@zq-silk/yui 0.15.9 → 0.15.12

package/dist/integration/gitIntegrationService.js

@@ -6,18 +6,21 @@ import { dirname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { selectEnvironment } from "../agent/launchEnvironment.js";
 import { controllerSocketPath } from "../core/controllerEndpoint.js";
+import { durableJobIdempotencyKey } from "../job/durableJob.js";
+import { applyIntegrationSource, assertIntegrationCandidate, assertRecordedSourceCandidate } from "./integrationSourceApplication.js";
 import { planBootstrapJobSteps, planL2JobSteps } from "../verification/verificationPlan.js";
 import { assertNoAdHocFullSuiteChecks, checkResultsFromGateArtifact, checkResultsFromGateJob, gateIdentityForCandidate, lookupReusableGateArtifact, recordGateArtifactFromJob, recordGateArtifactFromStepOutcomes, resolveVerificationGate, runGateStepsInProcess } from "../verification/verificationGateService.js";
 import { recordGateArtifactPotentialReuse, recordGateArtifactReuse } from "../verification/gateArtifact.js";
 import { touchGateArtifact } from "../verification/gateArtifactStore.js";
-import { NodeGitWorkspace, RemoteBaselineConflictError } from "../repository/gitWorkspace.js";
-import { resolveWorktreeRoot } from "../repository/taskWorkspacePreparer.js";
+import { NodeGitWorkspace } from "../repository/gitWorkspace.js";
+import { integrationWorkspaceRoot } from "../repository/taskWorkspacePreparer.js";
 import { acquireProjectMaintenanceLocks } from "../repository/projectMaintenanceLock.js";
 import { taskWorkspaceRefSegment } from "../repository/taskWorkspaceIdentity.js";
 import { FileTaskRuntimeIsolation } from "../runtime/taskRuntimeIsolation.js";
+import { managedIntegrationRuntimeRoot } from "../storage/homeLayout.js";
 import { advanceTaskProjectCommit } from "../task/task.js";
 import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
-import { recordIntegrationCheckJob, requireResolutionDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
+import { recordIntegrationCheckJob, updateIntegrationAttempt } from "./integrationAttempt.js";
 import { createManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
 import { readRuntimeIdentity } from "../release/runtimeRelease.js";
@@ -52,16 +55,12 @@ const INTEGRATION_OPERATIONAL_ENVIRONMENT_NAMES = [
     "CURL_CA_BUNDLE",
     "REQUESTS_CA_BUNDLE"
 ];
-export const REMOTE_BASELINE_CONFLICT_PREFIX = "Upstream rebase conflicts";
-const WORK_ITEM_MERGE_CONFLICT_PREFIX = "WorkItem merge conflicts";
-const MANUAL_INTEGRATION_PREFIX = "Manual WorkItem integration";
 export class GitIntegrationService {
     store;
     git;
     now;
     jobPort;
     home;
-    worktreeRoot;
     environment;
     runtimeIsolation;
     #resourceRegistrarValue;
@@ -71,50 +70,64 @@ export class GitIntegrationService {
         this.now = now;
         this.jobPort = jobPort;
         this.home = resolve(home);
-        this.worktreeRoot = resolveWorktreeRoot(home, store.getConfig().defaultWorkspace);
         this.environment = { ...environment };
         this.runtimeIsolation = runtimeIsolation;
     }
     #resourceRegistrar() {
         return this.#resourceRegistrarValue ??= new ResourceRegistrar(this.home, this.now);
     }
-    async integrate(taskId, integrationId) {
-        const initial = requireIntegration(this.store, taskId, integrationId);
+    async integrate(taskId, integrationId, signal) {
+        let initial = requireIntegration(this.store, taskId, integrationId);
+        if (!["running", "conflicted", "blocked", "validating"].includes(initial.status)) {
+            throw new Error(`Integration cannot continue from ${initial.status}.`);
+        }
         // The whole Integration is one Git transaction against the Project's
         // repository: worktree creation, cherry-picks, checks, and the target ref
         // CAS. A concurrent `project migrate` must not switch the catalog path or
         // remove the old checkout mid-Integration, so the per-Project maintenance
         // fence is held across every Git effect and released only on exit.
-        const release = acquireProjectMaintenanceLocks(this.home, [initial.projectId]);
+        const release = await acquireProjectMaintenanceLocks(this.home, [initial.projectId], { signal });
         try {
+            // A concurrent abort may have settled the attempt while this caller was
+            // acquiring the same Project fence. Never execute a pre-fence snapshot.
+            const currentUnderFence = requireIntegration(this.store, taskId, integrationId);
+            if (currentUnderFence.projectId !== initial.projectId
+                || !["running", "conflicted", "blocked", "validating"].includes(currentUnderFence.status)) {
+                throw new Error("Integration changed before execution admission; read its current record.");
+            }
+            initial = currentUnderFence;
             const task = this.store.getTask(initial.taskId);
             if (task === null || !task.projectBindings.some(({ projectId }) => projectId === initial.projectId)) {
                 throw new Error(`Integration Task Project is unavailable: ${initial.taskId}.`);
             }
-            if (task.status !== "active") {
+            if (task.status !== "active" || task.executionGate.state !== "enabled") {
                 throw new Error(`Integration Task is not active: ${task.id}/${task.status}.`);
             }
             const project = this.store.getProject(initial.projectId);
             if (project === null)
                 throw new Error(`Project not found: ${initial.projectId}.`);
+            if (project.status !== "active")
+                throw new Error(`Integration Project is not active: ${project.id}.`);
             const taskWorkspace = this.store.getTaskWorkspace(task.id);
-            const taskRepository = taskWorkspace?.entries.find(({ projectId }) => projectId === project.id)?.path;
+            const taskEntry = taskWorkspace?.entries.find(({ projectId }) => projectId === project.id);
+            const taskRepository = taskEntry?.path;
             if (taskWorkspace === null
                 || taskWorkspace.owner.type !== "task"
+                || taskEntry === undefined
                 || taskRepository === undefined) {
                 throw new Error(`Integration Task clone is unavailable: ${task.id}/${project.id}.`);
             }
             // Issue 08: a Project with a VerificationPlan gates through its plan
             // (bootstrap + L2) and reuses exact-SHA artifacts; an unconfigured
             // Project keeps the existing explicit check path unchanged.
