identity) {
     try {
-        const latest = input.latestVersion
-            ? await input.latestVersion()
-            : await createNpmUpdateClient({
+        let latest;
+        if (input.latestVersion) {
+            latest = await input.latestVersion();
+            if (!latest) {
+                return registryUnavailable("invalid-response");
+            }
+        }
+        else {
+            const checked = await createNpmUpdateClient({
                 currentVersion: identity.version,
                 packageRoot: identity.packageRoot,
-            }).latestVersion();
-        if (!latest)
-            return { outcome: "registry-unavailable" };
+                cwd: path.resolve(input.repoRoot),
+                env: process.env,
+            }).latestVersionCheck();
+            if (!checked.ok)
+                return registryUnavailable(checked.reason);
+            latest = checked.version;
+        }
         return versionsNewer(latest, identity.version)
             ? { outcome: "newer-available", latestVersion: latest }
             : { outcome: "latest", latestVersion: latest };
     }
     catch {
-        return { outcome: "registry-unavailable" };
+        return registryUnavailable("command-failed");
     }
 }
+function registryUnavailable(reason) {
+    const diagnostics = {
+        timeout: "npm version check timed out while using the configured npm settings. Verify the registry/proxy and retry.",
+        "spawn-failure": "npm could not be started. Verify that npm is installed and available on PATH.",
+        "command-failed": "npm version check failed using the configured registry. Run `npm config get registry` and `npm view @tea-agent/loop-agent dist-tags.latest` to diagnose.",
+        "invalid-response": "npm returned no valid stable latest version. Verify that the configured registry mirrors @tea-agent/loop-agent and its dist-tags.",
+    };
+    return {
+        outcome: "registry-unavailable",
+        failureReason: reason,
+        diagnostic: diagnostics[reason],
+    };
+}
 function toRepoPath(repoRoot, absolutePath) {
     return path.relative(repoRoot, absolutePath).split(path.sep).join("/");
 }
@@ -1729,7 +1780,8 @@ async function validateContinueMerge(directory, state, anchor) {
     state.mergeTasks = [];
     state.mergeGuard = undefined;
     state.phase = "PLAN";
-    state.nextAction = "Accepted the bounded semantic merge; replan and verify the current workspace.";
+    state.nextAction =
+        "Accepted the bounded semantic merge; continue with the next queued merge or run final verification.";
     await saveState(directory, state);
     await rm(path.join(directory, "merge-acceptance-pending.json"), {
         force: true,
@@ -2397,10 +2449,13 @@ async function verifyRecoveryFiles(repoRoot) {
     }
     return verification;
 }
-async function runFinalVerification(state, authoritativeHomeFingerprint, surface) {
+async function runFinalVerification(state, authoritativeHomeFingerprint, surface, modelCatalog) {
     await assertFrozenVerificationSurface(state.repoRoot, surface);
-    const finalCheck = await checkInitUpdate({ repoRoot: state.repoRoot });
-    const doctor = await runInitDoctor({ repoRoot: state.repoRoot });
+    const finalCheck = await checkInitUpdate({
+        repoRoot: state.repoRoot,
+        modelCatalog,
+    });
+    const doctor = await runInitDoctor({ repoRoot: state.repoRoot, modelCatalog });
     let inspect;
     try {
         const adapter = await resolveAdapter(state.repoRoot);
@@ -2474,6 +2529,11 @@ async function runFinalVerification(state, authoritativeHomeFingerprint, surface
             mergeReceiptCount: state.mergeReceipts.length,
         },
         initSurfaceClean: finalCheck.ok,
+        initSurface: {
+            deterministicActions: finalCheck.deterministicActions,
+            modelMergeTasks: finalCheck.modelMergeTasks,
+            humanDecisions: finalCheck.humanDecisions,
+        },
         doctor: { ok: doctor.ok, checks: doctor.checks },
         inspect,
         docsAudit,
@@ -2488,7 +2548,7 @@ async function runFinalVerification(state, authoritativeHomeFingerprint, surface
                 projectPi.reason === "enabled-false",
         },
         userHomeUnchanged: sameJsonValue(homeAfter, authoritativeHomeFingerprint),
-        mergeBoundaryClean: state.mergeTasks.length === 0,
+        mergeBoundaryClean: state.mergeTasks.length === 0 && state.queuedMergeTasks.length === 0,
         humanDecisionClean: state.humanDecisions.length === 0,
     };
 }
@@ -2589,6 +2649,7 @@ function assertAnchorCompletion(anchor, state) {
         !isSha256(completion.actionReceiptsSha256) ||
         !isSha256(completion.mergeReceiptsSha256) ||
         !isSha256(completion.stateProjectionSha256) ||
+        !isSha256(completion.verificationSha256) ||
         !isSha256(completion.finalReportSha256) ||
         !isFrozenVerificationSurface(completion.verificationSurface) ||
         completion.actionReceiptsSha256 !== sha256(serializeJson(state.actionReceipts)) ||
