@zq-silk/yui 0.15.11 → 0.16.0

package/dist/storage/migrations/verificationPlanV1.js

@@ -0,0 +1,162 @@
+export function readHistoricalVerificationPlan(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error("VerificationPlan must be an object.");
+    }
+    const record = raw;
+    if (record.kind !== "verification-plan")
+        throw new Error('VerificationPlan kind must be "verification-plan".');
+    if ((record.schemaVersion ?? 1) !== 1)
+        throw new Error("VerificationPlan schemaVersion must be 1.");
+    const mode = record.mode ?? "record";
+    if (mode !== "record" && mode !== "reuse" && mode !== "enforce") {
+        throw new Error(`VerificationPlan mode is invalid: ${String(mode)}.`);
+    }
+    const plan = {
+        schemaVersion: 1, kind: "verification-plan",
+        id: identity(record.id, "VerificationPlan id"),
+        version: text(record.version, "VerificationPlan version"),
+        mode,
+        toolchain: toolchain(record.toolchain),
+        bootstrap: steps(record.bootstrap, "bootstrap"),
+        l1: { categories: categories(record.l1) },
+        l2: { steps: steps(record.l2?.steps, "l2") },
+        ...(record.l3 === undefined ? {} : {
+            l3: { steps: steps(record.l3?.steps, "l3") }
+        }),
+        ...(record.excludedRealResourceChecks === undefined ? {} : {
+            excludedRealResourceChecks: textList(record.excludedRealResourceChecks, "VerificationPlan excludedRealResourceChecks")
+        }),
+        ...(record.artifactTtlDays === undefined ? {} : {
+            artifactTtlDays: positive(Number(record.artifactTtlDays), "VerificationPlan artifactTtlDays")
+        })
+    };
+    if (plan.l2.steps.length === 0)
+        throw new Error("VerificationPlan l2 requires at least one step.");
+    return plan;
+}
+export function resolveHistoricalVerificationPlan(project) {
+    let found;
+    for (const entry of project.knowledge) {
+        if (entry.status !== "active")
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(entry.body);
+        }
+        catch {
+            continue;
+        }
+        if (typeof parsed !== "object" || parsed === null
+            || parsed.kind !== "verification-plan")
+            continue;
+        const plan = readHistoricalVerificationPlan(parsed);
+        if (found !== undefined)
+            throw new Error(`Project ${project.id} declares multiple VerificationPlans; only one is allowed.`);
+        found = plan;
+    }
+    return found;
+}
+function toolchain(raw) {
+    if (raw === undefined)
+        return Object.freeze({});
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error("VerificationPlan toolchain must be an object.");
+    const record = raw;
+    return {
+        ...(record.node === undefined ? {} : { node: text(record.node, "VerificationPlan toolchain node") }),
+        ...(record.npm === undefined ? {} : { npm: text(record.npm, "VerificationPlan toolchain npm") }),
+        ...(record.platform === undefined ? {} : { platform: text(record.platform, "VerificationPlan toolchain platform") })
+    };
+}
+function steps(raw, label) {
+    if (!Array.isArray(raw))
+        throw new Error(`VerificationPlan ${label} steps must be an array.`);
+    const names = new Set();
+    return Object.freeze(raw.map(entry => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            throw new Error(`VerificationPlan ${label} step must be an object.`);
+        const record = entry;
+        const name = identity(record.name, `VerificationPlan ${label} step name`);
+        if (names.has(name))
+            throw new Error(`VerificationPlan ${label} step names must be unique: ${name}.`);
+        names.add(name);
+        if (!Array.isArray(record.argv) || record.argv.length === 0) {
+            throw new Error(`VerificationPlan ${label} step ${name} requires a non-empty argv.`);
+        }
+        const step = {
+            name, argv: Object.freeze(record.argv.map(value => text(value, `VerificationPlan ${label} step ${name} argv`))),
+            ...(record.cwd === undefined ? {} : { cwd: text(record.cwd, `VerificationPlan ${label} step ${name} cwd`) }),
+            ...(record.env === undefined ? {} : { env: stepEnv(record.env, `${label} step ${name}`) }),
+            ...(record.shell === undefined ? {} : { shell: record.shell === true })
+        };
+        if (step.cwd?.startsWith("/"))
+            throw new Error(`VerificationPlan ${label} step ${name} cwd must be workspace-relative.`);