-            const gate = resolveVerificationGate(project, this.environment);
             let prepared;
             let workspace;
             let managedWorkspace;
             try {
                 prepared = await this.git.ensureIntegrationWorktree({
                     repositoryPath: taskRepository,
-                    container: join(this.worktreeRoot, project.name),
+                    container: integrationWorkspaceRoot(this.home, task.id, initial.id),
+                    directory: taskEntry.directory,
                     taskSegment: taskWorkspaceRefSegment(task),
                     integrationId: initial.id,
                     baseRef: initial.beforeCommit
@@ -126,6 +139,12 @@ export class GitIntegrationService {
                     baseCommit: prepared.baseCommit
                 };
                 const existingWorkspace = this.store.getIntegrationWorkspace(task.id, initial.id);
+                if (existingWorkspace !== null && (resolve(existingWorkspace.root) !== resolve(prepared.path)
+                    || existingWorkspace.entries.length !== 1
+                    || existingWorkspace.entries[0]?.projectId !== project.id
+                    || existingWorkspace.entries[0]?.access !== "write"
+                    || existingWorkspace.entries[0]?.branch !== prepared.branch))
+                    throw new Error("Integration managed workspace identity changed.");
                 managedWorkspace = existingWorkspace ?? createManagedWorkspace({
                     owner: {
                         type: "integration-attempt",
@@ -135,7 +154,7 @@ export class GitIntegrationService {
                     root: prepared.path,
                     entries: [{
                             projectId: project.id,
-                            directory: project.name,
+                            directory: taskEntry.directory,
                             access: "write",
                             path: prepared.path,
                             branch: prepared.branch,
@@ -150,19 +169,26 @@ export class GitIntegrationService {
                 return this.#fail(initial, error, "integration-preparation");
             }
             if (initial.status === "validating") {
-                return this.#recoverValidating(initial, workspace, taskRepository);
+                return await this.#recoverValidating(initial, workspace, managedWorkspace, taskRepository);
             }
+            const gate = resolveVerificationGate(project, this.environment);
             let current = initial;
             // A check DurableJob is the source of truth for a running attempt that
             // already bound one: never re-apply commits or spawn a second job. The
             // job's terminal wakeup drives the resume through `integration continue`.
-            if (current.status === "running" && current.jobId !== undefined) {
-                return this.#resumeCheckJob(current, workspace, prepared.path, taskRepository, gate);
-            }
             try {
-                const conflict = await this.#applySource(current, workspace, prepared.path, project.remoteUrl);
-                if (conflict !== undefined) {
-                    return conflict;
+                current = await applyIntegrationSource({
+                    attempt: current, workspace, remoteUrl: project.remoteUrl,
+                    git: this.git, store: this.store, now: this.now
+                });
+                if (current.status === "conflicted" || current.status === "blocked") {
+                    return { status: current.status, attempt: current, workspace };
+                }
+                await assertIntegrationCandidate(prepared.path, current.candidateCommit, workspace.branch);
+                if (current.jobId !== undefined || current.checkInputDigest !== undefined) {
+                    if (this.jobPort === undefined)
+                        throw new Error("Integration requires its Controller Job port to resume.");
+                    return await this.#startCheckJob(current, workspace, prepared.path, managedWorkspace, taskRepository, gate);
                 }
                 // Static preflight: fail before any expensive check when the target
                 // moved or its worktree is dirty, so the check commands never run on a
@@ -170,17 +196,17 @@ export class GitIntegrationService {
                 // after the checks, so a move during the gate is still fenced at CAS.
                 await assertTargetReadyForChecks(taskRepository, current.targetRef, current.beforeCommit);
                 if (gate !== undefined) {
-                    return this.#runVerificationGate(current, workspace, prepared.path, managedWorkspace, taskRepository, gate);
+                    return await this.#runVerificationGate(current, workspace, prepared.path, managedWorkspace, taskRepository, gate);
                 }
                 if (this.jobPort !== undefined && current.checkCommands.length > 0) {
-                    return this.#startCheckJob(current, workspace, prepared.path, managedWorkspace, taskRepository);
+                    return await this.#startCheckJob(current, workspace, prepared.path, managedWorkspace, taskRepository);
                 }
+                const spec = await this.#checkSpecification(current, managedWorkspace, gate);
+                current = updateIntegrationAttempt(current, { checkInputDigest: spec.inputDigest }, this.now());
+                this.store.saveIntegrationAttempt(task.id, current);
                 const checkedHead = await gitLine(["-C", prepared.path, "rev-parse", "HEAD^{commit}"]);
-                const checkResults = await this.#runChecks(current, managedWorkspace, prepared.path);
-                const afterHead = await gitLine(["-C", prepared.path, "rev-parse", "HEAD^{commit}"]);
-                if (afterHead !== checkedHead) {
-                    return this.#fail(current, new Error(`Integration workspace moved during the checks: ${afterHead} != checked ${checkedHead}.`), "integration", workspace);
-                }
+                const checkResults = await this.#runChecks(current, managedWorkspace, prepared.path, spec.environment);
+                await assertIntegrationCandidate(prepared.path, checkedHead, workspace.branch);
                 if (checkResults.some((check) => check.outcome === "failed")) {
                     current = updateIntegrationAttempt(current, {
                         status: "failed",
@@ -201,18 +227,14 @@ export class GitIntegrationService {
                 return this.#terminalResult("committed", committed, workspace);
             }
             catch (error) {
-                if (error instanceof RemoteBaselineConflictError) {
-                    const pending = requireResolutionDecision(current, {
-                        affectedPaths: error.affectedPaths,
-                        summary: error.message
-                    }, this.now());
-                    this.store.saveIntegrationAttempt(task.id, pending);
-                    return { status: "blocked", attempt: pending, workspace };
-                }
+                // Git/Job effects may already exist even if the following save failed.
+                // Keep the last durable cursor/candidate for exact Agent-directed retry.
+                current = requireIntegration(this.store, taskId, integrationId);
                 if (current.status === "validating" && current.candidateCommit !== undefined) {
                     const target = await resolveRef(taskRepository, current.targetRef);
                     if (target === current.candidateCommit) {
                         try {
+                            await assertIntegrationCandidate(workspace.path, current.candidateCommit, workspace.branch);
                             await assertTargetReadyForChecks(taskRepository, current.targetRef, current.candidateCommit);
                             const committed = this.#recordCommitted(current);
                             return this.#terminalResult("committed", committed, workspace);
@@ -224,19 +246,117 @@ export class GitIntegrationService {
                         }
                     }
                 }
-                return this.#fail(current, error, "integration", workspace);
+                const diagnosed = updateIntegrationAttempt(current, {
+                    summary: error instanceof Error ? error.message : String(error)
+                }, this.now());
+                this.store.saveIntegrationAttempt(taskId, diagnosed);
+                return { status: diagnosed.status === "conflicted" ? "conflicted" : "blocked", attempt: diagnosed, workspace };
+            }
+        }
+        finally {
+            release();
+        }
+    }
+    /** Abandon under the same fence as Git/CAS, not just a status whitelist.
