@zq-silk/yui 0.13.9 → 0.14.0

package/dist/cli/updatePorts.js

@@ -7,10 +7,10 @@
  * `npm install --global --prefix <tmp>`, so the live global install is never
  * touched until the binary-activation step. Preflight invokes the STAGED binary's
  * internal `yui upgrade --update-preflight` contract so the target version
- * classifies the Home, validates a compatible source in memory, or reads the
- * authoritative offline inventory as required by that path. After the parent
- * stops the exact old Controller, storage activation performs the full staged
- * validation/switch. Post-verify invokes the actually activated global binary.
+ * proves that the Home already implements the exact current contract. After
+ * the parent stops the exact old Controller, only the binary is promoted;
+ * update never rewrites or switches storage. Post-verify invokes the actually
+ * activated global binary.
  *
  * Two hardening guarantees this module enforces:
  *
@@ -23,26 +23,16 @@
  *    global `yui` (via `npm prefix -g`), runs its `--json doctor`, AND confirms
  *    the promoted binary's reported version matches the staged version. A
  *    mismatch fails closed.
- *
- * And the ambiguity guarantee (P1-2): `activateStorage` returns `ambiguous`
- * (never a false "unchanged") when the child leaves no parseable receipt, and
- * `probeStorage` reads the durable receipt + backup + schema so the orchestrator
- * can resolve the true state.
  */
 import { spawnSync } from "node:child_process";
 import { accessSync, constants, existsSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import Database from "better-sqlite3";
 import { runtimeError } from "../errors/cliError.js";
 import { isConcreteVersion } from "../domain/validation.js";
 import { STORAGE_DOCTOR_CHECK_NAMES } from "../doctor/doctor.js";
 import { acquireHandoverLock } from "../release/runtimeRelease.js";
-import { inspectStorageSchema } from "../storage/storageSchema.js";
-import { placeUpgradeFence } from "../storage/upgradeFence.js";
-import { correlateUpgradeReceipt } from "../storage/upgrade/upgradeOrchestrator.js";
-import { readSwitchProgress } from "../storage/upgrade/switchProgress.js";
 const PACKAGE_NAME = "@zq-silk/yui";
 const PACKAGE_SPEC = `${PACKAGE_NAME}@latest`;
 function resolveExecutable(command, environmentPath) {
@@ -94,29 +84,11 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
     // deliberately not persisted as a retry or recovery protocol.
     let verifiedActivatedBinary;
     let verifiedActivatedVersion;
-    let storageFenceOwnerPid;
     const stopReplacementController = (home, pid) => (stopReplacementControllerForUpdate(home, pid, environment, run));
     return {
         beginControllerHandover(home) {
             return acquireHandoverLock(home).release;
         },
-        beginStorageWriteFence(home) {
-            const release = placeUpgradeFence(home, {
-                reason: "update storage activation in progress",
-                createdAt: new Date().toISOString(),
-                ownerPid: process.pid
-            });
-            storageFenceOwnerPid = process.pid;
-            let released = false;
-            return () => {
-                if (released)
-                    return;
-                release();
-                released = true;
-                if (storageFenceOwnerPid === process.pid)
-                    storageFenceOwnerPid = undefined;
-            };
-        },
         stage(version) {
             // A caller that names a version (the release workflow, which freezes the
             // exact version in its plan) installs THAT version — never a moving
@@ -165,25 +137,6 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
             const result = run(staged.binaryPath, ["--json", "upgrade", "--update-preflight"], { cwd: process.cwd(), env: { ...environment, YUI_HOME: home }, shell: false });
             return interpretPreflight(result);
         },
-        activateStorage(staged, home) {
-            const result = run(staged.binaryPath, ["--json", "upgrade"], {
-                cwd: process.cwd(),
-                // The parent update process captures/stops/drains the old Controller
-                // before invoking the staged child. Mark this internal call so the
-                // child performs storage migration only and never starts a Controller
-                // from the temporary staging installation.
