@zq-silk/yui 0.15.9 → 0.15.12

package/dist/storage/sqliteSchema.js

@@ -24,6 +24,9 @@ import { createHash } from "node:crypto";
 import { REMOVE_RUNTIME_GENERATION_SQL, removeRuntimeGenerationRecords } from "./migrations/removeRuntimeGeneration.js";
 import { migrateAgentRunContract } from "./migrations/agentRunContract.js";
 import { migrateArtifactsToGit } from "./migrations/artifactsToGit.js";
+import { migrateIntegrationContinuation } from "./migrations/integrationContinuation.js";
+import { UNIFY_HOME_LAYOUT_SQL, migrateUnifyHomeLayout } from "./migrations/unifyHomeLayout.js";
+import { COLLAPSE_WORKTREE_LAYOUT_SQL, migrateCollapseWorktreeLayout } from "./migrations/collapseWorktreeLayout.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
 /** Telemetry retention bounds (§4.4). Open question 3 in §11; defaults from the design. */
 export const TELEMETRY_KEEP_PER_RUN = 200;
@@ -643,6 +646,27 @@ CREATE TABLE IF NOT EXISTS context_snapshots (
 CREATE UNIQUE INDEX IF NOT EXISTS idx_context_snapshots_scope_sequence
   ON context_snapshots(task_id, scope, COALESCE(scope_ref, ''), sequence);
 `;
+/**
+ * The Global-owned Message store (decision-3 §9/§11). It extends the Message
+ * store to a Global owner exactly as `global_role_session_sets` parallels
+ * `role_session_sets`: keyed by the Global Role `name` with an FK to
+ * `global_roles`, never by a fabricated `task_id`, and never a new private
+ * queue. Ids are minted from the existing `global_sequences` counter, so a
+ * Global input has an explicit owner and an authorizable reference without
+ * reusing Task record shapes or Task permissions.
+ */
+const GLOBAL_ROLE_MESSAGE_SQL = `
+CREATE TABLE IF NOT EXISTS global_role_messages (
+  name       TEXT NOT NULL,
+  message_id TEXT NOT NULL,
+  seq        INTEGER NOT NULL,
+  payload    TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (name, message_id),
+  FOREIGN KEY (name) REFERENCES global_roles(name)
+);
+CREATE INDEX IF NOT EXISTS idx_global_role_messages_seq ON global_role_messages(name, seq);
+`;
 const MIGRATION_1_SQL = [
     BASELINE_CORE_SQL,
     BASELINE_JOB_AND_RELEASE_SQL,
@@ -1143,6 +1167,134 @@ UPDATE review_rounds SET payload = json_set(payload, '$.executionGroup.lanes', j
         // satisfies "optional still requires a migration declaration".
         sql: "SELECT 1; -- artifacts move to per-Task local Git; see migrateArtifactsToGit",
         migrateData: migrateArtifactsToGit
+    },
+    {
+        version: 20,
+        name: "integration-conflict-continuation",
+        introducedIn: "0.16.0",
+        // Widen Integration status with conflicted; declare optional sourceProgress
+        // (Git cursor/reflog action) and checkInputDigest. Exact old bound FF Job
+        // receipts supply these facts; unprovable history remains unchanged.
+        // Frozen Context and events are never rewritten.
+        sql: "SELECT 1; -- Integration Git progress and exact check admission",
+        migrateData: migrateIntegrationContinuation
+    },
+    {
+        version: 21,
+        name: "force-archive-independent-cleanup",
+        introducedIn: "0.16.0",
+        // Declare optional task.archived force/cleanup/warnings/retainedResources
+        // audit fields and task.archive-cleanup resource/status/detail/paths events;
+        // runtime.event-obsolete may retain the full originalEvent as source evidence.
+        // Archived Tasks may retain exact runtime/workspace/mailbox ownership.
+        // Existing archive, completion and Publication history is unchanged.
+        sql: "SELECT 1; -- archive intent and cleanup evidence remain separate facts"
+    },
+    {
+        version: 22,
+        name: "controller-owned-agent-host-ingress",
+        introducedIn: "0.16.0",
+        // Add optional `host` source metadata to the stable Inbox v1 observation
+        // envelope. Such facts contain no resolved Run: current Controller alone
+        // validates ownership and commits observations, process custody and native
+        // account locations. Existing Inbox facts and domain history stay intact.