+     * A delivered validating candidate is recorded as committed; a provably
+     * unadvanced one may be abandoned without requiring obsolete check settings. */
+    async abort(taskId, integrationId, reason, authorize, signal) {
+        const initial = requireIntegration(this.store, taskId, integrationId);
+        const release = await acquireProjectMaintenanceLocks(this.home, [initial.projectId], { signal });
+        try {
+            const attempt = requireIntegration(this.store, taskId, integrationId);
+            authorize(this.store, taskId);
+            const task = this.store.getTask(taskId);
+            if (task?.status !== "active" || attempt.projectId !== initial.projectId
+                || !task.projectBindings.some(binding => binding.projectId === attempt.projectId)) {
+                throw new Error("Integration Task/Project is not available for abort.");
+            }
+            if (!["running", "blocked", "conflicted", "validating"].includes(attempt.status)) {
+                throw new Error(`Integration cannot be aborted from ${attempt.status}: ${attempt.id}.`);
+            }
+            if (reason.trim() === "")
+                throw new Error("Integration abort reason is required.");
+            const jobs = this.store.listDurableJobs(taskId).filter(job => job.owner.kind === "integration-attempt" && job.owner.integrationAttemptId === integrationId);
+            const workspace = this.store.getIntegrationWorkspace(taskId, integrationId);
+            if (jobs.some(job => job.taskId !== taskId || job.projectId !== attempt.projectId
+                || job.workspace !== workspace?.root)) {
+                throw new Error("Integration Job Project/workspace identity changed; inspect before abort.");
+            }
+            if (attempt.jobId !== undefined && !jobs.some(job => job.id === attempt.jobId)) {
+                throw new Error("Integration Job binding does not match its owner; inspect before abort.");
+            }
+            if (attempt.status === "validating") {
+                if (attempt.candidateCommit === undefined || attempt.checks === undefined) {
+                    throw new Error("Validating Integration has no candidate/check evidence; inspect before settlement.");
+                }
+                const main = this.store.getTaskWorkspace(taskId);
+                const mainEntry = main?.entries.find(entry => entry.projectId === attempt.projectId && entry.access === "write");
+                const workspaceEntry = workspace?.entries.find(entry => entry.projectId === attempt.projectId && entry.access === "write");
+                const project = this.store.getProject(attempt.projectId);
+                if (main?.owner.type !== "task" || mainEntry === undefined || workspace === null
+                    || project === null || project.status !== "active"
+                    || workspace.owner.type !== "integration-attempt" || workspace.owner.taskId !== taskId
+                    || workspace.owner.integrationAttemptId !== integrationId
+                    || workspaceEntry?.path !== workspace.root) {
+                    throw new Error("Integration target/workspace ownership is unavailable for settlement.");
+                }
+                if (jobs.some(job => ["queued", "running", "unknown-needs-attention"].includes(job.status))) {
+                    throw new Error("Validating Integration still has an active or unproven Job; settle that exact Job first.");
+                }
+                if (attempt.jobId !== undefined) {
+                    assertCheckJobIdentity(attempt, jobs.find(job => job.id === attempt.jobId), workspace.root);
+                }
+                const target = await resolveRef(mainEntry.path, attempt.targetRef);
+                if (target === attempt.candidateCommit && target !== attempt.beforeCommit) {
+                    await assertTargetReadyForChecks(mainEntry.path, attempt.targetRef, target);
+                    return this.#recordCommitted(attempt, authorize);
+                }
+                if (target !== attempt.beforeCommit) {
+                    throw new Error(`Target moved to ${target}; cannot prove this Integration is unadvanced. Inspect before settlement.`);
+                }
+            }
+            for (const job of jobs) {
+                if (this.jobPort !== undefined && (job.status === "queued" || job.status === "running")) {
+                    await this.jobPort.cancelJob(taskId, job.id);
+                }
             }
+            return this.store.transaction(tx => {
+                authorize(tx, taskId);
+                const current = requireIntegration(tx, taskId, integrationId);
+                if (JSON.stringify(current) !== JSON.stringify(attempt)) {
+                    throw new Error("Integration changed during abort; inspect its current record.");
+                }
+                const aborted = updateIntegrationAttempt(current, {
+                    status: "failed",
+                    checks: [...(current.checks ?? []), { name: "aborted", outcome: "failed", details: reason }]
+                }, this.now());
+                tx.saveIntegrationAttempt(taskId, aborted);
+                return aborted;
+            });
         }
         finally {
             release();
         }
     }
-    async cleanup(integration) {
+    async cleanup(integration, options = {}) {
         // The whole cleanup is one Git transaction against the Project's
         // repository, mirroring integrate(): a concurrent `project migrate` must
         // not switch the catalog path or remove the old checkout mid-cleanup.
-        const release = acquireProjectMaintenanceLocks(this.home, [integration.projectId]);
+        const release = await acquireProjectMaintenanceLocks(this.home, [integration.projectId], { signal: options.signal });
         try {
+            options.authorize?.();
+            const current = requireIntegration(this.store, integration.taskId, integration.id);
+            if (current.projectId !== integration.projectId
+                || !["committed", "superseded", "failed"].includes(current.status)) {
+                throw new Error("Integration changed before cleanup; read its current record.");
+            }
+            integration = current;
+            const activeJob = this.store.listDurableJobs(integration.taskId).find(job => job.owner.kind === "integration-attempt" && job.owner.integrationAttemptId === integration.id
+                && (job.status === "queued" || job.status === "running"
+                    || (job.status === "unknown-needs-attention" && job.acknowledgedAt === undefined)));
+            if (activeJob !== undefined) {
+                throw new Error(`Integration ${integration.id} has an active DurableJob: ${activeJob.id}/${activeJob.status}.`);
+            }
             const task = this.store.getTask(integration.taskId);
             if (task === null || !task.projectBindings.some(({ projectId }) => projectId === integration.projectId)) {
                 throw new Error(`Integration Task Project is unavailable: ${integration.id}.`);
@@ -253,9 +373,18 @@ export class GitIntegrationService {
                 const runtime = this.#runtimePreparation(integration, managedWorkspace);
                 this.runtimeIsolation.cleanup(runtime, integration.status === "committed" ? "completion" : "failure");
             }
+            const recorded = managedWorkspace?.entries[0];
+            const directory = recorded?.directory
+                ?? task.projectBindings.find(({ projectId }) => projectId === integration.projectId)?.directory;
+            if (directory === undefined) {
+                throw new Error(`Integration Project binding is unavailable: ${task.id}/${project.id}.`);
+            }
             const result = await this.git.removeIntegrationWorktree({
                 repositoryPath: taskRepository,
-                container: join(this.worktreeRoot, project.name),
+                container: recorded !== undefined
+                    ? dirname(recorded.path)
+                    : integrationWorkspaceRoot(this.home, task.id, integration.id),
+                directory,
                 taskSegment: taskWorkspaceRefSegment(task),
                 integrationId: integration.id,
                 discardChanges: integration.status === "failed"
@@ -287,26 +416,15 @@ export class GitIntegrationService {
      * it, so a Leader exit mid-checks leaves no running/no-check zombie.