-                env: {
-                    ...environment,
-                    YUI_HOME: home,
-                    YUI_UPDATE_EXTERNALLY_QUIESCED: "1",
-                    ...(storageFenceOwnerPid === undefined
-                        ? {}
-                        : { YUI_UPDATE_HANDOVER_OWNER_PID: String(storageFenceOwnerPid) })
-                },
-                shell: false
-            });
-            return interpretActivation(result);
-        },
         activateBinary(staged) {
             verifiedActivatedBinary = undefined;
             verifiedActivatedVersion = undefined;
@@ -200,7 +153,7 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
             if (activeBinary === null || !existsSync(activeBinary)) {
                 throw runtimeError("Post-update health check failed: could not locate the activated global `yui` binary.");
             }
-            // 1) Health check the migrated Home through the activated binary's loader.
+            // 1) Health check the unchanged current Home through the activated binary.
             // POST-VERIFY PARSES THE MACHINE-READABLE RESULT FIRST, THEN THE EXIT STATUS
             // (R2-F2). `yui --json doctor` deliberately sets a non-zero exit when storage
             // is unhealthy, so interpreting the exit status before the envelope would
@@ -237,64 +190,6 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
             verifiedActivatedBinary = activeBinary;
             verifiedActivatedVersion = activeVersion;
         },
-        probeStorage(home) {
-            // Resolve an ambiguous activation from durable on-disk evidence (P1-2),
-            // but only trust a receipt that CORRESPONDS to the current Home/backup
-            // (P2-6): a leftover receipt from a prior attempt, a different Home, or one
-            // whose backup was already restored/cleaned is NOT evidence that THIS
-            // attempt's switch committed. When it does not correspond, fall back to the
-            // on-disk schema and report `switched: false` so the caller re-probes the
-            // real state instead of giving a recovery instruction from a stale receipt.
-            const schema = inspectStorageSchema(home);
-            const sqliteSchemaHead = inspectSqliteSchemaHead(home);
-            // A crash mid-switch leaves a durable progress marker. A marker of ANY phase
-            // — `backing-up`, `promoting`, or `interrupted` — is only actionable as an
-            // interrupted switch when the FILESYSTEM still corroborates it: the backup
-            // exists AND the Home is not in place (missing/uninitialized), so the
-            // authoritative data lives only at the backup and the recovery is a precise
-            // restore. This gate now applies to `interrupted` too (R2-F3): a leftover
-            // `interrupted` marker after a manual recovery — Home already restored, or
-            // the backup already gone — must NOT be trusted to emit a restore path; we
-            // ignore the stale marker and re-probe the real state below.
-            const progress = readSwitchProgress(home);
-            if (progress !== null) {
-                const backupPresent = progress.backupPath !== undefined
-                    && existsSync(progress.backupPath);
-                // The Home is "in place" only when storage is actually initialized there;
-                // a missing/uninitialized Home after a mid-switch crash means the data is
-                // at the backup.
-                const homeInitialized = schema.status !== "uninitialized";
-                if (backupPresent && !homeInitialized) {
-                    // Original at the backup, Home missing/uninitialized: recover by restore.
-                    // The Home is uninitialized here, so it is definitively not current.
-                    return {
-                        switched: false,
-                        interrupted: true,
-                        schemaCurrent: false,
-                        ...(sqliteSchemaHead === undefined ? {} : { sqliteSchemaHead }),
-                        ...(progress.backupPath === undefined ? {} : { backupPath: progress.backupPath })
-                    };
-                }
-                // Otherwise the marker is stale relative to the current filesystem (Home
-                // intact, or no backup to restore). Do not emit a restore path from it —
-                // fall through and reconcile against the receipt/schema below.