+        // Host status capabilities/transport diagnostics are live, not stored.
+        sql: "SELECT 1; -- Controller-owned Host ingress; no historical data rewrite"
+    },
+    {
+        version: 23,
+        name: "unified-message-input-control",
+        introducedIn: "0.16.1",
+        // Widen the Message payload with an optional durable input action
+        // (queue/steer) plus its stable requestId, and an optional interrupt-then
+        // handoff claim (requestId + exact target AgentRun). Existing messages carry
+        // neither field and keep their current queue semantics and delivery history;
+        // no native Turn identity is synthesized and no history is rewritten. The
+        // same contiguous migration adds the Global-owned Message store
+        // (global_role_messages), extending the Message store to a Global owner
+        // exactly as global_role_session_sets parallels role_session_sets: an
+        // explicit Global owner and authorizable reference, no fabricated Task and
+        // no new private global queue (decision-3 §9/§11).
+        sql: `SELECT 1; -- Message input actions, exact Session delivery pins, provider receipts and interrupt-then claims; Global Session provider bindings and native interrupt evidence\n${GLOBAL_ROLE_MESSAGE_SQL}`
+    },
+    {
+        version: 24,
+        name: "unify-home-layout",
+        introducedIn: "0.15.9",
+        // Unify every Yui self-managed path under a single canonical YUI_HOME. The
+        // managed Git worktrees move from the out-of-Home `defaultWorkspace` into
+        // `<home>/workspaces/{worktree,tasks}` and the provider runtimes from the
+        // `<home>.task-runtimes` sibling into `<home>/runtime/task-runtimes`. Only
+        // the durable Git worktree tree is physically relocated, by COPY (never
+        // rename-away): its replica is digest-verified against the source and
+        // atomically published while the original is PRESERVED as the rollback
+        // anchor; the regenerable task views and disposable runtimes are pointer
+        // rewrites only. The copied worktrees are then repaired, and only the
+        // persisted pointers the runtime trusts as live are rewritten. Frozen
+        // evidence (Context snapshots, terminal Run Git evidence, candidate
+        // snapshots, terminal Jobs, reports) and self-healing/self-rediscovered
+        // records (Task cwd, active Role workspaces, views, resource registry) are
+        // left intact; a queued/running Job bound under a relocating root is refused
+        // rather than silently moved. The data/filesystem transform is the
+        // substantive step; the SQL is inert.
+        sql: UNIFY_HOME_LAYOUT_SQL,
+        migrateData: migrateUnifyHomeLayout
+    },
+    {
+        version: 25,
+        name: "collapse-worktree-layout",
+        introducedIn: "0.15.9",
+        // Collapse the two-layer managed workspace layout into a single layer of real
+        // Git worktrees addressed by Task/owner and Project. Each managed worktree
+        // moves from its per-Project physical root
+        // (`<home>/workspaces/worktree/<projectName>/<taskKey>/<roleKey>`) to the
+        // location the v19 symlink view used to point at
+        // (`<home>/workspaces/tasks/<taskId>/<owner>/<projectDirectory>`), so the
+        // logical entry path and the physical worktree become the same directory and
+        // the symlink-view indirection is gone; an integration attempt moves under a
+        // new `tasks/<taskId>/integrations/<id>/` owner root, addressed by the bound
+        // Project directory rather than the Project name. Only the durable Git
+        // worktrees are physically relocated, by COPY (never rename-away): each
+        // replica is digest-verified against the source and atomically published over
+        // the regenerable view symlink while the original is PRESERVED as the
+        // rollback anchor. The copied worktrees are then repaired, and only the
+        // persisted pointers the runtime trusts as live are rewritten. Frozen
+        // evidence and self-healing records are left intact; a queued/running Job
+        // bound under a relocating worktree is refused rather than silently moved.
+        // The data/filesystem transform is the substantive step; the SQL is inert.
+        sql: COLLAPSE_WORKTREE_LAYOUT_SQL,
+        migrateData: migrateCollapseWorktreeLayout
+    },
+    {
+        version: 26,
+        name: "publication-candidate-adoption",
+        introducedIn: "0.15.12",
+        // Add optional Publication.headCommit (the observed PR/MR source head) and
+        // publication.candidate-adopted events binding publicationId, completionEventId,
+        // projectId, acceptedCommit/localCommit, acceptedTree/candidateTree, diffDigest,
+        // acceptance and by, optionally integrationId/integrationDigest. Derived
+        // task.archived mergeCoverage may also be uncovered or unverified.
