@zq-silk/yui 0.15.12 → 0.16.0

package/dist/storage/storageSchema.js

@@ -16,23 +16,11 @@ export class StorageSchemaError extends Error {
 /**
  * Inspect the one authoritative SQLite migration head without changing it.
  *
- * `schema.json` and `state.json` are recognized only to prevent setup from
- * overwriting an old Home whose SQLite authority is missing. They are not
- * version authorities for current Homes.
+ * Extra files never override the SQLite authority. A missing database in a
+ * non-empty Home is unverified, not permission to initialize over its evidence.
  */
 export function inspectStorageSchema(rootDir) {
     const databasePath = join(rootDir, CURRENT_DATABASE_FILENAME);
-    const hasPreBaselineEvidence = existsSync(join(rootDir, "schema.json")) || existsSync(join(rootDir, "state.json"));
-    if (hasPreBaselineEvidence) {
-        return {
-            status: "unsupported",
-            direction: "older",
-            currentVersion: 0,
-            latestVersion: CURRENT_STORAGE_VERSION,
-            minimumSupportedVersion: MIN_SUPPORTED_STORAGE_VERSION,
-            databasePath
-        };
-    }
     if (!existsSync(databasePath)) {
         if (existsSync(rootDir)) {
             try {

package/dist/storage/storageVersions.js

@@ -13,4 +13,4 @@
  * intermediate Yui releases.
  */
 export const MIN_SUPPORTED_STORAGE_VERSION = 1;
-export const CURRENT_STORAGE_VERSION = 27;
+export const CURRENT_STORAGE_VERSION = 37;

package/dist/storage/storeRpc.js

@@ -8,7 +8,8 @@
  *
  *   - {@link AsyncTaskStore} ........ the async counterpart to `TaskStore`
  *     (design §6): every method returns a promise; the worker owns the
- *     `SqliteTaskStore` connection, the main thread never touches the db.
+ *     worker-side connection. The Controller's separate synchronous scheduler
+ *     connection is not routed through this interface.
  *   - {@link AsyncTaskStoreClient} .. the client: serializes requests, applies
  *     the storage idempotency/dialect rules on top of the shared bounded RPC
  *     (outbox §5.4, `AbortSignal` cancellation §3.1, restart + replay §3.1).
@@ -16,8 +17,8 @@
  *     `transactionAsync` ships an ordered batch that the worker runs inside one
  *     `BEGIN IMMEDIATE … COMMIT` (§3.2).
  *
- * SQLite is the only product Store. `YUI_STORE_WORKER` controls whether its
- * connection lives in a Worker Thread; it does not select another authority.
+ * SQLite is the only product Store. `YUI_STORE_WORKER` selects the observer
+ * execution boundary; it does not select another authority.
  */
 import { BoundedRpcClient, nextRequestId } from "../core/boundedRpc.js";
 import { StorageCancelledError, StorageConflictError, StorageRecordError } from "./taskStore.js";
@@ -51,6 +52,12 @@ const READ_ONLY_STORE_METHODS = new Set([
     "getTask",
     "readNextActionFacts",
     "readCompletionReadinessFacts",
+    "queryContextRecords",
+    "latestEventSequence",
+    "listEventsByType",
+    "listTaskRunWorkspaceBases",
+    "contextInputReferences",
+    "listActiveRuns",
     "listActiveTaskIds",
     "listPlanningDraftTaskIds",
     "listPendingActivationRequestTaskIds",
@@ -168,12 +175,8 @@ function storageProtocol(home, options) {
  * RPCs) plus {@link transactionAsync}, {@link invokeObserver}, and {@link close}.
  */
 export class AsyncTaskStoreClient {
-    #home;
-    #options;
     #rpc;
     constructor(home, options = {}) {
-        this.#home = home;
-        this.#options = options;
         this.#rpc = new BoundedRpcClient(storageProtocol(home, options), {
             maxInFlight: options.maxInFlight,
             maxQueue: options.maxQueue,
@@ -218,6 +221,11 @@ export class AsyncTaskStoreClient {
     close() {
         return this.#rpc.close();
     }
+    /** Best-effort diagnostic batch on this worker, without a Task outbox entry. */
+    async flushTelemetry(entries, runCap) {
+        const requestId = nextRequestId();
+        await this.#rpc.send(requestId, { kind: "telemetry", requestId, entries, runCap });
+    }
     /** Currently in-flight requests (metrics/tests). */
     get inFlight() {
         return this.#rpc.inFlight;