-            }
-            const correlation = correlateUpgradeReceipt(home);
-            if (!correlation.corresponds) {
-                return {
-                    switched: false,
-                    schemaCurrent: schema.status === "current",
-                    ...(sqliteSchemaHead === undefined ? {} : { sqliteSchemaHead })
-                };
-            }
-            const receipt = correlation.receipt;
-            return {
-                switched: true,
-                schemaCurrent: schema.status === "current",
-                ...(sqliteSchemaHead === undefined ? {} : { sqliteSchemaHead }),
-                ...(receipt.backupPath === undefined ? {} : { backupPath: receipt.backupPath })
-            };
-        },
         cleanup(staged) {
             if (staged.stagingPath !== undefined) {
                 rmSync(staged.stagingPath, { recursive: true, force: true });
@@ -312,7 +207,6 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         stopController(home, expectedPid) {
             return stopControllerForUpdate(home, expectedPid, environment, spawn);
         },
-        stopReplacementController,
         startController(home) {
             if (verifiedActivatedBinary === undefined || verifiedActivatedVersion === undefined) {
                 throw runtimeError("Replacement Controller cannot start before the activated global binary has "
@@ -325,39 +219,6 @@ export function createUpdatePorts(environment, spawn = spawnSync, stagingRoot =
         }
     };
 }
-/**
- * Read the generic durable SQLite ledger without asking the old parent binary
- * to understand the staged release's migration registry. The staged preflight
- * supplies the validated source and target heads used to interpret this value.
- */
-function inspectSqliteSchemaHead(home) {
-    const path = join(home, "yui.db");
-    if (!existsSync(path))
-        return undefined;
-    const db = new Database(path, { readonly: true, fileMustExist: true });
-    try {
-        db.pragma("query_only = ON");
-        const rows = db.prepare("SELECT version, checksum FROM schema_migrations ORDER BY version").all();
-        if (rows.length === 0)
-            throw new Error("SQLite migration ledger is empty.");
-        for (let index = 0; index < rows.length; index += 1) {
-            const row = rows[index];
-            if (row.version !== index + 1
-                || typeof row.checksum !== "string"
-                || row.checksum.length === 0) {
-                throw new Error("SQLite migration ledger is not a contiguous checksummed prefix.");
-            }
-        }
-        const head = rows.at(-1);
-        return {
-            version: head.version,
-            checksum: head.checksum
-        };
-    }
-    finally {
-        db.close();
-    }
-}
 const UPDATE_CLI_PATH = fileURLToPath(new URL("../cli.js", import.meta.url));
 const UPDATE_CLIENT_RUNTIME_PATH = fileURLToPath(new URL("../controller/clientRuntime.js", import.meta.url));
 const UPDATE_CONTROLLER_RECONCILIATION_PATH = fileURLToPath(new URL("../controller/updateReconciliation.js", import.meta.url));
@@ -921,90 +782,19 @@ function interpretPreflight(result) {
         ...(data.sceneUnchanged === true ? { sceneUnchanged: true } : {})
     };
 }
-/** Strictly parse the green states of the internal update preflight. */
+/** Only the exact current storage contract is a green update preflight. */
 function parseUpdatePreflightResult(data) {
-    const status = data.status;
-    const stepCount = data.stepCount;
-    if ((status !== "already-current"
-        && status !== "compatible"
-        && status !== "in-place-migration"
-        && status !== "migration-required")
-        || !Number.isSafeInteger(stepCount)
-        || stepCount < 0) {
+    if (data.status !== "already-current" || data.stepCount !== 0)
         return null;
-    }
     const homeClassification = data.classification;
     if (!isRecord(homeClassification) || !isRecord(homeClassification.classification))
         return null;
     const classification = homeClassification.classification;
-    const expected = status === "already-current"
-        ? { verdict: "USABLE", classificationStatus: "current" }
-        : status === "compatible"
-            ? { verdict: "COMPATIBLE", classificationStatus: "compatible-old" }
-            : { verdict: "MIGRATABLE", classificationStatus: "migration-required" };
-    if (classification.verdict !== expected.verdict