+        // No stored delivery index and no inferred adoption or verification:
+        // valid old Publication, completion and archive payloads remain byte-identical.
+        sql: "SELECT 1; -- fixed acceptance-to-publication evidence; preserve all historical facts"
+    },
+    {
+        version: 27,
+        name: "bounded-provider-input-retry",
+        introducedIn: "0.16.0",
+        // Optional owned input/recovery records on the existing Provider binding;
+        // positive Driver transient evidence on StandardAgentError. No historical
+        // failures are scanned, scheduled, reclassified or replayed by upgrading.
+        sql: `
+-- ProviderTurn.input/retrySupported/failure; ProviderRuntimeBinding.retry/retryHistory/retryDisabled;
+-- optional error retryable and retryAfterMs facts. Index existing records only.
+CREATE INDEX idx_task_provider_retry ON role_session_sets(
+  json_extract(payload, '$.providerBinding.retry.status')
+) WHERE json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight');
+CREATE INDEX idx_global_provider_retry ON global_role_session_sets(
+  json_extract(payload, '$.providerBinding.retry.status')
+) WHERE json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight');
+`
     }
 ]);
 for (let index = 0; index < MIGRATIONS.length; index += 1) {
@@ -1386,8 +1538,14 @@ export function migrateSqliteSchema(db, options) {
             throw new SqliteSchemaMigrationError(`Storage version ${applied.currentVersion} requires an explicit upgrade to `
                 + `${CURRENT_STORAGE_VERSION}`, "admission");
         }
+        // Bound the applied steps to `throughVersion` (default and clamp: head), so a
+        // migration test can stop at one step's intermediate state while production
+        // always advances to head. The validate-mode guard above still fires on the
+        // FULL pending set — the bound never lets an ordinary open partially migrate.
+        const targetVersion = Math.min(options.throughVersion ?? CURRENT_STORAGE_VERSION, CURRENT_STORAGE_VERSION);
+        const toApply = pending.filter((migration) => migration.version <= targetVersion);
         const newlyApplied = [];
-        for (const migration of pending) {
+        for (const migration of toApply) {
             db.exec(migration.sql);
             migration.migrateData?.(db);
             const appliedAt = new Date().toISOString();
@@ -1400,12 +1558,16 @@ export function migrateSqliteSchema(db, options) {
         // earlier and is validated when the real upgrade later completes it).
         if (effectiveTarget >= CURRENT_STORAGE_VERSION)
             validateSchemaObjects(db);
-        return newlyApplied;
+        // The true head reached: the highest already-applied version or, when this
+        // run advanced the ledger, the last step it committed. Bounded runs report
+        // the intermediate head; an unbounded run reports CURRENT_STORAGE_VERSION.
+        const head = newlyApplied.at(-1) ?? applied.currentVersion;
+        return { newlyApplied, head };
     };
-    const newlyApplied = options.mode === "apply" && !db.inTransaction
+    const outcome = options.mode === "apply" && !db.inTransaction
         ? db.transaction(migrate)()
         : migrate();
-    return { applied: newlyApplied, version: CURRENT_STORAGE_VERSION };
+    return { applied: outcome.newlyApplied, version: outcome.head };
 }
 /** The names of every table the schema creates (for tests/introspection). */
 export const SQLITE_SCHEMA_TABLES = [
@@ -1421,6 +1583,7 @@ export const SQLITE_SCHEMA_TABLES = [
     "projects",
     "global_roles",
     "global_role_session_sets",
+    "global_role_messages",
     "global_sequences",
     "tasks_catalog",
     "managed_workspaces",

package/dist/storage/sqliteStore.js

@@ -38,6 +38,7 @@ import { existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import Database from "better-sqlite3";
+import { queryTaskCatalog } from "./taskCatalog.js";
 import { validatePluginValidation } from "../plugins/pluginPackage.js";
 import { validatePluginIntent, validatePluginIntentFailure } from "../plugins/pluginIntent.js";
 import { validateLocalResource, validateEnvironmentPreparation } from "../resources/projectResource.js";
@@ -45,6 +46,7 @@ import { validateConfiguredAgent } from "../agent/agent.js";
 import { validateTaskBrief } from "../brief/taskBrief.js";
 import { consumePendingBatch, mailboxTargetKey, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateContextSnapshot } from "../context/contextSnapshot.js";
+import { validateGlobalRoleMessage } from "../message/message.js";
 import { runPurposeAdmitsTaskState } from "../agentRun/agentRun.js";
