@zq-silk/yui 0.15.12 → 0.16.0

package/dist/storage/migrations/currentRuntimeContract.js

@@ -0,0 +1,228 @@
+import { readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp } from "../../domain/validation.js";
+import { readHistoricalVerificationPlan } from "./verificationPlanV1.js";
+/** Immutable audit only: no current executor or cache lookup reads this table.
+ * Raw payloads and binary logs survive retiring their executable contracts. */
+export const CURRENT_RUNTIME_CONTRACT_SQL = `
+CREATE TABLE storage_migration_archive (
+  migration_version INTEGER NOT NULL,
+  family TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  content BLOB,
+  PRIMARY KEY (migration_version, family, record_key)
+);
+`;
+/** Read-only blockers, shared by preflight and the actual 34→35 transaction.
+ * An old admitted execution/physical owner must settle through its original
+ * contract. Neither an upgrade nor a directory name proves it is safe to drop. */
+export function preflightCurrentRuntimeContract(db) {
+    const gate = db.prepare(`SELECT task_id,integration_id FROM integration_attempts
+    WHERE status NOT IN ('committed','superseded','failed')
+      AND json_type(payload,'$.gatePlanDigest') IS NOT NULL LIMIT 1`)
+        .get();
+    if (gate)
+        throw new Error(`Current verification cutover requires the admitted gate to settle: ${gate.task_id}/${gate.integration_id}. Continue or abort it with the old release.`);
+    const owner = db.prepare(`SELECT process_key FROM session_owners
+    WHERE json_extract(payload,'$.providerRoot.attribution')='launch-env' LIMIT 1`)
+        .get();
+    if (owner)
+        throw new Error(`Retired Session owner attribution requires explicit old-release reconciliation: ${owner.process_key}. Preserve its process evidence; no owner was rewritten.`);
+    if (db.name !== ":memory:" && db.name !== "") {
+        const directory = join(dirname(db.name), "runtime", "session-owners");
+        let files;
+        try {
+            files = readdirSync(directory).filter(name => name.endsWith(".json"));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            files = [];
+        }
+        if (files.length)
+            throw new Error(`Retired file Session owners remain at ${directory}. Inspect and release their exact resources with the old release, then archive the files outside the active Home before upgrading.`);
+    }
+    for (const row of historicalIntegrations(db)) {
+        const value = JSON.parse(row.payload);
+        if (!["committed", "superseded", "failed"].includes(value.status)) {
+            throw new Error(`Historical Integration must be explicitly settled before retirement: ${row.task_id}/${row.integration_id}.`);
+        }
+        const workspace = db.prepare(`SELECT 1 FROM managed_workspaces WHERE task_id=?
+      AND json_extract(payload,'$.owner.integrationAttemptId')=? LIMIT 1`).get(row.task_id, row.integration_id);
+        const job = db.prepare(`SELECT 1 FROM durable_jobs WHERE task_id=?
+      AND json_extract(payload,'$.owner.integrationAttemptId')=?
+      AND (status IN ('queued','running') OR (status='unknown-needs-attention'
+        AND json_type(payload,'$.acknowledgedAt') IS NULL)) LIMIT 1`).get(row.task_id, row.integration_id);
+        const adoption = db.prepare(`SELECT 1 FROM events WHERE task_id=?
+      AND type='publication.candidate-adopted'
+      AND json_extract(payload,'$.payload.integrationId')=? LIMIT 1`).get(row.task_id, row.integration_id);
+        if (workspace || job || adoption) {
+            throw new Error(`Historical Integration still has execution or delivery references: ${row.task_id}/${row.integration_id}. Preserve the Home and resolve/export its original evidence before upgrading.`);
+        }
+    }
+}
+/** Frozen v34 contract retirement. Existing migration definitions are unchanged.
