@zq-silk/yui 0.2.0 → 0.4.2

package/dist/storage/taskStore.js

@@ -4,34 +4,119 @@ import { join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { validateConfiguredAgent } from "../agent/agent.js";
 import { reconciliationIntervalMilliseconds } from "../config/yuiConfig.js";
+import { resolveTimeZone } from "../output/timePresentation.js";
+import { mailboxTargetKey, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateInputRequest } from "../input/inputRequest.js";
 import { validateRoleSessionSet } from "../executor/agentExecutor.js";
 import { validateTaskMessage } from "../message/message.js";
 import { validateAgentRun } from "../run/agentRun.js";
-import { validateRepository } from "../repository/repository.js";
+import { validateReviewConfig } from "../review/reviewConfig.js";
+import { validateReviewRound } from "../review/reviewRound.js";
+import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
+import { assertProjectCatalog, validateProject } from "../repository/project.js";
+import { validateAgentProfile } from "../profile/agentProfile.js";
+import { validateChangeSet } from "../integration/changeSet.js";
+import { validateIntegrationAttempt } from "../integration/integrationAttempt.js";
 import { validateGlobalRole, validateTaskRole } from "../role/role.js";
+import { CURRENT_LEADER_FAILURE_SCHEMA_VERSION } from "../scheduler/leaderFailure.js";
+import { CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION } from "../scheduler/operatorNotification.js";
 import { validateTask } from "../task/task.js";
-import { validateRoleWorkspace } from "../worktree/roleWorkspace.js";
+import { formatAgentRunReceiptId, TASK_RECORD_ID_PREFIXES, validateTaskRecordReference } from "../task/taskRecordReference.js";
+import { workItemExecutionGroupById, validateWorkItem } from "../workItem/workItem.js";
+import { isExecutionGroupTransition, validateExecutionGroup } from "../execution/executionGroup.js";
+import { managedWorkspaceKey, validateManagedWorkspace } from "../worktree/managedWorkspace.js";
 import { writeTextFileAtomically } from "./durableFile.js";
-import { requireStorageSchema } from "./storageSchema.js";
+import { assertHomeWritable } from "./upgradeFence.js";
+import { CURRENT_AGGREGATE_SCHEMA_VERSION, requireCompatibleStorageSchema, requireStorageSchema, writeCurrentStorageManifest } from "./storageSchema.js";
 export const STORAGE_STATE_FILE = "state.json";
+/** The root StorageState schema is the persisted aggregate document version. */
+export const CURRENT_STORAGE_STATE_SCHEMA_VERSION = CURRENT_AGGREGATE_SCHEMA_VERSION;
+export const CURRENT_CONFIG_SCHEMA_VERSION = 1;
+export const CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION = 3;
+/**
+ * Persisted StorageState/StoredTask family versions owned by this boundary.
+ *
+ * Keep these names next to the strict parser/writer so the upgrade record map
+ * can classify exactly the bytes this store accepts and emits. Nested session
+ * members and the PendingWakeup projection are included as parser boundaries
+ * below, but are not independent record-axis families.
+ */
+export const CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION = 2;
+export const CURRENT_PROJECT_SCHEMA_VERSION = 2;
+export const CURRENT_AGENT_PROFILE_SCHEMA_VERSION = 2;
+export const CURRENT_GLOBAL_ROLE_SCHEMA_VERSION = 3;
+export const CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION = 3;
+export const CURRENT_TASK_SCHEMA_VERSION = 3;
+export const CURRENT_TASK_BRIEF_SCHEMA_VERSION = 2;
+export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 3;
+export const CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION = 2;
+export const CURRENT_WORK_ITEM_SCHEMA_VERSION = 9;
+export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 4;
+export const CURRENT_CHANGE_SET_SCHEMA_VERSION = 2;
+export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 2;
+export const CURRENT_MESSAGE_SCHEMA_VERSION = 2;
+export const CURRENT_INPUT_REQUEST_SCHEMA_VERSION = 2;
+export const CURRENT_DECISION_SCHEMA_VERSION = 1;
+export const CURRENT_MILESTONE_SCHEMA_VERSION = 1;
+export const CURRENT_EVENT_SCHEMA_VERSION = 2;
+export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 1;
+export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 3;
+export const CURRENT_PENDING_WAKEUP_SCHEMA_VERSION = 1;
 const STORAGE_LOCK_DIRECTORY = ".state.lock";
 const LOCK_TIMEOUT_MS = 5_000;
 const LOCK_RETRY_MS = 10;
 export const COMPLETION_SHELLS = ["bash", "zsh", "fish"];
+/**
+ * Lane-scoped active pointers live beside the legacy role pointers.  The
+ * namespace starts with a slash because Role identities reject slashes; this
+ * makes the two key spaces disjoint even for legal Role names such as
+ * `lane:worker:1`.
+ */
+export function executionLaneActiveRunKey(executionGroupId, executionLaneId) {
+    return `/execution-lane/${encodeLaneKeyPart(executionGroupId)}:${encodeLaneKeyPart(executionLaneId)}`;
+}
+function encodeLaneKeyPart(value) {
+    return encodeURIComponent(value).replace(/:/gu, "%3A");
+}
+function executionLaneActiveRunKeyParts(key) {
+    const match = /^\/execution-lane\/([^:]+):([^:]+)$/u.exec(key);
+    if (match === null)
+        return null;
+    try {
+        return {
+            executionGroupId: decodeURIComponent(match[1]),
+            executionLaneId: decodeURIComponent(match[2])
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** The schema version of each persisted `state.json#/tasks/*` aggregate. */
+export const CURRENT_STORED_TASK_SCHEMA_VERSION = 14;
+/**
+ * Persisted nested-record versions consumed by this store's strict parser.
+ * Keep these named at the storage boundary so the upgrade record-axis map can
+ * assert it is classifying the same bytes the store reads and writes.
+ */
+export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 4;
+export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 6;
 export class FileTaskStore {
     rootDir;
     #transaction = null;
-    constructor(rootDir) {
+    #readCache = null;
+    #normalizeState;
+    constructor(rootDir, options = {}) {
         this.rootDir = rootDir;
-        requireStorageSchema(rootDir);
+        this.#normalizeState = options.normalizeState;
+        this.#requireReadableSchema();
     }
     rootDirectory() { return this.rootDir; }
     transaction(execute) {
         if (this.#transaction !== null)
             return synchronousResult(execute(this));
         return this.#withWriteLock(() => {
-            const state = this.#readState();
+            const state = this.#readCachedState();
             this.#transaction = { state, baseRevision: state.revision, dirty: false };
             try {
                 const result = synchronousResult(execute(this));
@@ -39,6 +124,10 @@ export class FileTaskStore {
                     this.#commit(state, this.#transaction.baseRevision);
                 return result;
             }
+            catch (error) {
+                this.#readCache = null;
+                throw error;
+            }
             finally {
                 this.#transaction = null;
             }
@@ -46,12 +135,12 @@ export class FileTaskStore {
     }
     getConfig() { return clone(this.#state().config); }
     saveConfig(config) {
-        const stored = versioned(config, 1, "Yui config");
+        const stored = versioned(config, CURRENT_CONFIG_SCHEMA_VERSION, "Yui config");
         validateYuiConfig(stored);
         this.#mutate((state) => { state.config = stored; });
     }
     saveConfiguredAgent(agent) {
-        const stored = identified(agent, 2, "id", agent.id, "Configured Agent");
+        const stored = identified(agent, CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION, "id", agent.id, "Configured Agent");
         validateConfiguredAgent(stored);
         this.#mutate((state) => { state.configuredAgents[stored.id] = stored; });
     }
@@ -72,7 +161,7 @@ export class FileTaskStore {
                 ...existing,
                 ...clone(patch),
                 updatedAt: now.toISOString()
-            }, 2, "Configured Agent");
+            }, CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION, "Configured Agent");
             const unchanged = isDeepStrictEqual({ ...existing, updatedAt: candidate.updatedAt }, candidate);
             if (unchanged)
                 return { status: "unchanged", agent: existing };
@@ -85,36 +174,87 @@ export class FileTaskStore {
     removeConfiguredAgent(id) {
         return this.#remove((state) => state.configuredAgents, id);
     }
-    nextRepositoryId() {
-        return this.#nextGlobalId("repository", (state) => Object.keys(state.repositories));
+    nextProjectId() {
+        return this.#nextGlobalId("project", (state) => Object.keys(state.projects));
     }
-    saveRepository(repository) {
-        const stored = identified(repository, 1, "id", repository.id, "Repository");
-        validateRepository(stored);
-        this.#mutate((state) => { state.repositories[stored.id] = stored; });
+    saveProject(project) {
+        const stored = identified(project, CURRENT_PROJECT_SCHEMA_VERSION, "id", project.id, "Project");
+        validateProject(stored);
+        this.#mutate((state) => {
+            assertProjectCatalog([
+                ...Object.values(state.projects).filter(({ id }) => id !== stored.id),
+                stored
+            ]);
+            state.projects[stored.id] = stored;
+        });
     }
-    createRepositoryIfAbsent(repository) {
+    createProjectIfAbsent(project) {
+        validateProject(project);
         return this.transaction((store) => {
-            if (store.getRepository(repository.id) !== null)
+            if (store.getProject(project.id) !== null)
                 return null;
-            if (store.listRepositories().some((entry) => (entry.name === repository.name || entry.path === repository.path)))
+            try {
+                assertProjectCatalog([...store.listProjects(), project]);
+            }
+            catch {
                 return null;
-            store.saveRepository(repository);
-            return clone(repository);
+            }
+            store.saveProject(project);
+            return clone(project);
         });
     }
-    listRepositories() { return values(this.#state().repositories, "id"); }
-    getRepository(id) { return optional(this.#state().repositories[id]); }
-    removeRepository(id) {
+    listProjects() { return values(this.#state().projects, "id"); }
+    getProject(id) { return optional(this.#state().projects[id]); }
+    removeProject(id) {
         return this.transaction((store) => {
-            if (store.listTasks().some((task) => task.repositoryId === id)) {
-                throw new StorageRecordError(`Repository is still used by a Task: ${id}`);
+            if (store.listTasks().some((task) => task.projectBindings.some((binding) => binding.projectId === id))) {
+                throw new StorageRecordError(`Project is still used by a Task: ${id}`);
             }
-            return this.#remove((state) => state.repositories, id);
+            return this.#remove((state) => state.projects, id);
         });
     }
+    saveAgentProfile(profile) {
+        const stored = identified(profile, CURRENT_AGENT_PROFILE_SCHEMA_VERSION, "id", profile.id, "Agent Profile");
+        validateAgentProfile(stored);
+        this.#mutate((state) => {
+            const existing = state.agentProfiles[stored.id];
+            if (existing !== undefined) {
+                if (stored.revision < existing.revision) {
+                    throw new StorageRecordError(`Agent Profile revision cannot move backwards: ${stored.id}.`);
+                }
+                if (stored.revision === existing.revision
+                    && !isDeepStrictEqual(stored, existing)) {
+                    throw new StorageRecordError(`Agent Profile revision cannot be overwritten: ${stored.id}/${stored.revision}.`);
+                }
+                if (stored.revision > existing.revision + 1) {
+                    throw new StorageRecordError(`Agent Profile revision must be contiguous: ${stored.id}/${stored.revision}.`);
+                }
+            }
+            else if (stored.revision !== 1) {
+                throw new StorageRecordError(`A new Agent Profile must start at revision 1: ${stored.id}.`);
+            }
+            state.agentProfiles[stored.id] = stored;
+        });
+    }
+    createAgentProfileIfAbsent(profile) {
+        return this.transaction((store) => {
+            if (store.getAgentProfile(profile.id) !== null)
+                return null;
+            store.saveAgentProfile(profile);
+            return clone(profile);
+        });
+    }
+    listAgentProfiles() {
+        return values(this.#state().agentProfiles, "id");
+    }
+    getAgentProfile(id) {
+        return optional(this.#state().agentProfiles[id]);
+    }
+    removeAgentProfile(id) {
+        return this.#remove((state) => state.agentProfiles, id);
+    }
     saveGlobalRole(role) {
-        const stored = identified(role, 2, "name", role.name, "Global Role");
+        const stored = identified(role, CURRENT_GLOBAL_ROLE_SCHEMA_VERSION, "name", role.name, "Global Role");
         validateGlobalRole(stored);
         const sessions = this.getGlobalRoleSessionSet(stored.name);
         if (sessions !== null)
@@ -122,7 +262,7 @@ export class FileTaskStore {
         this.#mutate((state) => { state.globalRoles[stored.name] = stored; });
     }
     saveGlobalRoleWithSessionSet(role, sessions) {
-        const storedRole = identified(role, 2, "name", role.name, "Global Role");
+        const storedRole = identified(role, CURRENT_GLOBAL_ROLE_SCHEMA_VERSION, "name", role.name, "Global Role");
         validateGlobalRole(storedRole);
         const storedSessions = sessions === null ? null : globalSessions(sessions);
         if (storedSessions !== null)
@@ -170,10 +310,12 @@ export class FileTaskStore {
     }
     nextTaskId() { return this.#nextGlobalId("task", (state) => Object.keys(state.tasks)); }
     saveTask(task) {
-        const stored = validateTask(identified(task, 1, "id", task.id, "Task"));
+        const stored = validateTask(identified(task, CURRENT_TASK_SCHEMA_VERSION, "id", task.id, "Task"));
         this.#mutate((state) => {
-            if (stored.repositoryId !== undefined && state.repositories[stored.repositoryId] === undefined) {
-                throw new StorageRecordError(`Task Repository not found: ${stored.repositoryId}`);
+            for (const binding of stored.projectBindings) {
+                if (state.projects[binding.projectId] === undefined) {
+                    throw new StorageRecordError(`Task Project not found: ${binding.projectId}`);
+                }
             }
             const aggregate = state.tasks[stored.id] ?? emptyStoredTask(stored);
             aggregate.task = stored;
@@ -182,6 +324,9 @@ export class FileTaskStore {
     }
     listTasks() { return values(this.#state().tasks, (aggregate) => aggregate.task.id).map((entry) => clone(entry.task)); }
     getTask(id) { return optional(this.#state().tasks[id]?.task); }
+    getReviewConfig() {
+        return optional(this.#state().config.review);
+    }
     getTaskBrief(taskId) {
         return optional(this.#state().tasks[taskId]?.brief ?? undefined);
     }
@@ -194,9 +339,92 @@ export class FileTaskStore {
         this.#requireTaskForWrite(taskId);
         this.#mutate((state) => { state.tasks[taskId].brief = null; });
     }
+    nextChangeSetId(taskId) {
+        return this.#nextTaskRecordId(taskId, "changeSet");
+    }
+    saveChangeSet(taskId, changeSet) {
+        const stored = identifiedChangeSet(changeSet, changeSet.id);
+        validateChangeSet(stored);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`ChangeSet belongs to another Task: ${stored.taskId}.`);
+        }
+        const aggregate = this.#requireTaskForWrite(taskId);
+        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === stored.headCommit);
+        if (evidenceRound !== undefined) {
+            throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${stored.headCommit} cannot become a ChangeSet.`);
+        }
+        if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === stored.projectId)) {
+            throw new StorageRecordError(`ChangeSet Project does not match Task: ${stored.id}.`);
+        }
+        if (aggregate.workItems[stored.workItemId] === undefined) {
+            throw new StorageRecordError(`ChangeSet Work Item not found: ${stored.workItemId}.`);
+        }
+        const existing = aggregate.changeSets[stored.id];
+        if (existing !== undefined && !isDeepStrictEqual(existing, stored)) {
+            throw new StorageRecordError(`ChangeSet is immutable: ${stored.id}.`);
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "changeSet", stored.id);
+            task.changeSets[stored.id] = stored;
+        });
+    }
+    listChangeSets(taskId) {
+        return values(this.#requireTask(taskId).changeSets, "id");
+    }
+    getChangeSet(taskId, changeSetId) {
+        return optional(this.#state().tasks[taskId]?.changeSets[changeSetId]);
+    }
+    nextIntegrationAttemptId(taskId) {
+        return this.#nextTaskRecordId(taskId, "integrationAttempt");
+    }
+    saveIntegrationAttempt(taskId, attempt) {
+        const stored = identified(attempt, CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION, "id", attempt.id, "Integration Attempt");
+        validateIntegrationAttempt(stored);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Integration Attempt belongs to another Task: ${stored.taskId}.`);
+        }
+        const aggregate = this.#requireTaskForWrite(taskId);
+        if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === stored.projectId)) {
+            throw new StorageRecordError(`Integration Project does not match Task: ${stored.id}.`);
+        }
+        for (const changeSetId of stored.changeSetIds) {
+            const changeSet = aggregate.changeSets[changeSetId];
+            if (changeSet === undefined) {
+                throw new StorageRecordError(`Integration ChangeSet not found: ${changeSetId}.`);
+            }
+            if (changeSet.projectId !== stored.projectId) {
+                throw new StorageRecordError(`Integration ChangeSet belongs to another Project: ${changeSetId}.`);
+            }
+            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+            if (evidenceRound !== undefined) {