package/dist/storage/taskStore.js

@@ -2,12 +2,12 @@ import { lstatSync, mkdirSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
+import { resolveTimeZone } from "../config/timeZone.js";
+import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
 import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
 import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
-import { validatePublicationReference } from "../task/publicationReference.js";
-import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveLeaderNextActionMode, resolveLeaderSemanticBudgetRuns, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours, resolveRuntimeHealth, resolveTelemetryEnabled, resolveTelemetryRunCap, resolveTelemetryTerminalKeep, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
-import { resolveTimeZone } from "../output/timePresentation.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
+import { validatePublicationReference } from "../task/publicationReference.js";
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
 export const CURRENT_CONFIG_SCHEMA_VERSION = 6;
 /** Current SQLite payload-family versions owned by this storage boundary. */
@@ -151,12 +151,10 @@ export function validateYuiConfig(config) {
             "resourcesGcMode",
             "resourcesGcAutoQuarantine",
             "review",
-            "leaderNextActionMode",
             "runtimeHealth",
             "controllerTaskConcurrency",
             "agentLaunchInactivityTimeoutSeconds",
             "deliveryTimeoutSeconds",
-            "leaderSemanticBudgetRuns",
             "resourcesQuarantineTtlHours",
             "tmuxBin",
             "tmuxHistoryLimit",
@@ -176,7 +174,6 @@ export function validateYuiConfig(config) {
         resolveTimeZone(config.timeZone);
         if (config.review !== undefined)
             validateReviewConfig(config.review);
-        resolveLeaderNextActionMode(config.leaderNextActionMode);
         resolveResourcesGcMode(config.resourcesGcMode);
         resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
         resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours);
@@ -184,7 +181,6 @@ export function validateYuiConfig(config) {
         resolveControllerTaskConcurrency(config.controllerTaskConcurrency);
         resolveAgentLaunchInactivityTimeoutSeconds(config.agentLaunchInactivityTimeoutSeconds);
         resolveDeliveryTimeoutSeconds(config.deliveryTimeoutSeconds);
-        resolveLeaderSemanticBudgetRuns(config.leaderSemanticBudgetRuns);
         resolveTmuxBin(config.tmuxBin);
         resolveTmuxHistoryLimit(config.tmuxHistoryLimit);
         resolveTelemetryEnabled(config.telemetryEnabled);