+        return step;
+    }));
+}
+function stepEnv(raw, label) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error(`VerificationPlan ${label} env must be a map.`);
+    const env = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value !== "string")
+            throw new Error(`VerificationPlan ${label} env values must be strings: ${key}.`);
+        env[identity(key, `VerificationPlan ${label} env key`)] = value;
+    }
+    return Object.freeze(env);
+}
+function categories(raw) {
+    if (raw === undefined)
+        return Object.freeze([]);
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error("VerificationPlan l1 must be an object.");
+    const values = raw.categories;
+    if (!Array.isArray(values))
+        throw new Error("VerificationPlan l1 categories must be an array.");
+    const ids = new Set();
+    return Object.freeze(values.map(entry => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            throw new Error("VerificationPlan l1 category must be an object.");
+        const record = entry;
+        const id = identity(record.id, "VerificationPlan l1 category id");
+        if (ids.has(id))
+            throw new Error(`VerificationPlan l1 category ids must be unique: ${id}.`);
+        ids.add(id);
+        return Object.freeze({
+            id, paths: textList(record.paths, `VerificationPlan l1 category ${id} paths`),
+            checks: steps(record.checks, `l1 ${id}`)
+        });
+    }));
+}
+function textList(raw, label) {
+    if (!Array.isArray(raw))
+        throw new Error(`${label} must be an array.`);
+    const seen = new Set();
+    return Object.freeze(raw.map(value => {
+        const next = text(value, label);
+        if (seen.has(next))
+            throw new Error(`${label} must be unique: ${next}.`);
+        seen.add(next);
+        return next;
+    }));
+}
+function text(value, label) {
+    if (typeof value !== "string" || value.includes("\0"))
+        throw new Error(`${label} is invalid.`);
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}
+function identity(value, label) {
+    const normalized = text(value, label);
+    if ([".", "..", "__proto__", "prototype", "constructor"].includes(normalized) || /[\/\\\0]/u.test(normalized)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return normalized;
+}
+function positive(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`${label} must be a positive integer.`);
+    return value;
+}

package/dist/storage/migrations/verificationPolicy.js

@@ -0,0 +1,74 @@
+import { resolveHistoricalVerificationPlan } from "./verificationPlanV1.js";
+/** Read-only: an admitted old gate keeps its original plan identity until it
+ * settles. The cutover never relabels a running Job or replays its checks. */
+export function preflightVerificationPolicy(db) {
+    const active = db.prepare(`SELECT task_id, integration_id FROM integration_attempts
+    WHERE status IN ('running','validating')
+      AND json_type(payload,'$.gatePlanDigest') IS NOT NULL LIMIT 1`)
+        .get();
+    if (active !== undefined) {
+        throw new Error(`Verification policy cutover requires the admitted gate to settle: ${active.task_id}/${active.integration_id}. Preserve its Job and continue it with the current release before upgrading.`);
+    }
+}
+/** Frozen 32→33 policy cutover. Only declared configuration representations
+ * change; old execution artifacts/Job results and their logs remain evidence. */
+export function migrateVerificationPolicy(db) {
+    preflightVerificationPolicy(db);
+    const configRow = db.prepare("SELECT payload FROM config WHERE id=1").get();
+    if (configRow !== undefined) {
+        const config = JSON.parse(configRow.payload);
+        const mode = config.leaderNextActionMode;
+        const budget = config.leaderSemanticBudgetRuns;
+        if ((mode != null && (typeof mode !== "string"
+            || !["", "display", "warn", "enforce"].includes(mode.trim().toLowerCase())))
+            || (budget != null && (!Number.isSafeInteger(budget) || budget < 1 || budget > 20))) {
+            throw new Error("Invalid retired Leader policy; preserve the config for diagnosis.");
+        }
+    }
+    const projects = db.prepare("SELECT id,payload FROM projects").all();
+    const saveProject = db.prepare("UPDATE projects SET payload=? WHERE id=?");
+    for (const row of projects) {
+        const project = JSON.parse(row.payload);
+        // This frozen reader preserves validation and duplicate-plan rejection.