 import { compareRuntimeSessionCandidates, projectRuntimeSessionCandidate } from "../runtime/runtimeSessionCandidate.js";
 import { sessionOwnerProcessKey } from "../runtime/sessionOwnerIdentity.js";
@@ -548,6 +550,8 @@ export class SqliteTaskStore {
             validateTaskRole(record);
         if (table === "global_roles")
             validateGlobalRole(record);
+        if (table === "global_role_messages")
+            validateGlobalRoleMessage(record);
         return record;
     }
     #sortById(rows, idOf) {
@@ -764,7 +768,7 @@ export class SqliteTaskStore {
                     activeRunRefs.push(`${task.id}/${run.id}`);
             }
             for (const attempt of this.listIntegrationAttempts(task.id)) {
-                if (attempt.status === "running" || attempt.status === "blocked") {
+                if (["running", "blocked", "conflicted", "validating"].includes(attempt.status)) {
                     unresolvedIntegrationRefs.push(`${task.id}/${attempt.id}`);
                 }
             }
@@ -855,6 +859,42 @@ export class SqliteTaskStore {
             this.#saveRuntimeSessionCandidate(sessions);
         });
     }
+    // -- global role messages ---------------------------------------------------
+    nextGlobalRoleMessageId() { return this.#nextGlobalId("global-message"); }
+    saveGlobalRoleMessage(message) {
+        validateGlobalRoleMessage(message);
+        this.#requireGlobalRole(message.roleName);
+        this.#mutate(() => {
+            const seq = this.#globalMessageSequence(message.id);
+            this.#db.prepare(`INSERT INTO global_role_messages (name, message_id, seq, payload, created_at) VALUES (?, ?, ?, ?, ?)`).run(message.roleName, message.id, seq, this.#json(message), message.createdAt);
+        });
+    }
+    listGlobalRoleMessages(roleName) {
+        return this.#sortById(this.#listPayload("global_role_messages", "name = ?", [roleName]), (message) => message.id);
+    }
+    updateGlobalRoleMessage(message) {
+        validateGlobalRoleMessage(message);
+        this.#requireGlobalRole(message.roleName);
+        this.#mutate(() => {
+            const seq = this.#globalMessageSequence(message.id);
+            const result = this.#db.prepare(`UPDATE global_role_messages SET seq = ?, payload = ? WHERE name = ? AND message_id = ?`).run(seq, this.#json(message), message.roleName, message.id);
+            if (result.changes === 0) {
+                throw new StorageRecordError(`Global message not found: ${message.roleName}/${message.id}`);
+            }
+        });
+    }
+    #requireGlobalRole(name) {
+        const row = this.#db.prepare("SELECT 1 FROM global_roles WHERE name = ?").get(name);
+        if (row === undefined)
+            throw new StorageRecordError(`Global Role not found: ${name}`);
+    }
+    /** A Global message id is `global-message-<n>`; its numeric tail is its seq. */
+    #globalMessageSequence(id) {
+        const match = /^global-message-([1-9]\d*)$/.exec(id);
+        if (match === null)
+            throw new StorageRecordError(`Global message id is invalid: ${id}`);
+        return Number(match[1]);
+    }
     // -- tasks ------------------------------------------------------------------
     nextTaskId() { return this.#nextGlobalId("task"); }
     saveTask(task) {
@@ -882,6 +922,15 @@ export class SqliteTaskStore {
         const tasks = this.#listPayload("task_records", "1=1", []);
         return this.#sortById(tasks, (task) => task.id);
     }
+    queryTaskCatalog(query) {
+        return queryTaskCatalog(this.#db, query);
+    }
+    listTaskChoices() {
+        const rows = this.#db.prepare(`SELECT c.task_id AS id, c.status,
+      json_extract(r.payload, '$.title') AS title
+      FROM tasks_catalog c JOIN task_records r ON r.task_id = c.task_id`).all();
+        return this.#sortById(rows, task => task.id);
+    }
     getTask(id) {
         return this.#getPayload("task_records", "task_id = ?", [id]);
     }
@@ -1228,6 +1277,13 @@ export class SqliteTaskStore {
     listRoleSessionSets(taskId) {
         return this.#sortById(this.#listPayload("role_session_sets", "task_id = ?", [taskId]), (set) => set.owner.roleName);
     }
+    listProviderRetrySessions() {
+        const pending = "json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight')";
+        return [
+            ...this.#listPayload("role_session_sets", pending, []),
+            ...this.#listPayload("global_role_session_sets", pending, [])
+        ];
+    }
     listRuntimeSessionCandidates(query = {}) {
         const taskIds = query.taskIds === undefined
             ? undefined

package/dist/storage/storageVersions.js

@@ -13,4 +13,4 @@
  * intermediate Yui releases.