+                throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become an Integration source.`);
+            }
+        }
+        const existing = aggregate.integrationAttempts[stored.id];
+        if (existing !== undefined) {
+            if (Date.parse(stored.updatedAt) < Date.parse(existing.updatedAt)) {
+                throw new StorageRecordError(`Integration Attempt updatedAt cannot move backwards: ${stored.id}.`);
+            }
+            if (!validIntegrationTransition(existing, stored)) {
+                throw new StorageRecordError(`Integration Attempt transition is invalid: ${stored.id}.`);
+            }
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "integrationAttempt", stored.id);
+            task.integrationAttempts[stored.id] = stored;
+        });
+    }
+    listIntegrationAttempts(taskId) {
+        return values(this.#requireTask(taskId).integrationAttempts, "id");
+    }
+    getIntegrationAttempt(taskId, integrationId) {
+        return optional(this.#state().tasks[taskId]?.integrationAttempts[integrationId]);
+    }
     saveRole(taskId, role) {
         const aggregate = this.#requireTaskForWrite(taskId);
-        const stored = identified(role, 2, "name", role.name, "Task Role");
+        const stored = identified(role, CURRENT_TASK_ROLE_SCHEMA_VERSION, "name", role.name, "Task Role");
         if (stored.taskId !== taskId)
             throw new StorageRecordError(`Task Role belongs to another Task: ${stored.taskId}`);
         validateTaskRole(stored);
@@ -208,7 +436,7 @@ export class FileTaskStore {
     listRoles(taskId) { return values(this.#requireTask(taskId).roles, "name"); }
     getRole(taskId, name) { return optional(this.#state().tasks[taskId]?.roles[name]); }
     saveTaskRoleWithSessionSet(role, sessions) {
-        const storedRole = identified(role, 2, "name", role.name, "Task Role");
+        const storedRole = identified(role, CURRENT_TASK_ROLE_SCHEMA_VERSION, "name", role.name, "Task Role");
         validateTaskRole(storedRole);
         const storedSessions = taskSessions(sessions);
         assertSessionsMatchRole(storedSessions, storedRole);
@@ -223,40 +451,91 @@ export class FileTaskStore {
     removeTaskRole(taskId, name) {
         return this.transaction(() => {
             const aggregate = this.#requireTask(taskId);
-            if (aggregate.roleWorkspaces[name] !== undefined) {
-                throw new StorageRecordError(`Task Role workspace must be cleaned before removing the Role: ${taskId}/${name}`);
-            }
             const removed = this.#remove(() => aggregate.roles, name);
-            this.#mutate(() => { delete aggregate.roleSessionSets[name]; delete aggregate.activeRuns[name]; });
+            this.#mutate((state) => {
+                delete aggregate.roleSessionSets[name];
+                delete aggregate.activeRuns[name];
+                delete state.mailboxes[mailboxTargetKey({ kind: "role", taskId, roleName: name })];
+            });
             return removed;
         });
     }
-    saveRoleWorkspace(taskId, workspace) {
+    saveManagedWorkspace(workspace) {
+        const stored = versioned(workspace, CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION, "Managed workspace");
+        validateManagedWorkspace(stored);
+        const taskId = stored.owner.taskId;
         const aggregate = this.#requireTaskForWrite(taskId);
-        const stored = clone(workspace);
-        validateRoleWorkspace(stored);
-        if (stored.taskId !== taskId) {
-            throw new StorageRecordError(`RoleWorkspace belongs to another Task: ${stored.taskId}`);
+        if (stored.owner.type === "work-item"
+            && aggregate.workItems[stored.owner.workItemId] === undefined) {
+            throw new StorageRecordError(`Managed workspace WorkItem not found: ${taskId}/${stored.owner.workItemId}.`);
         }
-        if (aggregate.roles[stored.roleName] === undefined) {
-            throw new StorageRecordError(`Task Role not found: ${taskId}/${stored.roleName}`);
+        if (stored.owner.type === "review-round"
+            && aggregate.reviewRounds[stored.owner.reviewRoundId] === undefined) {
+            throw new StorageRecordError(`Managed workspace ReviewRound not found: ${taskId}/${stored.owner.reviewRoundId}.`);
         }
-        if (aggregate.task.repositoryId !== stored.repositoryId) {
-            throw new StorageRecordError(`RoleWorkspace Repository does not match Task: ${taskId}/${stored.roleName}`);
+        if (stored.owner.type === "integration-attempt"
+            && aggregate.integrationAttempts[stored.owner.integrationAttemptId] === undefined) {
+            throw new StorageRecordError(`Managed workspace Integration Attempt not found: ${taskId}/${stored.owner.integrationAttemptId}.`);
+        }
+        if (stored.owner.type === "execution-lane") {
+            const groupOwner = stored.owner;
+            if (groupOwner.purpose === "execution") {
+                const item = groupOwner.workItemId === undefined
+                    ? undefined
+                    : aggregate.workItems[groupOwner.workItemId];
+                if (item === undefined
+                    || workItemExecutionGroupById(item, groupOwner.executionGroupId) === undefined
+                    || !workItemExecutionGroupById(item, groupOwner.executionGroupId).lanes.some(({ id }) => id === groupOwner.executionLaneId)) {
+                    throw new StorageRecordError(`Managed execution Lane WorkItem lineage is invalid: ${taskId}/${groupOwner.executionGroupId}/${groupOwner.executionLaneId}.`);
+                }
+            }
+            else {
+                const round = groupOwner.reviewRoundId === undefined
+                    ? undefined
+                    : aggregate.reviewRounds[groupOwner.reviewRoundId];
+                if (round === undefined || round.executionGroup?.id !== groupOwner.executionGroupId
+                    || !round.executionGroup.lanes.some(({ id }) => id === groupOwner.executionLaneId)) {
+                    throw new StorageRecordError(`Managed review Lane ReviewRound lineage is invalid: ${taskId}/${groupOwner.executionGroupId}/${groupOwner.executionLaneId}.`);
+                }
+            }
+        }
+        assertManagedWorkspaceReferences(aggregate, stored, "Managed workspace");
+        const boundProjects = new Set(aggregate.task.projectBindings.map(({ projectId }) => projectId));
+        if (stored.entries.some(({ projectId }) => !boundProjects.has(projectId))) {
+            throw new StorageRecordError(`Managed workspace Project does not match Task: ${taskId}.`);
         }
         this.#mutate((state) => {
-            state.tasks[taskId].roleWorkspaces[stored.roleName] = stored;
+            state.tasks[taskId].managedWorkspaces[managedWorkspaceKey(stored.owner)] = stored;
         });
     }
-    listRoleWorkspaces(taskId) {
-        return values(this.#requireTask(taskId).roleWorkspaces, "roleName");
+    listManagedWorkspaces(taskId) {
+        return values(this.#requireTask(taskId).managedWorkspaces, (workspace) => managedWorkspaceKey(workspace.owner));
     }
-    getRoleWorkspace(taskId, roleName) {
-        return optional(this.#state().tasks[taskId]?.roleWorkspaces[roleName]);
+    listManagedWorkspace(taskId) {
+        return this.listManagedWorkspaces(taskId);
     }
-    removeRoleWorkspace(taskId, roleName) {
-        this.#requireTaskForWrite(taskId);
-        return this.#remove((state) => state.tasks[taskId].roleWorkspaces, roleName);
+    getTaskWorkspace(taskId) {
+        return this.getManagedWorkspace({ type: "task", taskId });
+    }
+    getWorkItemWorkspace(taskId, workItemId) {
+        return this.getManagedWorkspace({ type: "work-item", taskId, workItemId });
+    }
+    getReviewRoundWorkspace(taskId, reviewRoundId) {
+        return this.getManagedWorkspace({ type: "review-round", taskId, reviewRoundId });
+    }
+    getIntegrationWorkspace(taskId, integrationAttemptId) {
+        return this.getManagedWorkspace({
+            type: "integration-attempt",
+            taskId,
+            integrationAttemptId
+        });
+    }
+    getManagedWorkspace(owner) {
+        return optional(this.#state().tasks[owner.taskId]?.managedWorkspaces[managedWorkspaceKey(owner)]);
+    }
+    removeManagedWorkspace(owner) {
+        this.#requireTaskForWrite(owner.taskId);
+        return this.#remove((state) => state.tasks[owner.taskId].managedWorkspaces, managedWorkspaceKey(owner));
     }
     getRoleSessionSet(taskId, roleName) {
         return optional(this.#state().tasks[taskId]?.roleSessionSets[roleName]);
@@ -282,26 +561,131 @@ export class FileTaskStore {
         const set = this.getRoleSessionSet(taskId, roleName);
         return set === null ? null : optional(set.sessions[set.activeAgentId]);
     }
-    nextWorkItemId(_taskId) { return this.#nextGlobalId("work-item", (state) => allKeys(state, "workItems")); }
+    nextWorkItemId(taskId) {
+        return this.#nextTaskRecordId(taskId, "workItem");
+    }
     getWorkItem(taskId, id) { return optional(this.#state().tasks[taskId]?.workItems[id]); }
-    findWorkItem(id) { return findUnique(this.#state(), "workItems", id, "Work item"); }
     listWorkItems(taskId) { return values(this.#requireTask(taskId).workItems, "id"); }
     saveWorkItem(taskId, item) {
-        const stored = identified(item, 1, "id", item.id, "Work item");
+        const stored = identified(item, CURRENT_WORK_ITEM_SCHEMA_VERSION, "id", item.id, "Work item");
         if (stored.taskId !== taskId)
             throw new StorageRecordError(`Work item belongs to another Task: ${stored.taskId}`);
-        this.#requireTaskForWrite(taskId);
-        this.#mutate((state) => { state.tasks[taskId].workItems[stored.id] = stored; });
+        validateWorkItem(stored);
+        const aggregate = this.#requireTaskForWrite(taskId);
+        const boundProjects = new Set(aggregate.task.projectBindings.map(({ projectId }) => projectId));
+        if (stored.writeProjectIds.some((projectId) => !boundProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item writable Project does not belong to Task: ${stored.id}.`);
+        }
+        const writableProjects = new Set(stored.writeProjectIds);
+        if (stored.baseRefs?.some(({ projectId }) => !boundProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item base-ref Project does not belong to Task: ${stored.id}.`);
+        }
+        if (stored.baseRefs?.some(({ projectId }) => !writableProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item base-ref Project must be writable: ${stored.id}.`);
+        }
+        for (const dependencyId of stored.dependsOn) {
+            const dependency = this.getWorkItem(taskId, dependencyId);
+            if (dependency === null) {
+                throw new StorageRecordError(`Work Item dependency not found: ${dependencyId}.`);
+            }
+        }
+        assertAcyclicWorkItems({
+            ...aggregate.workItems,
+            [stored.id]: stored
+        });
+        for (const candidate of stored.candidates) {
+            assertWorkItemCandidateReferences(aggregate, stored, candidate, "Work Item candidate");
+        }
+        const existing = this.getWorkItem(taskId, stored.id);
+        if (existing !== null && !validWorkItemTransition(existing, stored)) {
+            throw new StorageRecordError(`Work Item transition is invalid: ${stored.id}.`);
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "workItem", stored.id);
+            task.workItems[stored.id] = stored;
+        });
+    }
+    nextAgentRunId(taskId) {
+        return this.#nextTaskRecordId(taskId, "agentRun");
+    }
+    peekNextAgentRunId(taskId) {
+        return this.#peekTaskRecordId(taskId, "agentRun");
     }
-    nextAgentRunId(_taskId) { return this.#nextGlobalId("agent-run", (state) => allKeys(state, "agentRuns")); }
     getAgentRun(taskId, id) { return optional(this.#state().tasks[taskId]?.agentRuns[id]); }
-    findAgentRun(id) { return findUnique(this.#state(), "agentRuns", id, "Agent run"); }
     listAgentRuns(taskId) { return values(this.#requireTask(taskId).agentRuns, "id"); }
     saveAgentRun(run) {
-        const stored = identified(run, 1, "id", run.id, "Agent run");
+        const stored = identified(run, CURRENT_AGENT_RUN_SCHEMA_VERSION, "id", run.id, "Agent run");
         validateAgentRun(stored);
-        this.#requireTaskForWrite(stored.taskId);
-        this.#mutate((state) => { state.tasks[stored.taskId].agentRuns[stored.id] = stored; });
+        const aggregate = this.#requireTaskForWrite(stored.taskId);
+        if (stored.purpose === "review"
+            && aggregate.task.projectBindings.length > 0
+            && stored.workspace === undefined) {
+            throw new StorageRecordError(`A Project-backed review Agent run requires its ReviewRound workspace: ${stored.id}.`);
+        }
+        if (stored.reviewRoundId !== undefined) {
+            const round = aggregate.reviewRounds[stored.reviewRoundId];
+            if (round === undefined) {
+                throw new StorageRecordError(`Agent run ReviewRound not found: ${stored.reviewRoundId}.`);
+            }
+            const laneRole = round.executionGroup?.lanes.find(({ id }) => id === stored.executionLaneId)?.roleName;
+            if (round.workItemId !== stored.workItemId
+                || (round.reviewerRoleName !== stored.roleName && laneRole !== stored.roleName)) {
+                throw new StorageRecordError(`Agent run does not match ReviewRound: ${stored.id}.`);
+            }
+        }
+        assertAgentRunExecutionReferences(aggregate, stored);
+        this.#mutate((state) => {
+            const task = state.tasks[stored.taskId];
+            observeTaskRecordId(task, "agentRun", stored.id);
+            task.agentRuns[stored.id] = stored;
+        });
+    }
+    nextReviewRoundId(taskId) {
+        return this.#nextTaskRecordId(taskId, "reviewRound");
+    }
+    getReviewRound(taskId, reviewRoundId) {
+        return optional(this.#state().tasks[taskId]?.reviewRounds[reviewRoundId]);
+    }
+    listReviewRounds(taskId) {
+        return values(this.#requireTask(taskId).reviewRounds, "id");
+    }
+    saveReviewRound(taskId, round) {
+        const stored = identified(round, CURRENT_REVIEW_ROUND_SCHEMA_VERSION, "id", round.id, "ReviewRound");
+        validateReviewRound(stored);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`ReviewRound belongs to another Task: ${stored.taskId}.`);
+        }
+        const aggregate = this.#requireTaskForWrite(taskId);
+        const item = aggregate.workItems[stored.workItemId];
+        if (item === undefined) {
+            throw new StorageRecordError(`ReviewRound Work Item not found: ${stored.workItemId}.`);
+        }
+        const candidate = item.candidates.find(({ id }) => id === stored.candidateId);
+        if (candidate === undefined) {
+            throw new StorageRecordError(`ReviewRound Candidate not found: ${stored.candidateId}.`);
+        }
+        assertWorkItemCandidateReferences(aggregate, item, candidate, `ReviewRound candidate ${stored.id}`);
+        if ((stored.scope ?? "work-item") === "task"
+            && !sameTaskFinalReviewContract(stored.taskFinalReviewContract, candidate.taskFinalReviewContract)) {
+            throw new StorageRecordError(`Task ReviewRound contract does not match its Candidate: ${stored.id}.`);
+        }
+        if (stored.reviewerRunId !== undefined) {
+            const reviewerRun = aggregate.agentRuns[stored.reviewerRunId];
+            if (reviewerRun !== undefined
+                && (reviewerRun.reviewRoundId !== stored.id || reviewerRun.purpose !== "review")) {
+                throw new StorageRecordError(`ReviewRound Reviewer Run is invalid: ${stored.reviewerRunId}.`);
+            }
+        }
+        const existing = aggregate.reviewRounds[stored.id];
+        if (existing !== undefined && !validReviewRoundTransition(existing, stored)) {
+            throw new StorageRecordError(`ReviewRound transition is invalid: ${stored.id}.`);
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "reviewRound", stored.id);
+            task.reviewRounds[stored.id] = stored;
+        });
     }
     getActiveAgentRun(taskId, roleName) {
         const aggregate = this.#state().tasks[taskId];
@@ -314,6 +698,10 @@ export class FileTaskStore {
         return clone(run);
     }
     saveActiveAgentRun(run) {
+        if (run.executionGroupId !== undefined && run.executionLaneId !== undefined) {
+            this.saveActiveExecutionLaneRun(run);
+            return;
+        }
         if (run.status !== "active")
             throw new StorageRecordError(`Active Agent run must have active status: ${run.id}`);
         this.transaction((store) => {
@@ -321,36 +709,135 @@ export class FileTaskStore {
             if (current !== null && current.id !== run.id) {
                 throw new StorageRecordError(`Role already has an active Agent run: ${run.taskId}/${run.roleName}`);
             }
+            const sessions = store.getTaskRoleSessionSet(run.taskId, run.roleName);
+            if (sessions !== null && sessions.inFlight !== null && sessions.inFlight.runId !== run.id) {
+                throw new StorageRecordError(`Role still has an in-flight Turn: ${run.taskId}/${run.roleName}/${sessions.inFlight.runId}`);
+            }
             store.saveAgentRun(run);
             this.#mutate((state) => {
-                state.tasks[run.taskId].activeRuns[run.roleName] = { schemaVersion: 1, runId: run.id };
+                state.tasks[run.taskId].activeRuns[run.roleName] = {
+                    schemaVersion: CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION,
+                    runId: run.id
+                };
             });
         });
     }
     clearActiveAgentRun(taskId, roleName) {
-        this.#mutate((state) => { const task = state.tasks[taskId]; if (task !== undefined)
-            delete task.activeRuns[roleName]; });
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            if (task === undefined)
+                return;
+            const rolePointer = task.activeRuns[roleName];
+            delete task.activeRuns[roleName];
+            // Older Controller paths only know the Role key.  When that key points
+            // at a lane-backed Run, remove the matching lane pointer too; preserve
+            // every other lane for the same Role in a multi-lane group.