+        resolveHistoricalVerificationPlan(project);
+        let changed = false;
+        const knowledge = project.knowledge.map(entry => {
+            if (entry.status !== "active")
+                return entry;
+            let value;
+            try {
+                value = JSON.parse(entry.body);
+            }
+            catch {
+                return entry;
+            }
+            if (typeof value !== "object" || value === null
+                || value.kind !== "verification-plan")
+                return entry;
+            const { mode: _mode, ...plan } = value;
+            changed = true;
+            return { ...entry, body: JSON.stringify({ ...plan, schemaVersion: 1 }) };
+        });
+        if (changed)
+            saveProject.run(JSON.stringify({ ...project, knowledge }), row.id);
+    }
+    const invalidRerun = db.prepare(`SELECT task_id,integration_id FROM integration_attempts
+    WHERE json_type(payload,'$.rerunChecks') IS NOT NULL
+      AND json_type(payload,'$.rerunChecks') NOT IN ('true','false') LIMIT 1`).get();
+    if (invalidRerun !== undefined)
+        throw new Error("Invalid Integration check execution intent; preserve the record.");
+    const artifacts = db.prepare(`SELECT key,payload FROM gate_artifacts
+    WHERE json_type(payload,'$.potentialReuseCount') IS NOT NULL`).all();
+    for (const artifact of artifacts) {
+        const count = JSON.parse(artifact.payload).potentialReuseCount;
+        if (!Number.isSafeInteger(count) || count < 0) {
+            throw new Error(`Invalid historical verification counter: ${artifact.key}. Preserve the artifact for diagnosis.`);
+        }
+    }
+    db.exec(`
+    UPDATE config SET payload=json_remove(payload,'$.leaderNextActionMode','$.leaderSemanticBudgetRuns');
+    UPDATE integration_attempts SET payload=json_set(payload,'$.rerunChecks',json('false'))
+      WHERE json_type(payload,'$.rerunChecks') IS NULL;
+    UPDATE gate_artifacts SET payload=json_remove(payload,'$.potentialReuseCount');
+  `);
+}

package/dist/storage/migrations/workItemHistory.js

@@ -0,0 +1,46 @@
+/** Frozen 31→32 transform: obsolete execution-shaped diagnostics are audit
+ * records, not another representation of current WorkItem state. */
+export function migrateWorkItemHistory(db) {
+    const rows = db.prepare(`SELECT task_id, work_item_id, payload FROM work_items
+    WHERE json_type(payload, '$.historicalState') IS NOT NULL
+    ORDER BY task_id, work_item_id`).all();
+    for (const row of rows) {
+        const value = JSON.parse(row.payload);
+        const history = value.historicalState;
+        if (value.taskId !== row.task_id || value.id !== row.work_item_id
+            || history === null || typeof history !== "object" || Array.isArray(history)
+            || !["pending", "running", "awaiting_acceptance", "completed", "failed", "retired"].includes(history.status)
+            || (history.outcome !== undefined && !text(history.outcome))
+            || (history.endedAt !== undefined
+                && (!text(history.endedAt) || !Number.isFinite(Date.parse(history.endedAt))))) {
+            throw new Error(`Invalid historical WorkItem execution state: ${row.task_id}/${row.work_item_id}. Preserve it for diagnosis.`);
+        }
+    }
+    const highWater = db.prepare(`SELECT max(
+    coalesce((SELECT high_water FROM id_sequences WHERE task_id = ? AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events WHERE task_id = ?), 0)
+  ) AS value`);
+    const saveEvent = db.prepare("INSERT INTO events(task_id,event_id,type,occurred_at,payload) VALUES(?,?,?,?,?)");
+    const saveCounter = db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'event',?)