  */
 export const MIN_SUPPORTED_STORAGE_VERSION = 1;
-export const CURRENT_STORAGE_VERSION = 19;
+export const CURRENT_STORAGE_VERSION = 27;

package/dist/storage/storeRpc.js

@@ -46,6 +46,7 @@ const READ_ONLY_STORE_METHODS = new Set([
     "getGlobalRole",
     "getGlobalRoleSessionSet",
     "listGlobalRoleSessionSets",
+    "listGlobalRoleMessages",
     "listTasks",
     "getTask",
     "readNextActionFacts",
@@ -71,6 +72,7 @@ const READ_ONLY_STORE_METHODS = new Set([
     "getRoleSessionSet",
     "getTaskRoleSessionSet",
     "listRoleSessionSets",
+    "listProviderRetrySessions",
     "listRuntimeSessionCandidates",
     "getRoleSession",
     "getWorkItem",

package/dist/storage/taskCatalog.js

@@ -0,0 +1,123 @@
+/** Current facts, not another persisted projection or execution status. */
+export const CATALOG_ATTENTION = [
+    "openInputs", "pendingOperations", "unknownOperations", "executionSignals"
+];
+/**
+ * All filtering/counting stays in SQLite. Only page-sized rows and fixed
+ * attention samples cross into JS; no Task/Run/Message/Event body is decoded.
+ * The existing catalog and record tables remain the only stored authorities.
+ */
+export function queryTaskCatalog(db, query) {
+    const scope = ["1=1"];
+    const params = { limit: query.limit };
+    if (query.taskId !== undefined) {
+        scope.push("c.task_id = @taskId");
+        params.taskId = query.taskId;
+    }
+    if (!query.all)
+        scope.push("c.status <> 'archived'");
+    const match = ["1=1"];
+    if (query.status !== undefined) {
+        match.push("status = @status");
+        params.status = query.status;
+    }
+    if (query.project !== undefined) {
+        match.push(`EXISTS (SELECT 1 FROM task_records r, json_each(r.payload, '$.projectBindings') p
+      WHERE r.task_id = facts.id AND json_extract(p.value, '$.projectId') = @project)`);
+        params.project = query.project;
+    }
+    if (query.search) {
+        match.push(`EXISTS (SELECT 1 FROM task_records r WHERE r.task_id = facts.id AND
+      (instr(lower(json_extract(r.payload, '$.title')), lower(@search)) > 0
+       OR instr(lower(r.task_id), lower(@search)) > 0
+       OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.tags') tag
+          WHERE instr(lower(tag.value), lower(@search)) > 0)
+       OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.projectBindings') b
+          JOIN projects p ON p.id = json_extract(b.value, '$.projectId')
+          WHERE instr(lower(json_extract(p.payload, '$.name')), lower(@search)) > 0)))`);
+        params.search = query.search;
+    }
+    if (query.attention !== undefined)
+        match.push(`${query.attention} > 0`);
+    const position = (name, op) => {
+        const value = query[name];
+        if (value === undefined)
+            return;
+        params[`${name}Date`] = value.createdAt;
+        params[`${name}Id`] = value.id;
+        match.push(`(createdAt, id) ${op} (@${name}Date, @${name}Id)`);
+    };
+    position("through", "<=");
+    // A fixed upper key excludes newly-created Tasks on later pages. Updates
+    // to mutable filters are current reads, not a snapshot/session protocol.