+ * Only active verification configuration changes; old proof is never relabelled
+ * as current success. Historical Integration bytes become ordinary Task Events. */
+export function migrateCurrentRuntimeContract(db) {
+    preflightCurrentRuntimeContract(db);
+    const archive = db.prepare(`INSERT INTO storage_migration_archive
+    (migration_version,family,record_key,payload,content) VALUES(35,?,?,?,?)`);
+    for (const row of db.prepare("SELECT id,payload FROM projects").all()) {
+        const project = JSON.parse(row.payload);
+        let changed = false;
+        let plans = 0;
+        const knowledge = project.knowledge.map((entry) => {
+            if (entry.status !== "active")
+                return entry;
+            let value;
+            try {
+                value = JSON.parse(entry.body);
+            }
+            catch {
+                return entry;
+            }
+            if (!value || typeof value !== "object" || value.kind !== "verification-plan")
+                return entry;
+            if (++plans > 1 || value.schemaVersion !== 1 || Object.hasOwn(value, "mode")) {
+                throw new Error(`Invalid v34 verification configuration: ${row.id}. Preserve it for diagnosis.`);
+            }
+            readHistoricalVerificationPlan(value);
+            const { l1: _retired, ...current } = value;
+            changed = true;
+            return { ...entry, body: JSON.stringify({ ...current, schemaVersion: 2 }) };
+        });
+        if (changed) {
+            archive.run("project", row.id, row.payload, null);
+            db.prepare("UPDATE projects SET payload=? WHERE id=?").run(JSON.stringify({ ...project, knowledge }), row.id);
+        }
+    }
+    const artifacts = db.prepare("SELECT key,project_id,payload FROM gate_artifacts WHERE level='L1'")
+        .all();
+    for (const row of artifacts) {
+        const value = JSON.parse(row.payload);
+        if (value.schemaVersion !== 1 || value.level !== "L1" || value.key !== row.key
+            || value.projectId !== row.project_id || !/^[a-f0-9]{64}$/.test(row.key)
+            || !["complete", "incomplete"].includes(value.status)
+            || !["unknown", "succeeded", "failed"].includes(value.outcome)
+            || (value.status === "incomplete") !== (value.outcome === "unknown")
+            || !Array.isArray(value.steps)) {
+            throw new Error(`Invalid retired L1 evidence: ${row.key}. Preserve it for diagnosis.`);
+        }
+        validateRetiredGate(value);
+        archive.run("gate-artifact", row.key, row.payload, null);
+        const logs = db.prepare("SELECT step_name,log_content,log_digest,log_bytes FROM gate_artifact_logs WHERE artifact_key=?")
+            .all(row.key);
+        for (const { log_content, ...metadata } of logs) {
+            if (metadata.log_bytes !== log_content.length
+                || metadata.log_digest !== createHash("sha256").update(log_content).digest("hex")) {
+                throw new Error(`Corrupted retired L1 log: ${row.key}/${metadata.step_name}. Preserve it for diagnosis.`);
+            }
+            archive.run("gate-artifact-log", JSON.stringify([row.key, metadata.step_name]), JSON.stringify(metadata), log_content);
+        }
+        db.prepare("DELETE FROM gate_artifact_logs WHERE artifact_key=?").run(row.key);
+        db.prepare("DELETE FROM gate_artifacts WHERE key=?").run(row.key);
+    }
+    const at = new Date().toISOString();
+    for (const row of historicalIntegrations(db)) {
+        const value = JSON.parse(row.payload);
+        if (value.schemaVersion !== 6 || value.taskId !== row.task_id || value.id !== row.integration_id
+            || !/^integration-[1-9][0-9]*$/.test(value.id)
+            || !Array.isArray(value.source.changeSetIds) || value.source.changeSetIds.length === 0
+            || value.source.changeSetIds.some((id) => typeof id !== "string" || !/^change-set-[1-9][0-9]*$/.test(id))
+            || new Set(value.source.changeSetIds).size !== value.source.changeSetIds.length
+            || !Array.isArray(value.checkCommands) || value.checkCommands.some((command) => !text(command))
+            || typeof value.rerunChecks !== "boolean" || !text(value.projectId) || !text(value.targetRef)
+            || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value.beforeCommit)
+            || !Number.isFinite(Date.parse(value.createdAt)) || !Number.isFinite(Date.parse(value.updatedAt))
+            || !Number.isFinite(Date.parse(value.endedAt))
+            || (value.status === "committed" && (value.afterCommit !== value.candidateCommit
+                || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(value.afterCommit) || !text(value.summary)))) {
+            throw new Error(`Invalid historical Integration: ${row.task_id}/${row.integration_id}. Preserve it for diagnosis.`);
+        }
+        const sequence = db.prepare(`SELECT max(
+      coalesce((SELECT high_water FROM id_sequences WHERE task_id=? AND kind='event'),0),
+      coalesce((SELECT max(CAST(substr(event_id,7) AS INTEGER)) FROM events WHERE task_id=?),0)
+    ) AS value`).get(row.task_id, row.task_id).value + 1;
+        const event = { schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "integration.source-retired", createdAt: at,
+            payload: { integrationId: row.integration_id, record: row.payload, disposition: "audit-only" } };
+        db.prepare("INSERT INTO events(task_id,event_id,type,occurred_at,payload) VALUES(?,?,?,?,?)")