+            if (rolePointer === undefined)
+                return;
+            for (const [key, pointer] of Object.entries(task.activeRuns)) {
+                if (executionLaneActiveRunKeyParts(key) !== null && pointer.runId === rolePointer.runId) {
+                    delete task.activeRuns[key];
+                }
+            }
+        });
+    }
+    getActiveExecutionLaneRun(taskId, executionGroupId, executionLaneId) {
+        const aggregate = this.#state().tasks[taskId];
+        const key = executionLaneActiveRunKey(executionGroupId, executionLaneId);
+        const pointer = aggregate?.activeRuns[key];
+        if (aggregate === undefined || pointer === undefined)
+            return null;
+        const run = aggregate.agentRuns[pointer.runId];
+        if (run === undefined) {
+            throw new StorageRecordError(`Active Agent run pointer is dangling: ${taskId}/${key}`);
+        }
+        if (run.executionGroupId !== executionGroupId
+            || run.executionLaneId !== executionLaneId
+            || run.status !== "active") {
+            throw new StorageRecordError(`Active Agent run pointer is invalid: ${taskId}/${key}`);
+        }
+        return clone(run);
+    }
+    saveActiveExecutionLaneRun(run) {
+        if (run.status !== "active") {
+            throw new StorageRecordError(`Active Agent run must have active status: ${run.id}`);
+        }
+        if (run.executionGroupId === undefined || run.executionLaneId === undefined) {
+            throw new StorageRecordError(`Lane active Agent run requires execution lineage: ${run.id}`);
+        }
+        this.transaction((store) => {
+            const key = executionLaneActiveRunKey(run.executionGroupId, run.executionLaneId);
+            const current = store.getActiveExecutionLaneRun(run.taskId, run.executionGroupId, run.executionLaneId);
+            if (current !== null && current.id !== run.id) {
+                throw new StorageRecordError(`Execution Lane already has an active Agent run: ${run.taskId}/${key}`);
+            }
+            const sessions = store.getTaskRoleSessionSet(run.taskId, run.roleName);
+            if (sessions !== null && sessions.inFlight !== null && sessions.inFlight.runId !== run.id) {
+                throw new StorageRecordError(`Role still has an in-flight Turn: ${run.taskId}/${run.roleName}/${sessions.inFlight.runId}`);
+            }
+            store.saveAgentRun(run);
+            this.#mutate((state) => {
+                const task = state.tasks[run.taskId];
+                task.activeRuns[key] = {
+                    schemaVersion: CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION,
+                    runId: run.id
+                };
+                // Preserve the legacy role pointer for the single-lane delivery path.
+                // A second lane for the same Role keeps the first pointer unchanged;
+                // lane-aware readers use the exact key above.
+                if (task.activeRuns[run.roleName] === undefined) {
+                    task.activeRuns[run.roleName] = {
+                        schemaVersion: CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION,
+                        runId: run.id
+                    };
+                }
+            });
+        });
+    }
+    clearActiveExecutionLaneRun(taskId, executionGroupId, executionLaneId) {
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            if (task === undefined)
+                return;
+            const key = executionLaneActiveRunKey(executionGroupId, executionLaneId);
+            const pointer = task.activeRuns[key];
+            delete task.activeRuns[key];
+            const runId = pointer?.runId;
+            for (const [roleName, rolePointer] of Object.entries(task.activeRuns)) {
+                if (executionLaneActiveRunKeyParts(roleName) !== null)
+                    continue;
+                const roleRun = task.agentRuns[rolePointer.runId];
+                const matches = runId !== undefined
+                    ? rolePointer.runId === runId
+                    : roleRun?.executionGroupId === executionGroupId
+                        && roleRun.executionLaneId === executionLaneId;
+                if (matches) {
+                    delete task.activeRuns[roleName];
+                }
+            }
+        });
+    }
+    nextMessageId(taskId) {
+        return this.#nextTaskRecordId(taskId, "message");
     }
-    nextMessageId(_taskId) { return this.#nextGlobalId("message", (state) => allKeys(state, "messages")); }
     saveMessage(taskId, message) {
         validateTaskMessage(message);
+        if (message.taskId !== taskId) {
+            throw new StorageRecordError(`Message belongs to another Task: ${message.taskId}`);
+        }
         this.#saveTaskRecord(taskId, "messages", message, "Message");
     }
     listMessages(taskId) { return values(this.#requireTask(taskId).messages, "id"); }
-    nextInputRequestId(_taskId) {
-        return this.#nextGlobalId("input", (state) => allKeys(state, "inputRequests"));
+    nextInputRequestId(taskId) {
+        return this.#nextTaskRecordId(taskId, "inputRequest");
     }
     saveInputRequest(taskId, request) {
-        const stored = validateInputRequest(request);
+        const stored = validateInputRequest(versioned(request, CURRENT_INPUT_REQUEST_SCHEMA_VERSION, "Input request"));
         if (stored.taskId !== taskId) {
             throw new StorageRecordError(`Input request belongs to another Task: ${stored.taskId}`);
         }
         this.#mutate((state) => {
             const aggregate = requireTaskFromState(state, taskId);
-            const owner = taskRecordOwner(state, "inputRequests", stored.id);
-            if (owner !== null && owner !== taskId) {
-                throw new StorageRecordError(`Input request already exists in another Task: ${stored.id}`);
-            }
             const existing = aggregate.inputRequests[stored.id];
             if (existing === undefined && stored.status !== "open") {
                 throw new StorageRecordError(`Input request must start open: ${stored.id}`);
@@ -358,25 +845,25 @@ export class FileTaskStore {
             if (existing !== undefined && !isValidInputRequestTransition(existing, stored)) {
                 throw new StorageRecordError(`Input request cannot be overwritten: ${stored.id}`);
             }
+            observeTaskRecordId(aggregate, "inputRequest", stored.id);
             aggregate.inputRequests[stored.id] = stored;
         });
     }
     getInputRequest(taskId, requestId) {
         return optional(this.#state().tasks[taskId]?.inputRequests[requestId]);
     }
-    findInputRequest(requestId) {
-        return findUnique(this.#state(), "inputRequests", requestId, "Input request");
-    }
     listInputRequests(taskId) {
         return values(this.#requireTask(taskId).inputRequests, "id");
     }
     listAllInputRequests() {
         return Object.values(this.#state().tasks)
             .flatMap((aggregate) => Object.values(aggregate.inputRequests).map(clone))
-            .sort((left, right) => numericCompare(left.id, right.id));
+            .sort((left, right) => (left.createdAt.localeCompare(right.createdAt)
+            || left.taskId.localeCompare(right.taskId)
+            || numericCompare(left.id, right.id)));
     }
-    nextDecisionId(_taskId) {
-        return this.#nextGlobalId("decision", (state) => allKeys(state, "decisions"));
+    nextDecisionId(taskId) {
+        return this.#nextTaskRecordId(taskId, "decision");
     }
     saveDecision(taskId, decision) {
         const stored = storedDecision(decision);
@@ -385,10 +872,6 @@ export class FileTaskStore {
         }
         this.#mutate((state) => {
             const aggregate = requireTaskFromState(state, taskId);
-            const owner = taskRecordOwner(state, "decisions", stored.id);
-            if (owner !== null && owner !== taskId) {
-                throw new StorageRecordError(`Decision already exists in another Task: ${stored.id}`);
-            }
             const existing = aggregate.decisions[stored.id];
             if (existing === undefined && stored.status !== "active") {
                 throw new StorageRecordError(`Decision must start active: ${stored.id}`);
@@ -396,6 +879,7 @@ export class FileTaskStore {
             if (existing !== undefined && !isValidDecisionSupersession(existing, stored)) {
                 throw new StorageRecordError(`Decision cannot be overwritten: ${stored.id}`);
             }
+            observeTaskRecordId(aggregate, "decision", stored.id);
             aggregate.decisions[stored.id] = stored;
         });
     }
@@ -405,8 +889,8 @@ export class FileTaskStore {
     getDecision(taskId, decisionId) {
         return this.#requireTask(taskId).decisions[decisionId] ?? null;
     }
-    nextMilestoneId(_taskId) {
-        return this.#nextGlobalId("milestone", (state) => allKeys(state, "milestones"));
+    nextMilestoneId(taskId) {
+        return this.#nextTaskRecordId(taskId, "milestone");
     }
     saveMilestone(taskId, milestone) {
         const stored = storedMilestone(milestone);
@@ -415,9 +899,10 @@ export class FileTaskStore {
         }
         this.#mutate((state) => {
             const aggregate = requireTaskFromState(state, taskId);
-            if (taskRecordOwner(state, "milestones", stored.id) !== null) {
-                throw new StorageRecordError(`Milestone already exists: ${stored.id}`);
+            if (aggregate.milestones[stored.id] !== undefined) {
+                throw new StorageRecordError(`Milestone already exists: ${taskId}/${stored.id}`);
             }
+            observeTaskRecordId(aggregate, "milestone", stored.id);
             aggregate.milestones[stored.id] = stored;
         });
     }
@@ -427,24 +912,91 @@ export class FileTaskStore {
     getMilestone(taskId, milestoneId) {
         return this.#requireTask(taskId).milestones[milestoneId] ?? null;
     }
-    nextEventId(_taskId) { return this.#nextGlobalId("event", (state) => allKeys(state, "events")); }
+    nextEventId(taskId) {
+        return this.#nextTaskRecordId(taskId, "event");
+    }
     saveEvent(taskId, event) {
         const stored = storedTaskEvent(event);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Task event belongs to another Task: ${stored.taskId}`);
+        }
         this.#mutate((state) => {
             const aggregate = requireTaskFromState(state, taskId);
-            if (taskRecordOwner(state, "events", stored.id) !== null) {
-                throw new StorageRecordError(`Task event already exists: ${stored.id}`);
+            if (aggregate.events[stored.id] !== undefined) {
+                throw new StorageRecordError(`Task event already exists: ${taskId}/${stored.id}`);
             }
+            observeTaskRecordId(aggregate, "event", stored.id);
             aggregate.events[stored.id] = stored;
         });
     }
     listEvents(taskId) { return values(this.#requireTask(taskId).events, "id"); }
-    getPendingWakeup(taskId) { return optional(this.#state().tasks[taskId]?.pendingWakeup ?? undefined); }
+    getWorkMailbox(target) {
+        return optional(this.#state().mailboxes[mailboxTargetKey(target)]);
+    }
+    listWorkMailboxes() {
+        return Object.entries(this.#state().mailboxes)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([, mailbox]) => clone(mailbox));
+    }
+    saveWorkMailbox(value) {
+        let mailbox;
+        try {
+            mailbox = validateWorkMailbox(versioned(value, CURRENT_WORK_MAILBOX_SCHEMA_VERSION, "WorkMailbox"));
+        }
+        catch (error) {
+            throw new StorageRecordError(error instanceof Error ? error.message : String(error));
+        }
+        this.#mutate((state) => {
+            validateMailboxReferences(state, mailbox);
+            state.mailboxes[mailboxTargetKey(mailbox.target)] = clone(mailbox);
+        });
+    }
+    removeWorkMailbox(target) {
+        return this.#remove((state) => state.mailboxes, mailboxTargetKey(target));
+    }
+    getPendingWakeup(taskId) {
+        return pendingWakeupProjection(this.getWorkMailbox({ kind: "role", taskId, roleName: "leader" }));
+    }
     listPendingWakeups() {
-        return Object.values(this.#state().tasks).flatMap((task) => task.pendingWakeup === null ? [] : [clone(task.pendingWakeup)]).sort((a, b) => numericCompare(a.taskId, b.taskId));
+        return this.listWorkMailboxes()
+            .flatMap((mailbox) => {
+            const wakeup = pendingWakeupProjection(mailbox);
+            return wakeup === null ? [] : [wakeup];
+        })
+            .sort((a, b) => numericCompare(a.taskId, b.taskId));
+    }
+    savePendingWakeup(value) {
+        const wakeup = identified(value, CURRENT_PENDING_WAKEUP_SCHEMA_VERSION, "taskId", value.taskId, "Pending wakeup");
+        const target = { kind: "role", taskId: wakeup.taskId, roleName: "leader" };
+        this.transaction(() => {
+            const existing = this.getWorkMailbox(target);
+            if (existing !== null && existing.pending !== null
+                && wakeup.requestCount <= existing.pending.requestCount) {
+                throw new StorageRecordError(`Pending wakeup is stale: ${wakeup.taskId}`);
+            }
+            const fromSequence = existing?.pending?.fromSequence ?? existing?.nextSequence ?? 1;
+            const toSequence = fromSequence + wakeup.requestCount - 1;
+            this.saveWorkMailbox({
+                schemaVersion: CURRENT_WORK_MAILBOX_SCHEMA_VERSION,
+                target,
+                nextSequence: Math.max(existing?.nextSequence ?? 1, toSequence + 1),
+                processing: existing?.processing ?? null,
+                pending: {
+                    ...existing?.pending,
+                    fromSequence,
+                    toSequence,
+                    reasons: [...wakeup.reasons],
+                    refs: existing?.pending?.refs ?? [],
+                    requestCount: wakeup.requestCount,
+                    firstQueuedAt: wakeup.firstRequestedAt,
+                    lastQueuedAt: wakeup.lastRequestedAt
+                }
+            });
+        });
+    }
+    clearPendingWakeup(taskId) {
+        this.removeWorkMailbox({ kind: "role", taskId, roleName: "leader" });
     }
-    savePendingWakeup(value) { this.#saveSingleton(value.taskId, "pendingWakeup", value, "Pending wakeup"); }
-    clearPendingWakeup(taskId) { this.#clearSingleton(taskId, "pendingWakeup"); }
     getLeaderFailure(taskId) { return optional(this.#state().tasks[taskId]?.leaderFailure ?? undefined); }
     saveLeaderFailure(value) { this.#saveSingleton(value.taskId, "leaderFailure", value, "Leader failure"); }
     clearLeaderFailure(taskId) { this.#clearSingleton(taskId, "leaderFailure"); }
@@ -452,7 +1004,10 @@ export class FileTaskStore {
     saveOperatorNotification(value) { this.#saveSingleton(value.taskId, "operatorNotification", value, "Operator notification"); }
     clearOperatorNotification(taskId) { this.#clearSingleton(taskId, "operatorNotification"); }
     #saveSingleton(taskId, key, value, label) {
-        const stored = identified(value, 1, "taskId", taskId, label);
+        const schemaVersion = key === "leaderFailure"
+            ? CURRENT_LEADER_FAILURE_SCHEMA_VERSION
+            : CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION;