@@ -2609,7 +2670,19 @@ async function readFreshCompletedVerification(repoRoot, state) {
     if (!anchor.completion?.verificationSurface) {
         throw new Error("completed verification surface authority is missing");
     }
-    const verification = await runFinalVerification(state, anchor.homeFingerprint, anchor.completion.verificationSurface);
+    const verificationBytes = await readFile(path.join(runDirectory(repoRoot, state.runId), "verification.json")).catch(() => {
+        throw new Error("completed init upgrade verification evidence is missing or unreadable");
+    });
+    if (sha256(verificationBytes) !== anchor.completion.verificationSha256) {
+        throw new Error("completed init upgrade verification evidence is not authorized by the controller anchor");
+    }
+    let verification;
+    try {
+        verification = JSON.parse(verificationBytes.toString("utf-8"));
+    }
+    catch {
+        throw new Error("completed init upgrade verification evidence is invalid JSON");
+    }
     assertCompletedVerification(state, verification);
     return { verification, reportMarkdown: report.toString("utf-8") };
 }
@@ -2683,6 +2756,119 @@ async function readStatusResult(repoRoot, runId) {
     const authenticated = await readFreshCompletedVerification(repoRoot, state);
     return toResult(state, authenticated.verification, await readGitignoreMigrationProjection(directory, state, anchor.gitignoreMigrationSha256));
 }
+async function activateModelMergeTask(input) {
+    const { directory, state, task, gitignoreMigration } = input;
+    const verificationSurface = await freezeVerificationSurface(state.repoRoot);
+    assertTaskOutsideVerificationSurface(task, verificationSurface);
+    if (verificationSurface.files.some((entry) => entry.path === normalizeAllowedPath(task.path))) {
+        await validateControllerAuthorizedVerificationMerge({
+            repoRoot: state.repoRoot,
+            task,
+            surface: verificationSurface,
+        });
+    }
+    state.mergeTasks = [task];
+    state.mergeGuard = await createMergeGuard(state.repoRoot, task);
+    state.phase = "MODEL_MERGE";
+    state.status = "in-progress";
+    await writeControllerAnchor({
+        state,
+        mergeAuthority: {
+            ...state.mergeGuard,
+            priorMergeReceiptCount: state.mergeReceipts.length,
+            priorMergeReceiptsSha256: sha256(serializeJson(state.mergeReceipts)),
+            stateProjection: controllerStateProjection(state),
+            stateProjectionSha256: canonicalSha256(controllerStateProjection(state)),
+            verificationSurface,
+        },
+    });
+    state.nextAction = `Complete only task ${task.taskId} within allowedPaths=[${task.allowedPaths.join(", ")}], then call init upgrade --continue. The controller will reject every other workspace change and all symlink/realpath escapes. ${state.queuedMergeTasks.length} semantic merge task(s) remain queued without replanning.`;
+    await writeJsonAtomic(path.join(directory, "merge-tasks.json"), [state.mergeTasks[0], ...state.queuedMergeTasks]);
+    await saveState(directory, state);
+    await writeReport(directory, state, undefined, gitignoreMigration);
+    return toResult(state, undefined, gitignoreMigration);
+}
+async function verifyAndCompleteUpgrade(input) {
+    const { directory, state, gitignoreMigration, modelCatalog } = input;
+    state.mergeTasks = [];
+    state.queuedMergeTasks = [];
+    state.mergeGuard = undefined;
+    state.humanDecisions = [];
+    if (state.mergeReceipts.length > 0) {
+        let postMerge = await checkInitUpdate({
+            repoRoot: state.repoRoot,
+            modelCatalog,
+        });
+        const seen = new Set();
+        for (let pass = 0; postMerge.deterministicActions.length > 0 && pass < 2; pass += 1) {
+            const digest = canonicalSha256(postMerge.deterministicActions);
+            if (seen.has(digest)) {
+                throw new Error(`post-merge deterministic init update did not converge: ${postMerge.deterministicActions.map((action) => `${action.type}:${action.path}`).join(", ")}`);
+            }
+            seen.add(digest);
+            const converged = await applyInitUpdate({
+                repoRoot: state.repoRoot,
+                applySafe: true,
+                clientRecovery: "project",
+                modelCatalog,
+            });
+            state.actionReceipts.push(...converged.applied);
+            await writeJsonAtomic(path.join(directory, "change-manifest.json"), state.actionReceipts);
+            if (converged.applied.length === 0)
+                break;
+            postMerge = await checkInitUpdate({
+                repoRoot: state.repoRoot,
+                modelCatalog,
+            });
+        }
+        if (postMerge.deterministicActions.length > 0) {
+            throw new Error(`post-merge deterministic init update exceeded the 2-pass convergence limit: ${postMerge.deterministicActions.map((action) => `${action.type}:${action.path}`).join(", ")}`);
+        }
+        if (postMerge.modelMergeTasks.length > 0 ||