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -4,16 +4,14 @@ import Database from "better-sqlite3";
 import { inspectAgentHostCompatibility, describeAgentHostUpgradeBlockers } from "../../runtime/agentHostCompatibility.js";
 import { RUNTIME_OBSERVATION_TASK_EVENT, createRuntimeObservation } from "../../runtime/runtimeObservation.js";
 import { RUNTIME_PROCESS_EXIT_TASK_EVENT, validateRuntimeProcessExitObservation } from "../../runtime/processExitObservation.js";
-import { validateAgentProfile } from "../../profile/agentProfile.js";
-import { validateRoleSessionSet } from "../../executor/agentExecutor.js";
-import { validateReviewRound } from "../../review/reviewRound.js";
-import { validateRun } from "../../agentRun/agentRun.js";
-import { validateDurableJob } from "../../job/durableJob.js";
-import { validateWorkItem } from "../../workItem/workItem.js";
 import { SqliteTaskStore } from "../sqliteStore.js";
 import { storageBackupRoot } from "../homeLayout.js";
 import { preflightUnifyHomeLayout } from "../migrations/unifyHomeLayout.js";
 import { preflightCollapseWorktreeLayout } from "../migrations/collapseWorktreeLayout.js";
+import { preflightNotificationOnlyWakes } from "../migrations/notificationOnlyWakes.js";
+import { preflightVerificationPolicy } from "../migrations/verificationPolicy.js";
+import { preflightCurrentInputContract } from "../migrations/currentInputContract.js";
+import { preflightCurrentRuntimeContract } from "../migrations/currentRuntimeContract.js";
 import { migrateSqliteSchema, storageMigrationPlan } from "../sqliteSchema.js";
 import { CURRENT_DATABASE_FILENAME, inspectStorageSchema } from "../storageSchema.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "../storageVersions.js";
@@ -153,7 +151,6 @@ export async function runStorageUpgrade(options) {
             database.close();
         }
         validateCurrentStore(options.home);
-        rmSync(join(options.home, "schema.json"), { force: true });
     }
     catch (error) {
         const restoration = migrationCommitted
@@ -206,29 +203,8 @@ export async function runStorageUpgrade(options) {
 function validateCurrentStore(home) {
     const store = new SqliteTaskStore(home);
     try {
-        store.getConfig();
-        for (const profile of store.listAgentProfiles())
-            validateAgentProfile(profile);
-        for (const sessions of store.listGlobalRoleSessionSets()) {
-            validateRoleSessionSet(sessions);
-        }
-        for (const owner of store.listSessionOwners()) {
-            if (owner.schemaVersion !== 2 || Object.hasOwn(owner, "launchId")) {
-                throw new Error("Session owner runtime identity is invalid.");
-            }
-        }
+        store.validateCurrentRecords();
         for (const taskId of store.listTasks().map(({ id }) => id)) {
-            for (const job of store.listDurableJobs(taskId))
-                validateDurableJob(job);
-            for (const item of store.listWorkItems(taskId))
-                validateWorkItem(item);
-            for (const round of store.listReviewRounds(taskId))
-                validateReviewRound(round);
-            for (const run of store.listRuns(taskId))
-                validateRun(run);
-            for (const sessions of store.listRoleSessionSets(taskId)) {
-                validateRoleSessionSet(sessions);
-            }
             for (const event of store.listEvents(taskId)) {
                 if (event.type === RUNTIME_OBSERVATION_TASK_EVENT) {
                     createRuntimeObservation(JSON.parse(event.payload.observation ?? ""));
@@ -345,16 +321,17 @@ function blocked(classification, stage, message, action) {
     };
 }
 /**
- * Run each path-relocating data migration's READ-ONLY preflight against the
+ * Run each data migration's registered READ-ONLY preflight against the
  * current (pre-upgrade) database and, when any finds a blocker, return a
  * `blocked` result the caller surfaces before touching the Controller or the
- * Home. Returns `null` when the plan carries no path-relocating data migration,
+ * Home. Returns `null` when the plan carries no registered readiness check,
  * or when every preflight is clear.
  *
- * Both the 18->19 unify and the 19->20 collapse migrations physically relocate
+ * Both the 23->24 unify and the 24->25 collapse migrations physically relocate
  * managed worktrees and share the same blocker shape (in-flight Job, conflicting
  * relocation target). When a Home is upgraded across both in one run, their
- * blockers are aggregated so the operator sees every readiness problem at once.
+ * blockers are aggregated so the operator sees their readiness problems together.
+ * Notification retirement separately rejects unsettled execution references.
  *
  * The database is opened read-only so the checks cannot mutate the authoritative
  * store, and the handle is always closed. An unexpected failure to evaluate a
@@ -364,8 +341,11 @@ function blocked(classification, stage, message, action) {
 function preflightMigrationBlockers(home, plan, classification) {
     const relocatesUnify = plan.some((step) => step.name === "unify-home-layout");
     const relocatesCollapse = plan.some((step) => step.name === "collapse-worktree-layout");
-    // Only meaningful when the plan actually includes a path-relocating migration.
-    if (!relocatesUnify && !relocatesCollapse)
+    const retiresRunWakes = plan.some((step) => step.name === "notification-only-wakes");
+    const changesVerification = plan.some(step => step.name === "advisory-and-verification-policy");
+    const changesInput = plan.some(step => step.name === "current-input-contract");
+    const retiresRuntime = plan.some(step => step.name === "current-verification-and-owner-contract");
+    if (!relocatesUnify && !relocatesCollapse && !retiresRunWakes && !changesVerification && !changesInput && !retiresRuntime)
         return null;
     let blockers;
     try {
@@ -379,6 +359,14 @@ function preflightMigrationBlockers(home, plan, classification) {
                 blockers.push(...preflightUnifyHomeLayout(database).blockers);
             if (relocatesCollapse)
                 blockers.push(...preflightCollapseWorktreeLayout(database).blockers);
+            if (retiresRunWakes)
+                preflightNotificationOnlyWakes(database);
+            if (changesVerification)
+                preflightVerificationPolicy(database);
+            if (changesInput)
+                preflightCurrentInputContract(database);
+            if (retiresRuntime)
+                preflightCurrentRuntimeContract(database);
         }
         finally {
             database.close();
@@ -386,8 +374,8 @@ function preflightMigrationBlockers(home, plan, classification) {
     }
     catch (error) {
         return {
-            ...blocked(classification, "in-flight", `The storage migration readiness check could not be completed: ${messageOf(error)}`, "Resolve the reported problem, confirm no Job is queued or running against a managed "
-                + "workspace, then rerun the upgrade.")
+            ...blocked(classification, "in-flight", `The storage migration readiness check could not be completed: ${messageOf(error)}`, "Resolve the named execution or resource boundary, preserving original input and results. "
+                + "Confirm the relevant Runs and Jobs are settled, then rerun the upgrade.")
         };
     }
     if (blockers.length === 0)