+    ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`);
+    const removeHistoricalState = db.prepare(`UPDATE work_items SET payload=json_remove(payload,'$.historicalState')
+    WHERE task_id=? AND work_item_id=?`);
+    const counters = new Map();
+    const at = new Date().toISOString();
+    for (const row of rows) {
+        const sequence = (counters.get(row.task_id)
+            ?? highWater.get(row.task_id, row.task_id).value) + 1;
+        counters.set(row.task_id, sequence);
+        const event = {
+            schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "work-item.execution-state-retired", createdAt: at,
+            payload: { workItemId: row.work_item_id, record: row.payload, disposition: "audit-only" }
+        };
+        saveEvent.run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        saveCounter.run(row.task_id, sequence);
+        removeHistoricalState.run(row.task_id, row.work_item_id);
+    }
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}

package/dist/storage/persistenceWorker.js

@@ -3,9 +3,9 @@
  *
  * The worker owns the {@link SqliteTaskStore} connection: one writer connection
  * (single-writer, `BEGIN IMMEDIATE`) plus a small read pool (separate WAL
- * connections that never take the write lock, §3.2). The main thread never
- * touches the db; it sends commands over a `MessageChannel` port and receives
- * results.
+ * connections for reads). Observer folds and telemetry ingestion use this
+ * worker; the Controller's synchronous scheduler still has its own connection
+ * to the same WAL database. This is an execution boundary, not another Store.
  *
  * The port handshake, dispatch, cancellation observation, and error
  * serialization are provided by the shared `core/boundedRpc` worker host
@@ -22,6 +22,8 @@
  *   - `observer` ..... a controller observer method hosted by the worker (the
  *                      `FileSchedulerStoreAdapter` folds run here, off the main
  *                      event loop).
+ *   - `telemetry` .... bounded diagnostic batch, using existing row keys and
+ *                      triggers without Task revision or outbox writes.
  *   - `expectedRevision` enforces the global revision CAS in the same txn
  *                      (§5.3); a mismatch fails with `StorageConflictError`.
  *
@@ -141,6 +143,7 @@ runRpcWorker({
             case "call":
             case "transaction":
             case "observer":
+            case "telemetry":
                 return "request";
         }
     },
@@ -149,6 +152,7 @@ runRpcWorker({
             case "call":
             case "transaction":
             case "observer":
+            case "telemetry":
             case "cancel":
                 return request.requestId;
             case "init":
@@ -157,7 +161,7 @@ runRpcWorker({
         }
     },
     init: (request) => handleInit(request),
-    handle: (request) => {
+    handle: async (request) => {
         switch (request.kind) {
             case "call":
                 return handleCall(request);
@@ -165,6 +169,10 @@ runRpcWorker({
                 return handleTransaction(request);
             case "observer":
                 return handleObserver(request);
+            case "telemetry":
+                if (state.writer === undefined)
+                    throw new Error("Worker not initialized.");
+                return state.writer.flushTelemetry(request.entries, request.runCap);
             case "init":
             case "cancel":
             case "shutdown":

package/dist/storage/recordValidation.js

@@ -0,0 +1,87 @@
+import { validateConfiguredAgent } from "../agent/agent.js";
+import { validateRun } from "../agentRun/agentRun.js";
+import { validateContextSnapshot } from "../context/contextSnapshot.js";
+import { validateDecision } from "../decision/decision.js";
+import { validateTaskEvent } from "../event/taskEvent.js";
+import { validateRoleSessionSet } from "../executor/agentExecutor.js";
+import { validateInputRequest } from "../input/inputRequest.js";
+import { validateChangeSet } from "../integration/changeSet.js";
+import { validateIntegrationAttempt } from "../integration/integrationAttempt.js";
+import { validateDurableJob } from "../job/durableJob.js";
+import { validateGlobalRoleMessage, validateTaskMessage } from "../message/message.js";
+import { validateMilestone } from "../milestone/milestone.js";
+import { validatePluginIntent } from "../plugins/pluginIntent.js";
+import { validatePluginValidation } from "../plugins/pluginPackage.js";
+import { validateAgentProfile } from "../profile/agentProfile.js";
+import { validateProject } from "../repository/project.js";
+import { validateEnvironmentPreparation, validateLocalResource } from "../resources/projectResource.js";
+import { validateReviewRound } from "../review/reviewRound.js";
+import { validateGlobalRole, validateTaskRole } from "../role/role.js";
+import { createSessionOwnerIdentity } from "../runtime/sessionOwnerIdentity.js";
+import { validateTaskWake } from "../scheduler/taskWake.js";
+import { validateTask } from "../task/task.js";
+import { validateGateArtifact } from "../verification/gateArtifact.js";
+import { validateWorkItem } from "../workItem/workItem.js";
+import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
+import { StorageRecordError, storedCapabilityGrant, storedPublicationReference, storedReleaseWorkflow } from "./taskStore.js";
+const check = (validate) => record => { validate(record); };
+/** One current domain contract for saves, reads and explicit Home diagnostics.