+            postMerge.humanDecisions.length > 0) {
+            throw new Error("accepted semantic merges introduced new non-deterministic init decisions; start a new bounded upgrade run");
+        }
+    }
+    state.phase = "VERIFY";
+    const anchor = await readControllerAnchor(state.repoRoot, state);
+    const verificationSurface = await freezeVerificationSurface(state.repoRoot);
+    const verification = await runFinalVerification(state, anchor.homeFingerprint, verificationSurface, modelCatalog);
+    await writeJsonAtomic(path.join(directory, "verification.json"), verification);
+    const verificationSha256 = sha256(await readFile(path.join(directory, "verification.json")));
+    if (verificationPassed(verification)) {
+        state.status = "completed";
+        state.phase = "COMPLETED";
+        state.nextAction =
+            "Init upgrade completed; reload the host session so updated AGENTS, skills, and recovery extensions are discovered.";
+        await writeReport(directory, state, verification, gitignoreMigration);
+        const finalReportSha256 = sha256(await readFile(path.join(directory, "final-report.md")));
+        await writeControllerAnchor({
+            state,
+            completion: {
+                status: "completed",
+                phase: "COMPLETED",
+                actionReceiptCount: state.actionReceipts.length,
+                mergeReceiptCount: state.mergeReceipts.length,
+                actionReceiptsSha256: sha256(serializeJson(state.actionReceipts)),
+                mergeReceiptsSha256: sha256(serializeJson(state.mergeReceipts)),
+                stateProjectionSha256: canonicalSha256(controllerStateProjection(state)),
+                verificationSurface,
+                verificationSha256,
+                finalReportSha256,
+            },
+        });
+    }
+    else {
+        state.status = "failed";
+        const authorityReason = authoritativeVerificationFailureReason(verification);
+        state.nextAction = authorityReason
+            ? `Verification failed: ${authorityReason}. Inspect verification.json, repair only the controller-returned concrete merge path, then use --continue.`
+            : "Verification failed. Inspect verification.json; repair only the controller-returned concrete merge path or address the reported external blocker, then use --continue.";
+    }
+    await saveState(directory, state);
+    await writeReport(directory, state, verification, gitignoreMigration);
+    return toResult(state, verification, gitignoreMigration);
+}
 async function executeUpgrade(directory, state, input) {
     const identity = await readIdentity();
     if (!sameControllerIdentity(identity, state.controllerIdentity)) {
@@ -2711,8 +2897,7 @@ async function executeUpgrade(directory, state, input) {
     }
     if (state.versionGate.outcome === "registry-unavailable" && !choice) {
         state.status = "needs-human-decision";
-        state.nextAction =
-            "npm registry is unavailable. Choose --version-choice current, retry, or cancel.";
+        state.nextAction = `${state.versionGate.diagnostic ?? "npm registry is unavailable."} Choose --version-choice current, retry, or cancel.`;
         await saveState(directory, state);
         await writeReport(directory, state);
         return toResult(state);
@@ -2742,15 +2927,17 @@ async function executeUpgrade(directory, state, input) {
     if (choice === "retry" &&
         state.versionGate.outcome === "registry-unavailable") {
         state.status = "needs-human-decision";
-        state.nextAction =
-            "npm registry remains unavailable after retry. Choose --version-choice current, retry, or cancel.";
+        state.nextAction = `${state.versionGate.diagnostic ?? "npm registry remains unavailable after retry."} Choose --version-choice current, retry, or cancel.`;
         await saveState(directory, state);
         await writeReport(directory, state);
         return toResult(state);
     }
     state.status = "in-progress";
     state.phase = "PLAN";
-    const pre = await checkInitUpdate({ repoRoot: state.repoRoot });
+    const pre = await checkInitUpdate({
+        repoRoot: state.repoRoot,
+        modelCatalog: state.modelCatalog,
+    });
     await writeJsonAtomic(path.join(directory, "pre-update-report.json"), pre);
     await writeJsonAtomic(path.join(directory, "upgrade-plan.json"), {
         deterministicActions: pre.deterministicActions,
@@ -2791,29 +2978,42 @@ async function executeUpgrade(directory, state, input) {
         repoRoot: state.repoRoot,
         applySafe: true,
         clientRecovery: "project",
+        modelCatalog: state.modelCatalog,
     });
     state.actionReceipts.push(...safe.applied);
     await writeJsonAtomic(path.join(directory, "change-manifest.json"), state.actionReceipts);
-    let post = await checkInitUpdate({ repoRoot: state.repoRoot });
+    let post = await checkInitUpdate({
+        repoRoot: state.repoRoot,
+        modelCatalog: state.modelCatalog,
+    });
     // Converge remaining safe deterministic init actions before the final check.
