@zq-silk/yui 0.15.11 → 0.16.0

package/dist/storage/migrations/currentInputContract.js

@@ -0,0 +1,86 @@
+/** Frozen 33→34 boundary. An old immediate request without origin was not
+ * auto-adoptable. Its owner must activate or cancel it with the old release;
+ * an upgrade cannot make that choice, even while execution is stopped. */
+export function preflightCurrentInputContract(db) {
+    const blocked = db.prepare(`SELECT task_id FROM task_records
+    WHERE json_extract(payload,'$.status')='draft'
+      AND json_type(payload,'$.retiredAt') IS NULL
+      AND json_extract(payload,'$.activationRequest.startMode')='immediate'
+      AND json_extract(payload,'$.activationRequest.disposition')='pending'
+      AND json_type(payload,'$.activationRequest.origin') IS NULL LIMIT 1`)
+        .get();
+    if (blocked !== undefined) {
+        throw new Error(`Input contract cutover requires explicit activation or cancellation of the origin-less pending request: ${blocked.task_id}. Preserve the request and resolve it with the old release before upgrading.`);
+    }
+}
+/** Preserve original representations as audit Events, not runtime alternatives.
+ * All interpretation of wakePolicy/origin ends at this migration. */
+export function migrateCurrentInputContract(db) {
+    preflightCurrentInputContract(db);
+    const highWater = db.prepare(`SELECT max(
+    coalesce((SELECT high_water FROM id_sequences WHERE task_id=? AND kind='event'),0),
+    coalesce((SELECT max(CAST(substr(event_id,7) AS INTEGER)) FROM events WHERE task_id=?),0)
+  ) AS value`);
+    const saveEvent = db.prepare("INSERT INTO events(task_id,event_id,type,occurred_at,payload) VALUES(?,?,?,?,?)");
+    const saveCounter = db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'event',?)
+    ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`);
+    const at = new Date().toISOString();
+    const archive = (taskId, type, record) => {
+        const seq = highWater.get(taskId, taskId).value + 1;
+        const event = { schemaVersion: 2, id: `event-${seq}`, taskId, type, createdAt: at,
+            payload: { record, disposition: "audit-only" } };
+        saveEvent.run(taskId, event.id, type, at, JSON.stringify(event));
+        saveCounter.run(taskId, seq);
+    };
+    const messages = db.prepare("SELECT task_id,message_id,payload FROM messages ORDER BY task_id,seq")
+        .all();
+    const saveMessage = db.prepare("UPDATE messages SET payload=? WHERE task_id=? AND message_id=?");
+    for (const row of messages) {
+        const message = JSON.parse(row.payload);
+        const user = message.kind === "user" || message.kind === "operator";
+        const hasPolicy = Object.hasOwn(message, "wakePolicy");
+        if (message.schemaVersion !== 3 || message.id !== row.message_id || message.taskId !== row.task_id
+            || (hasPolicy && (!user || !["leader", "none"].includes(message.wakePolicy)))
+            || (message.intent !== undefined && (!user || !["record", "discuss", "develop"].includes(message.intent)))
+            || (hasPolicy && message.intent !== undefined
+                && (message.wakePolicy === "none") !== (message.intent === "record"))) {
+            throw new Error(`Invalid historical Message input: ${row.task_id}/${row.message_id}. Preserve it for diagnosis.`);
+        }
+        if (!hasPolicy && (!user || message.intent !== undefined))
+            continue;
+        archive(row.task_id, "message.input-contract-retired", row.payload);
+        if (user && message.intent === undefined) {
+            message.intent = message.wakePolicy === "none" ? "record" : "discuss";
+        }
+        delete message.wakePolicy;
+        saveMessage.run(JSON.stringify(message), row.task_id, row.message_id);
+    }
+    const tasks = db.prepare("SELECT task_id,payload FROM task_records ORDER BY task_id")
+        .all();
+    const saveTask = db.prepare("UPDATE task_records SET payload=? WHERE task_id=?");
+    for (const row of tasks) {
+        const task = JSON.parse(row.payload);
+        const requests = [
+            ...(task.activationRequest === undefined ? [] : [task.activationRequest]),
+            ...(task.settledActivationRequests ?? [])
+        ];
+        let changed = false;