      */
     async #startCheckJob(attempt, workspace, path, managedWorkspace, repositoryPath, gate) {
-        const runtime = this.#runtimePreparation(attempt, managedWorkspace);
-        const head = await gitLine(["-C", path, "rev-parse", "HEAD^{commit}"]);
-        const steps = gate === undefined
-            ? attempt.checkCommands.map((command, index) => ({
-                name: `check-${index + 1}`,
-                command,
-                timeoutMs: 30 * 60_000
-            }))
-            : [
-                ...planBootstrapJobSteps(gate.plan).map((step) => ({
-                    ...step,
-                    timeoutMs: 30 * 60_000
-                })),
-                ...planL2JobSteps(gate.plan).map((step) => ({
-                    ...step,
-                    timeoutMs: 30 * 60_000
-                }))
-            ];
-        const releaseId = integrationRuntimeReleaseIdentity(this.home);
-        if (gate === undefined && releaseId !== null) {
+        if (attempt.status !== "running" || attempt.candidateCommit === undefined) {
+            throw new Error(`Integration check admission requires a running, proven candidate: ${attempt.id}.`);
+        }
+        await assertIntegrationCandidate(path, attempt.candidateCommit, workspace.branch);
+        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit);
+        const { runtime, head, steps, environment, inputDigest, releaseId } = await this.#checkSpecification(attempt, managedWorkspace, gate);
+        const ownedJobs = this.store.listDurableJobs(attempt.taskId).filter(job => job.owner.kind === "integration-attempt" && job.owner.integrationAttemptId === attempt.id);
+        if (gate === undefined && releaseId !== null && attempt.checkInputDigest === undefined
+            && ownedJobs.length === 0 && attempt.jobId === undefined) {
             const reusable = findReusableIntegrationCheckEvidence({
                 taskId: attempt.taskId,
                 projectId: attempt.projectId,
@@ -320,25 +438,28 @@ export class GitIntegrationService {
                 logPathFor: (job, relativeLogPath) => (join(job.artifactsLocator, "logs", relativeLogPath))
             });
             if (reusable !== null) {
-                return this.#finalizeGateSuccess(attempt, workspace, repositoryPath, head, [...reusable.checks]);
+                return this.#finalizeGateSuccess(updateIntegrationAttempt(attempt, { checkInputDigest: inputDigest }, this.now()), workspace, repositoryPath, head, [...reusable.checks]);
             }
         }
-        this.runtimeIsolation.activate(runtime);
-        const baseEnvironment = await integrationCheckEnvironment(this.environment, runtime);
-        const environment = Object.freeze({
-            ...baseEnvironment,
-            ...(releaseId === null ? {} : { [INTEGRATION_RUNTIME_RELEASE_ENV]: releaseId })
-        });
+        if (attempt.checkInputDigest !== undefined && attempt.checkInputDigest !== inputDigest) {
+            throw new Error("Integration check conditions changed since admission; inspect the original Job, then abort or start a new attempt.");
+        }
+        if (attempt.jobId !== undefined) {
+            return this.#resumeCheckJob(attempt, workspace, path, repositoryPath, gate);
+        }
         // Persist the gate identity before starting the job so a plan edit
         // during the gate never misattributes the evidence on resume.
-        let persisted = attempt;
-        if (gate !== undefined) {
-            persisted = updateIntegrationAttempt(attempt, {
+        const persisted = updateIntegrationAttempt(attempt, {
+            checkInputDigest: inputDigest,
+            ...(gate === undefined ? {} : {
                 gatePlanDigest: gate.planDigest,
                 gateToolchainDigest: gate.toolchainDigest
-            }, this.now());
-            this.store.saveIntegrationAttempt(attempt.taskId, persisted);
-        }
+            })
+        }, this.now());
+        this.store.saveIntegrationAttempt(attempt.taskId, persisted);
+        // All domain admission and durable candidate identity precede Job effects.
+        this.runtimeIsolation.activate(runtime);
+        await prepareIntegrationRuntimeHome(runtime, this.home);
         const job = await this.jobPort.startCheckJob({
             taskId: attempt.taskId,
             integrationId: attempt.id,
@@ -348,6 +469,7 @@ export class GitIntegrationService {
             env: environment,
             steps
         });
+        assertCheckJobIdentity(persisted, job, path);
         const bound = recordIntegrationCheckJob(persisted, job.id, this.now());
         this.store.saveIntegrationAttempt(attempt.taskId, bound);
         if (job.status !== "queued" && job.status !== "running") {
@@ -367,12 +489,17 @@ export class GitIntegrationService {
      */
     async #resumeCheckJob(attempt, workspace, path, repositoryPath, gate) {
         const job = await this.jobPort.getJob(attempt.taskId, attempt.jobId);
+        assertCheckJobIdentity(attempt, job, path);
+        await assertIntegrationCandidate(path, job.head, workspace.branch);
+        await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.beforeCommit);
+        if (gate?.planDigest !== attempt.gatePlanDigest
+            || gate?.toolchainDigest !== attempt.gateToolchainDigest) {
+            throw new Error("Integration verification plan/toolchain changed; the original Job cannot prove the current gate.");
+        }
         if (job.status === "queued" || job.status === "running") {
             return { status: "checks-running", attempt, workspace, job };
         }
-        const planStyle = gate !== undefined
-            || (job.steps?.some((step) => step.name.startsWith("bootstrap-") || step.name.startsWith("gate-")) ?? false);
-        const checks = planStyle
+        const checks = gate !== undefined
             ? checkResultsFromGateJob(job, this.home)
             : checkResultsFromJob(attempt, job);
         const managedWorkspace = this.store.getIntegrationWorkspace(attempt.taskId, attempt.id);
@@ -380,25 +507,13 @@ export class GitIntegrationService {
             const runtime = this.#runtimePreparation(attempt, managedWorkspace);
             this.runtimeIsolation.cleanup(runtime, checks.some((check) => check.outcome === "failed") ? "failure" : "completion");
         }
-        // Issue 08: record the GateArtifact for a plan-gated attempt. The
-        // identity is recomputed from the current plan and the job's exact
-        // checked head; a plan/toolchain change since the job started yields a
-        // different key, so the artifact is never misattributed (the attempt
-        // still converges from the job's own evidence).