+    const after = [];
+    if (query.after !== undefined) {
+        params.afterDate = query.after.createdAt;
+        params.afterId = query.after.id;
+        after.push("(createdAt, id) > (@afterDate, @afterId)");
+    }
+    const count = (table, condition) => `(SELECT count(*) FROM ${table} x WHERE x.task_id = c.task_id AND (${condition}))`;
+    // Execution signals deliberately preserve raw inspectable conditions:
+    // live runs (including unknown admission/identity/stall), unresolved work,
+    // integrations, and pending Leader recovery. They are NOT a second
+    // classifier for working/blocked/success; precise execution stays in detail.
+    // Including all live runs is conservative: an off-page runtime attention
+    // cannot disappear just because a lightweight read did not fold its history.
+    const cte = `WITH facts AS MATERIALIZED (
+    SELECT c.task_id AS id, c.created_at AS createdAt, c.updated_at AS updatedAt, c.status,
+      ${count("work_items", "1=1")} AS workItems,
+      ${count("turns", "status = 'active'")} AS activeRuns,
+      ${count("input_requests", "status = 'open'")} AS openInputs,
+      ${count("durable_jobs", "status IN ('queued','running')")} AS pendingOperations,
+      ${count("durable_jobs", "status = 'unknown-needs-attention'")} AS unknownOperations,
+      CASE WHEN c.status IN ('active','draft') THEN
+        ${count("turns", "status = 'active'")} +
+        ${count("work_items", "status = 'open' OR (status = 'accepted' AND json_extract(payload, '$.currentExecutionGroupId') IS NOT NULL)")} +
+        ${count("integration_attempts", "status IN ('running','validating','blocked','conflicted','failed')")} +
+        ${count("review_rounds", "status IN ('pending','running','failed')")} +
+        ${count("task_projections", "kind = 'leader-failure' AND payload IS NOT NULL AND payload <> 'null'")} +
+        ${count("mailboxes", "role_name = 'leader' AND (json_type(pending) = 'object' OR json_type(processing) = 'object')")}
+      ELSE 0 END AS executionSignals
+    FROM tasks_catalog c WHERE ${scope.join(" AND ")}
+  ), matching AS MATERIALIZED (SELECT * FROM facts WHERE ${match.join(" AND ")})
+  SELECT
+    (SELECT json_group_array(json_object('status',status,'count',n))
+      FROM (SELECT status,count(*) n FROM facts GROUP BY status)) AS counts,
+    (SELECT count(*) FROM matching) AS total,
+    (SELECT json_object('id',id,'createdAt',createdAt) FROM matching
+      ORDER BY createdAt DESC,id DESC LIMIT 1) AS upper,
+    ${CATALOG_ATTENTION.map(kind => `
+      (SELECT sum(${kind}) FROM facts) AS ${kind}Count,
+      (SELECT count(*) FROM facts WHERE ${kind} > 0) AS ${kind}Tasks,
+      (SELECT json_group_array(id) FROM (SELECT id FROM facts WHERE ${kind} > 0
+        ORDER BY createdAt,id LIMIT 4)) AS ${kind}Ids`).join(",")},
+    (SELECT json_group_array(json_object(
+      'id',page.id,'createdAt',page.createdAt,'updatedAt',page.updatedAt,'status',page.status,
+      'title',substr(json_extract(r.payload,'$.title'),1,256),
+      'summary',substr(json_extract(r.brief,'$.leaderSummary'),1,512),
+      'summaryPresent',json(CASE WHEN r.brief IS NULL THEN 'false' ELSE 'true' END),
+      'workItems',page.workItems,'activeRuns',page.activeRuns,
+      'openInputs',page.openInputs,'pendingOperations',page.pendingOperations,
+      'unknownOperations',page.unknownOperations,'executionSignals',page.executionSignals)
+      ORDER BY page.createdAt,page.id)
+      FROM (SELECT * FROM matching ${after.length ? `WHERE ${after.join(" AND ")}` : ""}
+        ORDER BY createdAt,id LIMIT @limit) page
+      JOIN task_records r ON r.task_id = page.id) AS rows`;
+    const result = db.prepare(cte).get(params);
+    const counts = { draft: 0, active: 0, completed: 0, cancelled: 0, archived: 0, total: 0 };
+    for (const entry of JSON.parse(result.counts)) {
+        counts[entry.status] = entry.count;
+        counts.total += entry.count;
+    }
+    return {
+        rows: JSON.parse(result.rows),
+        total: result.total,
+        through: result.upper === null ? null : JSON.parse(result.upper),
+        counts,
+        attention: Object.fromEntries(CATALOG_ATTENTION.map(kind => [kind, {
+                count: Number(result[`${kind}Count`] ?? 0),
+                taskCount: Number(result[`${kind}Tasks`] ?? 0),