+        for (const request of requests) {
+            if (request === null || typeof request !== "object" || request.schemaVersion !== 1
+                || request.operation?.targetId !== row.task_id
+                || !["immediate", "after-planning-turn"].includes(request.startMode)
+                || !["pending", "failed", "cancelled", "adopted"].includes(request.disposition)
+                || (Object.hasOwn(request, "origin") && !["explicit", "submit-develop"].includes(request.origin))) {
+                throw new Error(`Invalid historical activation request: ${row.task_id}. Preserve it for diagnosis.`);
+            }
+            if (Object.hasOwn(request, "origin")) {
+                changed = true;
+                delete request.origin;
+            }
+        }
+        if (changed) {
+            archive(row.task_id, "task.activation-origin-retired", row.payload);
+            saveTask.run(JSON.stringify(task), row.task_id);
+        }
+    }
+}

package/dist/storage/migrations/currentRuntimeContract.js

@@ -0,0 +1,228 @@
+import { readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp } from "../../domain/validation.js";
+import { readHistoricalVerificationPlan } from "./verificationPlanV1.js";
+/** Immutable audit only: no current executor or cache lookup reads this table.
+ * Raw payloads and binary logs survive retiring their executable contracts. */
+export const CURRENT_RUNTIME_CONTRACT_SQL = `
+CREATE TABLE storage_migration_archive (
+  migration_version INTEGER NOT NULL,
+  family TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  content BLOB,
+  PRIMARY KEY (migration_version, family, record_key)
+);
+`;
+/** Read-only blockers, shared by preflight and the actual 34→35 transaction.
+ * An old admitted execution/physical owner must settle through its original
+ * contract. Neither an upgrade nor a directory name proves it is safe to drop. */
+export function preflightCurrentRuntimeContract(db) {
+    const gate = db.prepare(`SELECT task_id,integration_id FROM integration_attempts
+    WHERE status NOT IN ('committed','superseded','failed')
+      AND json_type(payload,'$.gatePlanDigest') IS NOT NULL LIMIT 1`)
+        .get();
+    if (gate)
+        throw new Error(`Current verification cutover requires the admitted gate to settle: ${gate.task_id}/${gate.integration_id}. Continue or abort it with the old release.`);
+    const owner = db.prepare(`SELECT process_key FROM session_owners
+    WHERE json_extract(payload,'$.providerRoot.attribution')='launch-env' LIMIT 1`)
+        .get();
+    if (owner)
+        throw new Error(`Retired Session owner attribution requires explicit old-release reconciliation: ${owner.process_key}. Preserve its process evidence; no owner was rewritten.`);
+    if (db.name !== ":memory:" && db.name !== "") {
+        const directory = join(dirname(db.name), "runtime", "session-owners");
+        let files;
+        try {
+            files = readdirSync(directory).filter(name => name.endsWith(".json"));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            files = [];
+        }
+        if (files.length)
+            throw new Error(`Retired file Session owners remain at ${directory}. Inspect and release their exact resources with the old release, then archive the files outside the active Home before upgrading.`);
+    }
+    for (const row of historicalIntegrations(db)) {
+        const value = JSON.parse(row.payload);
+        if (!["committed", "superseded", "failed"].includes(value.status)) {
+            throw new Error(`Historical Integration must be explicitly settled before retirement: ${row.task_id}/${row.integration_id}.`);
+        }
+        const workspace = db.prepare(`SELECT 1 FROM managed_workspaces WHERE task_id=?
+      AND json_extract(payload,'$.owner.integrationAttemptId')=? LIMIT 1`).get(row.task_id, row.integration_id);
+        const job = db.prepare(`SELECT 1 FROM durable_jobs WHERE task_id=?
+      AND json_extract(payload,'$.owner.integrationAttemptId')=?
+      AND (status IN ('queued','running') OR (status='unknown-needs-attention'
+        AND json_type(payload,'$.acknowledgedAt') IS NULL)) LIMIT 1`).get(row.task_id, row.integration_id);
+        const adoption = db.prepare(`SELECT 1 FROM events WHERE task_id=?