package/dist/task/completionReadiness.js

@@ -17,18 +17,13 @@ export function pendingCompletionMessages(store, taskId) {
     const ids = new Set(refs.filter(ref => ref.type === "message" && ref.taskId === taskId).map(ref => ref.id));
     return operationalTaskRecords(store.listMessages(taskId), store.listEvents(taskId), "message")
         .filter(message => ids.has(message.id)
-        && (message.kind === "user" || message.kind === "operator") && message.wakePolicy !== "none");
+        && (message.kind === "user" || message.kind === "operator"));
 }
 const ACTIVE_JOB_STATUSES = new Set([
     "queued",
     "running",
     "unknown-needs-attention"
 ]);
-const UNRESOLVED_INTEGRATION_STATUSES = new Set([
-    "running",
-    "blocked",
-    "validating"
-]);
 const TERMINAL_REVIEW_STATUSES = new Set(["completed", "failed"]);
 const TERMINAL_LANE_STATUSES = new Set(["completed", "failed", "skipped"]);
 export function projectCompletionReadiness(facts) {
@@ -45,7 +40,7 @@ export function projectCompletionReadiness(facts) {
     }
     // A pending/running Task-final Review must be resumed or blocked first.
     for (const round of facts.reviewRounds) {
-        if ((round.scope ?? "work-item") !== "task")
+        if (round.scope !== "task")
             continue;
         if (round.status !== "pending" && round.status !== "running")
             continue;
@@ -103,11 +98,9 @@ export function projectCompletionReadiness(facts) {
             fix: `yui task integration start ${task.id} --work-item ${delivery.workItemId} --project ${delivery.projectId} --strategy <ff|cherry-pick|merge|manual>`
         });
     }
-    // Current delivery Attempts and any Attempt that may still be writing must
-    // settle. Historical blocked Attempts remain audit evidence only.
+    // Unsettled attempts must be explicitly resolved; terminal history remains
+    // evidence and is not a second delivery workflow.
     for (const integration of facts.integrations) {
-        if (!UNRESOLVED_INTEGRATION_STATUSES.has(integration.status))
-            continue;
         if (!integrationAttemptRequiresSettlement(integration))
             continue;
         blockers.push({
@@ -117,18 +110,6 @@ export function projectCompletionReadiness(facts) {
             fix: `yui task integration continue ${task.id}/${integration.id}`
         });
     }
-    // Legacy queue entries may still launch an Integration and therefore must
-    // settle even though ChangeSets are no longer delivery authority.
-    for (const entry of facts.integrationQueueEntries) {
-        if (entry.status === "committed" || entry.status === "superseded")
-            continue;
-        blockers.push({
-            code: "unsettled-integration-queue-entry",
-            ref: ref("integration-queue-entry", entry.id),
-            reason: `Integration queue entry ${entry.id} is ${entry.status}.`,
-            fix: `settle integration queue entry ${entry.id} (continue or supersede)`
-        });
-    }
     // Terminal child workspaces are cleanup advisories: Task completion is the
     // semantic delivery boundary, while archive remains the fail-closed resource
     // reclamation boundary. Missing/non-terminal ownership stays conservative.
@@ -198,7 +179,7 @@ function workspaceCompletionDisposition(facts, taskId, workspace) {
         }
         case "integration-attempt": {
             const integration = facts.integrations.find((entry) => entry.id === owner.integrationAttemptId);
-            if (integration !== undefined && UNRESOLVED_INTEGRATION_STATUSES.has(integration.status)) {
+            if (integration !== undefined && integrationAttemptRequiresSettlement(integration)) {
                 return null;
             }
             const value = {