+                taskIds: JSON.parse(result[`${kind}Ids`])
+            }]))
+    };
+}

package/dist/storage/taskStore.js

@@ -448,6 +448,8 @@ export function storedPublicationReference(value) {
         fields.push("targetBranch");
     if (reference.localCommit !== undefined)
         fields.push("localCommit");
+    if (reference.headCommit !== undefined)
+        fields.push("headCommit");
     if (reference.remoteCommit !== undefined)
         fields.push("remoteCommit");
     if (reference.evidence !== undefined)

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -1,6 +1,7 @@
-import { basename, dirname, join } from "node:path";
+import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import Database from "better-sqlite3";
+import { inspectAgentHostCompatibility, describeAgentHostUpgradeBlockers } from "../../runtime/agentHostCompatibility.js";
 import { RUNTIME_OBSERVATION_TASK_EVENT, createRuntimeObservation } from "../../runtime/runtimeObservation.js";
 import { RUNTIME_PROCESS_EXIT_TASK_EVENT, validateRuntimeProcessExitObservation } from "../../runtime/processExitObservation.js";
 import { validateAgentProfile } from "../../profile/agentProfile.js";
@@ -10,6 +11,9 @@ import { validateRun } from "../../agentRun/agentRun.js";
 import { validateDurableJob } from "../../job/durableJob.js";
 import { validateWorkItem } from "../../workItem/workItem.js";
 import { SqliteTaskStore } from "../sqliteStore.js";
+import { storageBackupRoot } from "../homeLayout.js";
+import { preflightUnifyHomeLayout } from "../migrations/unifyHomeLayout.js";
+import { preflightCollapseWorktreeLayout } from "../migrations/collapseWorktreeLayout.js";
 import { migrateSqliteSchema, storageMigrationPlan } from "../sqliteSchema.js";
 import { CURRENT_DATABASE_FILENAME, inspectStorageSchema } from "../storageSchema.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "../storageVersions.js";
@@ -38,6 +42,15 @@ export async function runStorageUpgrade(options) {
             ? classification.classification.blocker.action
             : "Use a compatible Yui release.");
     }
+    const incompatibleHosts = await inspectAgentHostCompatibility(options.home);
+    if (incompatibleHosts.length > 0) {
+        return {
+            ...blocked(state.status === "current" ? currentClassification() : migratableClassification(state.currentVersion), "host-compatibility", `Existing Agent Hosts cannot safely use the target Controller/storage:\n${describeAgentHostUpgradeBlockers(incompatibleHosts)}`, "Keep the current Controller, Home and Host processes unchanged. Inspect the named Sessions and original pending "
+                + "inputs/results; let current work settle, then use explicitly authorized Session replacement/cleanup at a safe "
+                + "boundary before retrying the upgrade. This target cannot hot-patch legacy Host memory."),
+            hosts: incompatibleHosts
+        };
+    }
     if (state.status === "current") {
         try {
             validateCurrentStore(options.home);
@@ -73,6 +86,21 @@ export async function runStorageUpgrade(options) {
             + `to ${CURRENT_STORAGE_VERSION}.`), "corruption", "The storage migration registry is incomplete.", "Install a Yui release that carries the complete migration chain.");
     }
     const classification = migratableClassification(state.currentVersion);
+    // Genuine pre-migration safety check, shared by ALL migrating modes. The
+    // unify-home data migration (18->19) physically relocates on-disk trees and
+    // rewrites live launch pointers, so before any mode proceeds we run its READ-
+    // ONLY preflight and refuse up front on the same conditions the migration would
+    // throw on inside the apply transaction: a queued/running Job bound under a
+    // relocating root, or a conflicting relocation target. The migration is applied
+    // offline (after the operator has stopped this Home's writers), so the preflight
+    // does not scan for live processes. Surfacing these here — before the Controller
+    // is stopped or a backup is taken — is what makes `--dry-run` and the updater's
+    // `--update-preflight` a genuine readiness signal rather than a mere list of
+    // schema steps, while the in-transaction checks remain the authoritative guard
+    // against anything that starts after this point.