+      AND type='publication.candidate-adopted'
+      AND json_extract(payload,'$.payload.integrationId')=? LIMIT 1`).get(row.task_id, row.integration_id);
+        if (workspace || job || adoption) {
+            throw new Error(`Historical Integration still has execution or delivery references: ${row.task_id}/${row.integration_id}. Preserve the Home and resolve/export its original evidence before upgrading.`);
+        }
+    }
+}
+/** Frozen v34 contract retirement. Existing migration definitions are unchanged.
+ * Only active verification configuration changes; old proof is never relabelled
+ * as current success. Historical Integration bytes become ordinary Task Events. */
+export function migrateCurrentRuntimeContract(db) {
+    preflightCurrentRuntimeContract(db);
+    const archive = db.prepare(`INSERT INTO storage_migration_archive
+    (migration_version,family,record_key,payload,content) VALUES(35,?,?,?,?)`);
+    for (const row of db.prepare("SELECT id,payload FROM projects").all()) {
+        const project = JSON.parse(row.payload);
+        let changed = false;
+        let plans = 0;
+        const knowledge = project.knowledge.map((entry) => {
+            if (entry.status !== "active")
+                return entry;
+            let value;
+            try {
+                value = JSON.parse(entry.body);
+            }
+            catch {
+                return entry;
+            }
+            if (!value || typeof value !== "object" || value.kind !== "verification-plan")
+                return entry;
+            if (++plans > 1 || value.schemaVersion !== 1 || Object.hasOwn(value, "mode")) {
+                throw new Error(`Invalid v34 verification configuration: ${row.id}. Preserve it for diagnosis.`);
+            }
+            readHistoricalVerificationPlan(value);
+            const { l1: _retired, ...current } = value;
+            changed = true;
+            return { ...entry, body: JSON.stringify({ ...current, schemaVersion: 2 }) };
+        });
+        if (changed) {
+            archive.run("project", row.id, row.payload, null);
+            db.prepare("UPDATE projects SET payload=? WHERE id=?").run(JSON.stringify({ ...project, knowledge }), row.id);
+        }
+    }
+    const artifacts = db.prepare("SELECT key,project_id,payload FROM gate_artifacts WHERE level='L1'")
+        .all();
+    for (const row of artifacts) {
+        const value = JSON.parse(row.payload);
+        if (value.schemaVersion !== 1 || value.level !== "L1" || value.key !== row.key
+            || value.projectId !== row.project_id || !/^[a-f0-9]{64}$/.test(row.key)
+            || !["complete", "incomplete"].includes(value.status)
+            || !["unknown", "succeeded", "failed"].includes(value.outcome)
+            || (value.status === "incomplete") !== (value.outcome === "unknown")
+            || !Array.isArray(value.steps)) {
+            throw new Error(`Invalid retired L1 evidence: ${row.key}. Preserve it for diagnosis.`);
+        }
+        validateRetiredGate(value);
+        archive.run("gate-artifact", row.key, row.payload, null);
+        const logs = db.prepare("SELECT step_name,log_content,log_digest,log_bytes FROM gate_artifact_logs WHERE artifact_key=?")