package/dist/task/draftPlan.js

@@ -1,25 +1,4 @@
-import { RUNTIME_OBSERVATION_TASK_EVENT } from "../runtime/runtimeObservation.js";
 import { SYSTEM_LEADER_ROLE } from "../role/systemRoles.js";
-/**
- * Runtime Task-event types that are emitted with a Role but no Turn in their
- * payload. Each one is still only exempted when its `roleName` resolves to the
- * Leader — the `runtime.` prefix is never exempted, and a type absent from this
- * set keeps disqualifying the Draft.
- *
- * Turn lifecycle events are deliberately not listed: they use one generic type
- * per transition and name the Turn in their payload, so the guard resolves that
- * Turn's own purpose instead of trusting the type. Listing invented
- * `turn.planning-*` types would have exempted nothing while silently
- * disqualifying every Draft that ever held a planning conversation.
- */
-export const PLANNING_ROLE_EVENT_TYPES = new Set([
-    "runtime.session-stop-requested",
-    "runtime.session-termination",
-    // Written by the liveness/host-exit paths, which admit a Draft planning Turn.
-    // Its payload carries the Role and embeds the Turn only inside the serialized
-    // observation, so it is resolved as Role-scoped rather than by that blob.
-    "runtime.process-exit-observed"
-]);
 export function assertDraftTaskExecutionFree(store, task) {
     if (task.status !== "draft") {
         throw new Error(`Task is not a Draft: ${task.id}/${task.status}.`);
@@ -168,35 +147,3 @@ function firstDraftExecutionFact(store, task) {
     // of delivery authority. The domain records above own delivery facts.
     return undefined;
 }
-/**
- * Whether one runtime/Turn Task event belongs to this Draft's own planning
- * conversation.
- *
- * The binding the event carries decides this, never its type prefix:
- *
- * - it names a Turn → that Turn must exist on this Task and be `planning`;
- * - it names no Turn → its exact type must be Role-scoped by construction and
- *   its `roleName` must be the Leader, the only Role a Draft may run.
- *
- * Everything else stays disqualifying, so an unrecognized type, a foreign Role
- * or a Turn reference that cannot be resolved fails closed.
- */
-function isDraftPlanningEvent(store, task, event) {
-    // Several emitters write an absent Turn as an empty string, so only a
-    // non-empty id counts as a reference worth resolving.
-    const runId = event.payload["runId"];
-    if (typeof runId === "string" && runId !== "") {
-        return store.getRun(task.id, runId)?.purpose === "planning";
-    }
-    // A canonical runtime observation is the event normal delivery writes for
-    // session.started/conversation.observed/turn.accepted and every terminal. It
-    // names its Turn in the same payload field as everything else and was
-    // resolved above; only an unfenced host-level observation reaches here, where
-    // the Role still has to prove it. Admitting this one type by its own binding
-    // is not the same as admitting the `runtime.` prefix.
-    if (event.type !== RUNTIME_OBSERVATION_TASK_EVENT
-        && !PLANNING_ROLE_EVENT_TYPES.has(event.type)) {
-        return false;
-    }
-    return event.payload["roleName"] === SYSTEM_LEADER_ROLE;
-}

package/dist/task/nextAction.js

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
+import { actionableExecutionLaneRecoveries } from "../execution/executionHealth.js";
 import { governingWorkItemDeliveries, workItemDeliverySettled } from "../integration/deliveryObligation.js";
 import { isCompletedTaskReviewEvidenceFromRuns } from "../review/reviewAcceptance.js";
-import { actionableExecutionLaneRecoveries } from "../execution/executionHealth.js";
 import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
 import { resolveRecordedTaskFinalReviewContract } from "../review/taskFinalReviewContractResolution.js";
-import { draftWorkItemDependencyIssue } from "./draftPlan.js";
 import { currentWorkItemCandidate, currentWorkItemExecutionGroup, governingWorkItemCandidate } from "../workItem/workItem.js";
+import { draftWorkItemDependencyIssue } from "./draftPlan.js";
 const OPEN_WORK_ITEM_STATUSES = new Set(["open"]);
 export function projectNextAction(facts) {
     const { task } = facts;
@@ -150,7 +150,7 @@ export function projectNextAction(facts) {
         }
         return buildAction(facts, {
             kind: "integrate-work-item",
-            reason: `Integration ${checkingIntegration.id} awaits check-result consumption (${job?.status ?? "read current Job"}); an empty integration queue does not finalize this direct attempt.`,
+            reason: `Integration ${checkingIntegration.id} awaits check-result consumption (${job?.status ?? "read current Job"}); its exact Job must be consumed to finalize the attempt.`,
             refs,
             preconditions: [{ fact: "The Integration retains its exact check Job", satisfied: true, ref: refs[0] }],
             recommendedCommand: `yui task integration continue ${task.id}/${checkingIntegration.id}`
@@ -378,7 +378,7 @@ export function projectNextAction(facts) {
     }
     if (deliveryWorkItems.length === 0
         && !taskFinalReviewRequired(facts)
-        && !facts.reviewRounds.some((round) => ((round.scope ?? "work-item") === "task"
+        && !facts.reviewRounds.some((round) => (round.scope === "task"
             && (round.status === "pending" || round.status === "running")))) {
         const reviewAlternative = facts.reviewConfig === null
             ? []
@@ -675,7 +675,6 @@ export function durableStateFingerprint(facts) {
         ...facts.workItems.map((item) => `work:${item.id}:${item.status}:${item.revision}:${item.updatedAt}`),
         ...facts.changeSets.map((changeSet) => `change-set:${changeSet.id}:${changeSet.headCommit}`),
         ...facts.integrations.map((attempt) => `integration:${attempt.id}:${attempt.status}:${attempt.updatedAt}`),
-        ...facts.integrationQueueEntries.map((entry) => `integration-queue:${entry.id}:${entry.status}:${entry.updatedAt}`),
         ...facts.reviewRounds.map((round) => `review:${round.id}:${round.status}:${round.endedAt ?? ""}`)
     ];
     return createHash("sha256").update(parts.join("\n")).digest("hex");
@@ -819,22 +818,17 @@ function taskFinalReviewRole(facts) {
 function ref(kind, id) {
     return { kind, id };
 }
-function latestFailedReviewFor(rounds, workItemId) {
-    return [...rounds]
-        .reverse()
-        .find((round) => round.workItemId === workItemId && round.status === "failed");
-}
 function latestTaskFinalReview(rounds, contract) {
     return [...rounds]
         .reverse()
-        .find((round) => ((round.scope ?? "work-item") === "task"
+        .find((round) => (round.scope === "task"
         && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
 }
 function hasValidFinalReview(facts) {
     const contract = taskFinalReviewContract(facts);
     const final = [...facts.reviewRounds]
         .reverse()
-        .find((round) => ((round.scope ?? "work-item") === "task"
+        .find((round) => (round.scope === "task"
         && (contract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, contract))));
     if (final === undefined || !isCompletedTaskReviewEvidenceFromRuns(final, facts.reviewOutcomeEvidence?.runs ?? []))
         return false;
@@ -853,7 +847,7 @@ function detectProtocolInconsistency(facts) {
                 : [ref("candidate", `${item.id}/${candidate.id}`)];
         });
         const reviewRefs = facts.reviewRounds
-            .filter((round) => ((round.scope ?? "work-item") === "task"
+            .filter((round) => (round.scope === "task"
             && round.taskFinalReviewContract !== undefined))
             .map((round) => ref("review-round", round.id));
         return {