+            .run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'event',?)
+      ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`).run(row.task_id, sequence);
+        // Preserve the retired identity's high-water mark so it cannot be reused.
+        const integrationSequence = Number(row.integration_id.slice("integration-".length));
+        if (!Number.isSafeInteger(integrationSequence) || integrationSequence < 1)
+            throw new Error("Invalid retired Integration identity.");
+        db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'integrationAttempt',?)
+      ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`).run(row.task_id, integrationSequence);
+        db.prepare("DELETE FROM integration_attempts WHERE task_id=? AND integration_id=?").run(row.task_id, row.integration_id);
+    }
+}
+function historicalIntegrations(db) {
+    return db.prepare(`SELECT task_id,integration_id,payload FROM integration_attempts
+    WHERE json_extract(payload,'$.source.kind')='historical-change-sets' ORDER BY task_id,integration_id`)
+        .all();
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}
+/** The retired v34 artifact shape, frozen here rather than accepted by current
+ * GateArtifact readers. It is archived verbatim, never made into an L2 proof. */
+function validateRetiredGate(value) {
+    requireIdentity(value.projectId, "Retired GateArtifact projectId");
+    for (const field of ["key", "planDigest", "toolchainDigest"]) {
+        if (typeof value[field] !== "string" || !/^[a-f0-9]{64}$/.test(value[field])) {
+            throw new Error(`Invalid retired GateArtifact ${field}.`);
+        }
+    }
+    const commit = (sha) => {
+        if (typeof sha !== "string" || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(sha))
+            throw new Error("Invalid retired gate commit.");
+    };
+    commit(value.commit);
+    if (value.boundary !== undefined) {
+        requireText(value.boundary.targetRef, "Retired gate target");
+        commit(value.boundary.baseHead);
+    }
+    const identity = { projectId: value.projectId, level: value.level, commit: value.commit,
+        planDigest: value.planDigest, toolchainDigest: value.toolchainDigest,
+        ...(value.boundary === undefined ? {} : { boundary: value.boundary }) };
+    if (createHash("sha256").update(canonical(identity)).digest("hex") !== value.key) {
+        throw new Error("Retired gate key does not match its original identity.");
+    }
+    const names = new Set();
+    for (const step of value.steps) {
+        requireIdentity(step.name, "Retired gate step name");
+        if (names.has(step.name))
+            throw new Error("Duplicate retired gate step.");
+        names.add(step.name);
+        requireText(step.command, "Retired gate command");
+        if (!["passed", "failed", "skipped"].includes(step.outcome))
+            throw new Error("Invalid retired gate step outcome.");
+        requirePositiveInteger(step.durationMs + 1, "Retired gate duration");
+        requireText(step.logPath, "Retired gate log path");
+        if (step.logPath.startsWith("/") || step.logPath.includes("..")
+            || typeof step.logDigest !== "string" || !/^[a-f0-9]{64}$/.test(step.logDigest)
+            || !Number.isSafeInteger(step.logBytes) || step.logBytes < 0)
+            throw new Error("Invalid retired gate log metadata.");
+    }
+    if (Object.hasOwn(value, "potentialReuseCount"))
+        throw new Error("Invalid v34 retired gate counter.");
+    requirePositiveInteger(value.reuseCount + 1, "Retired gate reuse count");
+    requireTimestamp(value.createdAt, "Retired gate createdAt");
+    requireTimestamp(value.lastUsedAt, "Retired gate lastUsedAt");
+    if (value.completedAt !== undefined)
+        requireTimestamp(value.completedAt, "Retired gate completedAt");
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object")
+        return `{${Object.keys(value).sort()
+            .map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+    return JSON.stringify(value);
+}

package/dist/storage/migrations/historicalVerificationPlan.js

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+/** Frozen pre-fix encoding used only to recognize valid historical Jobs.
+ * Never use corrected execution semantics to reinterpret a released migration,
+ * and never use these helpers to create executable work or reusable evidence.