+    const migrationBlocked = preflightMigrationBlockers(options.home, plan, classification);
+    if (migrationBlocked !== null)
+        return migrationBlocked;
     if (options.mode === "update-preflight") {
         return {
             outcome: "update-preflight",
@@ -223,7 +251,10 @@ async function createDatabaseBackup(home, sourceVersion, now) {
     const source = join(home, CURRENT_DATABASE_FILENAME);
     if (!existsSync(source))
         throw new Error("The authoritative yui.db is missing.");
-    const backupDirectory = join(dirname(home), `${basename(home)}-backups`);
+    // Backups live inside Home so a single canonical root contains every
+    // self-managed artifact; the upgrade fence still protects them from the
+    // live database because they are a distinct partition from yui.db.
+    const backupDirectory = storageBackupRoot(home);
     mkdirSync(backupDirectory, { recursive: true, mode: 0o700 });
     const timestamp = now.toISOString().replaceAll(":", "-");
     const backupPath = join(backupDirectory, `pre-storage-v${sourceVersion}-${timestamp}.db`);
@@ -313,6 +344,68 @@ function blocked(classification, stage, message, action) {
         sceneUnchanged: true
     };
 }
+/**
+ * Run each path-relocating data migration's READ-ONLY preflight against the
+ * current (pre-upgrade) database and, when any finds a blocker, return a
+ * `blocked` result the caller surfaces before touching the Controller or the
+ * Home. Returns `null` when the plan carries no path-relocating data migration,
+ * or when every preflight is clear.
+ *
+ * Both the 18->19 unify and the 19->20 collapse migrations physically relocate
+ * managed worktrees and share the same blocker shape (in-flight Job, conflicting
+ * relocation target). When a Home is upgraded across both in one run, their
+ * blockers are aggregated so the operator sees every readiness problem at once.
+ *
+ * The database is opened read-only so the checks cannot mutate the authoritative
+ * store, and the handle is always closed. An unexpected failure to evaluate a
+ * preflight is itself a fail-closed blocker: we must not advance to an
+ * irreversible migration on an unverifiable readiness signal.
+ */
+function preflightMigrationBlockers(home, plan, classification) {
+    const relocatesUnify = plan.some((step) => step.name === "unify-home-layout");
+    const relocatesCollapse = plan.some((step) => step.name === "collapse-worktree-layout");
+    // Only meaningful when the plan actually includes a path-relocating migration.
+    if (!relocatesUnify && !relocatesCollapse)
+        return null;
+    let blockers;
+    try {
+        const database = new Database(join(home, CURRENT_DATABASE_FILENAME), {
+            readonly: true,
+            fileMustExist: true
+        });
+        try {
+            blockers = [];
+            if (relocatesUnify)
+                blockers.push(...preflightUnifyHomeLayout(database).blockers);
+            if (relocatesCollapse)
+                blockers.push(...preflightCollapseWorktreeLayout(database).blockers);
+        }
+        finally {
+            database.close();
+        }
+    }
+    catch (error) {
+        return {
+            ...blocked(classification, "in-flight", `The storage migration readiness check could not be completed: ${messageOf(error)}`, "Resolve the reported problem, confirm no Job is queued or running against a managed "
+                + "workspace, then rerun the upgrade.")
+        };
+    }
+    if (blockers.length === 0)
+        return null;
+    return {
+        outcome: "blocked",
+        stage: "in-flight",
+        message: "Refusing to migrate: the Home is not safe to relocate under the current layout yet. "
+            + blockers.map((entry) => entry.detail).join("; ") + ".",
+        action: "Resolve the reported condition(s) — let a queued/running Job finish or cancel it, and "
+            + "clear any conflicting relocation target — then rerun the upgrade. The migration is applied "
+            + "offline, so first confirm the Controller and any execution writers for this Home are "
+            + "stopped. The authoritative Home is unchanged.",
+        blockers: blockers.map((entry) => ({ reason: entry.reason, detail: entry.detail })),
+        classification,
+        sceneUnchanged: true
+    };
+}
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }