@zq-silk/yui 0.16.1 → 1.0.0-alpha

package/dist/storage/sqliteStore.js

@@ -12,7 +12,7 @@
  *                                    the write transaction; conflict ->
  *                                    StorageConflictError (transactionWithRevisionCas).
  *   - Atomic durable write ........ WAL + synchronous=FULL; COMMIT == fsync.
- *   - Mailbox per-target ordering . WorkMailbox v2 sequence/cursors in one row.
+ *   - Mailbox per-target ordering . WorkMailbox sequence/cursors in one row.
  *   - Exactly-once terminal state . conditional updates + UNIQUE(request_id)
  *                                    on the durable outbox.
  *   - Crash recovery .............. WAL rollback of uncommitted transactions;
@@ -62,8 +62,9 @@ import { gateArtifactKey, validateGateArtifact } from "../verification/gateArtif
 import { validateWorkItem } from "../workItem/workItem.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { contextInputReferences, queryContextRecords } from "./contextRecords.js";
-import { inspectSqliteSchemaMigrations, migrateSqliteSchema, SqliteSchemaMigrationError, TELEMETRY_KEEP_PER_RUN, TELEMETRY_RUN_CAP } from "./sqliteSchema.js";
+import { initializeSqliteSchema, validateSqliteSchema, SqliteSchemaError, TELEMETRY_KEEP_PER_RUN, TELEMETRY_RUN_CAP } from "./sqliteSchema.js";
 import { StorageSchemaError } from "./storageSchema.js";
+import { STORAGE_FORMAT } from "./storageVersions.js";
 import { queryTaskCatalog } from "./taskCatalog.js";
 import { CURRENT_CONFIG_SCHEMA_VERSION, CURRENT_WORK_MAILBOX_SCHEMA_VERSION, executionLaneActiveRunKey, executionLaneActiveRunKeyParts, isValidCapabilityGrantTransition, isValidReleaseWorkflowTransition, pendingWakeupProjection, StorageCancelledError, StorageConflictError, StorageRecordError, storedCapabilityGrant, storedPublicationReference, storedReleaseWorkflow, validateYuiConfig } from "./taskStore.js";
 /** Read the immutable Home identity without opening a writable Store connection. */
@@ -139,7 +140,8 @@ export class SqliteTaskStore {
     #dirty = false;
     constructor(rootDir, _options = {}) {
         this.#rootDir = rootDir;
-        mkdirSync(rootDir, { recursive: true, mode: 0o700 });
+        if (!_options.readonly)
+            mkdirSync(rootDir, { recursive: true, mode: 0o700 });
         const filename = _options.databaseFilename ?? "yui.db";
         const databasePath = join(rootDir, filename);
         // Remember whether the database file existed before this connection opened
@@ -147,18 +149,17 @@ export class SqliteTaskStore {
         // may seed its singleton rows; a store that opens an existing file missing
         // those rows has found corruption, not a bootstrap opportunity.
         const databaseExisted = existsSync(databasePath);
-        this.#db = new Database(databasePath);
+        this.#db = new Database(databasePath, _options.readonly ? { readonly: true, fileMustExist: true } : {});
         try {
+            const existingSchema = databaseExisted ? validateSqliteSchema(this.#db) : undefined;
             // §4.1 / §9: WAL, no fsync weakening, FKs on, busy timeout for CLI contention.
-            this.#db.pragma("journal_mode = WAL");
+            if (!_options.readonly)
+                this.#db.pragma("journal_mode = WAL");
             this.#db.pragma("synchronous = FULL");
             this.#db.pragma("foreign_keys = ON");
             this.#db.pragma("busy_timeout = 5000");
             this.#db.pragma("wal_autocheckpoint = 1000");
-            migrateSqliteSchema(this.#db, {
-                mode: !databaseExisted ? "apply" : "validate"
-            });
-            const schema = inspectSqliteSchemaMigrations(this.#db);
+            const schema = existingSchema ?? initializeSqliteSchema(this.#db);
             this.#openedSchemaHead = {
                 version: schema.currentVersion,
                 checksum: schema.currentChecksum
@@ -309,12 +310,13 @@ export class SqliteTaskStore {
     }
     /** Verify the SQLite schema head at the single write boundary. */
     #prepareWrite() {
-        const current = this.#db.prepare("SELECT version, checksum FROM schema_migrations ORDER BY version DESC LIMIT 1").get();
-        if (current?.version !== this.#openedSchemaHead.version
+        const current = this.#db.prepare("SELECT format, major || '.' || minor AS version, checksum FROM storage_schema WHERE id=1").get();
+        if (current?.format !== STORAGE_FORMAT
+            || current.version !== this.#openedSchemaHead.version
             || current.checksum !== this.#openedSchemaHead.checksum) {
-            throw new SqliteSchemaMigrationError(`open Store schema head ${this.#openedSchemaHead.version}/${this.#openedSchemaHead.checksum} `
+            throw new SqliteSchemaError(`open Store format ${STORAGE_FORMAT} found ${String(current?.format)}; schema head ${this.#openedSchemaHead.version}/${this.#openedSchemaHead.checksum} `
                 + `changed to ${String(current?.version)}/${String(current?.checksum)}; `
-                + "reopen the Store with the active Yui version before writing", "admission");
+                + "reopen the Store with the active Yui version before writing");
         }
     }
     #bumpRevision() {
@@ -1754,7 +1756,7 @@ export class SqliteTaskStore {
     // -- active turns ----------------------------------------------------------
     #saveActiveRun(taskId, pointer, runId) {
         this.#mutate(() => {
-            const payload = this.#json({ schemaVersion: 3, runId });
+            const payload = this.#json({ schemaVersion: 1, runId });
             this.#db.prepare(`INSERT INTO active_turns (task_id, pointer, turn_id, payload, updated_at) VALUES (?, ?, ?, ?, ?)
          ON CONFLICT(task_id, pointer) DO UPDATE SET turn_id = excluded.turn_id, payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, pointer, runId, payload, this.#now());
         });