package/dist/task/remoteDeliveryService.js

@@ -0,0 +1,89 @@
+import { isDeepStrictEqual } from "node:util";
+import { usageError } from "../errors/cliError.js";
+import { projectTaskRemoteDelivery } from "../task/remoteDelivery.js";
+import { PUBLICATION_ADOPTED_EVENT } from "./publicationAdoption.js";
+export function projectTaskRemoteDeliveryFromStore(store, task, currentCandidate = null) {
+    return createTaskRemoteDeliveryProof(store, task, currentCandidate).delivery;
+}
+export function createTaskRemoteDeliveryProof(store, task, currentCandidate = null) {
+    const publications = store.listPublicationReferences(task.id);
+    const delivery = projectTaskRemoteDelivery({
+        task,
+        events: store.listEventsByType(task.id, [
+            "task.completed", "task.archived", PUBLICATION_ADOPTED_EVENT
+        ]),
+        publications,
+        managedWorkspaces: store.listManagedWorkspaces(task.id),
+        runs: task.projectBindings.length === 0 ? [] : store.listTaskRunWorkspaceBases(task.id),
+        integrations: store.listIntegrationAttempts(task.id),
+        currentCandidate
+    });
+    return {
+        schemaVersion: 1,
+        task: taskRemoteDeliveryProofTask(task),
+        publications,
+        delivery
+    };
+}
+export function assertTaskRemoteDeliveryProof(store, task, proof) {
+    if (proof === undefined || proof.schemaVersion !== 1) {
+        throw usageError(`Task remote-delivery preflight proof is required: ${task.id}.`);
+    }
+    if (!isDeepStrictEqual(proof.task, taskRemoteDeliveryProofTask(task))) {
+        throw usageError(`Task changed after remote-delivery preflight: ${task.id}.`);
+    }
+    if (!isDeepStrictEqual(proof.publications, store.listPublicationReferences(task.id))) {
+        throw usageError(`Task Publication evidence changed after remote-delivery preflight: ${task.id}.`);
+    }
+    // Recheck semantic adoption/Integration facts as well as Publication versions.
+    // For provisional cancelled Tasks retain the frozen candidate used at preflight.
+    const current = projectTaskRemoteDeliveryFromStore(store, task, {
+        projects: proof.delivery.projects.flatMap(p => p.expectedLocalCommit === null
+            ? [] : [{ projectId: p.projectId, commit: p.expectedLocalCommit }])
+    });
+    if (!isDeepStrictEqual(current, proof.delivery)) {
+        throw usageError(`Task delivery evidence changed after remote-delivery preflight: ${task.id}.`);
+    }
+    assertTaskRemoteDeliveryIntegrated(proof.delivery);
+    return proof.delivery;
+}
+export function assertTaskRemoteDeliveryIntegrated(delivery) {
+    if (!delivery.allMerged) {
+        const headUnavailable = delivery.projects.filter((project) => (project.codeDelivery !== "none"
+            && project.coverage === "head-unavailable"));
+        if (headUnavailable.length > 0 && delivery.source === "task-completed") {
+            throw usageError(`Task ${delivery.taskId} has no frozen completion heads for: ${headUnavailable.map(({ projectId }) => projectId).join(", ")}. Historical acceptance cannot be inferred from a merge or archive.`);
+        }
+        const uncovered = delivery.projects
+            .filter((project) => project.codeDelivery !== "none" && !project.merged)
+            .map((project) => (`${project.projectId}/${project.coverage}`
+            + (project.publication === null ? "" : `/${project.publication.id}`)))
+            .join(", ");
+        throw usageError(`Task ${delivery.taskId} is not fully merged into remote delivery: ${uncovered || "expected Project heads are unavailable"}. Inspect each Project reason with task remote-delivery. Record confirmed Publication facts; `
+            + "for a changed post-completion candidate, review publication diff and explicitly adopt its acceptance.");
+    }
+    if (delivery.allVerified)
+        return;
+    const unverified = delivery.projects
+        .filter((project) => (project.codeDelivery !== "none"
+        && project.merged
+        && !project.verified))
+        .map((project) => (`${project.projectId}/${project.coverage}`
+        + (project.publication === null ? "" : `/${project.publication.id}`)))
+        .join(", ");
+    throw usageError(`Task ${delivery.taskId} has merged Publication evidence that is not verified: `
+        + `${unverified || "verification evidence is unavailable"}. Run task publication verify `
+        + "for each Publication only when the provider read is authorized.");
+}
+export function taskRemoteDeliveryProofTask(task) {
+    return {
+        id: task.id,
+        status: task.status,
+        projectBindings: task.projectBindings,
+        ...(task.workspaceIdentity === undefined
+            ? {}
+            : { workspaceIdentity: task.workspaceIdentity }),
+        ...(task.completedAt === undefined ? {} : { completedAt: task.completedAt }),
+        ...(task.retiredAt === undefined ? {} : { retiredAt: task.retiredAt })
+    };
+}