+        // The current plan/toolchain was matched to admission above. Record only
+        // that exact identity, never reinterpret an old Job under a changed plan.
         if (gate !== undefined
             && (job.result?.outcome === "succeeded" || job.result?.outcome === "failed")) {
-            // Use the digests captured at job start so a plan edit during the
-            // gate never misattributes the evidence.
-            const recordGate = attempt.gatePlanDigest !== undefined
-                ? Object.freeze({
-                    ...gate,
-                    planDigest: attempt.gatePlanDigest,
-                    toolchainDigest: attempt.gateToolchainDigest ?? gate.toolchainDigest
-                })
-                : gate;
             const identity = gateIdentityForCandidate({
                 projectId: attempt.projectId,
-                gate: recordGate,
+                gate,
                 level: "L2",
                 commit: job.head,
                 targetRef: attempt.targetRef,
@@ -424,30 +539,16 @@ export class GitIntegrationService {
             this.store.saveIntegrationAttempt(attempt.taskId, failed);
             return this.#terminalResult("failed", failed, workspace);
         }
-        const candidateCommit = await gitLine(["-C", path, "rev-parse", "HEAD^{commit}"]);
-        if (candidateCommit !== job.head) {
-            // The job proved the checks at one SHA; the workspace has since moved.
-            // Advancing the target ref would publish unchecked code, so fail closed.
-            return this.#fail(attempt, new Error(`Integration workspace moved since the check ran: ${candidateCommit} != checked ${job.head}.`), "integration", workspace);
-        }
-        const validating = updateIntegrationAttempt(attempt, {
-            status: "validating",
-            candidateCommit,
-            checks
-        }, this.now());
-        this.store.saveIntegrationAttempt(attempt.taskId, validating);
-        await advanceTargetRef(repositoryPath, validating.targetRef, candidateCommit, validating.beforeCommit);
-        const committed = this.#recordCommitted(validating);
-        return this.#terminalResult("committed", committed, workspace);
+        return this.#finalizeGateSuccess(attempt, workspace, repositoryPath, job.head, checks);
     }
-    async #runChecks(attempt, workspace, path) {
+    async #runChecks(attempt, workspace, path, environment) {
         if (attempt.checkCommands.length === 0)
             return [];
         const runtime = this.#runtimePreparation(attempt, workspace);
         this.runtimeIsolation.activate(runtime);
         let cleanupReason = "failure";
         try {
-            const environment = await integrationCheckEnvironment(this.environment, runtime);
+            await prepareIntegrationRuntimeHome(runtime, this.home);
             const checks = await runChecks(path, attempt.checkCommands, this.home, attempt.taskId, attempt.id, environment);
             cleanupReason = checks.some(({ outcome }) => outcome === "failed")
                 ? "failure"
@@ -472,6 +573,12 @@ export class GitIntegrationService {
      * gate.
      */
     async #runVerificationGate(attempt, workspace, path, managedWorkspace, repositoryPath, gate) {
+        const spec = await this.#checkSpecification(attempt, managedWorkspace, gate);
+        attempt = updateIntegrationAttempt(attempt, {
+            checkInputDigest: spec.inputDigest,
+            gatePlanDigest: gate.planDigest, gateToolchainDigest: gate.toolchainDigest
+        }, this.now());
+        this.store.saveIntegrationAttempt(attempt.taskId, attempt);
         if (gate.mode === "enforce") {
             try {
                 assertNoAdHocFullSuiteChecks(gate.plan, attempt.checkCommands);
@@ -513,12 +620,12 @@ export class GitIntegrationService {
         this.runtimeIsolation.activate(runtime);
         let cleanupReason = "failure";
         try {
-            const environment = await integrationCheckEnvironment(this.environment, runtime);
+            await prepareIntegrationRuntimeHome(runtime, this.home);
             const steps = [
                 ...planBootstrapJobSteps(gate.plan),
                 ...planL2JobSteps(gate.plan)
             ];
-            const outcomes = await runGateStepsInProcess(path, steps, environment, integrationCheckDirectory(this.home, attempt.taskId, attempt.id), candidateCommit);
+            const outcomes = await runGateStepsInProcess(path, steps, spec.environment, integrationCheckDirectory(this.home, attempt.taskId, attempt.id), candidateCommit);
             const succeeded = outcomes.length === steps.length
                 && outcomes.every((outcome) => outcome.exitCode === 0 && outcome.signal === null && !outcome.timedOut);
             const artifact = await recordGateArtifactFromStepOutcomes(this.store, identity, gate.plan, outcomes, succeeded, this.now());
@@ -536,6 +643,7 @@ export class GitIntegrationService {
         }
     }
     async #finalizeGateSuccess(attempt, workspace, repositoryPath, candidateCommit, checks) {
+        await assertIntegrationCandidate(workspace.path, candidateCommit, workspace.branch);
         const validating = updateIntegrationAttempt(attempt, {
             status: "validating",
             candidateCommit,
@@ -552,175 +660,75 @@ export class GitIntegrationService {
             allowExactActive: true
         });
     }
-    async #applySource(attempt, workspace, candidatePath, remoteUrl) {
-        if (attempt.source.kind === "historical-change-sets") {
-            throw new Error(`Historical Integration cannot be resumed under the current source contract: ${attempt.id}.`);
-        }
-        if (attempt.source.kind === "upstream") {
-            if (remoteUrl === undefined) {
-                throw new Error(`Project has no remote URL for upstream Integration: ${attempt.projectId}.`);
-            }
-            if (attempt.resolution?.action === "manual-resolution"
-                && attempt.conflict?.summary.startsWith(REMOTE_BASELINE_CONFLICT_PREFIX)) {
-                await continueUpstreamRebase(candidatePath);
-                return undefined;
-            }
-            const fetchRemote = this.git.fetchRemoteHeadIntoWorktree;
-            if (fetchRemote === undefined) {
-                throw new Error("Integration Git workspace cannot fetch an upstream source.");
-            }
-            const fetched = await fetchRemote.call(this.git, {
-                repositoryPath: candidatePath,
-                remoteUrl,
-                branch: attempt.source.branch
-            });
-            if (fetched.commit !== attempt.source.remoteCommit) {
-                throw new Error(`Upstream branch moved before Integration: expected ${attempt.source.remoteCommit}, fetched ${fetched.commit}.`);
-            }
-            if (await this.git.isAncestor(candidatePath, attempt.source.remoteCommit, attempt.beforeCommit)) {
-                return undefined;
-            }
-            try {
-                await git([
-                    "-C", candidatePath,
-                    "-c", "user.name=Yui",
-                    "-c", "user.email=yui@local",
-                    "rebase", "--onto",
-                    attempt.source.remoteCommit,
-                    attempt.source.taskBaseCommit,
-                    workspace.branch
-                ]);
-            }
-            catch (error) {
-                const affectedPaths = await conflictedPaths(candidatePath);