package/dist/storage/storageSchema.js

@@ -1,8 +1,8 @@
 import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import Database from "better-sqlite3";
-import { inspectSqliteSchemaMigrations, storageMigrationPlan } from "./sqliteSchema.js";
-import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
+import { inspectSqliteSchema, storageMinorUpgradePlan, SqliteSchemaError } from "./sqliteSchema.js";
+import { compareStorageVersions, CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
 export { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
 export const CURRENT_DATABASE_FILENAME = "yui.db";
 export class StorageSchemaError extends Error {
@@ -47,7 +47,7 @@ export function inspectStorageSchema(rootDir) {
         return invalid(databasePath, error);
     }
     try {
-        const migration = inspectSqliteSchemaMigrations(database);
+        const migration = inspectSqliteSchema(database);
         const fields = {
             currentVersion: migration.currentVersion,
             latestVersion: CURRENT_STORAGE_VERSION,
@@ -57,13 +57,13 @@ export function inspectStorageSchema(rootDir) {
         if (migration.currentVersion === CURRENT_STORAGE_VERSION) {
             return { status: "current", ...fields };
         }
-        if (migration.currentVersion > CURRENT_STORAGE_VERSION) {
+        if (compareStorageVersions(migration.currentVersion, CURRENT_STORAGE_VERSION) > 0) {
             return { status: "unsupported", direction: "newer", ...fields };
         }
-        if (migration.currentVersion < MIN_SUPPORTED_STORAGE_VERSION) {
+        if (compareStorageVersions(migration.currentVersion, MIN_SUPPORTED_STORAGE_VERSION) < 0) {
             return { status: "unsupported", direction: "older", ...fields };
         }
-        const plan = storageMigrationPlan(migration.currentVersion);
+        const plan = storageMinorUpgradePlan(migration.currentVersion);
         if (plan === null) {
             return {
                 status: "invalid",
@@ -114,6 +114,7 @@ function invalid(databasePath, error) {
         latestVersion: CURRENT_STORAGE_VERSION,
         minimumSupportedVersion: MIN_SUPPORTED_STORAGE_VERSION,
         databasePath,
-        detail: error instanceof Error ? error.message : String(error)
+        detail: error instanceof Error ? error.message : String(error),
+        reason: error instanceof SqliteSchemaError && error.code === "STORAGE_FORMAT_UNSUPPORTED" ? "format" : "corruption"
     };
 }

package/dist/storage/storageVersions.js

@@ -1,16 +1,23 @@
-/**
- * The one durable compatibility axis for a Yui Home.
- *
- * Version 1 is the clean baseline introduced by Yui 0.15.0: SQLite's migration
- * ledger is authoritative and the historical layout/aggregate/record-version
- * manifest is not part of the active Home. Pre-0.15.0 Homes are outside this
- * compatibility line and remain untouched.
- *
- * Runtime code reads only {@link CURRENT_STORAGE_VERSION}. The explicit
- * upgrade boundary carries every forward migration from
- * {@link MIN_SUPPORTED_STORAGE_VERSION} to the current version so one target
- * CLI can upgrade any valid Home in that interval without installing
- * intermediate Yui releases.
- */
-export const MIN_SUPPORTED_STORAGE_VERSION = 1;
-export const CURRENT_STORAGE_VERSION = 37;
+export const CURRENT_STORAGE_VERSION = "1.0";
+export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
+export const STORAGE_FORMAT = "yui-home";
+export function isStorageVersion(value) {
+    if (typeof value !== "string" || !/^[1-9]\d*\.(0|[1-9]\d*)$/u.test(value))
+        return false;
+    return value.split(".").every(part => Number.isSafeInteger(Number(part)));
+}
+export function storageVersionParts(value) {
+    if (!isStorageVersion(value))
+        throw new Error(`Invalid storage version: ${String(value)}.`);
+    const [major, minor] = value.split(".").map(Number);
+    return { major: major, minor: minor };
+}
+export function compareStorageVersions(left, right) {
+    const a = storageVersionParts(left), b = storageVersionParts(right);
+    return Math.sign(a.major - b.major || a.minor - b.minor);
+}
+/** Cross-major conversion is never an ordinary update, even if explicitly pinned. */
+export function isMinorStorageUpgrade(from, to) {
+    const a = storageVersionParts(from), b = storageVersionParts(to);
+    return a.major === b.major && b.minor > a.minor;
+}

package/dist/storage/taskStore.js

@@ -9,30 +9,10 @@ import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
 import { validatePublicationReference } from "../task/publicationReference.js";
 import { validateTaskRecordReference } from "../task/taskRecordReference.js";
-export const CURRENT_CONFIG_SCHEMA_VERSION = 6;
-/** Current SQLite payload-family versions owned by this storage boundary. */
-export const CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION = 2;
-export const CURRENT_PROJECT_SCHEMA_VERSION = 6;
-export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 3;
-export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
-export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 5;
-export const CURRENT_TASK_SCHEMA_VERSION = 7;
-export const CURRENT_TASK_BRIEF_SCHEMA_VERSION = 2;
-export const CURRENT_CONTEXT_SNAPSHOT_SCHEMA_VERSION = 1;
-export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 4;
-export const CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION = 2;
-export const CURRENT_WORK_ITEM_SCHEMA_VERSION = 15;
-export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 8;
-export const CURRENT_CHANGE_SET_SCHEMA_VERSION = 4;
-export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 6;
-export const CURRENT_MESSAGE_SCHEMA_VERSION = 3;
-export const CURRENT_INPUT_REQUEST_SCHEMA_VERSION = 3;
-export const CURRENT_DECISION_SCHEMA_VERSION = 1;
-export const CURRENT_MILESTONE_SCHEMA_VERSION = 2;
-export const CURRENT_EVENT_SCHEMA_VERSION = 2;
-export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 2;
+export const CURRENT_CONFIG_SCHEMA_VERSION = 1;
+export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 1;
 export const CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION = 1;
-export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 5;
+export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 1;
 export const CURRENT_PUBLICATION_REFERENCE_SCHEMA_VERSION = 1;
 export const CURRENT_PENDING_WAKEUP_SCHEMA_VERSION = 1;
 export const COMPLETION_SHELLS = ["bash", "zsh", "fish"];
@@ -62,12 +42,6 @@ export function executionLaneActiveRunKeyParts(key) {
         return null;
     }
 }
-/**
- * Nested-record versions consumed by the current SQLite payload validators.
- */
-export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 12;
-export const CURRENT_RUN_SCHEMA_VERSION = 5;
-export const CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION = 1;
 export class StorageRecordError extends Error {
     constructor(message) { super(message); this.name = "StorageRecordError"; }
 }

package/dist/storage/upgrade/upgradeOrchestrator.js

@@ -1,22 +1,15 @@
 import { join } from "node:path";
 import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import Database from "better-sqlite3";
-import { inspectAgentHostCompatibility, describeAgentHostUpgradeBlockers } from "../../runtime/agentHostCompatibility.js";
 import { RUNTIME_OBSERVATION_TASK_EVENT, createRuntimeObservation } from "../../runtime/runtimeObservation.js";
 import { RUNTIME_PROCESS_EXIT_TASK_EVENT, validateRuntimeProcessExitObservation } from "../../runtime/processExitObservation.js";
 import { SqliteTaskStore } from "../sqliteStore.js";
 import { storageBackupRoot } from "../homeLayout.js";
-import { preflightUnifyHomeLayout } from "../migrations/unifyHomeLayout.js";
-import { preflightCollapseWorktreeLayout } from "../migrations/collapseWorktreeLayout.js";
-import { preflightNotificationOnlyWakes } from "../migrations/notificationOnlyWakes.js";
-import { preflightVerificationPolicy } from "../migrations/verificationPolicy.js";
-import { preflightCurrentInputContract } from "../migrations/currentInputContract.js";
-import { preflightCurrentRuntimeContract } from "../migrations/currentRuntimeContract.js";
-import { migrateSqliteSchema, storageMigrationPlan } from "../sqliteSchema.js";
+import { applySqliteMinorUpgrades, storageMinorUpgradePlan } from "../sqliteSchema.js";
 import { CURRENT_DATABASE_FILENAME, inspectStorageSchema } from "../storageSchema.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "../storageVersions.js";
 /**
- * Upgrade one valid Home through the complete linear migration chain.
+ * Upgrade only recognized minor versions within the current Home major.
  *
  * Supported earlier versions are readable only here. Ordinary stores still
  * admit exactly {@link CURRENT_STORAGE_VERSION}; no old-shape normalizer or
@@ -30,6 +23,13 @@ export async function runStorageUpgrade(options) {
         return blocked({ ...corruptedClassification("Storage is not initialized."), uninitialized: true }, "uninitialized", "Yui storage is not initialized for this Home.", "Run `yui setup` with a new Home.");
     }
     if (state.status === "invalid") {
+        if (state.reason === "format") {
+            return blocked({
+                classification: { verdict: "UNSUPPORTED_FORMAT", status: "unsupported", detail: state.detail },
+                currentStorageVersion: CURRENT_STORAGE_VERSION,
+                minimumSupportedStorageVersion: MIN_SUPPORTED_STORAGE_VERSION
+            }, "unsupported", state.detail, "Keep this Home unchanged and use its matching release or the independent explicit conversion tool. Ordinary upgrades never cross storage formats.");
+        }
         return blocked(corruptedClassification(state.detail), "corruption", `Storage is invalid: ${state.detail}`, "Preserve this Home for diagnosis and restore it from a known-good backup.");
     }
     if (state.status === "unsupported") {
@@ -40,15 +40,6 @@ export async function runStorageUpgrade(options) {
             ? classification.classification.blocker.action
             : "Use a compatible Yui release.");
     }
-    const incompatibleHosts = await inspectAgentHostCompatibility(options.home);
-    if (incompatibleHosts.length > 0) {
-        return {
-            ...blocked(state.status === "current" ? currentClassification() : migratableClassification(state.currentVersion), "host-compatibility", `Existing Agent Hosts cannot safely use the target Controller/storage:\n${describeAgentHostUpgradeBlockers(incompatibleHosts)}`, "Keep the current Controller, Home and Host processes unchanged. Inspect the named Sessions and original pending "
-                + "inputs/results; let current work settle, then use explicitly authorized Session replacement/cleanup at a safe "
-                + "boundary before retrying the upgrade. This target cannot hot-patch legacy Host memory."),
-            hosts: incompatibleHosts
-        };
-    }
     if (state.status === "current") {
         try {
             validateCurrentStore(options.home);
@@ -78,27 +69,12 @@ export async function runStorageUpgrade(options) {
             }
         };
     }
-    const plan = storageMigrationPlan(state.currentVersion);
+    const plan = storageMinorUpgradePlan(state.currentVersion);
     if (plan === null) {
         return blocked(corruptedClassification(`No complete migration path exists from ${state.currentVersion} `
-            + `to ${CURRENT_STORAGE_VERSION}.`), "corruption", "The storage migration registry is incomplete.", "Install a Yui release that carries the complete migration chain.");
+            + `to ${CURRENT_STORAGE_VERSION}.`), "corruption", "The storage migration registry is incomplete.", "Use a release with an explicit same-major minor upgrade path; cross-major conversion is separate.");
     }
     const classification = migratableClassification(state.currentVersion);
-    // Genuine pre-migration safety check, shared by ALL migrating modes. The
-    // unify-home data migration (18->19) physically relocates on-disk trees and
-    // rewrites live launch pointers, so before any mode proceeds we run its READ-
-    // ONLY preflight and refuse up front on the same conditions the migration would
-    // throw on inside the apply transaction: a queued/running Job bound under a
-    // relocating root, or a conflicting relocation target. The migration is applied
-    // offline (after the operator has stopped this Home's writers), so the preflight
-    // does not scan for live processes. Surfacing these here — before the Controller
-    // is stopped or a backup is taken — is what makes `--dry-run` and the updater's
-    // `--update-preflight` a genuine readiness signal rather than a mere list of
-    // schema steps, while the in-transaction checks remain the authoritative guard
-    // against anything that starts after this point.
-    const migrationBlocked = preflightMigrationBlockers(options.home, plan, classification);
-    if (migrationBlocked !== null)
-        return migrationBlocked;
     if (options.mode === "update-preflight") {
         return {
             outcome: "update-preflight",
@@ -144,7 +120,7 @@ export async function runStorageUpgrade(options) {
             database.pragma("synchronous = FULL");
             database.pragma("foreign_keys = ON");
             database.pragma("busy_timeout = 5000");
-            migrateSqliteSchema(database, { mode: "apply" });
+            applySqliteMinorUpgrades(database);
             migrationCommitted = true;
         }
         finally {
@@ -201,7 +177,7 @@ export async function runStorageUpgrade(options) {
     };
 }
 function validateCurrentStore(home) {
-    const store = new SqliteTaskStore(home);
+    const store = new SqliteTaskStore(home, { readonly: true });
     try {
         store.validateCurrentRecords();
         for (const taskId of store.listTasks().map(({ id }) => id)) {
@@ -284,7 +260,7 @@ function unsupportedClassification(state) {
     const action = future
         ? "Use a newer Yui release."
         : "Preserve this Home for use with its matching historical Yui release, "
-            + "or initialize a new Home with Yui 0.15.0 or later.";
+            + "or use the independent explicit converter for a different storage major.";
     return {
         classification: {
             verdict: "NEEDS_NEW_VERSION",
@@ -320,80 +296,6 @@ function blocked(classification, stage, message, action) {
         sceneUnchanged: true
     };
 }
-/**
- * Run each data migration's registered READ-ONLY preflight against the
- * current (pre-upgrade) database and, when any finds a blocker, return a
- * `blocked` result the caller surfaces before touching the Controller or the
- * Home. Returns `null` when the plan carries no registered readiness check,
- * or when every preflight is clear.
- *
- * Both the 23->24 unify and the 24->25 collapse migrations physically relocate
- * managed worktrees and share the same blocker shape (in-flight Job, conflicting
- * relocation target). When a Home is upgraded across both in one run, their
- * blockers are aggregated so the operator sees their readiness problems together.
- * Notification retirement separately rejects unsettled execution references.
- *
- * The database is opened read-only so the checks cannot mutate the authoritative
- * store, and the handle is always closed. An unexpected failure to evaluate a
- * preflight is itself a fail-closed blocker: we must not advance to an
- * irreversible migration on an unverifiable readiness signal.
- */
-function preflightMigrationBlockers(home, plan, classification) {
-    const relocatesUnify = plan.some((step) => step.name === "unify-home-layout");
-    const relocatesCollapse = plan.some((step) => step.name === "collapse-worktree-layout");
-    const retiresRunWakes = plan.some((step) => step.name === "notification-only-wakes");
-    const changesVerification = plan.some(step => step.name === "advisory-and-verification-policy");
-    const changesInput = plan.some(step => step.name === "current-input-contract");
-    const retiresRuntime = plan.some(step => step.name === "current-verification-and-owner-contract");
-    if (!relocatesUnify && !relocatesCollapse && !retiresRunWakes && !changesVerification && !changesInput && !retiresRuntime)
-        return null;
-    let blockers;
-    try {
-        const database = new Database(join(home, CURRENT_DATABASE_FILENAME), {
-            readonly: true,
-            fileMustExist: true
-        });
-        try {
-            blockers = [];
-            if (relocatesUnify)
-                blockers.push(...preflightUnifyHomeLayout(database).blockers);
-            if (relocatesCollapse)
-                blockers.push(...preflightCollapseWorktreeLayout(database).blockers);
-            if (retiresRunWakes)
-                preflightNotificationOnlyWakes(database);
-            if (changesVerification)
-                preflightVerificationPolicy(database);
-            if (changesInput)
-                preflightCurrentInputContract(database);
-            if (retiresRuntime)
-                preflightCurrentRuntimeContract(database);
-        }
-        finally {
-            database.close();
-        }
-    }
-    catch (error) {
-        return {
-            ...blocked(classification, "in-flight", `The storage migration readiness check could not be completed: ${messageOf(error)}`, "Resolve the named execution or resource boundary, preserving original input and results. "
-                + "Confirm the relevant Runs and Jobs are settled, then rerun the upgrade.")
-        };
-    }
-    if (blockers.length === 0)
-        return null;
-    return {
-        outcome: "blocked",
-        stage: "in-flight",
-        message: "Refusing to migrate: the Home is not safe to relocate under the current layout yet. "
-            + blockers.map((entry) => entry.detail).join("; ") + ".",
-        action: "Resolve the reported condition(s) — let a queued/running Job finish or cancel it, and "
-            + "clear any conflicting relocation target — then rerun the upgrade. The migration is applied "
-            + "offline, so first confirm the Controller and any execution writers for this Home are "
-            + "stopped. The authoritative Home is unchanged.",
-        blockers: blockers.map((entry) => ({ reason: entry.reason, detail: entry.detail })),
-        classification,
-        sceneUnchanged: true
-    };
-}
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/task/nextAction.js

@@ -91,24 +91,7 @@ export function projectNextAction(facts) {
                         ref: refs[1]
                     }
                 ],
-                recommendedCommand: `yui task work edit ${task.id}/${dependencyIssue.workItemId} --clear-dependencies`
-            });
-        }
-        const draftWork = selectOpenWorkItem(facts.workItems);
-        if (draftWork.kind === "blocked") {
-            const refs = [
-                ref("work-item", draftWork.itemId),
-                ref("work-item", draftWork.blockedBy)
-            ];
-            return buildAction(facts, {
-                kind: "repair-protocol-inconsistency",
-                reason: `Draft Work Item ${draftWork.itemId} depends on ${draftWork.blockedBy}, which is missing, retired, or not completed. Edit the Draft before activation.`,
-                refs,
-                conflicts: refs,
-                preconditions: [
-                    { fact: `Draft dependency ${draftWork.blockedBy} is valid`, satisfied: false, ref: refs[1] }
-                ],
-                recommendedCommand: `yui task work edit ${task.id}/${draftWork.itemId} --clear-dependencies`
+                ...dependencyJudgment(task.id, dependencyIssue.workItemId)
             });
         }
         return buildAction(facts, {
@@ -323,18 +306,24 @@ export function projectNextAction(facts) {
     }
     const openWork = selectOpenWorkItem(facts.workItems);
     if (openWork?.kind === "blocked") {
+        const issue = draftWorkItemDependencyIssue(facts.workItems);
+        const itemId = issue?.workItemId ?? openWork.itemId;
+        const dependencyId = issue?.dependencyId ?? openWork.blockedBy;
         const refs = [
-            ref("work-item", openWork.itemId),
-            ref("work-item", openWork.blockedBy)
+            ref("work-item", itemId),
+            ref("work-item", dependencyId)
         ];
         return buildAction(facts, {
             kind: "repair-protocol-inconsistency",
-            reason: `Work Item ${openWork.itemId} depends on ${openWork.blockedBy}, which is not completed or available.`,
+            reason: issue?.kind === "cycle"
+                ? `Work Item dependency cycle includes ${itemId}/${dependencyId}.`
+                : `Work Item ${itemId} depends on ${dependencyId}, which is ${issue === undefined ? "not completed" : "missing or retired"}.`,
             refs,
             conflicts: refs,
             preconditions: [
-                { fact: `Dependency ${openWork.blockedBy} is completed`, satisfied: false, ref: refs[1] }
-            ]
+                { fact: `Dependency ${dependencyId} is valid and completed`, satisfied: false, ref: refs[1] }
+            ],
+            ...dependencyJudgment(task.id, itemId)
         });
     }
     if (openWork?.kind === "ready") {
@@ -769,6 +758,27 @@ function reviewRoundConflict(round, activeRuns) {
     }
     return null;
 }
+function dependencyJudgment(taskId, workItemId) {
+    return {
+        recommendedCommand: `yui task work show ${taskId}/${workItemId}`,
+        alternatives: [
+            {
+                kind: "inspect-dependencies",
+                reason: "Read the related requirements and dependency records before choosing a repair.",
+                recommendedCommand: `yui task work list ${taskId}`
+            },
+            {
+                kind: "revise-dependencies",
+                reason: "If the intended dependency graph is wrong, edit the affected WorkItem with --after for the complete intended set, preserving unrelated valid dependencies."
+            },
+            {
+                kind: "retire-obsolete-work",
+                reason: "Only if the requirement is no longer needed, deliberately retire it and reconcile its dependents."
+            }
+        ],
+        judgmentRequired: "The records identify a blocked dependency, not which business requirement or edge is wrong. Determine the intended graph from Task requirements; do not infer permission to delete dependencies."
+    };
+}
 function selectOpenWorkItem(workItems) {
     const byId = new Map(workItems.map((item) => [item.id, item]));
     const openItems = workItems.filter((item) => OPEN_WORK_ITEM_STATUSES.has(item.status));

package/dist/task/task.js

@@ -3,7 +3,7 @@ import { cancelTaskActivationRequest, recordTaskActivationEvidence, validateTask
 export function createTask(id, title, now, metadata = {}) {
     const timestamp = now.toISOString();
     return {
-        schemaVersion: 7,
+        schemaVersion: 1,
         id: requireSafeIdentity(id, "Task id"),
         title: requireText(title, "Task title"),
         ...cloneMetadata(metadata),
@@ -16,7 +16,7 @@ export function createTask(id, title, now, metadata = {}) {
 /**
  * Persist the Task's durable workspace identity. The identity is immutable on
  * the Task: a second binding is rejected so restart/reconcile/attach can never
- * silently adopt a different (foreign or legacy) ref namespace.
+ * silently adopt a different workspace ref namespace.
  */
 export function bindTaskWorkspaceIdentity(task, identity, now) {
     validateTask(task);
@@ -304,7 +304,8 @@ export function reopenTask(task, now) {
             }
             : {}),
         status: "active",
-        executionGate: { state: "enabled" },
+        // Reopening intent does not lift an independent execution stop. Only the
+        // explicit start operation may do that after its authority/cleanup checks.
         updatedAt: now.toISOString()
     });
 }
@@ -408,8 +409,19 @@ export function startTaskExecution(task, now) {
     });
 }
 export function validateTask(task) {
-    if (task.schemaVersion !== 7)
-        throw new Error("Task must use schemaVersion 7.");
+    if (task.schemaVersion !== 1)
+        throw new Error("Task must use schemaVersion 1.");
+    const fields = [
+        "schemaVersion", "id", "title", "type", "description", "priority", "tags", "dueAt",
+        "projectBindings", "cwd", "workspaceIdentity", "status", "executionGate", "activationRequest",
+        "settledActivationRequests", "completedAt", "completedBy", "completionSummary", "completionArtifactRefs",
+        "retiredAt", "retiredBy", "retirementSummary", "retirementIsolation", "replacementTaskId",
+        "archivedAt", "archivedBy", "archiveReason", "archiveSummary", "createdAt", "updatedAt"
+    ];
+    for (const field of Object.keys(task)) {
+        if (!fields.includes(field))
+            throw new Error(`Task contains an unsupported field: ${field}.`);
+    }
     requireSafeIdentity(task.id, "Task id");
     requireText(task.title, "Task title");
     if (task.type !== undefined)
@@ -491,9 +503,6 @@ export function validateTask(task) {
     normalizeProjectBindings(task.projectBindings);
     if (task.cwd !== undefined)
         requireText(task.cwd, "Task workspace");
-    if (Object.hasOwn(task, "legacyDeliveryPath")) {
-        throw new Error("Task contains the removed delivery-path field.");
-    }
     const completionFields = [task.completedAt, task.completedBy, task.completionSummary];
     const hasAnyCompletion = completionFields.some((value) => value !== undefined);
     const hasAllCompletion = completionFields.every((value) => value !== undefined);

package/dist/task/taskActivation.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import { requireIdentity, requireTimestamp } from "../domain/validation.js";
+import { requireIdentity, requireTimestamp, requireKnownFields } from "../domain/validation.js";
 import { recordOperationEvidence, validateOperationFacts } from "../kernel/operationFacts.js";
 export const TASK_ACTIVATION_IMPLEMENTATION = Object.freeze({
     id: "yui:task-activation",
@@ -229,6 +229,10 @@ export function validateTaskActivationRequest(request) {
     if (request.schemaVersion !== 1) {
         throw new Error("Activation request must use schemaVersion 1.");
     }
+    requireKnownFields(request, [
+        "schemaVersion", "operation", "startMode", "afterPlanningRun", "environmentPlan", "disposition",
+        "preparationId", "outcome", "requestedAt", "updatedAt"
+    ], "Activation request");
     validateOperationFacts(request.operation);
     if (request.operation.capability !== TASK_ACTIVATION_CAPABILITY) {
         throw new Error("Activation request capability is invalid.");
@@ -236,9 +240,6 @@ export function validateTaskActivationRequest(request) {
     if (!["immediate", "after-planning-turn"].includes(request.startMode)) {
         throw new Error(`Activation start mode is invalid: ${String(request.startMode)}.`);
     }
-    if (Object.hasOwn(request, "origin")) {
-        throw new Error("Activation contains retired origin metadata; use the storage upgrade boundary.");
-    }
     if ((request.startMode === "after-planning-turn")
         !== (request.afterPlanningRun !== undefined)) {
         throw new Error("Activation deferral must name exactly the planning Turn it waits for.");

package/dist/telemetry/sqliteTelemetryStore.js

@@ -2,7 +2,7 @@ import Database from "better-sqlite3";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { CURRENT_DATABASE_FILENAME as COMMITTED_DATABASE_FILENAME } from "../storage/currentTaskStore.js";
-import { migrateSqliteSchema } from "../storage/sqliteSchema.js";
+import { validateSqliteSchema } from "../storage/sqliteSchema.js";
 import { AsyncTaskStoreClient } from "../storage/storeRpc.js";
 import { DEFAULT_RUN_CAP, DEFAULT_TERMINAL_KEEP } from "./telemetryConfig.js";
 /**
@@ -251,13 +251,13 @@ export class SqliteTelemetryStore {
                 throw new Error(`Telemetry database not found: ${this.#path}`);
             }
             const db = opening = new Database(this.#path);
+            validateSqliteSchema(db);
             db.pragma("journal_mode = WAL");
             db.pragma("synchronous = FULL");
             db.pragma("foreign_keys = ON");
             // Cold diagnostic reads/retention must not wait behind a semantic writer.
             db.pragma("busy_timeout = 0");
             db.pragma("wal_autocheckpoint = 1000");
-            migrateSqliteSchema(db, { mode: "validate" });
             this.#db = db;
             return db;
         }

package/dist/verification/gateArtifact.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { requireIdentity, requirePositiveInteger, requireText, requireTimestamp } from "../domain/validation.js";
+import { requireIdentity, requireKnownFields, requirePositiveInteger, requireText, requireTimestamp } from "../domain/validation.js";
 /**
  * Issue 08: the reusable exact-SHA gate evidence record.
  *
@@ -80,6 +80,10 @@ export function recordGateArtifactReuse(artifact, now) {
     });
 }
 export function validateGateArtifact(artifact) {
+    requireKnownFields(artifact, [
+        "schemaVersion", "key", "projectId", "level", "commit", "planId", "planVersion", "planDigest", "toolchainDigest",
+        "boundary", "steps", "generator", "status", "outcome", "reuseCount", "createdAt", "completedAt", "lastUsedAt"
+    ], "GateArtifact");
     if (artifact.schemaVersion !== GATE_ARTIFACT_SCHEMA_VERSION) {
         throw new Error(`GateArtifact must use schemaVersion ${GATE_ARTIFACT_SCHEMA_VERSION}.`);
     }
@@ -139,8 +143,6 @@ export function validateGateArtifact(artifact) {
             throw new Error(`GateArtifact step ${step.name} logBytes is invalid.`);
         }
     }
-    if (Object.hasOwn(artifact, "potentialReuseCount"))
-        throw new Error("GateArtifact contains retired shadow metrics.");
     requirePositiveInteger(artifact.reuseCount + 1, "GateArtifact reuseCount");
     requireTimestamp(artifact.createdAt, "GateArtifact createdAt");
     requireTimestamp(artifact.lastUsedAt, "GateArtifact lastUsedAt");