     // Project/governance-derived drift (e.g. a personalized project rename after
     // an accepted merge) settles here instead of failing finalCheck. Model merge
     // tasks and human decisions are never auto-applied.
-    while (post.deterministicActions.length > 0) {
+    const deterministicPassDigests = new Set();
+    for (let pass = 0; post.deterministicActions.length > 0 && pass < 2; pass += 1) {
+        const actionDigest = canonicalSha256(post.deterministicActions);
+        if (deterministicPassDigests.has(actionDigest)) {
+            throw new Error(`deterministic init update did not converge; repeated actions: ${post.deterministicActions.map((action) => `${action.type}:${action.path}`).join(", ")}`);
+        }
+        deterministicPassDigests.add(actionDigest);
         const converged = await applyInitUpdate({
             repoRoot: state.repoRoot,
             applySafe: true,
             clientRecovery: "project",
+            modelCatalog: state.modelCatalog,
         });
         state.actionReceipts.push(...converged.applied);
         await writeJsonAtomic(path.join(directory, "change-manifest.json"), state.actionReceipts);
         if (converged.applied.length === 0)
             break;
-        post = await checkInitUpdate({ repoRoot: state.repoRoot });
-        if (post.humanDecisions.length > 0 ||
-            post.modelMergeTasks.length > 0) {
-            break;
-        }
+        post = await checkInitUpdate({
+            repoRoot: state.repoRoot,
+            modelCatalog: state.modelCatalog,
+        });
+    }
+    if (post.deterministicActions.length > 0) {
+        throw new Error(`deterministic init update exceeded the 2-pass convergence limit: ${post.deterministicActions.map((action) => `${action.type}:${action.path}`).join(", ")}`);
     }
     state.humanDecisions = post.humanDecisions;
     // Gitignore migration assessment: after the managed block has converged,
@@ -2851,6 +3051,7 @@ async function executeUpgrade(directory, state, input) {
     state.humanDecisions = post.humanDecisions;
     if (post.humanDecisions.length > 0) {
         state.mergeTasks = [];
+        state.queuedMergeTasks = [];
         state.mergeGuard = undefined;
         state.status = "needs-human-decision";
         state.phase = "MODEL_MERGE";
@@ -2863,78 +3064,21 @@ async function executeUpgrade(directory, state, input) {
     }
     if (post.modelMergeTasks.length > 0) {
         const activeTask = post.modelMergeTasks[0];
-        const verificationSurface = await freezeVerificationSurface(state.repoRoot);
-        assertTaskOutsideVerificationSurface(activeTask, verificationSurface);
-        if (verificationSurface.files.some((entry) => entry.path === normalizeAllowedPath(activeTask.path))) {
-            await validateControllerAuthorizedVerificationMerge({
-                repoRoot: state.repoRoot,
-                task: activeTask,
-                surface: verificationSurface,
-            });
-        }
-        state.mergeTasks = [activeTask];
-        state.mergeGuard = await createMergeGuard(state.repoRoot, activeTask);
-        // Bind the Git-dir anchor to the state actually handed to the model.