+        const stored = identified(value, schemaVersion, "taskId", taskId, label);
         this.#requireTaskForWrite(taskId);
         this.#mutate((state) => { state.tasks[taskId][key] = stored; });
     }
@@ -461,12 +1016,13 @@ export class FileTaskStore {
             state.tasks[key][field] = null; });
     }
     #saveTaskRecord(taskId, key, value, label) {
-        const record = versioned(value, 1, label);
+        const record = versioned(value, CURRENT_MESSAGE_SCHEMA_VERSION, label);
         this.#requireTaskForWrite(taskId);
         this.#mutate((state) => {
-            if (taskRecordOwner(state, key, record.id) !== null) {
-                throw new StorageRecordError(`${label} already exists: ${record.id}`);
+            if (state.tasks[taskId][key][record.id] !== undefined) {
+                throw new StorageRecordError(`${label} already exists: ${taskId}/${record.id}`);
             }
+            observeTaskRecordId(state.tasks[taskId], "message", record.id);
             state.tasks[taskId][key][record.id] = clone(value);
         });
     }
@@ -477,7 +1033,7 @@ export class FileTaskStore {
         return aggregate;
     }
     #requireTaskForWrite(taskId) { return this.#requireTask(taskId); }
-    #state() { return this.#transaction?.state ?? this.#readState(); }
+    #state() { return this.#transaction?.state ?? this.#readCachedState(); }
     #mutate(execute) { this.#mutateResult((state) => { execute(state); }); }
     #mutateResult(execute) {
         if (this.#transaction !== null) {
@@ -486,10 +1042,16 @@ export class FileTaskStore {
             return result;
         }
         return this.#withWriteLock(() => {
-            const state = this.#readState();
-            const result = execute(state);
-            this.#commit(state, state.revision);
-            return result;
+            const state = this.#readCachedState();
+            try {
+                const result = execute(state);
+                this.#commit(state, state.revision);
+                return result;
+            }
+            catch (error) {
+                this.#readCache = null;
+                throw error;
+            }
         });
     }
     #remove(select, id) {
@@ -509,14 +1071,49 @@ export class FileTaskStore {
         }, 0);
         return `${prefix}-${maximum + 1}`;
     }
+    #nextTaskRecordId(taskId, kind) {
+        return this.#mutateResult((state) => {
+            const aggregate = requireTaskFromState(state, taskId);
+            const next = nextTaskRecordSequence(aggregate, taskId, kind);
+            aggregate.idHighWaterMarks[kind] = next;
+            return `${TASK_RECORD_ID_PREFIXES[kind]}-${next}`;
+        });
+    }
+    #peekTaskRecordId(taskId, kind) {
+        const aggregate = this.#requireTask(taskId);
+        return `${TASK_RECORD_ID_PREFIXES[kind]}-${nextTaskRecordSequence(aggregate, taskId, kind)}`;
+    }
     #readState() {
-        requireStorageSchema(this.rootDir);
+        this.#requireReadableSchema();
         const path = join(this.rootDir, STORAGE_STATE_FILE);
         if (!existsSync(path))
             return emptyState();
-        return parseState(readFileSync(path, "utf8"));
+        return this.#parseState(readFileSync(path, "utf8"));
+    }
+    #readCachedState() {
+        this.#requireReadableSchema();
+        const path = join(this.rootDir, STORAGE_STATE_FILE);
+        if (!existsSync(path)) {
+            if (this.#readCache?.fingerprint === "missing")
+                return this.#readCache.state;
+            const state = emptyState();
+            this.#readCache = { fingerprint: "missing", state };
+            return state;
+        }
+        const fingerprint = stateFileFingerprint(path);
+        if (this.#readCache?.fingerprint === fingerprint)
+            return this.#readCache.state;
+        const state = this.#parseState(readFileSync(path, "utf8"));
+        this.#readCache = { fingerprint, state };
+        return state;
     }
     #commit(state, expectedRevision) {
+        // The upgrade admission fence is honored at the single write moment, so both
+        // baseline CLI writers and the Controller (which mutate through this same
+        // store) refuse to persist while an upgrade owns the Home. Reads and
+        // read-only transactions never reach here, and the fencing process itself is
+        // exempt so it can re-pin the revision under the lock.
+        assertHomeWritable(this.rootDir);
         const current = this.#readState();
         if (current.revision !== expectedRevision) {
             throw new StorageConflictError(`Storage changed concurrently (expected revision ${expectedRevision}, found ${current.revision}).`);
@@ -525,6 +1122,19 @@ export class FileTaskStore {
         const content = `${JSON.stringify(state, null, 2)}\n`;
         parseState(content);
         writeTextFileAtomically(join(this.rootDir, STORAGE_STATE_FILE), content);
+        if (this.#normalizeState !== undefined) {
+            // A compatible read never rewrites the Home. Its first actual mutation
+            // emits current-only state, then advances the durable manifest to the
+            // same current family versions under the existing storage write lock.
+            // A crash between the two atomic files is detected as manifest/state
+            // inconsistency on the next open; it is never silently accepted.
+            writeCurrentStorageManifest(this.rootDir);
+            this.#normalizeState = undefined;
+        }
+        this.#readCache = null;
+    }
+    #parseState(raw) {
+        return parseState(this.#normalizeState?.(raw) ?? raw);
     }
     #withWriteLock(execute) {
         const release = acquireStorageLock(this.rootDir);
@@ -535,6 +1145,16 @@ export class FileTaskStore {
             release();
         }
     }
+    #requireReadableSchema() {
+        if (this.#normalizeState === undefined)
+            requireStorageSchema(this.rootDir);
+        else
+            requireCompatibleStorageSchema(this.rootDir);
+    }
+}
+function stateFileFingerprint(path) {
+    const stat = statSync(path, { bigint: true });
+    return [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(":");
 }
 export class StorageRecordError extends Error {
     constructor(message) { super(message); this.name = "StorageRecordError"; }
@@ -549,29 +1169,74 @@ export function resolveYuiHome(env) {
 }
 export function ensureYuiHome(rootDir) { mkdirSync(rootDir, { recursive: true, mode: 0o700 }); }
 function emptyState() {
-    return { schemaVersion: 1, revision: 0, config: { schemaVersion: 1 }, configuredAgents: {}, repositories: {}, globalRoles: {}, globalRoleSessionSets: {}, tasks: {} };
+    return {
+        schemaVersion: CURRENT_STORAGE_STATE_SCHEMA_VERSION,
+        revision: 0,
+        config: { schemaVersion: CURRENT_CONFIG_SCHEMA_VERSION },
+        configuredAgents: {},
+        projects: {},
+        agentProfiles: {},
+        globalRoles: {},
+        globalRoleSessionSets: {},
+        tasks: {},
+        mailboxes: {}
+    };
 }
 function emptyStoredTask(task) {
     return {
-        schemaVersion: 1,
+        schemaVersion: CURRENT_STORED_TASK_SCHEMA_VERSION,
         task,
+        idHighWaterMarks: emptyTaskIdHighWaterMarks(),
         brief: null,
+        changeSets: {},
+        integrationAttempts: {},
         roles: {},
-        roleWorkspaces: {},
+        managedWorkspaces: {},
         roleSessionSets: {},
         workItems: {},
         agentRuns: {},
+        reviewRounds: {},
         activeRuns: {},
         messages: {},
         inputRequests: {},
         decisions: {},
         milestones: {},
         events: {},
-        pendingWakeup: null,
         leaderFailure: null,
         operatorNotification: null
     };
 }
+function emptyTaskIdHighWaterMarks() {
+    return {
+        workItem: 0,
+        agentRun: 0,
+        reviewRound: 0,
+        changeSet: 0,
+        integrationAttempt: 0,
+        message: 0,
+        inputRequest: 0,
+        decision: 0,
+        milestone: 0,
+        event: 0
+    };
+}
+function nextTaskRecordSequence(aggregate, taskId, kind) {
+    const next = aggregate.idHighWaterMarks[kind] + 1;
+    if (!Number.isSafeInteger(next)) {
+        throw new StorageRecordError(`Task ${kind} id space is exhausted: ${taskId}.`);
+    }
+    return next;
+}
+function validateTaskIdHighWaterMarks(value, taskId) {
+    const marks = object(value, `Task id high-water marks ${taskId}`);
+    const kinds = Object.keys(TASK_RECORD_ID_PREFIXES);
+    exact(marks, kinds, `Task id high-water marks ${taskId}`);
+    for (const kind of kinds) {
+        if (!Number.isSafeInteger(marks[kind]) || marks[kind] < 0) {
+            throw new StorageRecordError(`Task id high-water mark is invalid: ${taskId}/${kind}.`);
+        }
+    }
+}
 function parseState(raw) {
     let parsed;
     try {
@@ -581,30 +1246,65 @@ function parseState(raw) {
         throw new StorageRecordError(`Invalid ${STORAGE_STATE_FILE}: ${error instanceof Error ? error.message : String(error)}`);
     }
     const state = object(parsed, "Storage state");
-    exact(state, ["schemaVersion", "revision", "config", "configuredAgents", "repositories", "globalRoles", "globalRoleSessionSets", "tasks"], "Storage state");
-    if (state.schemaVersion !== 1 || !Number.isInteger(state.revision) || state.revision < 0)
+    exact(state, [
+        "schemaVersion",
+        "revision",
+        "config",
+        "configuredAgents",
+        "projects",
+        "agentProfiles",
+        "globalRoles",
+        "globalRoleSessionSets",
+        "tasks",
+        "mailboxes"
+    ], "Storage state");
+    if (state.schemaVersion !== CURRENT_STORAGE_STATE_SCHEMA_VERSION || !Number.isInteger(state.revision) || state.revision < 0)
         throw new StorageRecordError("Storage state schemaVersion/revision is invalid.");
     const result = clone(state);
-    result.config = versioned(result.config, 1, "Yui config");
+    result.config = versioned(result.config, CURRENT_CONFIG_SCHEMA_VERSION, "Yui config");
     validateYuiConfig(result.config);
     parseMap(result.configuredAgents, (value, key) => {
-        const agent = identified(value, 2, "id", key, "Configured Agent");
+        const agent = identified(value, CURRENT_CONFIGURED_AGENT_SCHEMA_VERSION, "id", key, "Configured Agent");
         validateConfiguredAgent(agent);
         return agent;
     }, "configuredAgents");
-    parseMap(result.repositories, (value, key) => {
-        const repository = identified(value, 1, "id", key, "Repository");
-        validateRepository(repository);
-        return repository;
-    }, "repositories");
+    parseMap(result.projects, (value, key) => {
+        const project = identified(value, CURRENT_PROJECT_SCHEMA_VERSION, "id", key, "Project");
+        validateProject(project);
+        return project;
+    }, "projects");
+    try {
+        assertProjectCatalog(Object.values(result.projects));
+    }
+    catch (error) {
+        throw new StorageRecordError(error instanceof Error ? error.message : String(error));
+    }
+    parseMap(result.agentProfiles, (value, key) => {
+        const profile = identified(value, CURRENT_AGENT_PROFILE_SCHEMA_VERSION, "id", key, "Agent Profile");
+        validateAgentProfile(profile);
+        return profile;
+    }, "agentProfiles");
     parseMap(result.globalRoles, (value, key) => {
-        const role = identified(value, 2, "name", key, "Global Role");
+        const role = identified(value, CURRENT_GLOBAL_ROLE_SCHEMA_VERSION, "name", key, "Global Role");
         validateGlobalRole(role);
         return role;
     }, "globalRoles");
     parseMap(result.globalRoleSessionSets, (value, key) => { const set = globalSessions(value); if (set.owner.roleName !== key)
         throw new StorageRecordError(`Global Role session set identity is inconsistent: ${key}`); return set; }, "globalRoleSessionSets");
     parseMap(result.tasks, (value, key) => parseStoredTask(value, key), "tasks");
+    parseMap(result.mailboxes, (value, key) => {
+        let mailbox;
+        try {
+            mailbox = validateWorkMailbox(versioned(value, CURRENT_WORK_MAILBOX_SCHEMA_VERSION, "WorkMailbox"));
+        }
+        catch (error) {
+            throw new StorageRecordError(error instanceof Error ? error.message : String(error));
+        }
+        if (mailboxTargetKey(mailbox.target) !== key) {
+            throw new StorageRecordError(`WorkMailbox identity is inconsistent: ${key}`);
+        }
+        return mailbox;
+    }, "mailboxes");
     for (const [name, role] of Object.entries(result.globalRoles)) {
         const sessions = result.globalRoleSessionSets[name];
         if (sessions !== undefined)
@@ -616,78 +1316,183 @@ function parseState(raw) {
         }
     }
     for (const aggregate of Object.values(result.tasks)) {
-        if (aggregate.task.repositoryId !== undefined
-            && result.repositories[aggregate.task.repositoryId] === undefined) {
-            throw new StorageRecordError(`Task Repository not found: ${aggregate.task.id}/${aggregate.task.repositoryId}`);
+        for (const binding of aggregate.task.projectBindings) {
+            if (result.projects[binding.projectId] === undefined) {
+                throw new StorageRecordError(`Task Project not found: ${aggregate.task.id}/${binding.projectId}`);
+            }
         }
         for (const [name, role] of Object.entries(aggregate.roles)) {
             const sessions = aggregate.roleSessionSets[name];
             if (sessions !== undefined)
                 assertSessionsMatchRole(sessions, role);
-            const workspace = aggregate.roleWorkspaces[name];
-            if (workspace !== undefined && workspace.path !== role.workspace) {
-                throw new StorageRecordError(`Task Role workspace path is inconsistent: ${aggregate.task.id}/${name}`);
-            }
         }
         for (const name of Object.keys(aggregate.roleSessionSets)) {
             if (aggregate.roles[name] === undefined) {
                 throw new StorageRecordError(`Task Role session set has no Role: ${aggregate.task.id}/${name}`);
             }
         }
-        for (const [name, workspace] of Object.entries(aggregate.roleWorkspaces)) {
-            if (aggregate.roles[name] === undefined) {
-                throw new StorageRecordError(`RoleWorkspace has no Task Role: ${aggregate.task.id}/${name}`);
+        for (const [key, workspace] of Object.entries(aggregate.managedWorkspaces)) {
+            if (workspace.owner.taskId !== aggregate.task.id) {
+                throw new StorageRecordError(`Managed workspace belongs to another Task: ${key}`);
             }
-            if (aggregate.task.repositoryId !== workspace.repositoryId) {
-                throw new StorageRecordError(`RoleWorkspace Repository does not match Task: ${aggregate.task.id}/${name}`);
+            const boundProjects = new Set(aggregate.task.projectBindings.map(({ projectId }) => projectId));
+            if (workspace.entries.some(({ projectId }) => !boundProjects.has(projectId))) {
+                throw new StorageRecordError(`Managed workspace Project does not match Task: ${aggregate.task.id}/${key}`);
+            }
+            if (workspace.owner.type === "work-item"
+                && aggregate.workItems[workspace.owner.workItemId] === undefined) {
+                throw new StorageRecordError(`Managed workspace WorkItem not found: ${aggregate.task.id}/${workspace.owner.workItemId}`);
+            }
+            if (workspace.owner.type === "review-round"
+                && aggregate.reviewRounds[workspace.owner.reviewRoundId] === undefined) {
+                throw new StorageRecordError(`Managed workspace ReviewRound not found: ${aggregate.task.id}/${workspace.owner.reviewRoundId}`);
+            }
+            if (workspace.owner.type === "integration-attempt"
+                && aggregate.integrationAttempts[workspace.owner.integrationAttemptId] === undefined) {
+                throw new StorageRecordError(`Managed workspace Integration Attempt not found: ${aggregate.task.id}/${workspace.owner.integrationAttemptId}`);
+            }
+            if (workspace.owner.type === "execution-lane") {
+                const laneOwner = workspace.owner;
+                const laneItem = laneOwner.purpose === "execution"
+                    ? aggregate.workItems[laneOwner.workItemId ?? ""]
+                    : undefined;
+                const group = laneOwner.purpose === "execution"
+                    ? (laneItem === undefined
+                        ? undefined
+                        : workItemExecutionGroupById(laneItem, laneOwner.executionGroupId))
+                    : aggregate.reviewRounds[laneOwner.reviewRoundId ?? ""]?.executionGroup;
+                if (group?.id !== laneOwner.executionGroupId
+                    || !group.lanes.some(({ id }) => id === laneOwner.executionLaneId)) {
+                    throw new StorageRecordError(`Managed workspace Execution Lane not found: ${aggregate.task.id}/${key}`);
+                }
             }
         }
+        validateCanonicalTaskReferences(result, aggregate);
     }
-    assertGloballyUniqueTaskRecordIds(result, "inputRequests", "Input request");
-    assertGloballyUniqueTaskRecordIds(result, "decisions", "Decision");
-    assertGloballyUniqueTaskRecordIds(result, "milestones", "Milestone");
-    assertGloballyUniqueTaskRecordIds(result, "events", "Task event");
-    assertGloballyUniqueTaskRecordIds(result, "messages", "Message");
+    for (const mailbox of Object.values(result.mailboxes))
+        validateMailboxReferences(result, mailbox);
     return result;
 }
+/** Strict current-model gate used by the compatible loader before any writer opens. */
+export function validateCurrentStorageStateSnapshot(value) {
+    parseState(`${JSON.stringify(value)}\n`);
+}
 function parseStoredTask(value, taskId) {
     const aggregate = object(value, `Task aggregate ${taskId}`);
-    exact(aggregate, ["schemaVersion", "task", "brief", "roles", "roleWorkspaces", "roleSessionSets", "workItems", "agentRuns", "activeRuns", "messages", "inputRequests", "decisions", "milestones", "events", "pendingWakeup", "leaderFailure", "operatorNotification"], `Task aggregate ${taskId}`);
-    versioned(aggregate, 1, `Task aggregate ${taskId}`);
-    validateTask(identified(aggregate.task, 1, "id", taskId, "Task"));
+    exact(aggregate, [
+        "schemaVersion",
+        "task",
+        "idHighWaterMarks",
+        "brief",
+        "changeSets",
+        "integrationAttempts",
+        "roles",
+        "managedWorkspaces",
+        "roleSessionSets",
+        "workItems",
+        "agentRuns",
+        "reviewRounds",
+        "activeRuns",
+        "messages",
+        "inputRequests",
+        "decisions",
+        "milestones",
+        "events",
+        "leaderFailure",
+        "operatorNotification"
+    ], `Task aggregate ${taskId}`);
+    parseMap(aggregate.changeSets, (record, key) => {
+        const changeSet = identifiedChangeSet(record, key);
+        if (changeSet.taskId !== taskId) {
+            throw new StorageRecordError(`ChangeSet belongs to another Task: ${changeSet.taskId}.`);
+        }
+        validateChangeSet(changeSet);
+        return changeSet;
+    }, "changeSets");
+    parseMap(aggregate.integrationAttempts, (record, key) => {
+        const attempt = identified(record, CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION, "id", key, "Integration Attempt");
+        if (attempt.taskId !== taskId) {
+            throw new StorageRecordError(`Integration Attempt belongs to another Task: ${attempt.taskId}.`);
+        }
+        validateIntegrationAttempt(attempt);
+        return attempt;
+    }, "integrationAttempts");
+    versioned(aggregate, CURRENT_STORED_TASK_SCHEMA_VERSION, `Task aggregate ${taskId}`);
+    validateTaskIdHighWaterMarks(aggregate.idHighWaterMarks, taskId);
+    validateTask(identified(aggregate.task, CURRENT_TASK_SCHEMA_VERSION, "id", taskId, "Task"));
     if (aggregate.brief !== null)
         storedTaskBrief(aggregate.brief);
-    parseMap(aggregate.roles, (record, key) => { const role = identified(record, 2, "name", key, "Task Role"); if (role.taskId !== taskId)
-        throw new StorageRecordError(`Task Role belongs to another Task: ${role.taskId}`); validateTaskRole(role); return role; }, "roles");
-    parseMap(aggregate.roleWorkspaces, (record, key) => {
-        const workspace = identified(record, 1, "roleName", key, "RoleWorkspace");
-        if (workspace.taskId !== taskId) {
-            throw new StorageRecordError(`RoleWorkspace belongs to another Task: ${workspace.taskId}`);
-        }
-        validateRoleWorkspace(workspace);
+    parseMap(aggregate.roles, (record, key) => {
+        const role = identified(record, CURRENT_TASK_ROLE_SCHEMA_VERSION, "name", key, "Task Role");
+        if (role.taskId !== taskId)
+            throw new StorageRecordError(`Task Role belongs to another Task: ${role.taskId}`);
+        validateTaskRole(role);
+        return role;
+    }, "roles");
+    parseMap(aggregate.managedWorkspaces, (record, key) => {
+        const workspace = versioned(record, CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION, "Managed workspace");
+        validateManagedWorkspace(workspace);
+        if (workspace.owner.taskId !== taskId) {
+            throw new StorageRecordError(`Managed workspace belongs to another Task: ${workspace.owner.taskId}`);
+        }
+        if (managedWorkspaceKey(workspace.owner) !== key) {
+            throw new StorageRecordError(`Managed workspace identity is inconsistent: ${taskId}/${key}`);
+        }
         return workspace;
-    }, "roleWorkspaces");
+    }, "managedWorkspaces");
     parseMap(aggregate.roleSessionSets, (record, key) => { const set = taskSessions(record); if (set.owner.taskId !== taskId || set.owner.roleName !== key)
         throw new StorageRecordError(`Task Role session set identity is inconsistent: ${taskId}/${key}`); return set; }, "roleSessionSets");
-    parseMap(aggregate.workItems, (record, key) => { const item = identified(record, 1, "id", key, "Work item"); if (item.taskId !== taskId)
-        throw new StorageRecordError(`Work item belongs to another Task: ${item.taskId}`); return item; }, "workItems");
-    parseMap(aggregate.agentRuns, (record, key) => { const run = identified(record, 1, "id", key, "Agent run"); if (run.taskId !== taskId)
-        throw new StorageRecordError(`Agent run belongs to another Task: ${run.taskId}`); validateAgentRun(run); return run; }, "agentRuns");
+    parseMap(aggregate.workItems, (record, key) => {
+        const item = identified(record, CURRENT_WORK_ITEM_SCHEMA_VERSION, "id", key, "Work item");
+        if (item.taskId !== taskId) {
+            throw new StorageRecordError(`Work item belongs to another Task: ${item.taskId}`);
+        }
+        validateWorkItem(item);
+        return item;
+    }, "workItems");
+    parseMap(aggregate.agentRuns, (record, key) => {
+        const run = identified(record, CURRENT_AGENT_RUN_SCHEMA_VERSION, "id", key, "Agent run");
+        if (run.taskId !== taskId) {
+            throw new StorageRecordError(`Agent run belongs to another Task: ${run.taskId}`);
+        }
+        validateAgentRun(run);
+        return run;
+    }, "agentRuns");
+    parseMap(aggregate.reviewRounds, (record, key) => {
+        const round = identified(record, CURRENT_REVIEW_ROUND_SCHEMA_VERSION, "id", key, "ReviewRound");
+        if (round.taskId !== taskId) {
+            throw new StorageRecordError(`ReviewRound belongs to another Task: ${round.taskId}.`);
+        }
+        validateReviewRound(round);
+        return round;
+    }, "reviewRounds");
     parseMap(aggregate.activeRuns, (record, key) => {
-        const pointer = versioned(record, 1, `Active run ${key}`);
+        const pointer = versioned(record, CURRENT_ACTIVE_RUN_POINTER_SCHEMA_VERSION, `Active run ${key}`);
         const run = typeof pointer.runId === "string" ? aggregate.agentRuns[pointer.runId] : undefined;
-        if (run === undefined || run.status !== "active" || run.roleName !== key) {
+        const laneMatch = executionLaneActiveRunKeyParts(key);
+        const validLanePointer = laneMatch !== null
+            && run !== undefined
+            && run.executionGroupId === laneMatch.executionGroupId
+            && run.executionLaneId === laneMatch.executionLaneId;
+        const validRolePointer = laneMatch === null
+            && run !== undefined
+            && run.roleName === key;
+        if (run === undefined || run.status !== "active"
+            || (!validLanePointer && !validRolePointer)) {
             throw new StorageRecordError(`Active run pointer is invalid: ${taskId}/${key}`);
         }
         return pointer;
     }, "activeRuns");
     parseMap(aggregate.messages, (record, key) => {
-        const message = identified(record, 1, "id", key, "Message");
+        const message = identified(record, CURRENT_MESSAGE_SCHEMA_VERSION, "id", key, "Message");
+        if (message.taskId !== taskId) {
+            throw new StorageRecordError(`Message belongs to another Task: ${message.taskId}`);
+        }
         validateTaskMessage(message);
         return message;
     }, "messages");
     parseMap(aggregate.inputRequests, (record, key) => {
-        const request = validateInputRequest(record);
+        const request = validateInputRequest(versioned(record, CURRENT_INPUT_REQUEST_SCHEMA_VERSION, "Input request"));
         if (request.id !== key) {
             throw new StorageRecordError(`Input request identity is inconsistent: ${key}.`);
         }
@@ -718,25 +1523,71 @@ function parseStoredTask(value, taskId) {
         const event = storedTaskEvent(record);
         if (event.id !== key)
             throw new StorageRecordError(`Task event identity is inconsistent: ${key}.`);
+        if (event.taskId !== taskId) {
+            throw new StorageRecordError(`Task event belongs to another Task: ${event.taskId}`);
+        }
         return event;
     }, "events");
-    for (const [key, label] of [["pendingWakeup", "Pending wakeup"], ["leaderFailure", "Leader failure"], ["operatorNotification", "Operator notification"]]) {
+    for (const [key, label] of [["leaderFailure", "Leader failure"], ["operatorNotification", "Operator notification"]]) {
         const record = aggregate[key];
-        if (record !== null)
-            identified(record, 1, "taskId", taskId, label);
+        if (record !== null) {
+            const schemaVersion = key === "leaderFailure"
+                ? CURRENT_LEADER_FAILURE_SCHEMA_VERSION
+                : CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION;
+            identified(record, schemaVersion, "taskId", taskId, label);
+        }
     }
+    validateTaskIdHighWaterCoverage(aggregate, taskId);
     return aggregate;
 }
+function validateTaskIdHighWaterCoverage(aggregate, taskId) {
+    const records = {
+        workItem: aggregate.workItems,
+        agentRun: aggregate.agentRuns,
+        reviewRound: aggregate.reviewRounds,
+        changeSet: aggregate.changeSets,
+        integrationAttempt: aggregate.integrationAttempts,
+        message: aggregate.messages,
+        inputRequest: aggregate.inputRequests,
+        decision: aggregate.decisions,
+        milestone: aggregate.milestones,
+        event: aggregate.events
+    };
+    for (const kind of Object.keys(TASK_RECORD_ID_PREFIXES)) {
+        const pattern = new RegExp(`^${TASK_RECORD_ID_PREFIXES[kind]}-(\\d+)$`);
+        for (const id of Object.keys(records[kind])) {
+            const match = pattern.exec(id);
+            if (match === null) {
+                throw new StorageRecordError(`Task-local ${kind} id is invalid: ${taskId}/${id}.`);
+            }
+            const sequence = Number.parseInt(match[1], 10);
+            if (sequence > aggregate.idHighWaterMarks[kind]) {
+                throw new StorageRecordError(`Task id high-water mark is behind ${taskId}/${kind}: ${id}.`);
+            }
+        }
+    }
+}
+function observeTaskRecordId(aggregate, kind, id) {
+    validateTaskRecordReference({ taskId: aggregate.task.id, localId: id }, kind);
+    const match = new RegExp(`^${TASK_RECORD_ID_PREFIXES[kind]}-(\\d+)$`).exec(id);
+    if (match === null)
+        throw new StorageRecordError(`Task-local ${kind} id is invalid: ${id}.`);
+    const sequence = Number.parseInt(match[1], 10);
+    aggregate.idHighWaterMarks[kind] = Math.max(aggregate.idHighWaterMarks[kind], sequence);
+}
 function validateYuiConfig(config) {
     try {
         reconciliationIntervalMilliseconds(config.reconciliationIntervalSeconds);
+        resolveTimeZone(config.timeZone);
+        if (config.review !== undefined)
+            validateReviewConfig(config.review);
     }
     catch (error) {
         throw new StorageRecordError(error instanceof Error ? error.message : "Yui reconciliation interval is invalid.");
     }
 }
 function globalSessions(value) {
-    const set = versioned(value, 1, "Global Role session set");
+    const set = versioned(value, CURRENT_GLOBAL_ROLE_SESSION_SET_SCHEMA_VERSION, "Global Role session set");
     if (set.owner?.scope !== "global" || typeof set.owner.roleName !== "string")
         throw new StorageRecordError("Global Role session owner is invalid.");
     validateSessions(set.sessions);
@@ -744,7 +1595,7 @@ function globalSessions(value) {
     return set;
 }
 function taskSessions(value) {
-    const set = versioned(value, 1, "Task Role session set");
+    const set = versioned(value, CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION, "Task Role session set");
     if (set.owner?.scope !== "task" || typeof set.owner.taskId !== "string" || typeof set.owner.roleName !== "string")
         throw new StorageRecordError("Task Role session owner is invalid.");
     validateSessions(set.sessions);
@@ -752,11 +1603,11 @@ function taskSessions(value) {
     return set;
 }
 function validateSessions(sessions) {
-    parseMap(sessions, (record, key) => identified(record, 1, "agentId", key, "Role Agent session"), "sessions");
+    parseMap(sessions, (record, key) => identified(record, CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION, "agentId", key, "Role Agent session"), "sessions");
 }
 function assertSessionsMatchRole(sessions, role) {
     validateRoleSessionSet(sessions);
-    if (sessions.owner.roleName !== role.name || sessions.activeAgentId !== role.activeAgentId) {
+    if (sessions.owner.roleName !== role.name) {
         throw new StorageRecordError(`Role session set does not match Role: ${role.name}`);
     }
     if ("taskId" in role && (sessions.owner.scope !== "task" || sessions.owner.taskId !== role.taskId)) {
@@ -765,7 +1616,16 @@ function assertSessionsMatchRole(sessions, role) {
     if (!("taskId" in role) && sessions.owner.scope !== "global") {
         throw new StorageRecordError(`Global Role session owner is inconsistent: ${role.name}`);
     }
-    for (const [agentId, session] of Object.entries(sessions.sessions)) {
+    const ownedSessions = [
+        ...Object.entries(sessions.sessions),
+        ...(sessions.owner.scope === "global"
+            ? Object.entries(sessions.history ?? {})
+            : [
+                ...(sessions.history ?? []).map((session, index) => [`history-${index}`, session])
+            ])
+    ];
+    for (const [, session] of ownedSessions) {
+        const agentId = session.agentId;
         const binding = role.agentBindings[agentId];
         if (binding === undefined || binding.adapterId !== session.adapterId) {
             throw new StorageRecordError(`Role Agent session has no matching binding: ${role.name}/${agentId}`);
@@ -773,9 +1633,19 @@ function assertSessionsMatchRole(sessions, role) {
     }
 }
 function storedTaskBrief(value) {
-    const brief = versioned(value, 1, "Task Brief");
-    exact(brief, ["schemaVersion", "objective", "boundaries", "currentFocus", "leaderSummary", "updatedAt", "updatedBy"], "Task Brief");
+    const brief = versioned(value, CURRENT_TASK_BRIEF_SCHEMA_VERSION, "Task Brief");
+    exact(brief, [
+        "schemaVersion",
+        "objective",
+        "boundaries",
+        "technicalApproach",
+        "currentFocus",
+        "leaderSummary",
+        "updatedAt",
+        "updatedBy"
+    ], "Task Brief");
     requireNormalizedText(brief.objective, "Task Brief objective");
+    requireOptionalNormalizedText(brief.technicalApproach, "Task Brief technical approach");
     requireNormalizedText(brief.currentFocus, "Task Brief current focus");
     requireNormalizedText(brief.leaderSummary, "Task Brief leader summary");
     requireNormalizedText(brief.updatedBy, "Task Brief updatedBy");
@@ -790,7 +1660,7 @@ function storedTaskBrief(value) {
     return brief;
 }
 function storedDecision(value) {
-    const decision = versioned(value, 1, "Decision");
+    const decision = versioned(value, CURRENT_DECISION_SCHEMA_VERSION, "Decision");
     const baseFields = [
         "schemaVersion", "id", "taskId", "title", "rationale", "status", "createdAt", "updatedAt"
     ];
@@ -810,6 +1680,7 @@ function storedDecision(value) {
     }
     requireRecordIdentity(decision.id, "Decision id");
     requireRecordIdentity(decision.taskId, "Decision Task id");
+    validateTaskRecordReference({ taskId: decision.taskId, localId: decision.id }, "decision");
     requireNormalizedText(decision.title, "Decision title");
     requireNormalizedText(decision.rationale, "Decision rationale");
     requireTimestamp(decision.createdAt, "Decision createdAt");
@@ -820,10 +1691,11 @@ function storedDecision(value) {
     return decision;
 }
 function storedMilestone(value) {
-    const milestone = versioned(value, 1, "Milestone");
+    const milestone = versioned(value, CURRENT_MILESTONE_SCHEMA_VERSION, "Milestone");
     exact(milestone, ["schemaVersion", "id", "taskId", "title", "summary", "createdBy", "createdAt"], "Milestone");
     requireRecordIdentity(milestone.id, "Milestone id");
     requireRecordIdentity(milestone.taskId, "Milestone Task id");
+    validateTaskRecordReference({ taskId: milestone.taskId, localId: milestone.id }, "milestone");
     requireNormalizedText(milestone.title, "Milestone title");
     requireNormalizedText(milestone.summary, "Milestone summary");
     if (milestone.createdBy !== "leader") {
@@ -833,9 +1705,11 @@ function storedMilestone(value) {
     return milestone;
 }
 function storedTaskEvent(value) {
-    const event = versioned(value, 1, "Task event");
-    exact(event, ["schemaVersion", "id", "type", "payload", "createdAt"], "Task event");
+    const event = versioned(value, CURRENT_EVENT_SCHEMA_VERSION, "Task event");
+    exact(event, ["schemaVersion", "id", "taskId", "type", "payload", "createdAt"], "Task event");
     requireRecordIdentity(event.id, "Task event id");
+    requireRecordIdentity(event.taskId, "Task event Task id");
+    validateTaskRecordReference({ taskId: event.taskId, localId: event.id }, "event");
     requireNormalizedText(event.type, "Task event type");
     const payload = object(event.payload, "Task event payload");
     for (const [key, payloadValue] of Object.entries(payload)) {
@@ -876,25 +1750,6 @@ function requireTaskFromState(state, taskId) {
         throw new StorageRecordError(`Task not found: ${taskId}`);
     return aggregate;
 }
-function taskRecordOwner(state, key, id) {
-    for (const [taskId, aggregate] of Object.entries(state.tasks)) {
-        if (aggregate[key][id] !== undefined)
-            return taskId;
-    }
-    return null;
-}
-function assertGloballyUniqueTaskRecordIds(state, key, label) {
-    const owners = new Map();
-    for (const [taskId, aggregate] of Object.entries(state.tasks)) {
-        for (const id of Object.keys(aggregate[key])) {
-            const owner = owners.get(id);
-            if (owner !== undefined) {
-                throw new StorageRecordError(`${label} id is duplicated across Tasks: ${id} (${owner}, ${taskId}).`);
-            }
-            owners.set(id, taskId);
-        }
-    }
-}
 function requireRecordIdentity(value, label) {
     const normalized = requireNormalizedText(value, label);
     if (["__proto__", "prototype", "constructor", ".", ".."].includes(normalized)
@@ -914,6 +1769,15 @@ function requireNormalizedText(value, label) {
         throw new StorageRecordError(`${label} must be normalized.`);
     return normalized;
 }
+function requireOptionalNormalizedText(value, label) {
+    if (typeof value !== "string" || value.includes("\0")) {
+        throw new StorageRecordError(`${label} is invalid.`);
+    }
+    const normalized = value.trim();
+    if (normalized !== value)
+        throw new StorageRecordError(`${label} must be normalized.`);
+    return normalized;
+}
 function requireTimestamp(value, label) {
     if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) {
         throw new StorageRecordError(`${label} is invalid.`);
@@ -938,6 +1802,9 @@ function identified(value, schemaVersion, key, expected, label) {
         throw new StorageRecordError(`${label} identity is inconsistent: ${expected}.`);
     return record;
 }
+function identifiedChangeSet(value, expectedId) {
+    return identified(value, CURRENT_CHANGE_SET_SCHEMA_VERSION, "id", expectedId, "ChangeSet");
+}
 function object(value, label) {
     if (typeof value !== "object" || value === null || Array.isArray(value))
         throw new StorageRecordError(`${label} must be an object.`);
@@ -979,12 +1846,726 @@ function values(records, identity) {
     return Object.values(records).map(clone).sort((left, right) => numericCompare(typeof identity === "function" ? identity(left) : String(left[identity]), typeof identity === "function" ? identity(right) : String(right[identity])));
 }
 function numericCompare(left, right) { return left.localeCompare(right, undefined, { numeric: true }); }
-function allKeys(state, key) { return Object.values(state.tasks).flatMap((task) => Object.keys(task[key])); }
-function findUnique(state, key, id, label) {
-    const matches = Object.values(state.tasks).flatMap((task) => task[key][id] === undefined ? [] : [task[key][id]]);
-    if (matches.length > 1)
-        throw new StorageRecordError(`${label} id is ambiguous: ${id}`);
-    return matches[0] === undefined ? null : clone(matches[0]);
+function pendingWakeupProjection(mailbox) {
+    if (mailbox === null || mailbox.target.kind !== "role" || mailbox.target.roleName !== "leader"
+        || mailbox.pending === null) {
+        return null;
+    }
+    return {
+        schemaVersion: CURRENT_PENDING_WAKEUP_SCHEMA_VERSION,
+        taskId: mailbox.target.taskId,
+        reasons: [...mailbox.pending.reasons],
+        requestCount: mailbox.pending.requestCount,
+        firstRequestedAt: mailbox.pending.firstQueuedAt,
+        lastRequestedAt: mailbox.pending.lastQueuedAt
+    };
+}
+function validateMailboxReferences(state, mailbox) {
+    if (mailbox.target.kind === "task"
+        || mailbox.target.kind === "role"
+        || mailbox.target.kind === "role-runtime") {
+        const aggregate = state.tasks[mailbox.target.taskId];
+        if (aggregate === undefined) {
+            throw new StorageRecordError(`WorkMailbox target Task not found: ${mailbox.target.taskId}`);
+        }
+        if (mailbox.target.kind === "role" && aggregate.roles[mailbox.target.roleName] === undefined) {
+            throw new StorageRecordError(`WorkMailbox target Role not found: ${mailbox.target.taskId}/${mailbox.target.roleName}`);
+        }
+    }
+    const refs = [];
+    if (mailbox.processing !== null) {
+        refs.push(...mailbox.processing.batch.refs);
+        if (mailbox.processing.executionRef !== undefined)
+            refs.push(mailbox.processing.executionRef);
+    }
+    if (mailbox.pending !== null)
+        refs.push(...mailbox.pending.refs);
+    for (const ref of refs) {
+        if (!mailboxReferenceExists(state, ref)) {
+            const identity = "taskId" in ref ? `${ref.taskId}/${ref.id}` : ref.id;
+            throw new StorageRecordError(`WorkMailbox reference does not exist: ${ref.type}/${identity}`);
+        }
+    }
+}
+function validateCanonicalTaskReferences(state, aggregate) {
+    const taskId = aggregate.task.id;
+    if (aggregate.task.replacementTaskId !== undefined) {
+        const replacement = state.tasks[aggregate.task.replacementTaskId];
+        if (replacement === undefined || replacement.task.id === taskId) {
+            throw new StorageRecordError(`Replacement Task reference is invalid: ${taskId}/${aggregate.task.replacementTaskId}.`);
+        }
+    }
+    const boundProjects = new Set(aggregate.task.projectBindings.map(({ projectId }) => projectId));
+    assertAcyclicWorkItems(aggregate.workItems);
+    for (const item of Object.values(aggregate.workItems)) {
+        for (const dependencyId of item.dependsOn) {
+            if (aggregate.workItems[dependencyId] === undefined) {
+                throw new StorageRecordError(`Work Item dependency not found: ${taskId}/${dependencyId}.`);
+            }
+        }
+        if (item.writeProjectIds.some((projectId) => !boundProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item writable Project does not belong to Task: ${taskId}/${item.id}.`);
+        }
+        const writableProjects = new Set(item.writeProjectIds);
+        if (item.baseRefs?.some(({ projectId }) => !boundProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item base-ref Project does not belong to Task: ${taskId}/${item.id}.`);
+        }
+        if (item.baseRefs?.some(({ projectId }) => !writableProjects.has(projectId))) {
+            throw new StorageRecordError(`Work Item base-ref Project must be writable: ${taskId}/${item.id}.`);
+        }
+        const replacementWorkItemId = item.disposition?.replacementWorkItemId;
+        if (replacementWorkItemId !== undefined) {
+            if (replacementWorkItemId === item.id) {
+                throw new StorageRecordError(`Work Item cannot replace itself: ${taskId}/${item.id}.`);
+            }
+            const replacement = aggregate.workItems[replacementWorkItemId];
+            if (replacement === undefined || replacement.taskId !== taskId) {
+                throw new StorageRecordError(`Replacement Work Item must belong to the same Task: ${taskId}/${replacementWorkItemId}.`);
+            }
+        }
+        for (const candidate of item.candidates) {
+            assertWorkItemCandidateReferences(aggregate, item, candidate, `Work Item candidate ${item.id}`);
+        }
+    }
+    for (const workspace of Object.values(aggregate.managedWorkspaces)) {
+        if (workspace.owner.type === "work-item"
+            && aggregate.workItems[workspace.owner.workItemId] === undefined) {
+            throw new StorageRecordError(`Managed workspace Work Item not found: ${taskId}/${workspace.owner.workItemId}.`);
+        }
+        if (workspace.owner.type === "review-round") {
+            const round = aggregate.reviewRounds[workspace.owner.reviewRoundId];
+            if (round === undefined) {
+                throw new StorageRecordError(`Managed workspace ReviewRound is invalid: ${taskId}/${workspace.owner.reviewRoundId}.`);
+            }
+        }
+    }
+    for (const [roleName, sessions] of Object.entries(aggregate.roleSessionSets)) {
+        if (sessions.inFlight !== null) {
+            const run = aggregate.agentRuns[sessions.inFlight.runId];
+            if (run === undefined || run.roleName !== roleName
+                || sessions.inFlight.receiptId !== formatAgentRunReceiptId(taskId, run.id)) {
+                throw new StorageRecordError(`Task Role in-flight Run is invalid: ${taskId}/${roleName}.`);
+            }
+        }
+        if (sessions.pendingTurnCompletion !== null) {
+            const completion = sessions.pendingTurnCompletion;
+            const run = aggregate.agentRuns[completion.runId];
+            if (completion.taskId !== taskId || run === undefined || run.roleName !== roleName) {
+                throw new StorageRecordError(`Task Role pending completion Run is invalid: ${taskId}/${roleName}.`);
+            }
+        }
+    }
+    for (const run of Object.values(aggregate.agentRuns)) {
+        if (run.workItemId !== undefined && aggregate.workItems[run.workItemId] === undefined) {
+            throw new StorageRecordError(`Agent Run Work Item not found: ${taskId}/${run.id}.`);
+        }
+        if (run.reviewRoundId !== undefined
+            && aggregate.reviewRounds[run.reviewRoundId] === undefined) {
+            throw new StorageRecordError(`Agent Run ReviewRound not found: ${taskId}/${run.id}.`);
+        }
+        assertAgentRunExecutionReferences(aggregate, run);
+    }
+    for (const message of Object.values(aggregate.messages)) {
+        if (message.runId !== undefined && aggregate.agentRuns[message.runId] === undefined) {
+            throw new StorageRecordError(`Message Run not found: ${taskId}/${message.id}.`);
+        }
+        if (message.workItemId !== undefined
+            && aggregate.workItems[message.workItemId] === undefined) {
+            throw new StorageRecordError(`Message Work Item not found: ${taskId}/${message.id}.`);
+        }
+    }
+    for (const request of Object.values(aggregate.inputRequests)) {
+        if (aggregate.agentRuns[request.requester.runId] === undefined) {
+            throw new StorageRecordError(`Input requester Run not found: ${taskId}/${request.id}.`);
+        }
+        for (const reference of request.blockedRefs) {
+            const found = reference.type === "run"
+                ? aggregate.agentRuns[reference.id]
+                : aggregate.workItems[reference.id];
+            if (found === undefined) {
+                throw new StorageRecordError(`Input blocked ${reference.type} not found: ${taskId}/${request.id}/${reference.id}.`);
+            }
+        }
+    }
+    for (const round of Object.values(aggregate.reviewRounds)) {
+        const item = aggregate.workItems[round.workItemId];
+        if (item === undefined) {
+            throw new StorageRecordError(`ReviewRound references are invalid: ${round.id}.`);
+        }
+        const candidate = item.candidates.find(({ id }) => id === round.candidateId);