+            .all(row.key);
+        for (const { log_content, ...metadata } of logs) {
+            if (metadata.log_bytes !== log_content.length
+                || metadata.log_digest !== createHash("sha256").update(log_content).digest("hex")) {
+                throw new Error(`Corrupted retired L1 log: ${row.key}/${metadata.step_name}. Preserve it for diagnosis.`);
+            }
+            archive.run("gate-artifact-log", JSON.stringify([row.key, metadata.step_name]), JSON.stringify(metadata), log_content);
+        }
+        db.prepare("DELETE FROM gate_artifact_logs WHERE artifact_key=?").run(row.key);
+        db.prepare("DELETE FROM gate_artifacts WHERE key=?").run(row.key);
+    }
+    const at = new Date().toISOString();
+    for (const row of historicalIntegrations(db)) {
+        const value = JSON.parse(row.payload);
+        if (value.schemaVersion !== 6 || value.taskId !== row.task_id || value.id !== row.integration_id
+            || !/^integration-[1-9][0-9]*$/.test(value.id)
+            || !Array.isArray(value.source.changeSetIds) || value.source.changeSetIds.length === 0
+            || value.source.changeSetIds.some((id) => typeof id !== "string" || !/^change-set-[1-9][0-9]*$/.test(id))
+            || new Set(value.source.changeSetIds).size !== value.source.changeSetIds.length
+            || !Array.isArray(value.checkCommands) || value.checkCommands.some((command) => !text(command))
+            || typeof value.rerunChecks !== "boolean" || !text(value.projectId) || !text(value.targetRef)
+            || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value.beforeCommit)
+            || !Number.isFinite(Date.parse(value.createdAt)) || !Number.isFinite(Date.parse(value.updatedAt))
+            || !Number.isFinite(Date.parse(value.endedAt))
+            || (value.status === "committed" && (value.afterCommit !== value.candidateCommit
+                || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value.afterCommit) || !text(value.summary)))) {
+            throw new Error(`Invalid historical Integration: ${row.task_id}/${row.integration_id}. Preserve it for diagnosis.`);
+        }
+        const sequence = db.prepare(`SELECT max(
+      coalesce((SELECT high_water FROM id_sequences WHERE task_id=? AND kind='event'),0),
+      coalesce((SELECT max(CAST(substr(event_id,7) AS INTEGER)) FROM events WHERE task_id=?),0)
+    ) AS value`).get(row.task_id, row.task_id).value + 1;
+        const event = { schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "integration.source-retired", createdAt: at,
+            payload: { integrationId: row.integration_id, record: row.payload, disposition: "audit-only" } };
+        db.prepare("INSERT INTO events(task_id,event_id,type,occurred_at,payload) VALUES(?,?,?,?,?)")
+            .run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'event',?)
+      ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`).run(row.task_id, sequence);
+        // Preserve the retired identity's high-water mark so it cannot be reused.
+        const integrationSequence = Number(row.integration_id.slice("integration-".length));
+        if (!Number.isSafeInteger(integrationSequence) || integrationSequence < 1)
+            throw new Error("Invalid retired Integration identity.");
+        db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'integrationAttempt',?)
+      ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`).run(row.task_id, integrationSequence);
+        db.prepare("DELETE FROM integration_attempts WHERE task_id=? AND integration_id=?").run(row.task_id, row.integration_id);
+    }
+}
+function historicalIntegrations(db) {
+    return db.prepare(`SELECT task_id,integration_id,payload FROM integration_attempts
+    WHERE json_extract(payload,'$.source.kind')='historical-change-sets' ORDER BY task_id,integration_id`)
+        .all();
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}
+/** The retired v34 artifact shape, frozen here rather than accepted by current
+ * GateArtifact readers. It is archived verbatim, never made into an L2 proof. */
+function validateRetiredGate(value) {
+    requireIdentity(value.projectId, "Retired GateArtifact projectId");
+    for (const field of ["key", "planDigest", "toolchainDigest"]) {
+        if (typeof value[field] !== "string" || !/^[a-f0-9]{64}$/.test(value[field])) {
+            throw new Error(`Invalid retired GateArtifact ${field}.`);
+        }
+    }
+    const commit = (sha) => {
+        if (typeof sha !== "string" || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha))
+            throw new Error("Invalid retired gate commit.");
+    };
+    commit(value.commit);
+    if (value.boundary !== undefined) {
+        requireText(value.boundary.targetRef, "Retired gate target");
+        commit(value.boundary.baseHead);
+    }
+    const identity = { projectId: value.projectId, level: value.level, commit: value.commit,
+        planDigest: value.planDigest, toolchainDigest: value.toolchainDigest,
+        ...(value.boundary === undefined ? {} : { boundary: value.boundary }) };
+    if (createHash("sha256").update(canonical(identity)).digest("hex") !== value.key) {
+        throw new Error("Retired gate key does not match its original identity.");
+    }
+    const names = new Set();
+    for (const step of value.steps) {
+        requireIdentity(step.name, "Retired gate step name");
+        if (names.has(step.name))
+            throw new Error("Duplicate retired gate step.");
+        names.add(step.name);
+        requireText(step.command, "Retired gate command");
+        if (!["passed", "failed", "skipped"].includes(step.outcome))
+            throw new Error("Invalid retired gate step outcome.");
+        requirePositiveInteger(step.durationMs + 1, "Retired gate duration");
+        requireText(step.logPath, "Retired gate log path");
+        if (step.logPath.startsWith("/") || step.logPath.includes("..")