+ * Protocol-specific metadata/outbox/telemetry have their own readers. This is
+ * validation only: historical formats belong exclusively to migrations. */
+const validators = {
+    task_records: check(validateTask),
+    work_items: check(validateWorkItem),
+    configured_agents: check(validateConfiguredAgent),
+    agent_profiles: check(validateAgentProfile),
+    projects: check(validateProject),
+    task_roles: check(validateTaskRole),
+    global_roles: check(validateGlobalRole),
+    role_session_sets: check(validateRoleSessionSet),
+    global_role_session_sets: check(validateRoleSessionSet),
+    messages: check(validateTaskMessage),
+    global_role_messages: check(validateGlobalRoleMessage),
+    turns: check(validateRun),
+    review_rounds: check(validateReviewRound),
+    change_sets: check(validateChangeSet),
+    integration_attempts: check(validateIntegrationAttempt),
+    durable_jobs: check(validateDurableJob),
+    context_snapshots: check(validateContextSnapshot),
+    managed_workspaces: check(validateManagedWorkspace),
+    input_requests: check(validateInputRequest),
+    decisions: check(validateDecision),
+    milestones: check(validateMilestone),
+    events: check(validateTaskEvent),
+    task_wakes: check(validateTaskWake),
+    gate_artifacts: check(validateGateArtifact),
+    capability_grants: check(storedCapabilityGrant),
+    release_workflows: check(storedReleaseWorkflow),
+    publication_references: check(storedPublicationReference),
+    local_resources: check(validateLocalResource),
+    environment_preparations: check(validateEnvironmentPreparation),
+    plugin_intents: check(validatePluginIntent),
+    plugin_validations: check(validatePluginValidation),
+    session_owners: check((record) => {
+        if (record.schemaVersion !== 2 || record.kind !== "yui-session-owner" || Object.hasOwn(record, "launchId")) {
+            throw new Error("Session owner identity is invalid.");
+        }
+        createSessionOwnerIdentity({ ...record, recordedAt: new Date(record.recordedAt) });
+    })
+};
+export const STORED_RECORD_TABLES = Object.freeze(Object.keys(validators));
+export function validateStoredRecord(table, record) {
+    if (!Object.hasOwn(validators, table))
+        return;
+    try {
+        if (record === null || typeof record !== "object" || Array.isArray(record)) {
+            throw new Error("Record must be an object.");
+        }
+        validators[table](record);
+    }
+    catch (error) {
+        const fields = record !== null && typeof record === "object" ? record : {};
+        const identity = [fields.taskId, fields.id ?? fields.name ?? fields.pluginId]
+            .filter((value) => typeof value === "string")
+            .map(value => JSON.stringify(value.slice(0, 160))).join("/");
+        throw new StorageRecordError(`Invalid ${table} record${identity ? ` ${identity}` : ""}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}

package/dist/storage/sqliteSchema.js

@@ -25,6 +25,13 @@ import { REMOVE_RUNTIME_GENERATION_SQL, removeRuntimeGenerationRecords } from ".
 import { migrateAgentRunContract } from "./migrations/agentRunContract.js";
 import { migrateArtifactsToGit } from "./migrations/artifactsToGit.js";
 import { migrateIntegrationContinuation } from "./migrations/integrationContinuation.js";
+import { migrateNotificationOnlyWakes } from "./migrations/notificationOnlyWakes.js";
+import { migrateWorkItemHistory } from "./migrations/workItemHistory.js";
+import { migrateVerificationPolicy } from "./migrations/verificationPolicy.js";
+import { migrateCurrentInputContract } from "./migrations/currentInputContract.js";
+import { CURRENT_RUNTIME_CONTRACT_SQL, migrateCurrentRuntimeContract } from "./migrations/currentRuntimeContract.js";
+import { migrateAgentFailureContext } from "./migrations/agentFailureContext.js";
+import { migrateNarrowAgentFailureContext } from "./migrations/narrowAgentFailureContext.js";
 import { UNIFY_HOME_LAYOUT_SQL, migrateUnifyHomeLayout } from "./migrations/unifyHomeLayout.js";
 import { COLLAPSE_WORKTREE_LAYOUT_SQL, migrateCollapseWorktreeLayout } from "./migrations/collapseWorktreeLayout.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
@@ -1264,6 +1271,171 @@ UPDATE review_rounds SET payload = json_set(payload, '$.executionGroup.lanes', j
         // The data/filesystem transform is the substantive step; the SQL is inert.