-        state.phase = "MODEL_MERGE";
-        state.status = "in-progress";
-        await writeControllerAnchor({
-            state,
-            mergeAuthority: {
-                ...state.mergeGuard,
-                priorMergeReceiptCount: state.mergeReceipts.length,
-                priorMergeReceiptsSha256: sha256(serializeJson(state.mergeReceipts)),
-                stateProjection: controllerStateProjection(state),
-                stateProjectionSha256: canonicalSha256(controllerStateProjection(state)),
-                verificationSurface,
-            },
-        });
-        state.nextAction = `Complete only task ${activeTask.taskId} within allowedPaths=[${activeTask.allowedPaths.join(", ")}], then call init upgrade --continue. The controller will reject every other workspace change and all symlink/realpath escapes.`;
-        await writeJsonAtomic(path.join(directory, "merge-tasks.json"), state.mergeTasks);
-        await saveState(directory, state);
-        await writeReport(directory, state, undefined, gitignoreMigration);
-        return toResult(state, undefined, gitignoreMigration);
-    }
-    state.mergeTasks = [];
-    state.mergeGuard = undefined;
-    state.humanDecisions = [];
-    state.phase = "VERIFY";
-    const anchor = await readControllerAnchor(state.repoRoot, state);
-    const verificationSurface = await freezeVerificationSurface(state.repoRoot);
-    const verification = await runFinalVerification(state, anchor.homeFingerprint, verificationSurface);
-    await writeJsonAtomic(path.join(directory, "verification.json"), verification);
-    if (verificationPassed(verification)) {
-        state.status = "completed";
-        state.phase = "COMPLETED";
-        state.nextAction =
-            "Init upgrade completed; reload the host session so updated AGENTS, skills, and recovery extensions are discovered.";
-        // The report is controller-produced before its exact bytes are anchored.
-        await writeReport(directory, state, verification, gitignoreMigration);
-        const finalReportSha256 = sha256(await readFile(path.join(directory, "final-report.md")));
-        await writeControllerAnchor({
+        state.queuedMergeTasks = post.modelMergeTasks.slice(1);
+        return await activateModelMergeTask({
+            directory,
             state,
-            completion: {
-                status: "completed",
-                phase: "COMPLETED",
-                actionReceiptCount: state.actionReceipts.length,
-                mergeReceiptCount: state.mergeReceipts.length,
-                actionReceiptsSha256: sha256(serializeJson(state.actionReceipts)),
-                mergeReceiptsSha256: sha256(serializeJson(state.mergeReceipts)),
-                stateProjectionSha256: canonicalSha256(controllerStateProjection(state)),
-                verificationSurface,
-                finalReportSha256,
-            },
+            task: activeTask,
+            gitignoreMigration,
         });
     }
-    else {
-        state.status = "failed";
-        const authorityReason = authoritativeVerificationFailureReason(verification);
-        state.nextAction = authorityReason
-            ? `Verification failed: ${authorityReason}. Inspect verification.json, repair only the controller-returned concrete merge path, then use --continue.`
-            : "Verification failed. Inspect verification.json; repair only the controller-returned concrete merge path or address the reported external blocker, then use --continue.";
-    }
-    await saveState(directory, state);
-    await writeReport(directory, state, verification, gitignoreMigration);
-    return toResult(state, verification, gitignoreMigration);
+    state.queuedMergeTasks = [];
+    return await verifyAndCompleteUpgrade({
+        directory,
+        state,
+        gitignoreMigration,
+        modelCatalog: state.modelCatalog,
+    });
 }
 export async function runInitUpgrade(input) {
     const repoRoot = path.resolve(input.repoRoot);
@@ -3031,6 +3175,28 @@ export async function runInitUpgrade(input) {
                     force: true,
                 });
             }
+            if (mergeOutcome === "accepted") {
+                const anchor = await readControllerAnchor(repoRoot, state);
+                const gitignoreMigration = await readGitignoreMigrationProjection(directory, state, anchor.gitignoreMigrationSha256);
+                if (!gitignoreMigration) {
+                    throw new Error("accepted init upgrade merge lacks its migration assessment");
+                }
+                const nextTask = state.queuedMergeTasks.shift();
+                if (nextTask) {
+                    return await activateModelMergeTask({
+                        directory,
+                        state,
+                        task: nextTask,
+                        gitignoreMigration,
+                    });
+                }
+                return await verifyAndCompleteUpgrade({
+                    directory,
+                    state,
+                    gitignoreMigration,
+                    modelCatalog: state.modelCatalog,
+                });
+            }
         }
         else {
             directory = runDirectory(repoRoot, runId);
@@ -3049,10 +3215,12 @@ export async function runInitUpgrade(input) {
                 versionGate: { outcome: "latest" },
                 nextAction: "Evaluate controller version and init surface.",
                 mergeTasks: [],
+                queuedMergeTasks: [],
                 mergeReceipts: [],
                 humanDecisions: [],
                 actionReceipts: [],
                 homeFingerprint: await homeFingerprint(),
+                modelCatalog: input.modelCatalog,
             };
             await writeControllerAnchor({ state, initialize: true });
             await writeJsonAtomic(path.join(directory, "controller-identity.json"), {