-                if (affectedPaths.length === 0)
-                    throw error;
-                const pending = requireResolutionDecision(attempt, {
-                    affectedPaths,
-                    summary: `${REMOTE_BASELINE_CONFLICT_PREFIX} in ${attempt.targetRef}.`
-                }, this.now());
-                this.store.saveIntegrationAttempt(attempt.taskId, pending);
-                return { status: "blocked", attempt: pending, workspace };
-            }
-            return undefined;
-        }
-        if (attempt.source.strategy === "manual") {
-            if (attempt.resolution?.action === "manual-resolution"
-                && attempt.conflict?.summary.startsWith(MANUAL_INTEGRATION_PREFIX)) {
-                if (!await this.git.isClean(candidatePath)) {
-                    throw new Error("Manual Integration workspace must be clean and committed.");
-                }
-                return undefined;
-            }
-            const pending = requireResolutionDecision(attempt, {
-                affectedPaths: [],
-                summary: `${MANUAL_INTEGRATION_PREFIX}; apply the selected WorkItem result in the Integration workspace.`
-            }, this.now());
-            this.store.saveIntegrationAttempt(attempt.taskId, pending);
-            return { status: "blocked", attempt: pending, workspace };
-        }
-        if (attempt.source.strategy === "ff") {
-            await git([
-                "-C", candidatePath,
-                "merge", "--ff-only",
-                attempt.source.resultCommit
-            ]);
-            return undefined;
-        }
-        if (attempt.source.strategy === "merge") {
-            if (attempt.resolution?.action === "manual-resolution"
-                && attempt.conflict?.summary.startsWith(WORK_ITEM_MERGE_CONFLICT_PREFIX)) {
-                await completeMergeResolution(candidatePath);
-                return undefined;
-            }
-            try {
-                await git([
-                    "-C", candidatePath,
-                    "-c", "user.name=Yui",
-                    "-c", "user.email=yui@local",
-                    "merge", "--no-edit", "--no-ff",
-                    attempt.source.resultCommit
-                ]);
-            }
-            catch (error) {
-                const affectedPaths = await conflictedPaths(candidatePath);
-                if (affectedPaths.length === 0)
-                    throw error;
-                const pending = requireResolutionDecision(attempt, {
-                    affectedPaths,
-                    summary: `${WORK_ITEM_MERGE_CONFLICT_PREFIX} in ${attempt.targetRef}.`
-                }, this.now());
-                this.store.saveIntegrationAttempt(attempt.taskId, pending);
-                return { status: "blocked", attempt: pending, workspace };
-            }
-            return undefined;
-        }
-        const commits = await commitsBetween(candidatePath, attempt.source.startCommit, attempt.source.resultCommit, attempt.source.workItemId);
-        let remaining = commits;
-        if (attempt.resolution?.action === "manual-resolution") {
-            const resolvedCommit = await completeCherryPickResolution(candidatePath);
-            const resolvedIndex = commits.findIndex(({ commit }) => commit === resolvedCommit);
-            if (resolvedIndex < 0) {
-                throw new Error(`Manual resolution commit is not part of the WorkItem result: ${resolvedCommit}.`);
-            }
-            remaining = commits.slice(resolvedIndex + 1);
-        }
-        for (const { label, commit } of remaining) {
-            // Fast-forward when the commit is a direct descendant of HEAD: this
-            // preserves the original commit SHA, which exact-SHA review evidence
-            // relies on.  Fall back to cherry-pick when the target moved since the
-            // WorkItem was based (the commit is no longer a direct descendant).
-            if (await gitSucceeds(["-C", candidatePath, "merge", "--ff-only", commit])) {
-                continue;
-            }
-            try {
-                await git(["-C", candidatePath, "cherry-pick", commit]);
-            }
-            catch {
-                const affectedPaths = (await git([
-                    "-C", candidatePath, "diff", "--name-only", "--diff-filter=U"
-                ])).trim().split("\n").filter(Boolean);
-                if (affectedPaths.length === 0
-                    && await isEmptyCherryPick(candidatePath, commit)) {
-                    await git(["-C", candidatePath, "cherry-pick", "--skip"]);
-                    continue;
-                }
-                const pending = requireResolutionDecision(attempt, {
-                    affectedPaths,
-                    summary: `${label} conflicts with ${attempt.targetRef}.`
-                }, this.now());
-                this.store.saveIntegrationAttempt(attempt.taskId, pending);
-                return { status: "blocked", attempt: pending, workspace };
-            }
-        }
-        return undefined;
+    /** The same specification is compared before first execution, bound-Job
+     * consumption and an unadvanced validating CAS. Computing it is read-only:
+     * a changed condition must not recreate a completed runtime or start a Job. */
+    async #checkSpecification(attempt, managedWorkspace, gate) {
+        const runtime = this.#runtimePreparation(attempt, managedWorkspace);
+        const head = attempt.candidateCommit;
+        if (head === undefined)
+            throw new Error("Integration check specification requires a candidate.");
+        const steps = gate === undefined
+            ? attempt.checkCommands.map((command, index) => ({
+                name: `check-${index + 1}`, command, timeoutMs: 30 * 60_000
+            }))
+            : [...planBootstrapJobSteps(gate.plan), ...planL2JobSteps(gate.plan)]
+                .map(step => ({ ...step, timeoutMs: 30 * 60_000 }));
+        const releaseId = integrationRuntimeReleaseIdentity(this.home);
+        const environment = Object.freeze({
+            ...integrationCheckEnvironment(this.environment, runtime, this.home),
+            ...(releaseId === null ? {} : { [INTEGRATION_RUNTIME_RELEASE_ENV]: releaseId })
+        });
+        const inputDigest = durableJobIdempotencyKey({
+            owner: { kind: "integration-attempt", integrationAttemptId: attempt.id },
+            projectId: attempt.projectId, head, workspace: managedWorkspace.root,
+            env: environment, steps
+        });
+        return { runtime, head, steps, environment, inputDigest, releaseId };
     }
-    async #recoverValidating(attempt, workspace, repositoryPath) {
+    async #recoverValidating(attempt, workspace, managedWorkspace, repositoryPath) {
         if (attempt.candidateCommit === undefined || attempt.checks === undefined) {
             return this.#fail(attempt, new Error("Validating Integration is missing its candidate commit or checks."), "integration-recovery", workspace);
         }
         const target = await resolveRef(repositoryPath, attempt.targetRef);
-        if (target === attempt.beforeCommit) {
-            try {
-                await advanceTargetRef(repositoryPath, attempt.targetRef, attempt.candidateCommit, attempt.beforeCommit);
+        // An already-applied CAS is a delivery fact, not a request to validate
+        // again under today's settings. No-op candidates still need current checks.