         sql: COLLAPSE_WORKTREE_LAYOUT_SQL,
         migrateData: migrateCollapseWorktreeLayout
+    },
+    {
+        version: 26,
+        name: "publication-candidate-adoption",
+        introducedIn: "0.15.12",
+        // Add optional Publication.headCommit (the observed PR/MR source head) and
+        // publication.candidate-adopted events binding publicationId, completionEventId,
+        // projectId, acceptedCommit/localCommit, acceptedTree/candidateTree, diffDigest,
+        // acceptance and by, optionally integrationId/integrationDigest. Derived
+        // task.archived mergeCoverage may also be uncovered or unverified.
+        // No stored delivery index and no inferred adoption or verification:
+        // valid old Publication, completion and archive payloads remain byte-identical.
+        sql: "SELECT 1; -- fixed acceptance-to-publication evidence; preserve all historical facts"
+    },
+    {
+        version: 27,
+        name: "bounded-provider-input-retry",
+        introducedIn: "0.16.0",
+        // Optional owned input/recovery records on the existing Provider binding;
+        // positive Driver transient evidence on StandardAgentError. No historical
+        // failures are scanned, scheduled, reclassified or replayed by upgrading.
+        sql: `
+-- ProviderTurn.input/retrySupported/failure; ProviderRuntimeBinding.retry/retryHistory/retryDisabled;
+-- optional error retryable and retryAfterMs facts. Index existing records only.
+CREATE INDEX idx_task_provider_retry ON role_session_sets(
+  json_extract(payload, '$.providerBinding.retry.status')
+) WHERE json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight');
+CREATE INDEX idx_global_provider_retry ON global_role_session_sets(
+  json_extract(payload, '$.providerBinding.retry.status')
+) WHERE json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight');
+`
+    },
+    {
+        version: 28,
+        name: "current-contract-only-dispatch",
+        introducedIn: "0.16.0",
+        // Freeze the one valid earlier singleton dispatch shape here, not in the
+        // normal runtime. Preserve the full input batch and sequence; only replace
+        // its transport dedupe identity. Merged/ambiguous batches, processing
+        // claims, original Messages, results and external-effect evidence remain
+        // untouched. This step does not accept, replay or complete any execution.
+        sql: `
+UPDATE mailboxes
+SET pending = json_set(pending,
+  '$.sources', json_array('turn-dispatch'),
+  '$.dedupeKeys', json_array('role-turn:' || task_id || ':' || role_name || ':' ||
+    (SELECT json_extract(value, '$.id') FROM json_each(mailboxes.pending, '$.refs')
+     WHERE json_extract(value, '$.type') = 'run'
+       AND json_extract(value, '$.taskId') = mailboxes.task_id)))
+WHERE target_kind = 'role' AND role_name <> 'leader' AND pending IS NOT NULL
+  AND json_extract(pending, '$.requestCount') = 1
+  AND json_array_length(pending, '$.sources') = 1
+  AND json_extract(pending, '$.sources[0]') = 'yui'
+  AND EXISTS (SELECT 1 FROM json_each(mailboxes.pending, '$.reasons')
+    WHERE value IN ('turn-dispatched', 'turn-retried', 'review-requested',
+                    'workitem-synthesis-ready', 'review-synthesis-ready'))
+  AND (SELECT count(*) FROM json_each(mailboxes.pending, '$.refs')
+       WHERE json_extract(value, '$.type') = 'run') = 1
+  AND EXISTS (SELECT 1 FROM json_each(mailboxes.pending, '$.refs')
+    WHERE json_extract(value, '$.type') = 'run'
+      AND json_extract(value, '$.taskId') = mailboxes.task_id);
+`
+    },
+    {
+        version: 29,
+        name: "agent-ordered-atomic-integration",
+        introducedIn: "0.16.0",
+        // Retire the scheduler, not its user's intent. Freeze each complete queue
+        // payload in ordinary Task history before dropping the active table.