-        || classification.status !== expected.classificationStatus
-        || (status === "already-current"
-            ? stepCount !== 0
-            : classification.stepCount !== stepCount || stepCount < 1)) {
+    if (classification.verdict !== "USABLE"
+        || classification.status !== "current") {
         return null;
     }
-    if (status === "already-current")
-        return { status };
-    const evidence = status === "compatible"
-        ? `${stepCount} compatible step(s) classified and the compatible source validated in memory`
-        : status === "in-place-migration"
-            ? `${stepCount} SQLite migration step(s) classified for one in-place transaction and the offline runtime inventory confirmed clear`
-            : `${stepCount} offline migration step(s) classified and the offline runtime inventory confirmed clear`;
-    const summary = `${evidence}. `
-        + "No staged Home or staged-output loader validation was performed during update preflight.";
-    if (status === "in-place-migration") {
-        const sqliteMigration = parseSqliteMigrationBoundary(data.sqliteMigration, stepCount);
-        if (sqliteMigration === null)
-            return null;
-        return {
-            status,
-            summary,
-            sqliteMigration
-        };
-    }
-    return {
-        status,
-        summary
-    };
-}
-function parseSqliteMigrationBoundary(value, stepCount) {
-    if (!isRecord(value))
-        return null;
-    const currentVersion = value.currentVersion;
-    const currentChecksum = value.currentChecksum;
-    const targetVersion = value.targetVersion;
-    const targetChecksum = value.targetChecksum;
-    const pendingVersions = value.pendingVersions;
-    if (!Number.isSafeInteger(currentVersion)
-        || currentVersion < 1
-        || typeof currentChecksum !== "string"
-        || currentChecksum.length === 0
-        || !Number.isSafeInteger(targetVersion)
-        || targetVersion <= currentVersion
-        || typeof targetChecksum !== "string"
-        || targetChecksum.length === 0
-        || !Array.isArray(pendingVersions)
-        || pendingVersions.length !== stepCount
-        || targetVersion !== currentVersion + stepCount
-        || pendingVersions.some((version, index) => !Number.isSafeInteger(version) || version !== currentVersion + index + 1)) {
-        return null;
-    }
-    return {
-        current: {
-            version: currentVersion,
-            checksum: currentChecksum
-        },
-        target: {
-            version: targetVersion,
-            checksum: targetChecksum
-        }
-    };
+    return { status: "already-current" };
 }
 function parseUpdateBlockers(value) {
     if (value === undefined)
@@ -1016,14 +806,14 @@ function parseUpdateBlockers(value) {
         if (!isRecord(item) || typeof item.reason !== "string" || item.reason.length === 0) {
             return undefined;
         }
-        const optional = ["taskId", "roleName", "runId", "nativeSessionId", "launchId"];
+        const optional = ["taskId", "roleName", "turnId", "nativeSessionId", "launchId"];
         if (optional.some((key) => item[key] !== undefined && typeof item[key] !== "string")) {
             return undefined;
         }
         parsed.push({
             ...(typeof item.taskId === "string" ? { taskId: item.taskId } : {}),
             ...(typeof item.roleName === "string" ? { roleName: item.roleName } : {}),
-            ...(typeof item.runId === "string" ? { runId: item.runId } : {}),
+            ...(typeof item.turnId === "string" ? { turnId: item.turnId } : {}),
             ...(typeof item.nativeSessionId === "string"
                 ? { nativeSessionId: item.nativeSessionId }
                 : {}),
@@ -1033,114 +823,6 @@ function parseUpdateBlockers(value) {
     }
     return parsed;
 }
-function interpretActivation(result) {
-    // A spawn transport error (could not even run) is a clean pre-switch failure.
-    if (result.error !== undefined) {
-        return {
-            status: "ambiguous",
-            detail: `the activation process could not be run: ${result.error.message}`
-        };
-    }
-    // Require a valid `{ ok:true, data }` success envelope (R3-F3). Killed by a
-    // signal, no parseable JSON, or an `ok:false`/malformed envelope: the child may
-    // have died after the atomic switch but before printing a valid result. This is
-    // AMBIGUOUS, never a false "recoverable/unchanged" (P1-2).