+        if (target !== attempt.candidateCommit || target === attempt.beforeCommit) {
+            if (target !== attempt.beforeCommit) {
+                throw new Error(`Target moved to ${target}; Integration CAS outcome needs inspection.`);
             }
-            catch (error) {
-                return this.#fail(attempt, error, "integration-recovery", workspace);
+            await assertIntegrationCandidate(workspace.path, attempt.candidateCommit, workspace.branch);
+            assertRecordedSourceCandidate(attempt, workspace);
+            const project = this.store.getProject(attempt.projectId);
+            if (project === null)
+                throw new Error("Integration Project is unavailable for check validation.");
+            const gate = resolveVerificationGate(project, this.environment);
+            const spec = await this.#checkSpecification(attempt, managedWorkspace, gate);
+            if (attempt.checkInputDigest !== spec.inputDigest
+                || gate?.planDigest !== attempt.gatePlanDigest
+                || gate?.toolchainDigest !== attempt.gateToolchainDigest) {
+                throw new Error("Integration check conditions changed after validation; preserve the evidence and abort or use a new attempt.");
             }
-        }
-        else if (target !== attempt.candidateCommit) {
-            return this.#fail(attempt, new Error(`Target moved to ${target}; expected ${attempt.beforeCommit}.`), "integration-recovery", workspace);
+            if (attempt.jobId !== undefined) {
+                const job = this.store.getDurableJob(attempt.taskId, attempt.jobId);
+                if (job === null || job.status !== "succeeded") {
+                    throw new Error("Validating Integration has no successful bound Job evidence.");
+                }
+                assertCheckJobIdentity(attempt, job, workspace.path);
+            }
+            await advanceTargetRef(repositoryPath, attempt.targetRef, attempt.candidateCommit, attempt.beforeCommit);
         }
         await assertTargetReadyForChecks(repositoryPath, attempt.targetRef, attempt.candidateCommit);
         const committed = this.#recordCommitted(attempt);
         return this.#terminalResult("committed", committed, workspace);
     }
-    #recordCommitted(attempt) {
+    #recordCommitted(attempt, authorize) {
         if (attempt.candidateCommit === undefined) {
             throw new Error(`Committed Integration has no candidate commit: ${attempt.id}.`);
         }
         const candidateCommit = attempt.candidateCommit;
         return this.store.transaction((tx) => {
+            authorize?.(tx, attempt.taskId);
             const task = tx.getTask(attempt.taskId);
             if (task === null)
                 throw new Error(`Task not found: ${attempt.taskId}.`);
@@ -769,6 +777,27 @@ export class GitIntegrationService {
         };
     }
 }
+function assertCheckJobIdentity(attempt, job, path) {
+    if (job.taskId !== attempt.taskId
+        || job.owner.kind !== "integration-attempt" || job.owner.integrationAttemptId !== attempt.id
+        || job.projectId !== attempt.projectId || job.workspace !== path
+        || job.head !== attempt.candidateCommit
+        || (attempt.jobId !== undefined && job.id !== attempt.jobId)
+        || attempt.checkInputDigest === undefined
+        || durableJobIdempotencyKey(job) !== attempt.checkInputDigest) {
+        throw new Error("Integration Job identity does not match its admitted Task, source candidate, Project, workspace and check specification.");
+    }
+    if (job.status === "succeeded") {
+        const results = job.result?.steps;
+        if (job.result?.outcome !== "succeeded" || results?.length !== job.steps.length
+            || job.steps.some((step, index) => {
+                const result = results[index];
+                return result?.name !== step.name || result.head !== job.head
+                    || result.exitCode !== 0 || result.signal !== null || result.timedOut;
+            }))
+            throw new Error("Integration Job success lacks exact candidate step evidence.");
+    }
+}
 function integrationSummary(attempt) {
     const unchanged = attempt.beforeCommit === attempt.candidateCommit;
     if (attempt.source.kind === "upstream") {
@@ -796,111 +825,6 @@ function integrationSummary(attempt) {
         ? `WorkItem ${attempt.source.workItemId} result was already represented; Task head was unchanged.`
         : `Integrated WorkItem ${attempt.source.workItemId} with ${attempt.source.strategy}.`;
 }
-async function isEmptyCherryPick(path, commit) {
-    let cherryPickHead;
-    try {
-        cherryPickHead = await gitLine([
-            "-C", path, "rev-parse", "--verify", "CHERRY_PICK_HEAD^{commit}"
-        ]);
-    }
-    catch {
-        return false;
-    }
-    return cherryPickHead === commit
-        && await gitSucceeds(["-C", path, "diff", "--cached", "--quiet"]);
-}
-async function commitsBetween(repositoryPath, startCommit, resultCommit, workItemId) {
-    const commits = (await git([
-        "-C", repositoryPath, "rev-list", "--reverse",
-        `${startCommit}..${resultCommit}`
-    ])).trim().split("\n").filter(Boolean);
-    const plan = [];
-    for (const commit of commits) {
-        if (await gitSucceeds([
-            "-C", repositoryPath,
-            "merge-base", "--is-ancestor", commit, "HEAD"
-        ]))
-            continue;
-        plan.push({ label: `WorkItem ${workItemId} commit ${commit}`, commit });
-    }
-    return plan;
-}
-async function completeCherryPickResolution(path) {
-    const unmerged = (await git(["-C", path, "diff", "--name-only", "--diff-filter=U"])).trim();
-    if (unmerged.length > 0) {
-        throw new Error(`Manual resolution is incomplete: ${unmerged.split("\n").join(", ")}.`);
-    }
-    let cherryPickHead;
-    try {
-        cherryPickHead = await gitLine([
-            "-C", path, "rev-parse", "--verify", "CHERRY_PICK_HEAD"
-        ]);
-    }
-    catch {
-        throw new Error("Manual resolution has no active cherry-pick.");
-    }
-    const emptyResolution = await gitSucceeds(["-C", path, "diff", "--cached", "--quiet"]);
-    if (emptyResolution) {
-        await git(["-C", path, "cherry-pick", "--skip"]);
-    }
-    else {