+ */
+export function historicalVerificationPlanDigest(plan) {
+    return createHash("sha256").update(JSON.stringify(canonicalize({
+        id: plan.id, version: plan.version, toolchain: plan.toolchain,
+        bootstrap: plan.bootstrap, l1: plan.l1, l2: plan.l2,
+        ...(plan.l3 === undefined ? {} : { l3: plan.l3 })
+    }))).digest("hex");
+}
+export function historicalGateJobSteps(plan) {
+    const encode = (step, name) => ({
+        name,
+        command: step.shell === true ? step.argv.join(" ") : step.argv.map(value => /^[A-Za-z0-9_./:=@+-]+$/u.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`).join(" "),
+        argv: step.argv,
+        ...(step.cwd === undefined ? {} : { cwd: step.cwd }),
+        ...(step.env === undefined ? {} : { env: step.env })
+    });
+    return [
+        ...plan.bootstrap.map((step, index) => encode(step, `bootstrap-${index + 1}`)),
+        ...plan.l2.steps.map((step, index) => encode(step, `gate-${index + 1}`))
+    ];
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+            .map(([key, entry]) => [key, canonicalize(entry)]));
+    }
+    return value;
+}

package/dist/storage/migrations/integrationContinuation.js

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { durableJobIdempotencyKey } from "../../job/durableJob.js";
-import { resolveProjectVerificationPlan, verificationPlanDigest, planBootstrapJobSteps, planL2JobSteps } from "../../verification/verificationPlan.js";
+import { resolveHistoricalVerificationPlan } from "./verificationPlanV1.js";
+import { historicalGateJobSteps, historicalVerificationPlanDigest } from "./historicalVerificationPlan.js";
 /** Classify only known v19 Git conflicts. Manual strategy and CAS blockers
  * keep their meaning. Never synthesize candidate/Job success or edit history. */
 export function migrateIntegrationContinuation(db) {
@@ -74,10 +75,10 @@ function migrateBoundFastForward(db, attempt) {
         name: `check-${index + 1}`, command, timeoutMs: 30 * 60_000
     }));
     if (attempt.gatePlanDigest !== undefined) {
-        const plan = resolveProjectVerificationPlan(project);
-        if (plan === undefined || verificationPlanDigest(plan) !== attempt.gatePlanDigest)
+        const plan = resolveHistoricalVerificationPlan(project);
+        if (plan === undefined || historicalVerificationPlanDigest(plan) !== attempt.gatePlanDigest)
             return;
-        steps = [...planBootstrapJobSteps(plan), ...planL2JobSteps(plan)].map(step => ({
+        steps = historicalGateJobSteps(plan).map(step => ({
             ...step, timeoutMs: 30 * 60_000
         }));
     }

package/dist/storage/migrations/narrowAgentFailureContext.js

@@ -0,0 +1,65 @@
+import { isAbsolute } from "node:path";
+/** Frozen v36 projection. Execution/Review/protocol data remains in audit only;
+ * a metadata query must not require those unrelated contracts to stay current. */
+export function migrateNarrowAgentFailureContext(db) {
+    const rows = db.prepare("SELECT task_id,event_id,payload FROM events WHERE type='runtime.agent-error'").all();
+    const archive = db.prepare(`INSERT INTO storage_migration_archive
+    (migration_version,family,record_key,payload,content) VALUES(37,?,?,?,NULL)`);
+    const update = db.prepare("UPDATE events SET payload=? WHERE task_id=? AND event_id=?");
+    for (const row of rows) {
+        const event = JSON.parse(row.payload);
+        const raw = event?.payload?.capabilityContext;
+        if (typeof raw !== "string")
+            throw new Error(`Missing v36 failure context: ${row.task_id}/${row.event_id}.`);
+        const context = JSON.parse(raw);
+        const key = JSON.stringify([row.task_id, row.event_id]);
+        const emptyIdentities = {};
+        for (const field of ["runId", "nativeSessionId", "nativeTurnId"]) {
+            if (event.payload[field] !== "")
+                continue;