+        // Existing Integrations, Jobs and WorkItem delivery evidence remain exact;
+        // no entry is interpreted as committed or automatically replayed.
+        sql: `
+CREATE TEMP TABLE retired_integration_queue AS
+SELECT q.*,
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS retired_at,
+  max(
+    coalesce((SELECT high_water FROM id_sequences
+              WHERE task_id = q.task_id AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events
+              WHERE task_id = q.task_id), 0)
+  ) + row_number() OVER (
+    PARTITION BY q.task_id ORDER BY q.created_at,
+      CAST(substr(q.queue_id, length('integration-queue-') + 1) AS INTEGER)
+  ) AS event_sequence
+FROM integration_queue AS q;
+
+INSERT INTO events(task_id, event_id, type, occurred_at, payload)
+SELECT task_id, 'event-' || event_sequence, 'integration.queue-retired', retired_at,
+  json_object(
+    'schemaVersion', 2, 'id', 'event-' || event_sequence, 'taskId', task_id,
+    'type', 'integration.queue-retired', 'createdAt', retired_at,
+    'payload', json_object('queueId', queue_id, 'record', payload,
+      'disposition', 'retired-without-replay')
+  )
+FROM retired_integration_queue;
+
+INSERT INTO id_sequences(task_id, kind, high_water)
+SELECT task_id, 'event', max(event_sequence)
+FROM retired_integration_queue GROUP BY task_id
+ON CONFLICT(task_id, kind) DO UPDATE SET high_water = excluded.high_water;
+
+DROP TABLE retired_integration_queue;
+DROP TABLE integration_queue;
+DELETE FROM id_sequences WHERE kind = 'integrationQueue';
+`
+    },
+    {
+        version: 30,
+        name: "notification-only-wakes",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Retire Run-linked wakes as audit events; notification schema 2; explicit Global providerBinding",
+        migrateData: migrateNotificationOnlyWakes
+    },
+    {
+        version: 31,
+        name: "explicit-review-scope",
+        introducedIn: "0.16.0",
+        sql: `
+UPDATE review_rounds
+SET payload = json_set(payload, '$.scope', 'work-item')
+WHERE json_type(payload, '$.scope') IS NULL
+   OR json_type(payload, '$.scope') = 'null';
+`
+    },
+    {
+        version: 32,
+        name: "work-item-history-as-events",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive original WorkItem payloads before removing historicalState",
+        migrateData: migrateWorkItemHistory
+    },
+    {
+        version: 33,
+        name: "advisory-and-verification-policy",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Retire rollout modes/shadow metrics; explicit rerun intent; verification proof v3",
+        migrateData: migrateVerificationPolicy
+    },
+    {
+        version: 34,
+        name: "current-input-contract",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive retired Message wake policies and activation origin gates",
+        migrateData: migrateCurrentInputContract
+    },
+    {
+        version: 35,
+        name: "current-verification-and-owner-contract",
+        introducedIn: "0.16.0",
+        sql: CURRENT_RUNTIME_CONTRACT_SQL,
+        migrateData: migrateCurrentRuntimeContract
+    },
+    {
+        version: 36,
+        name: "agent-failure-configuration-context",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Preserve historical errors; absent original launch configuration is explicitly unavailable",
+        migrateData: migrateAgentFailureContext
+    },
+    {
+        version: 37,
+        name: "narrow-agent-failure-context",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive full v36 failure snapshots; retain only native metadata selectors",
+        migrateData: migrateNarrowAgentFailureContext
     }
 ]);
 for (let index = 0; index < MIGRATIONS.length; index += 1) {
@@ -1540,6 +1712,7 @@ export function migrateSqliteSchema(db, options) {
 }
 /** The names of every table the schema creates (for tests/introspection). */
 export const SQLITE_SCHEMA_TABLES = [
+    "storage_migration_archive",
     "plugin_intents",
     "plugin_validations",
     "local_resources",
@@ -1558,7 +1731,6 @@ export const SQLITE_SCHEMA_TABLES = [
     "managed_workspaces",
     "id_sequences",
     "coordination_locks",
-    "integration_queue",
     "durable_jobs",
     "outbox",
     "mailboxes",