-    const data = parseSuccessEnvelopeData(result);
-    if (data === null) {
-        const how = result.signal !== null
-            ? `terminated by ${result.signal}`
-            : result.status === null
-                ? "terminated without an exit code"
-                : `exited with status ${result.status} and no valid success envelope`;
-        return {
-            status: "ambiguous",
-            detail: `the activation process ${how}`
-        };
-    }
-    const outcome = typeof data.outcome === "string" ? data.outcome : undefined;
-    // EXIT STATUS / OUTCOME CONSISTENCY (P1-2)
-    // A success-class outcome is only trustworthy when the child ALSO exited 0. A
-    // contradiction (e.g. stdout says `upgraded` but the process exited non-zero)
-    // means the child's own contract was violated mid-flight — the switch may or
-    // may not have committed — so it is AMBIGUOUS, never a false success. Blocker-
-    // class outcomes are exempt: `yui upgrade` deliberately exits non-zero (5) for
-    // a clean `blocked`, so a non-zero exit there is expected and consistent.
-    if ((outcome === "already-current" || outcome === "upgraded") && result.status !== 0) {
-        return {
-            status: "ambiguous",
-            detail: `the activation process reported outcome=${outcome} but exited with status `
-                + `${result.status ?? "null"} (a success outcome must exit 0); the switch state is unknown`
-        };
-    }
-    if (outcome === "already-current")
-        return { status: "already-current" };
-    if (outcome === "upgraded") {
-        if (data.migrationMode === "in-place" && data.backupPath === undefined) {
-            return { status: "migrated-in-place" };
-        }
-        const backupPath = data.backupPath;
-        if (typeof backupPath !== "string"
-            || backupPath.length === 0
-            || backupPath.trim() !== backupPath
-            || backupPath.includes("\0")
-            || !isAbsolute(backupPath)) {
-            return {
-                status: "ambiguous",
-                detail: "the activation process reported outcome=upgraded without a non-empty absolute backupPath"
-            };
-        }
-        return {
-            status: "migrated",
-            backupPath
-        };
-    }
-    if (outcome === "blocked") {
-        const stage = typeof data?.stage === "string" ? data.stage : "activate-storage";
-        // A `switch-ambiguous` blocker is NOT a clean, recoverable refusal (P1-4):
-        // the upgrade's atomic switch was left partially applied (original moved to
-        // backup, promotion + rollback both failed). Route it to AMBIGUOUS so the
-        // orchestrator probes the interrupted marker and reports a restore, never a
-        // false "the current install and Home remain usable".
-        if (stage === "switch-ambiguous") {
-            return {
-                status: "ambiguous",
-                detail: typeof data?.message === "string"
-                    ? data.message
-                    : "the storage switch was left partially applied"
-            };
-        }
-        // A post-verify blocker is emitted only after the atomic Home switch has
-        // committed. Treat it as AMBIGUOUS in the parent update flow so a stopped
-        // old Controller is never restored against the migrated Home; the receipt,
-        // backup, and switch-progress marker are the recovery evidence.
-        if (stage === "post-verify") {
-            return {
-                status: "ambiguous",
-                detail: typeof data?.message === "string"
-                    ? data.message
-                    : "storage switched but post-switch verification did not complete"
-            };
-        }
-        const blockers = parseUpdateBlockers(data.blockers);
-        return {
-            status: "blocked",
-            stage,
-            message: typeof data?.message === "string" ? data.message : "Storage activation was refused.",
-            action: typeof data?.action === "string"
-                ? data.action
-                : "Resolve the reported condition and retry.",
-            ...(blockers === undefined ? {} : { blockers }),
-            ...(typeof data.retryCommand === "string" ? { retryCommand: data.retryCommand } : {}),
-            ...(data.sceneUnchanged === true ? { sceneUnchanged: true } : {})
-        };
-    }
-    // Parseable JSON but an unrecognized outcome: we cannot classify it, so it is
-    // ambiguous rather than silently treated as a clean refusal.
-    return {
-        status: "ambiguous",
-        detail: `the activation process returned an unrecognized outcome (${String(outcome)})`
-    };
-}
 /**
  * Extract the validated `data` object from a spawn result's `{ ok: true, data }`
  * JSON envelope, or `null` when the result is not a trustworthy success envelope.
@@ -1243,7 +925,7 @@ function resolveGlobalBinary(environment, spawn) {
     return join(prefix, "bin", "yui");
 }
 /**
- * Fail closed unless the doctor result PROVES the migrated Home's storage is
+ * Fail closed unless the doctor result proves the current Home's storage is
  * healthy (P1-3 / R2-F2). The envelope and storage checks are validated BEFORE
  * the exit status is interpreted, because `yui --json doctor` deliberately exits
  * non-zero on unhealthy storage — so keying off the exit first would reduce a
@@ -1344,7 +1026,7 @@ function assertDoctorStorageHealthy(result) {
         const detail = [...blockingChecks, ...declaredBlockingChecks]
             .map((c) => `${String(c.name)}=${String(c.status)} (${String(c.detail)})`)
             .join("; ");
-        throw runtimeError("Post-update health check failed: the migrated Home is not healthy per the activated "
+        throw runtimeError("Post-update health check failed: the current Home is not healthy per the activated "
             + `binary's doctor: ${detail || "(no detail)"}. The storage did not come up cleanly on `
             + "the new version. Restore the timestamped backup to recover the original Home before "
             + "resuming writes.");
@@ -1358,7 +1040,7 @@ function assertDoctorStorageHealthy(result) {
 }
 /** A fail-closed post-update health-check error for an unverifiable doctor result. */
 function doctorUnverifiable(reason) {
-    return runtimeError(`Post-update health check failed: ${reason}, so the migrated Home cannot be confirmed `
+    return runtimeError(`Post-update health check failed: ${reason}, so the current Home cannot be confirmed `
         + "healthy. Investigate with `yui doctor` before resuming; if storage was migrated, restore "
         + "the timestamped backup to recover.");
 }

package/dist/cli/upgradeCommand.js

@@ -1,22 +1,7 @@
 /**
- * `yui upgrade` — the diagnostic/manual storage upgrade entry point.
- *
- * `yui upgrade --dry-run` first classifies read-only. Compatible-old validates
- * through the in-memory current-model gate and returns without staging a Home;
- * migration-required also proves the offline runtime inventory before it stages
- * and validates a fresh copy. The hidden `--update-preflight` contract stops at
- * classification, compatible-source validation, or offline inventory as required
- * by the classified path, so a staged updater can run it while the old Controller
- * remains live without a false staged-output validation claim. Execute enters
- * fence/quiesce/switch only for the offline path. Only explicitly declared
- * production paths can run; the aggregate `16→17` and execution record-family
- * transitions remain offline migrations.
- *
- * Like `doctor`/`controller`, this command needs a Home but manages its own
- * schema check (it must run against a non-current Home), so it is dispatched
- * before the unconditional `requireStorageSchema` gate in `cli.ts`.
+ * `yui upgrade` is now a read-only storage admission diagnostic. This release
+ * opens only its exact current contract and never rewrites an historical Home.
  */
-import { createProductionStorageRegistry } from "../storage/compatibleTaskStore.js";
 import { latestStorageVersionState } from "../storage/upgrade/recordVersions.js";
 import { runStorageUpgrade } from "../storage/upgrade/upgradeOrchestrator.js";
 import { usageError } from "../errors/cliError.js";
@@ -25,20 +10,12 @@ import { usageError } from "../errors/cliError.js";
  * updater's internal `--update-preflight` form, then returns rendered text,
  * structured data, and an exit code (0 for a safe result, 5 for a blocker).
  */
-export async function runUpgradeCommand(args, home, options = {}) {
+export async function runUpgradeCommand(args, home) {
     const mode = parseUpgradeArgs(args);
     const result = await runStorageUpgrade({
         home,
-        registry: createProductionStorageRegistry(),
         latest: latestStorageVersionState(),
-        mode,
-        ...(options.controllerLifecycle === undefined
-            ? {}
-            : { controllerLifecycle: options.controllerLifecycle }),
-        ...(options.externalUpgradeFenceOwnerPid === undefined
-            ? {}
-            : { externalUpgradeFenceOwnerPid: options.externalUpgradeFenceOwnerPid }),
-        ...(options.now === undefined ? {} : { now: options.now })
+        mode
     });
     return {
         output: renderUpgradeResult(result, mode),
@@ -52,7 +29,7 @@ function parseUpgradeArgs(args) {
     if (args.length === 1 && args[0] === "--dry-run")
         return "dry-run";
     // Intentionally omitted from public command help: this is the machine contract
-    // used by a staged `yui update`, not a replacement for user-facing dry-run.
+    // used by a staged `yui update`, not a replacement for user-facing dry-turn.
     if (args.length === 1 && args[0] === "--update-preflight")
         return "update-preflight";
     throw usageError("Upgrade usage: yui upgrade [--dry-run]");
@@ -63,48 +40,14 @@ export function renderUpgradeResult(result, mode) {
     switch (result.outcome) {
         case "already-current":
             return `${header}\nStorage is already at the current version; nothing to upgrade.`;
-        case "compatible":
-            return `${header}\nStorage is compatible-old and can be opened by the current loader. `
-                + "No Home migration, backup, or switch is required.";
-        case "update-preflight": {
-            const evidence = result.status === "already-current"
-                ? "four-state classification"
-                : result.status === "compatible"
-                    ? "four-state classification plus compatible-source validation"
-                    : result.status === "in-place-migration"
-                        ? "SQLite ledger classification plus a clear offline runtime inventory"
-                        : "four-state classification plus a clear offline runtime inventory";
-            return `${header}\nUpdate preflight: ${result.status} (${result.stepCount} step(s)); `
-                + `${evidence}. No staged Home was created, `
-                + "no staged-output loader validation was performed, and storage was not switched.";
-        }
-        case "dry-run": {
-            const steps = result.classification.sqliteMigration?.pendingVersions.length
-                ?? (result.report.outcome === "dry-run" ? result.report.steps.length : 0);
-            return `${header}\nDry run: validated ${steps} migration step(s) through the loader gate. `
-                + "Staged output discarded; storage was not switched.";
-        }
-        case "upgraded":
-            return result.migrationMode === "in-place"
-                ? `${header}\nUpgraded SQLite in place in one transaction; no database rebuild or backup copy was created.`
-                : `${header}\nUpgraded storage. Original Home backed up at `
-                    + `${result.backupPath ?? "(unspecified)"}.`;
+        case "update-preflight":
+            return `${header}\nUpdate preflight: already-current (0 steps). Storage was not modified.`;
         case "blocked": {
-            // Most blockers guarantee the source is untouched. A partial switch or a
-            // post-switch ambiguity explicitly carries the committed boundary and
-            // named recovery evidence; never print a false unchanged claim there.
-            const unchangedNote = result.storageCommitted === true
-                ? "The SQLite transaction committed in place; the old Controller was not restored (see Action)."
-                : result.switchCommitted === true
-                    ? "The storage switch committed, but post-switch completion is ambiguous; the old Controller was not restored (see Action and recovery evidence)."
-                    : result.stage === "switch-ambiguous"
-                        ? "The switch did not complete and could not be rolled back; the authoritative Home is NOT intact (see Action)."
-                        : "Storage was not switched; the authoritative Home is unchanged.";
             return [
                 header,
                 `${mode === "dry-run" ? "Dry run" : mode === "update-preflight" ? "Update preflight" : "Upgrade"} blocked at ${result.stage}: ${result.message}`,
                 `Action: ${result.action}`,
-                unchangedNote
+                "The authoritative Home is unchanged."
             ].join("\n");
         }
     }