+            emptyIdentities[field] = "";
+            delete event.payload[field];
+        }
+        if (Object.keys(emptyIdentities).length) {
+            archive.run("agent-error-empty-identities", key, JSON.stringify(emptyIdentities));
+        }
+        if (context?.status === "unavailable" && text(context.reason)) {
+            if (Object.keys(emptyIdentities).length)
+                update.run(JSON.stringify(event), row.task_id, row.event_id);
+            continue;
+        }
+        const old = context?.effective;
+        if (context?.status !== "recorded" || !/^[a-f0-9]{64}$/.test(context.agentFingerprint)
+            || old?.schemaVersion !== 4 || !text(old.agentId)
+            || !["codex", "claude", "acp"].includes(old.adapterId)
+            || !text(old.workspace?.root) || !isAbsolute(old.workspace.root)) {
+            throw new Error(`Invalid v36 failure context: ${row.task_id}/${row.event_id}.`);
+        }
+        const config = { adapterId: old.adapterId };
+        for (const key of ["model", "effort", ...(old.adapterId === "codex" ? ["profile"] : []),
+            ...(old.adapterId === "claude" ? ["settingsFile"] : [])]) {
+            if (old[key] === undefined)
+                continue;
+            if (!text(old[key]) || key === "settingsFile" && !isAbsolute(old[key])) {
+                throw new Error(`Invalid v36 failure ${key}: ${row.task_id}/${row.event_id}.`);
+            }
+            config[key] = old[key];
+        }
+        if (old.adapterId === "claude" && old.settingsSources !== undefined) {
+            if (!Array.isArray(old.settingsSources) || old.settingsSources.some((source) => !text(source))
+                || new Set(old.settingsSources).size !== old.settingsSources.length) {
+                throw new Error(`Invalid v36 settings sources: ${row.task_id}/${row.event_id}.`);
+            }
+            config.settingsSources = old.settingsSources;
+        }
+        archive.run("agent-error-context", key, raw);
+        event.payload.capabilityContext = JSON.stringify({
+            status: "recorded", agentId: old.agentId, cwd: old.workspace.root, config,
+            agentFingerprint: context.agentFingerprint
+        });
+        update.run(JSON.stringify(event), row.task_id, row.event_id);
+    }
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}

package/dist/storage/migrations/notificationOnlyWakes.js

@@ -0,0 +1,74 @@
+function runLinkedWakes(db) {
+    return db.prepare(`SELECT task_id, wake_id, seq, turn_id, payload FROM task_wakes
+    WHERE turn_id IS NOT NULL OR json_type(payload, '$.runId') IS NOT NULL
+    ORDER BY task_id, seq`).all();
+}
+/** Read only stable SQL identities, including prefixes before payload key renames. */
+export function preflightNotificationOnlyWakes(db) {
+    assertQuiescent(db, runLinkedWakes(db));
+}
+/** Frozen 29→30 transform. Old execution-linked wakes become audit events;
+ * accepted/pending notifications keep their exact identity and delivery state. */
+export function migrateNotificationOnlyWakes(db) {
+    const rows = runLinkedWakes(db);
+    // Check every retiring reference before changing any data. The outer
+    // migration transaction also rolls back on any later failure.
+    for (const row of rows) {
+        const value = JSON.parse(row.payload);
+        if (typeof value.runId !== "string" || value.runId !== row.turn_id) {
+            throw new Error(`Run-linked wake identity is inconsistent: ${row.task_id}/${row.wake_id}.`);
+        }
+    }
+    assertQuiescent(db, rows);
+    const counters = new Map();
+    const readCounter = db.prepare(`SELECT max(
+    coalesce((SELECT high_water FROM id_sequences WHERE task_id = ? AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events WHERE task_id = ?), 0)
+  ) AS value`);
+    const saveCounter = db.prepare(`INSERT INTO id_sequences(task_id, kind, high_water) VALUES (?, ?, ?)