-        await git(["-C", path, "-c", "user.name=Yui", "-c", "user.email=yui@local",
-            "cherry-pick", "--continue"]);
-    }
-    return cherryPickHead;
-}
-async function completeMergeResolution(path) {
-    const affected = await conflictedPaths(path);
-    if (affected.length > 0) {
-        throw new Error(`Manual merge resolution is incomplete: ${affected.join(", ")}.`);
-    }
-    try {
-        await gitLine(["-C", path, "rev-parse", "--verify", "MERGE_HEAD"]);
-    }
-    catch {
-        throw new Error("Manual WorkItem resolution has no active merge.");
-    }
-    await git([
-        "-C", path,
-        "-c", "user.name=Yui",
-        "-c", "user.email=yui@local",
-        "commit", "--no-edit"
-    ]);
-}
-async function continueUpstreamRebase(path) {
-    const affected = await conflictedPaths(path);
-    if (affected.length > 0) {
-        throw new RemoteBaselineConflictError(affected, `${REMOTE_BASELINE_CONFLICT_PREFIX}: ${affected.join(", ")}.`);
-    }
-    try {
-        await gitLine(["-C", path, "rev-parse", "--verify", "REBASE_HEAD"]);
-    }
-    catch {
-        throw new Error("Manual upstream resolution has no active rebase.");
-    }
-    try {
-        await git([
-            "-C", path,
-            "-c", "user.name=Yui",
-            "-c", "user.email=yui@local",
-            "-c", "core.editor=true",
-            "rebase", "--continue"
-        ]);
-    }
-    catch (error) {
-        const nextAffected = await conflictedPaths(path);
-        if (nextAffected.length > 0) {
-            throw new RemoteBaselineConflictError(nextAffected, `${REMOTE_BASELINE_CONFLICT_PREFIX}: ${nextAffected.join(", ")}.`, { cause: error });
-        }
-        throw error;
-    }
-}
-async function conflictedPaths(path) {
-    return (await git([
-        "-C", path,
-        "diff", "--name-only", "--diff-filter=U"
-    ])).trim().split("\n").filter(Boolean);
-}
 /**
  * Map a terminal check job back to the attempt's CheckResult[] shape. The
  * runner stops at the first failing step, so unreached checks are "skipped"
@@ -1048,27 +972,41 @@ async function spawnCheck(command, cwd, outputFd, environment) {
     clearTimeout(timeout);
     return { ...completion, timedOut };
 }
-async function integrationCheckEnvironment(source, runtime) {
-    const home = join(runtime.descriptor.roots.data, "home");
+async function prepareIntegrationRuntimeHome(runtime, home) {
+    const homeDirectory = join(runtime.descriptor.roots.data, "home");
     try {
-        await mkdir(home, { mode: 0o700 });
+        await mkdir(homeDirectory, { mode: 0o700 });
     }
     catch (error) {
         if (!isNodeCode(error, "EEXIST"))
             throw error;
     }
-    const homeMetadata = await lstat(home);
+    const homeMetadata = await lstat(homeDirectory);
     if (!homeMetadata.isDirectory() || homeMetadata.isSymbolicLink()) {
         throw new Error("Integration runtime HOME is not an owned directory.");
     }
+    // The tmux socket endpoint is the one approved short-path IPC exception; every
+    // other temp consumer (TMPDIR/TMP/TEMP) stays on the Home-side runtime tmp.
+    const tmuxSocketRoot = integrationTmuxSocketRoot(home);
+    try {
+        await mkdir(tmuxSocketRoot, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!isNodeCode(error, "EEXIST"))
+            throw error;
+    }
+}
+function integrationCheckEnvironment(source, runtime, home) {
+    const homeDirectory = join(runtime.descriptor.roots.data, "home");
+    const tmuxSocketRoot = integrationTmuxSocketRoot(home);
     return Object.freeze({
         ...selectEnvironment(source, INTEGRATION_OPERATIONAL_ENVIRONMENT_NAMES),
         PATH: source.PATH || `${dirname(process.execPath)}:/usr/local/bin:/usr/bin:/bin`,
-        HOME: home,
+        HOME: homeDirectory,
         TMPDIR: runtime.descriptor.roots.temporary,
         TMP: runtime.descriptor.roots.temporary,
         TEMP: runtime.descriptor.roots.temporary,
-        TMUX_TMPDIR: runtime.descriptor.roots.temporary,
+        TMUX_TMPDIR: tmuxSocketRoot,
         ...runtime.environment
     });
 }
@@ -1080,18 +1018,32 @@ function isNodeCode(error, code) {
 }
 function defaultIntegrationRuntimeIsolation(home, homeId) {
     const controlHome = resolve(home);
+    const runtimeRoot = managedIntegrationRuntimeRoot(controlHome);
     return new FileTaskRuntimeIsolation({
-        runtimeRoot: integrationRuntimeRoot(controlHome),
+        // The integration check's provider data/cache/tmp live in a dedicated Home
+        // partition — the same isolation contract every Task runtime obeys — not in
+        // a system-wide `/tmp` root. Only the tmux socket ENDPOINT stays a short
+        // `/tmp` path (see `integrationCheckEnvironment`) for the `sockaddr_un`
+        // budget; ordinary runtime state is now Yui-managed under Home.
+        runtimeRoot,
         pathLayout: "compact",
         controlPlane: {
             yuiHome: controlHome,
+            managedRuntimeRoot: runtimeRoot,
             controllerSocketPath: controllerSocketPath(homeId),
             tmuxNamespace: yuiTmuxServerName(controlHome),
             globalInstallPaths: [process.execPath]
         }
     });
 }
-function integrationRuntimeRoot(home) {
+/**
+ * Short `/tmp` directory that holds ONLY the integration check's tmux socket
+ * endpoint. tmux uses a `sockaddr_un` path whose length budget cannot absorb a
+ * deep Home path, so this single IPC endpoint is the one approved exception to
+ * the unified-Home contract. All other integration runtime state (data, cache,
+ * ordinary temp) lives in the Home partition from `managedIntegrationRuntimeRoot`.
+ */
+function integrationTmuxSocketRoot(home) {
     const uid = typeof process.getuid === "function" ? process.getuid() : 0;
     const homeDigest = createHash("sha256").update(resolve(home)).digest("hex").slice(0, 16);
     return join("/tmp", `yi-${uid.toString(36)}-${homeDigest}`);
@@ -1175,15 +1127,6 @@ async function git(args) {
         });
     }
 }
-async function gitSucceeds(args) {
-    try {
-        await git(args);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 async function gitLine(args) {
     const value = (await git(args)).trim();
     if (!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(value)) {