+            || typeof step.logDigest !== "string" || !/^[a-f0-9]{64}$/.test(step.logDigest)
+            || !Number.isSafeInteger(step.logBytes) || step.logBytes < 0)
+            throw new Error("Invalid retired gate log metadata.");
+    }
+    if (Object.hasOwn(value, "potentialReuseCount"))
+        throw new Error("Invalid v34 retired gate counter.");
+    requirePositiveInteger(value.reuseCount + 1, "Retired gate reuse count");
+    requireTimestamp(value.createdAt, "Retired gate createdAt");
+    requireTimestamp(value.lastUsedAt, "Retired gate lastUsedAt");
+    if (value.completedAt !== undefined)
+        requireTimestamp(value.completedAt, "Retired gate completedAt");
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object")
+        return `{${Object.keys(value).sort()
+            .map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+    return JSON.stringify(value);
+}

package/dist/storage/migrations/historicalVerificationPlan.js

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+/** Frozen pre-fix encoding used only to recognize valid historical Jobs.
+ * Never use corrected execution semantics to reinterpret a released migration,
+ * and never use these helpers to create executable work or reusable evidence.
+ */
+export function historicalVerificationPlanDigest(plan) {
+    return createHash("sha256").update(JSON.stringify(canonicalize({
+        id: plan.id, version: plan.version, toolchain: plan.toolchain,
+        bootstrap: plan.bootstrap, l1: plan.l1, l2: plan.l2,
+        ...(plan.l3 === undefined ? {} : { l3: plan.l3 })
+    }))).digest("hex");
+}
+export function historicalGateJobSteps(plan) {
+    const encode = (step, name) => ({
+        name,
+        command: step.shell === true ? step.argv.join(" ") : step.argv.map(value => /^[A-Za-z0-9_./:=@+-]+$/u.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`).join(" "),
+        argv: step.argv,
+        ...(step.cwd === undefined ? {} : { cwd: step.cwd }),
+        ...(step.env === undefined ? {} : { env: step.env })
+    });
+    return [
+        ...plan.bootstrap.map((step, index) => encode(step, `bootstrap-${index + 1}`)),
+        ...plan.l2.steps.map((step, index) => encode(step, `gate-${index + 1}`))
+    ];
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+            .map(([key, entry]) => [key, canonicalize(entry)]));
+    }
+    return value;
+}

package/dist/storage/migrations/integrationContinuation.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { durableJobIdempotencyKey } from "../../job/durableJob.js";
-import { resolveProjectVerificationPlan, verificationPlanDigest, planBootstrapJobSteps, planL2JobSteps } from "../../verification/verificationPlan.js";
+import { resolveHistoricalVerificationPlan } from "./verificationPlanV1.js";
+import { historicalGateJobSteps, historicalVerificationPlanDigest } from "./historicalVerificationPlan.js";
 /** Classify only known v19 Git conflicts. Manual strategy and CAS blockers
  * keep their meaning. Never synthesize candidate/Job success or edit history. */
 export function migrateIntegrationContinuation(db) {
@@ -74,10 +75,10 @@ function migrateBoundFastForward(db, attempt) {
         name: `check-${index + 1}`, command, timeoutMs: 30 * 60_000
     }));
     if (attempt.gatePlanDigest !== undefined) {
-        const plan = resolveProjectVerificationPlan(project);
-        if (plan === undefined || verificationPlanDigest(plan) !== attempt.gatePlanDigest)
+        const plan = resolveHistoricalVerificationPlan(project);
+        if (plan === undefined || historicalVerificationPlanDigest(plan) !== attempt.gatePlanDigest)
             return;
-        steps = [...planBootstrapJobSteps(plan), ...planL2JobSteps(plan)].map(step => ({
+        steps = historicalGateJobSteps(plan).map(step => ({
             ...step, timeoutMs: 30 * 60_000
         }));
     }

package/dist/storage/migrations/narrowAgentFailureContext.js

@@ -0,0 +1,65 @@
+import { isAbsolute } from "node:path";
+/** Frozen v36 projection. Execution/Review/protocol data remains in audit only;
+ * a metadata query must not require those unrelated contracts to stay current. */
+export function migrateNarrowAgentFailureContext(db) {