+    ON CONFLICT(task_id, kind) DO UPDATE SET high_water = max(high_water, excluded.high_water)`);
+    const saveEvent = db.prepare("INSERT INTO events(task_id, event_id, type, occurred_at, payload) VALUES (?, ?, ?, ?, ?)");
+    const removeWake = db.prepare("DELETE FROM task_wakes WHERE task_id = ? AND wake_id = ?");
+    const at = new Date().toISOString();
+    for (const row of rows) {
+        const sequence = (counters.get(row.task_id)
+            ?? readCounter.get(row.task_id, row.task_id).value) + 1;
+        counters.set(row.task_id, sequence);
+        const event = {
+            schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "wake.run-link-retired", createdAt: at,
+            payload: { wakeId: row.wake_id, runId: row.turn_id,
+                record: row.payload, disposition: "retired-without-replay" }
+        };
+        saveEvent.run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        saveCounter.run(row.task_id, "event", sequence);
+        saveCounter.run(row.task_id, "taskWake", row.seq);
+        removeWake.run(row.task_id, row.wake_id);
+    }
+    db.exec(`
+    ALTER TABLE task_wakes DROP COLUMN turn_id;
+    UPDATE task_wakes SET payload = json_set(payload, '$.schemaVersion', 2);
+    UPDATE global_role_session_sets
+      SET payload = json_set(payload, '$.providerBinding', json('null'))
+      WHERE json_type(payload, '$.providerBinding') IS NULL;
+  `);
+}
+function assertQuiescent(db, rows) {
+    const activeRun = db.prepare("SELECT 1 FROM turns WHERE task_id = ? AND turn_id = ? AND status = 'active'");
+    const claimedWake = db.prepare(`SELECT 1 FROM mailboxes WHERE task_id = ?
+    AND json_extract(processing, '$.owner') = ? LIMIT 1`);
+    const pendingInput = db.prepare(`SELECT 1 FROM role_session_sets WHERE task_id = ? AND (
+    (json_extract(payload, '$.providerBinding.run.status') IN ('submitting', 'accepted', 'delivery-unknown')
+      AND (json_extract(payload, '$.providerBinding.run.runId') = ?
+        OR json_extract(payload, '$.providerBinding.run.input.wakeId') = ?))
+    OR (json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight')
+      AND (json_extract(payload, '$.providerBinding.retry.input.runId') = ?
+        OR json_extract(payload, '$.providerBinding.retry.input.wakeId') = ?))) LIMIT 1`);
+    for (const row of rows) {
+        if (activeRun.get(row.task_id, row.turn_id)
+            || claimedWake.get(row.task_id, `leader-notification:${row.wake_id}`)
+            || pendingInput.get(row.task_id, row.turn_id, row.wake_id, row.turn_id, row.wake_id)) {
+            throw new Error(`Run-linked wake still owns unsettled input: ${row.task_id}/${row.wake_id}, Run ${row.turn_id}. Settle or stop that exact execution before upgrading.`);
+        }
+    }
+}

package/dist/storage/migrations/verificationPlanV1.js

@@ -0,0 +1,162 @@
+export function readHistoricalVerificationPlan(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error("VerificationPlan must be an object.");
+    }
+    const record = raw;
+    if (record.kind !== "verification-plan")
+        throw new Error('VerificationPlan kind must be "verification-plan".');
+    if ((record.schemaVersion ?? 1) !== 1)
+        throw new Error("VerificationPlan schemaVersion must be 1.");
+    const mode = record.mode ?? "record";
+    if (mode !== "record" && mode !== "reuse" && mode !== "enforce") {
+        throw new Error(`VerificationPlan mode is invalid: ${String(mode)}.`);
+    }
+    const plan = {
+        schemaVersion: 1, kind: "verification-plan",
+        id: identity(record.id, "VerificationPlan id"),
+        version: text(record.version, "VerificationPlan version"),
+        mode,
+        toolchain: toolchain(record.toolchain),
+        bootstrap: steps(record.bootstrap, "bootstrap"),
+        l1: { categories: categories(record.l1) },
+        l2: { steps: steps(record.l2?.steps, "l2") },
+        ...(record.l3 === undefined ? {} : {
+            l3: { steps: steps(record.l3?.steps, "l3") }
+        }),
+        ...(record.excludedRealResourceChecks === undefined ? {} : {
+            excludedRealResourceChecks: textList(record.excludedRealResourceChecks, "VerificationPlan excludedRealResourceChecks")
+        }),
+        ...(record.artifactTtlDays === undefined ? {} : {
+            artifactTtlDays: positive(Number(record.artifactTtlDays), "VerificationPlan artifactTtlDays")
+        })
+    };
+    if (plan.l2.steps.length === 0)
+        throw new Error("VerificationPlan l2 requires at least one step.");
+    return plan;
+}
+export function resolveHistoricalVerificationPlan(project) {
+    let found;
+    for (const entry of project.knowledge) {
+        if (entry.status !== "active")
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(entry.body);
+        }
+        catch {
+            continue;
+        }
+        if (typeof parsed !== "object" || parsed === null
+            || parsed.kind !== "verification-plan")
+            continue;
+        const plan = readHistoricalVerificationPlan(parsed);
+        if (found !== undefined)
+            throw new Error(`Project ${project.id} declares multiple VerificationPlans; only one is allowed.`);
+        found = plan;
+    }
+    return found;
+}
+function toolchain(raw) {
+    if (raw === undefined)
+        return Object.freeze({});
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error("VerificationPlan toolchain must be an object.");
+    const record = raw;
+    return {
+        ...(record.node === undefined ? {} : { node: text(record.node, "VerificationPlan toolchain node") }),
+        ...(record.npm === undefined ? {} : { npm: text(record.npm, "VerificationPlan toolchain npm") }),
+        ...(record.platform === undefined ? {} : { platform: text(record.platform, "VerificationPlan toolchain platform") })
+    };
+}
+function steps(raw, label) {
+    if (!Array.isArray(raw))
+        throw new Error(`VerificationPlan ${label} steps must be an array.`);
+    const names = new Set();
+    return Object.freeze(raw.map(entry => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            throw new Error(`VerificationPlan ${label} step must be an object.`);
+        const record = entry;
+        const name = identity(record.name, `VerificationPlan ${label} step name`);
+        if (names.has(name))
+            throw new Error(`VerificationPlan ${label} step names must be unique: ${name}.`);
+        names.add(name);
+        if (!Array.isArray(record.argv) || record.argv.length === 0) {
+            throw new Error(`VerificationPlan ${label} step ${name} requires a non-empty argv.`);
+        }
+        const step = {
+            name, argv: Object.freeze(record.argv.map(value => text(value, `VerificationPlan ${label} step ${name} argv`))),
+            ...(record.cwd === undefined ? {} : { cwd: text(record.cwd, `VerificationPlan ${label} step ${name} cwd`) }),
+            ...(record.env === undefined ? {} : { env: stepEnv(record.env, `${label} step ${name}`) }),
+            ...(record.shell === undefined ? {} : { shell: record.shell === true })
+        };
+        if (step.cwd?.startsWith("/"))
+            throw new Error(`VerificationPlan ${label} step ${name} cwd must be workspace-relative.`);
+        return step;
+    }));
+}
+function stepEnv(raw, label) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error(`VerificationPlan ${label} env must be a map.`);
+    const env = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value !== "string")
+            throw new Error(`VerificationPlan ${label} env values must be strings: ${key}.`);
+        env[identity(key, `VerificationPlan ${label} env key`)] = value;
+    }
+    return Object.freeze(env);
+}
+function categories(raw) {
+    if (raw === undefined)
+        return Object.freeze([]);
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        throw new Error("VerificationPlan l1 must be an object.");
+    const values = raw.categories;
+    if (!Array.isArray(values))
+        throw new Error("VerificationPlan l1 categories must be an array.");
+    const ids = new Set();
+    return Object.freeze(values.map(entry => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            throw new Error("VerificationPlan l1 category must be an object.");
+        const record = entry;
+        const id = identity(record.id, "VerificationPlan l1 category id");
+        if (ids.has(id))
+            throw new Error(`VerificationPlan l1 category ids must be unique: ${id}.`);
+        ids.add(id);
+        return Object.freeze({
+            id, paths: textList(record.paths, `VerificationPlan l1 category ${id} paths`),
+            checks: steps(record.checks, `l1 ${id}`)
+        });
+    }));
+}
+function textList(raw, label) {
+    if (!Array.isArray(raw))
+        throw new Error(`${label} must be an array.`);
+    const seen = new Set();
+    return Object.freeze(raw.map(value => {
+        const next = text(value, label);
+        if (seen.has(next))
+            throw new Error(`${label} must be unique: ${next}.`);
+        seen.add(next);
+        return next;
+    }));
+}
+function text(value, label) {
+    if (typeof value !== "string" || value.includes("\0"))
+        throw new Error(`${label} is invalid.`);
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}
+function identity(value, label) {
+    const normalized = text(value, label);
+    if ([".", "..", "__proto__", "prototype", "constructor"].includes(normalized) || /[\/\\\0]/u.test(normalized)) {
+        throw new Error(`${label} is invalid.`);
+    }
+    return normalized;
+}
+function positive(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error(`${label} must be a positive integer.`);
+    return value;
+}