package/dist/task/taskActivation.js

@@ -22,7 +22,6 @@ export const TASK_ACTIVATION_EVENT = Object.freeze({
     adopted: "task.activation-adopted",
     failed: "task.activation-failed"
 });
-export const TASK_ACTIVATION_ORIGINS = Object.freeze(["explicit", "submit-develop"]);
 /**
  * The digest that decides whether a repeated requestId is the same request.
  *
@@ -64,7 +63,6 @@ export function createTaskActivationRequest(taskId, input, now) {
             partialResultRefs: []
         },
         startMode: input.startMode,
-        ...(input.origin === undefined ? {} : { origin: input.origin }),
         ...(input.afterPlanningRun === undefined
             ? {}
             : { afterPlanningRun: input.afterPlanningRun }),
@@ -196,26 +194,6 @@ export function admitTaskActivationRequest(task, request, planningRunIsActive) {
     }
     return { disposition: "ready", request };
 }
-/**
- * Whether the Controller may continue (auto-adopt) a released request without an
- * explicit activation boundary call (task-32 §2.4).
- *
- * A deferred request already holds activation authority and is released by its
- * planning Turn ending, so it is adoptable regardless of origin. An immediate
- * request is auto-continued only when it carries a recognised provable origin:
- * an explicit activation action, or a develop submission the shared transaction
- * accepted while the Task was unplanned. A request with no origin — every one
- * migrated from before the field existed — is deliberately held back so an
- * upgrade cannot turn a historical pending request into a silent activation; it
- * still adopts through the explicit `yui task activate` boundary, which does not
- * consult origin. This replaces the old actor heuristic that both dropped legal
- * Operator/user immediate requests and could not distinguish provenance.
- */
-export function activationRequestIsControllerAdoptable(request) {
-    if (request.startMode === "after-planning-turn")
-        return true;
-    return request.origin !== undefined;
-}
 /**
  * The durable terminal outcome for a requestId, read from the activation event
  * ledger.
@@ -258,9 +236,8 @@ export function validateTaskActivationRequest(request) {
     if (!["immediate", "after-planning-turn"].includes(request.startMode)) {
         throw new Error(`Activation start mode is invalid: ${String(request.startMode)}.`);
     }
-    if (request.origin !== undefined
-        && !TASK_ACTIVATION_ORIGINS.includes(request.origin)) {
-        throw new Error(`Activation origin is invalid: ${String(request.origin)}.`);
+    if (Object.hasOwn(request, "origin")) {
+        throw new Error("Activation contains retired origin metadata; use the storage upgrade boundary.");
     }
     if ((request.startMode === "after-planning-turn")
         !== (request.afterPlanningRun !== undefined)) {

package/dist/task/taskActivationService.js

@@ -108,7 +108,6 @@ export function recordTaskActivationRequestInTransaction(tx, input, now) {
         actorId: input.actorId,
         authorityRef: input.authorityRef,
         startMode,
-        ...(input.origin === undefined ? {} : { origin: input.origin }),
         ...(planningRun === undefined ? {} : { afterPlanningRun: planningRun }),
         environmentPlan: plan
     }, now);
@@ -118,7 +117,6 @@ export function recordTaskActivationRequestInTransaction(tx, input, now) {
         startMode: request.startMode,
         environmentPlan: describeEnvironmentPlan(request.environmentPlan),
         actor: request.operation.actorId,
-        ...(request.origin === undefined ? {} : { origin: request.origin }),
         ...(request.afterPlanningRun === undefined
             ? {}
             : { afterPlanningRun: request.afterPlanningRun })

package/dist/task/taskRecordReference.js

@@ -6,7 +6,6 @@ export const TASK_RECORD_ID_PREFIXES = {
     reviewRound: "review-round",
     changeSet: "change-set",
     integrationAttempt: "integration",
-    integrationQueue: "integration-queue",
     durableJob: "job",
     message: "message",
     inputRequest: "input",