+    const rows = db.prepare("SELECT task_id,event_id,payload FROM events WHERE type='runtime.agent-error'").all();
+    const archive = db.prepare(`INSERT INTO storage_migration_archive
+    (migration_version,family,record_key,payload,content) VALUES(37,?,?,?,NULL)`);
+    const update = db.prepare("UPDATE events SET payload=? WHERE task_id=? AND event_id=?");
+    for (const row of rows) {
+        const event = JSON.parse(row.payload);
+        const raw = event?.payload?.capabilityContext;
+        if (typeof raw !== "string")
+            throw new Error(`Missing v36 failure context: ${row.task_id}/${row.event_id}.`);
+        const context = JSON.parse(raw);
+        const key = JSON.stringify([row.task_id, row.event_id]);
+        const emptyIdentities = {};
+        for (const field of ["runId", "nativeSessionId", "nativeTurnId"]) {
+            if (event.payload[field] !== "")
+                continue;
+            emptyIdentities[field] = "";
+            delete event.payload[field];
+        }
+        if (Object.keys(emptyIdentities).length) {
+            archive.run("agent-error-empty-identities", key, JSON.stringify(emptyIdentities));
+        }
+        if (context?.status === "unavailable" && text(context.reason)) {
+            if (Object.keys(emptyIdentities).length)
+                update.run(JSON.stringify(event), row.task_id, row.event_id);
+            continue;
+        }
+        const old = context?.effective;
+        if (context?.status !== "recorded" || !/^[a-f0-9]{64}$/.test(context.agentFingerprint)
+            || old?.schemaVersion !== 4 || !text(old.agentId)
+            || !["codex", "claude", "acp"].includes(old.adapterId)
+            || !text(old.workspace?.root) || !isAbsolute(old.workspace.root)) {
+            throw new Error(`Invalid v36 failure context: ${row.task_id}/${row.event_id}.`);
+        }
+        const config = { adapterId: old.adapterId };
+        for (const key of ["model", "effort", ...(old.adapterId === "codex" ? ["profile"] : []),
+            ...(old.adapterId === "claude" ? ["settingsFile"] : [])]) {
+            if (old[key] === undefined)
+                continue;
+            if (!text(old[key]) || key === "settingsFile" && !isAbsolute(old[key])) {
+                throw new Error(`Invalid v36 failure ${key}: ${row.task_id}/${row.event_id}.`);
+            }
+            config[key] = old[key];
+        }
+        if (old.adapterId === "claude" && old.settingsSources !== undefined) {
+            if (!Array.isArray(old.settingsSources) || old.settingsSources.some((source) => !text(source))
+                || new Set(old.settingsSources).size !== old.settingsSources.length) {
+                throw new Error(`Invalid v36 settings sources: ${row.task_id}/${row.event_id}.`);
+            }
+            config.settingsSources = old.settingsSources;
+        }
+        archive.run("agent-error-context", key, raw);
+        event.payload.capabilityContext = JSON.stringify({
+            status: "recorded", agentId: old.agentId, cwd: old.workspace.root, config,
+            agentFingerprint: context.agentFingerprint
+        });
+        update.run(JSON.stringify(event), row.task_id, row.event_id);
+    }
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}

package/dist/storage/migrations/notificationOnlyWakes.js

@@ -0,0 +1,74 @@
+function runLinkedWakes(db) {
+    return db.prepare(`SELECT task_id, wake_id, seq, turn_id, payload FROM task_wakes
+    WHERE turn_id IS NOT NULL OR json_type(payload, '$.runId') IS NOT NULL
+    ORDER BY task_id, seq`).all();
+}
+/** Read only stable SQL identities, including prefixes before payload key renames. */
+export function preflightNotificationOnlyWakes(db) {
+    assertQuiescent(db, runLinkedWakes(db));
+}
+/** Frozen 29→30 transform. Old execution-linked wakes become audit events;
+ * accepted/pending notifications keep their exact identity and delivery state. */
+export function migrateNotificationOnlyWakes(db) {
+    const rows = runLinkedWakes(db);
+    // Check every retiring reference before changing any data. The outer
+    // migration transaction also rolls back on any later failure.