+        if (candidate === undefined) {
+            throw new StorageRecordError(`ReviewRound Candidate not found: ${round.candidateId}.`);
+        }
+        assertWorkItemCandidateReferences(aggregate, item, candidate, `ReviewRound candidate ${round.id}`);
+        if ((round.scope ?? "work-item") === "task") {
+            const frozenProjects = round.taskCandidate?.projects ?? [];
+            if (frozenProjects.length !== boundProjects.size
+                || frozenProjects.some(({ projectId }) => !boundProjects.has(projectId))) {
+                throw new StorageRecordError(`Task ReviewRound Projects do not match Task scope: ${round.id}.`);
+            }
+            if (!sameTaskFinalReviewContract(round.taskFinalReviewContract, candidate.taskFinalReviewContract)) {
+                throw new StorageRecordError(`Task ReviewRound contract does not match its Candidate: ${round.id}.`);
+            }
+        }
+        if (round.reviewerRunId !== undefined) {
+            const reviewerRun = aggregate.agentRuns[round.reviewerRunId];
+            if (reviewerRun === undefined
+                || reviewerRun.reviewRoundId !== round.id
+                || reviewerRun.purpose !== "review") {
+                throw new StorageRecordError(`ReviewRound Reviewer Run is invalid: ${round.id}.`);
+            }
+        }
+    }
+    for (const changeSet of Object.values(aggregate.changeSets)) {
+        if (aggregate.workItems[changeSet.workItemId] === undefined) {
+            throw new StorageRecordError(`ChangeSet Work Item not found: ${changeSet.id}.`);
+        }
+        if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === changeSet.projectId)) {
+            throw new StorageRecordError(`ChangeSet Project does not match Task: ${changeSet.id}.`);
+        }
+        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+        if (evidenceRound !== undefined) {
+            throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become a ChangeSet.`);
+        }
+    }
+    for (const integration of Object.values(aggregate.integrationAttempts)) {
+        if (!boundProjects.has(integration.projectId)) {
+            throw new StorageRecordError(`Integration Project does not match Task: ${integration.id}.`);
+        }
+        for (const changeSetId of integration.changeSetIds) {
+            const changeSet = aggregate.changeSets[changeSetId];
+            if (changeSet === undefined) {
+                throw new StorageRecordError(`Integration ChangeSet not found: ${integration.id}/${changeSetId}.`);
+            }
+            if (changeSet.projectId !== integration.projectId) {
+                throw new StorageRecordError(`Integration ChangeSet belongs to another Project: ${integration.id}/${changeSetId}.`);
+            }
+            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+            if (evidenceRound !== undefined) {
+                throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become an Integration source.`);
+            }
+        }
+    }
+    for (const workspace of Object.values(aggregate.managedWorkspaces)) {
+        assertManagedWorkspaceReferences(aggregate, workspace, "Managed workspace");
+    }
+}
+/**
+ * Enforce the owner-specific scope at the storage boundary.  The map key and
+ * foreign-record checks prevent dangling identities; these checks prevent a
+ * valid owner from being paired with another lifecycle's Project scope.
+ */
+function assertManagedWorkspaceReferences(aggregate, workspace, label, workItemOverride) {
+    const taskId = aggregate.task.id;
+    const boundProjects = aggregate.task.projectBindings.map(({ projectId }) => projectId).sort();
+    const actualProjects = workspace.entries.map(({ projectId }) => projectId).sort();
+    const requireVisibleTaskScope = () => {
+        // Project bindings are persisted before the physical workspace is
+        // reconciled.  During that bounded hand-off a workspace may be missing a
+        // newly-bound Project, but it must never expose a Project outside the
+        // current Task.  Launch preparation closes the temporary subset before
+        // the workspace can be used.
+        if (actualProjects.some((projectId) => !boundProjects.includes(projectId))) {
+            throw new StorageRecordError(`${label} Project scope does not match Task: ${taskId}.`);
+        }
+    };
+    switch (workspace.owner.type) {
+        case "task":
+            requireVisibleTaskScope();
+            if (workspace.entries.some(({ access }) => access !== "write")) {
+                throw new StorageRecordError(`${label} Task workspace must be writable: ${taskId}.`);
+            }
+            return;
+        case "work-item": {
+            const item = workItemOverride?.id === workspace.owner.workItemId
+                ? workItemOverride
+                : aggregate.workItems[workspace.owner.workItemId];
+            if (item === undefined) {
+                throw new StorageRecordError(`${label} WorkItem not found: ${taskId}/${workspace.owner.workItemId}.`);
+            }
+            requireVisibleTaskScope();
+            const writable = workspace.entries
+                .filter(({ access }) => access === "write")
+                .map(({ projectId }) => projectId)
+                .sort();
+            const expectedWritable = [...item.writeProjectIds].sort();
+            // Write scope expansion is persisted before the physical WorkItem
+            // workspace is reconciled.  The stored workspace may therefore expose
+            // a temporary subset, but it may never grant write access outside the
+            // current WorkItem authorization.
+            if (writable.some((projectId) => !expectedWritable.includes(projectId))) {
+                throw new StorageRecordError(`${label} WorkItem write scope does not match: ${taskId}/${item.id}.`);
+            }
+            return;
+        }
+        case "review-round": {
+            const round = aggregate.reviewRounds[workspace.owner.reviewRoundId];
+            if (round === undefined) {
+                throw new StorageRecordError(`${label} ReviewRound not found: ${taskId}/${workspace.owner.reviewRoundId}.`);
+            }
+            requireVisibleTaskScope();
+            if (workspace.entries.some(({ access }) => access !== "write")) {
+                throw new StorageRecordError(`${label} ReviewRound workspace must be writable: ${taskId}/${round.id}.`);
+            }
+            const item = aggregate.workItems[round.workItemId];
+            const candidate = item?.candidates.find(({ id }) => id === round.candidateId);
+            const frozenProjects = round.scope === "task"
+                ? round.taskCandidate?.projects
+                : candidate?.gitSnapshot?.projects;
+            if (frozenProjects !== undefined) {
+                const expected = [...frozenProjects]
+                    .map(({ projectId, commit }) => ({ projectId, commit }))
+                    .sort((left, right) => left.projectId.localeCompare(right.projectId));
+                const actual = workspace.entries
+                    .map(({ projectId, baseCommit }) => ({ projectId, commit: baseCommit }))
+                    .sort((left, right) => left.projectId.localeCompare(right.projectId));
+                const matches = expected.length === actual.length
+                    && expected.every((frozen, index) => {
+                        const reviewEntry = actual[index];
+                        return reviewEntry?.projectId === frozen.projectId
+                            && reviewEntry.commit === frozen.commit;
+                    });
+                if (!matches) {
+                    const provenance = round.scope === "task"
+                        ? "Task frozen project set"
+                        : "Candidate frozen commit";
+                    throw new StorageRecordError(`${label} ReviewRound does not use the ${provenance}: ${taskId}/${round.id}.`);
+                }
+            }
+            return;
+        }
+        case "integration-attempt": {
+            const attempt = aggregate.integrationAttempts[workspace.owner.integrationAttemptId];
+            if (attempt === undefined) {
+                throw new StorageRecordError(`${label} Integration Attempt not found: ${taskId}/${workspace.owner.integrationAttemptId}.`);
+            }
+            if (workspace.entries.length !== 1
+                || workspace.entries[0].projectId !== attempt.projectId
+                || workspace.entries[0].access !== "write") {
+                throw new StorageRecordError(`${label} Integration Attempt scope is invalid: ${taskId}/${attempt.id}.`);
+            }
+            return;
+        }
+        case "execution-lane": {
+            const owner = workspace.owner;
+            const laneItem = owner.purpose === "execution"
+                ? aggregate.workItems[owner.workItemId ?? ""]
+                : undefined;
+            const group = owner.purpose === "execution"
+                ? (laneItem === undefined
+                    ? undefined
+                    : workItemExecutionGroupById(laneItem, owner.executionGroupId))
+                : aggregate.reviewRounds[owner.reviewRoundId ?? ""]?.executionGroup;
+            if (group === undefined || group.id !== owner.executionGroupId
+                || !group.lanes.some(({ id }) => id === owner.executionLaneId)) {
+                throw new StorageRecordError(`${label} Execution Lane lineage is invalid: ${taskId}/${owner.executionGroupId}/${owner.executionLaneId}.`);
+            }
+            requireVisibleTaskScope();
+            const writable = workspace.entries
+                .filter(({ access }) => access === "write")
+                .map(({ projectId }) => projectId)
+                .sort();
+            const expectedWritable = owner.purpose === "execution"
+                ? [...(aggregate.workItems[owner.workItemId ?? ""]?.writeProjectIds ?? [])].sort()
+                : boundProjects;
+            if (!isDeepStrictEqual(writable, expectedWritable)) {
+                throw new StorageRecordError(`${label} Execution Lane write scope does not match: ${taskId}/${owner.executionLaneId}.`);
+            }
+            return;
+        }
+    }
+}
+function validIntegrationTransition(before, after) {
+    if (before.id !== after.id
+        || before.taskId !== after.taskId
+        || before.projectId !== after.projectId
+        || before.targetRef !== after.targetRef
+        || before.expectedHead !== after.expectedHead
+        || !isDeepStrictEqual(before.changeSetIds, after.changeSetIds)
+        || !isDeepStrictEqual(before.checkCommands, after.checkCommands)
+        || before.createdAt !== after.createdAt)
+        return false;
+    const allowed = {
+        running: ["running", "blocked", "validating", "failed"],
+        blocked: ["blocked", "validating", "failed"],
+        validating: ["validating", "committed", "failed"],
+        committed: ["committed"],
+        failed: ["failed"]
+    };
+    return allowed[before.status].includes(after.status);
+}
+function assertAcyclicWorkItems(items) {
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (id) => {
+        if (visited.has(id))
+            return;
+        if (visiting.has(id))
+            throw new StorageRecordError(`Work Item dependency cycle detected: ${id}.`);
+        visiting.add(id);
+        const item = items[id];
+        if (item !== undefined) {
+            for (const dependencyId of item.dependsOn)
+                visit(dependencyId);
+        }
+        visiting.delete(id);
+        visited.add(id);
+    };
+    for (const id of Object.keys(items))
+        visit(id);
+}
+function mailboxReferenceExists(state, ref) {
+    if ("taskId" in ref) {
+        const aggregate = state.tasks[ref.taskId];
+        if (aggregate === undefined)
+            return false;
+        switch (ref.type) {
+            case "run": return aggregate.agentRuns[ref.id] !== undefined;
+            case "work-item": return aggregate.workItems[ref.id] !== undefined;
+            case "input": return aggregate.inputRequests[ref.id] !== undefined;
+            case "message": return aggregate.messages[ref.id] !== undefined;
+        }
+    }
+    switch (ref.type) {
+        case "task": return state.tasks[ref.id] !== undefined;
+        case "session":
+            return [
+                ...Object.values(state.globalRoleSessionSets),
+                ...Object.values(state.tasks).flatMap((task) => Object.values(task.roleSessionSets))
+            ].some((set) => Object.values(set.sessions).some((session) => session.nativeSessionId === ref.id));
+        default: return false;
+    }
+}
+function validWorkItemTransition(existing, candidate) {
+    if (isDeepStrictEqual(existing, candidate))
+        return true;
+    if (existing.id !== candidate.id
+        || existing.taskId !== candidate.taskId
+        || existing.assignee !== candidate.assignee
+        || existing.createdAt !== candidate.createdAt
+        || !isDeepStrictEqual(existing.baseRefs, candidate.baseRefs)
+        || candidate.revision !== existing.revision + 1
+        || Date.parse(candidate.updatedAt) < Date.parse(existing.updatedAt))
+        return false;
+    if (!compatibleWorkItemExecutionGroups(existing, candidate))
+        return false;
+    if (existing.status !== candidate.status
+        && (existing.title !== candidate.title
+            || existing.objective !== candidate.objective
+            || !isDeepStrictEqual(existing.acceptance, candidate.acceptance)
+            || !isDeepStrictEqual(existing.dependsOn, candidate.dependsOn)
+            || !isDeepStrictEqual(existing.writeProjectIds, candidate.writeProjectIds)))
+        return false;
+    const candidateProjects = new Set(candidate.writeProjectIds);
+    if (existing.writeProjectIds.some((projectId) => !candidateProjects.has(projectId))) {
+        return false;
+    }
+    const candidatesChanged = !isDeepStrictEqual(existing.candidates, candidate.candidates);
+    const submittedCandidate = existing.status === "running"
+        && candidate.status === "awaiting_acceptance"
+        && candidate.candidates.length === existing.candidates.length + 1
+        && isDeepStrictEqual(candidate.candidates.slice(0, existing.candidates.length), existing.candidates);
+    if (candidatesChanged && !submittedCandidate) {
+        return false;
+    }
+    const allowed = {
+        pending: ["pending", "running", "retired"],
+        running: [
+            "running",
+            "awaiting_acceptance",
+            "completed",
+            "failed",
+            "retired"
+        ],
+        awaiting_acceptance: [
+            "awaiting_acceptance",
+            "completed",
+            "failed",
+            "retired"
+        ],
+        completed: ["completed"],
+        failed: ["failed", "running", "retired"],
+        retired: ["retired"]
+    };
+    return allowed[existing.status].includes(candidate.status);
+}
+function compatibleWorkItemExecutionGroups(existing, candidate) {
+    if (candidate.executionGroups.length < existing.executionGroups.length)
+        return false;
+    for (const [index, historical] of existing.executionGroups.entries()) {
+        const next = candidate.executionGroups[index];
+        if (next === undefined || next.id !== historical.id)
+            return false;
+        const isCurrent = existing.currentExecutionGroupId === historical.id;
+        const mutableCurrent = isCurrent && historical.resolution === undefined;
+        if (!mutableCurrent && !isDeepStrictEqual(historical, next))
+            return false;
+        if (mutableCurrent && !compatibleExecutionGroups(historical, next))
+            return false;
+    }
+    const appended = candidate.executionGroups.slice(existing.executionGroups.length);
+    if (appended.length > 1)
+        return false;
+    if (appended.length === 1) {
+        const priorCurrent = existing.currentExecutionGroupId === undefined
+            ? undefined
+            : workItemExecutionGroupById(existing, existing.currentExecutionGroupId);
+        if (priorCurrent !== undefined && priorCurrent.resolution === undefined)
+            return false;
+        if (candidate.currentExecutionGroupId !== appended[0].id)
+            return false;
+    }
+    else if (candidate.currentExecutionGroupId !== existing.currentExecutionGroupId) {
+        const priorCurrent = existing.currentExecutionGroupId === undefined
+            ? undefined
+            : workItemExecutionGroupById(existing, existing.currentExecutionGroupId);
+        const clearingResolvedRetry = existing.status === "failed"
+            && candidate.status === "running"
+            && candidate.currentExecutionGroupId === undefined
+            && priorCurrent?.resolution !== undefined;
+        if (!clearingResolvedRetry)
+            return false;
+    }
+    if (candidate.currentExecutionGroupId !== undefined
+        && workItemExecutionGroupById(candidate, candidate.currentExecutionGroupId) === undefined) {
+        return false;
+    }
+    return true;
+}
+function assertWorkItemCandidateReferences(aggregate, item, candidate, label) {
+    if (candidate.workItemRevision > item.revision) {
+        throw new StorageRecordError(`${label} revision is invalid.`);
+    }
+    if ((candidate.executionGroupId === undefined) !== (candidate.executionLaneId === undefined)) {
+        throw new StorageRecordError(`${label} execution lineage is incomplete.`);
+    }
+    if (candidate.executionGroupId !== undefined) {
+        const group = workItemExecutionGroupById(item, candidate.executionGroupId);
+        const lane = group?.lanes.find(({ id }) => id === candidate.executionLaneId);
+        if (group === undefined
+            || group.id !== candidate.executionGroupId
+            || lane === undefined) {
+            throw new StorageRecordError(`${label} execution lineage is invalid: candidate=${candidate.executionGroupId}/${candidate.executionLaneId}; `
+                + `item=${group?.id ?? "none"}/${lane?.id ?? "none"}.`);
+        }
+    }
+    if (candidate.workspace !== undefined) {
+        if (candidate.workspace.owner.taskId !== item.taskId) {
+            throw new StorageRecordError(`${label} workspace belongs to another Task.`);
+        }
+        if (candidate.workspace.owner.type === "work-item"
+            && candidate.workspace.owner.workItemId !== item.id) {
+            throw new StorageRecordError(`${label} workspace belongs to another Work Item.`);
+        }
+        if (candidate.workspace.owner.type !== "work-item") {
+            throw new StorageRecordError(`${label} must use the WorkItem-owned Develop workspace.`);
+        }
+        assertManagedWorkspaceReferences(aggregate, candidate.workspace, label, item);
+    }
+    if (candidate.source.type === "direct") {
+        if (item.assignee !== undefined) {
+            throw new StorageRecordError(`${label} cannot be direct for an assigned Work Item.`);
+        }
+        if (candidate.workspace !== undefined
+            && (candidate.workspace.owner.type !== "work-item"
+                || candidate.workspace.owner.taskId !== item.taskId
+                || candidate.workspace.owner.workItemId !== item.id)) {
+            throw new StorageRecordError(`${label} must use the WorkItem-owned Develop workspace.`);
+        }
+        if (candidate.taskMainSnapshot !== undefined) {
+            const expectedProjects = [...item.writeProjectIds].sort();
+            const actualProjects = candidate.taskMainSnapshot.projects
+                .map(({ projectId }) => projectId)
+                .sort();
+            if (!isDeepStrictEqual(actualProjects, expectedProjects)) {
+                throw new StorageRecordError(`${label} Task-main snapshot scope is stale.`);
+            }
+            for (const project of candidate.taskMainSnapshot.projects) {
+                const binding = aggregate.task.projectBindings.find(({ projectId }) => projectId === project.projectId);
+                if (binding === undefined || binding.directory !== project.directory) {
+                    throw new StorageRecordError(`${label} Task-main snapshot Project is not bound: ${project.projectId}.`);
+                }
+            }
+        }
+        return;
+    }
+    const run = aggregate.agentRuns[candidate.source.runId];
+    const resolvedGroupSummary = candidate.executionGroupId === undefined
+        ? undefined
+        : workItemExecutionGroupById(item, candidate.executionGroupId)?.resolution?.summary;
+    if (run === undefined
+        || run.workItemId !== item.id
+        || run.purpose !== "execution"
+        || run.status !== "yielded"
+        || (run.summary !== candidate.summary && resolvedGroupSummary !== candidate.summary)) {
+        throw new StorageRecordError(`${label} Run is invalid: ${candidate.source.runId}.`);
+    }
+    if (candidate.executionGroupId !== run.executionGroupId
+        || candidate.executionLaneId !== run.executionLaneId) {
+        throw new StorageRecordError(`${label} execution lineage does not match its source Run.`);
+    }
+    // A Gitless execution Run still carries its durable Task-owned empty view
+    // for runtime fencing, while its Candidate intentionally has no Develop
+    // workspace or Git snapshot. This is the only source/run workspace
+    // mismatch permitted at the storage boundary.
+    const gitlessRunWorkspace = run.workspace?.owner.type === "task"
+        && run.workspace.owner.taskId === item.taskId
+        && aggregate.task.projectBindings.length === 0
+        && run.workspace.entries.length === 0
+        && (() => {
+            const durable = aggregate.managedWorkspaces[managedWorkspaceKey(run.workspace.owner)];
+            return durable !== undefined && isDeepStrictEqual(durable, run.workspace);
+        })();
+    if (!gitlessRunWorkspace
+        && (candidate.workspace === undefined) !== (run.workspace === undefined)) {
+        throw new StorageRecordError(`${label} workspace does not match its source Run.`);
+    }
+    if (!gitlessRunWorkspace && candidate.workspace !== undefined && run.workspace !== undefined) {
+        assertCandidateWorkspaceMatchesRun(candidate.workspace, run.workspace, label);
+    }
+    if (candidate.workspace !== undefined && (candidate.workspace.owner.type !== "work-item"
+        || candidate.workspace.owner.taskId !== item.taskId
+        || candidate.workspace.owner.workItemId !== item.id)) {
+        throw new StorageRecordError(`${label} must use the WorkItem-owned Develop workspace.`);
+    }
+}
+function assertAgentRunExecutionReferences(aggregate, run) {
+    if ((run.executionGroupId === undefined) !== (run.executionLaneId === undefined)) {
+        throw new StorageRecordError(`Agent Run execution lineage is incomplete: ${run.id}.`);
+    }
+    if (run.executionGroupId === undefined)
+        return;
+    const ownerGroup = run.purpose === "review"
+        ? (run.reviewRoundId === undefined
+            ? undefined
+            : aggregate.reviewRounds[run.reviewRoundId]?.executionGroup)
+        : (run.workItemId === undefined || run.executionGroupId === undefined
+            ? undefined
+            : (() => {
+                const item = aggregate.workItems[run.workItemId];
+                return item === undefined
+                    ? undefined
+                    : workItemExecutionGroupById(item, run.executionGroupId);
+            })());
+    if (ownerGroup === undefined) {
+        throw new StorageRecordError(`Agent Run ExecutionGroup not found: ${run.id}.`);
+    }
+    validateExecutionGroup(ownerGroup);
+    const lane = ownerGroup.lanes.find(({ id }) => id === run.executionLaneId);
+    if (ownerGroup.id !== run.executionGroupId || lane === undefined) {
+        throw new StorageRecordError(`Agent Run ExecutionLane does not match its owner: ${run.id}.`);
+    }
+    if (lane.roleName !== run.roleName) {
+        throw new StorageRecordError(`Agent Run Role does not match its ExecutionLane: ${run.id}.`);
+    }
+}
+function compatibleExecutionGroups(existing, candidate) {
+    if (existing === undefined)
+        return true;
+    if (candidate === undefined)
+        return false;
+    return isExecutionGroupTransition(existing, candidate);
+}
+/** Candidate freezes Git commits at yield time, so timestamp/baseCommit fields
+ * may differ from the Run's dispatch snapshot while workspace identity and
+ * execution scope must remain exact. */
+function assertCandidateWorkspaceMatchesRun(candidate, run, label) {
+    if (candidate.owner.type === "work-item" && run.owner.type === "execution-lane") {
+        if (candidate.owner.taskId !== run.owner.taskId
+            || run.owner.purpose !== "execution"
+            || candidate.owner.workItemId !== run.owner.workItemId
+            || candidate.entries.length !== run.entries.length) {
+            throw new StorageRecordError(`${label} workspace lineage does not match its source Lane.`);
+        }
+        for (const source of run.entries) {
+            const target = candidate.entries.find(({ projectId }) => projectId === source.projectId);
+            if (target === undefined || target.directory !== source.directory || target.access !== source.access) {
+                throw new StorageRecordError(`${label} workspace Project scope does not match its source Lane.`);
+            }
+        }
+        return;
+    }
+    if (candidate.owner.type !== run.owner.type
+        || candidate.owner.taskId !== run.owner.taskId
+        || candidate.root !== run.root
+        || candidate.entries.length !== run.entries.length) {
+        throw new StorageRecordError(`${label} workspace does not match its source Run.`);
+    }
+    for (const source of run.entries) {
+        const frozen = candidate.entries.find(({ projectId }) => projectId === source.projectId);
+        if (frozen === undefined
+            || frozen.directory !== source.directory
+            || frozen.access !== source.access
+            || frozen.path !== source.path
+            || frozen.branch !== source.branch
+            || frozen.baseRef !== source.baseRef) {
+            throw new StorageRecordError(`${label} workspace scope does not match its source Run.`);
+        }
+    }
+}
+function validReviewRoundTransition(existing, candidate) {
+    if (isDeepStrictEqual(existing, candidate))
+        return true;
+    if (existing.id !== candidate.id
+        || existing.taskId !== candidate.taskId
+        || existing.workItemId !== candidate.workItemId
+        || existing.candidateId !== candidate.candidateId
+        || existing.reviewerRoleName !== candidate.reviewerRoleName
+        || existing.reviewBaseCommit !== candidate.reviewBaseCommit
+        || (existing.scope ?? "work-item") !== (candidate.scope ?? "work-item")
+        || !isDeepStrictEqual(existing.taskCandidate, candidate.taskCandidate)
+        || !sameTaskFinalReviewContract(existing.taskFinalReviewContract, candidate.taskFinalReviewContract)
+        || !compatibleExecutionGroups(existing.executionGroup, candidate.executionGroup)
+        || existing.requestedBy !== candidate.requestedBy
+        || existing.createdAt !== candidate.createdAt)
+        return false;
+    if (existing.status === "pending") {
+        if (candidate.status === "pending") {
+            return (existing.workspace === undefined
+                && candidate.workspace !== undefined
+                || existing.executionGroup === undefined
+                    && candidate.executionGroup !== undefined
+                || existing.executionGroup !== undefined
+                    && candidate.executionGroup !== undefined
+                    && !isDeepStrictEqual(existing.executionGroup, candidate.executionGroup))
+                && candidate.reviewerRunId === undefined
+                && candidate.summary === undefined
+                && candidate.checks === undefined
+                && candidate.evidenceCommit === undefined
+                && candidate.endedAt === undefined
+                && candidate.workspaceDisposition === undefined;
+        }
+        return ["running", "failed"].includes(candidate.status)
+            && (existing.workspace === undefined
+                || isDeepStrictEqual(existing.workspace, candidate.workspace));
+    }
+    if (existing.status === "running") {
+        if (candidate.status === "running") {
+            return existing.reviewerRunId === candidate.reviewerRunId
+                && isDeepStrictEqual(existing.workspace, candidate.workspace)
+                && existing.executionGroup !== undefined
+                && candidate.executionGroup !== undefined
+                && !isDeepStrictEqual(existing.executionGroup, candidate.executionGroup)
+                && candidate.summary === undefined
+                && candidate.report === undefined
+                && candidate.checks === undefined
+                && candidate.evidenceCommit === undefined
+                && candidate.endedAt === undefined
+                && candidate.workspaceDisposition === undefined;
+        }
+        return ["completed", "failed"].includes(candidate.status)
+            && existing.reviewerRunId === candidate.reviewerRunId
+            && isDeepStrictEqual(existing.workspace, candidate.workspace);
+    }
+    if (existing.status === candidate.status
+        && (existing.status === "completed" || existing.status === "failed")) {
+        const { workspaceDisposition: _existingDisposition, ...existingResult } = existing;
+        const { workspaceDisposition: _candidateDisposition, ...candidateResult } = candidate;
+        return isDeepStrictEqual(existingResult, candidateResult)
+            && existing.workspaceDisposition?.kind !== "removed"
+            && candidate.workspaceDisposition !== undefined;
+    }
+    return false;
 }
 function synchronousResult(value) { if (typeof value === "object" && value !== null && "then" in value)
     throw new StorageRecordError("FileTaskStore transactions must be synchronous."); return value; }
@@ -1008,6 +2589,21 @@ function acquireStorageLock(rootDir) {
         }
     }
 }
+/**
+ * Run `execute` while holding the same storage write lock the store uses, without
+ * the version-gated {@link FileTaskStore} constructor. The upgrade orchestrator
+ * uses this to re-pin the committed revision under the lock against a source Home
+ * whose schema is not the current version (so a store cannot be constructed yet).
+ */
+export function withStorageWriteLock(rootDir, execute) {
+    const release = acquireStorageLock(rootDir);
+    try {
+        return execute();
+    }
+    finally {
+        release();
+    }
+}
 function reclaimDeadLock(lock) {
     try {
         const age = Date.now() - statSync(lock).mtimeMs;