+    for (const row of rows) {
+        const value = JSON.parse(row.payload);
+        if (typeof value.runId !== "string" || value.runId !== row.turn_id) {
+            throw new Error(`Run-linked wake identity is inconsistent: ${row.task_id}/${row.wake_id}.`);
+        }
+    }
+    assertQuiescent(db, rows);
+    const counters = new Map();
+    const readCounter = db.prepare(`SELECT max(
+    coalesce((SELECT high_water FROM id_sequences WHERE task_id = ? AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events WHERE task_id = ?), 0)
+  ) AS value`);
+    const saveCounter = db.prepare(`INSERT INTO id_sequences(task_id, kind, high_water) VALUES (?, ?, ?)
+    ON CONFLICT(task_id, kind) DO UPDATE SET high_water = max(high_water, excluded.high_water)`);
+    const saveEvent = db.prepare("INSERT INTO events(task_id, event_id, type, occurred_at, payload) VALUES (?, ?, ?, ?, ?)");
+    const removeWake = db.prepare("DELETE FROM task_wakes WHERE task_id = ? AND wake_id = ?");
+    const at = new Date().toISOString();
+    for (const row of rows) {
+        const sequence = (counters.get(row.task_id)
+            ?? readCounter.get(row.task_id, row.task_id).value) + 1;
+        counters.set(row.task_id, sequence);
+        const event = {
+            schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "wake.run-link-retired", createdAt: at,
+            payload: { wakeId: row.wake_id, runId: row.turn_id,
+                record: row.payload, disposition: "retired-without-replay" }
+        };
+        saveEvent.run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        saveCounter.run(row.task_id, "event", sequence);
+        saveCounter.run(row.task_id, "taskWake", row.seq);
+        removeWake.run(row.task_id, row.wake_id);
+    }
+    db.exec(`
+    ALTER TABLE task_wakes DROP COLUMN turn_id;
+    UPDATE task_wakes SET payload = json_set(payload, '$.schemaVersion', 2);
+    UPDATE global_role_session_sets
+      SET payload = json_set(payload, '$.providerBinding', json('null'))
+      WHERE json_type(payload, '$.providerBinding') IS NULL;
+  `);
+}
+function assertQuiescent(db, rows) {
+    const activeRun = db.prepare("SELECT 1 FROM turns WHERE task_id = ? AND turn_id = ? AND status = 'active'");
+    const claimedWake = db.prepare(`SELECT 1 FROM mailboxes WHERE task_id = ?
+    AND json_extract(processing, '$.owner') = ? LIMIT 1`);
+    const pendingInput = db.prepare(`SELECT 1 FROM role_session_sets WHERE task_id = ? AND (
+    (json_extract(payload, '$.providerBinding.run.status') IN ('submitting', 'accepted', 'delivery-unknown')
+      AND (json_extract(payload, '$.providerBinding.run.runId') = ?
+        OR json_extract(payload, '$.providerBinding.run.input.wakeId') = ?))
+    OR (json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight')
+      AND (json_extract(payload, '$.providerBinding.retry.input.runId') = ?
+        OR json_extract(payload, '$.providerBinding.retry.input.wakeId') = ?))) LIMIT 1`);
+    for (const row of rows) {
+        if (activeRun.get(row.task_id, row.turn_id)
+            || claimedWake.get(row.task_id, `leader-notification:${row.wake_id}`)
+            || pendingInput.get(row.task_id, row.turn_id, row.wake_id, row.turn_id, row.wake_id)) {
+            throw new Error(`Run-linked wake still owns unsettled input: ${row.task_id}/${row.wake_id}, Run ${row.turn_id}. Settle or stop that exact execution before upgrading.`);
+        }
+    }
+}