@zq-silk/yui 0.5.3 → 0.6.1

package/dist/storage/taskStore.js

@@ -1,15 +1,18 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { validateConfiguredAgent } from "../agent/agent.js";
-import { reconciliationIntervalMilliseconds } from "../config/yuiConfig.js";
+import { validateCapabilityGrant } from "../grant/capabilityGrant.js";
+import { validateReleaseWorkflow } from "../release/releaseWorkflow.js";
+import { reconciliationIntervalMilliseconds, resolveLeaderNextActionMode, resolveResourcesGcAutoQuarantine, resolveResourcesGcMode } from "../config/yuiConfig.js";
 import { resolveTimeZone } from "../output/timePresentation.js";
 import { mailboxTargetKey, validateWorkMailbox } from "../coordination/workMailbox.js";
 import { validateInputRequest } from "../input/inputRequest.js";
 import { validateRoleSessionSet } from "../executor/agentExecutor.js";
 import { validateTaskMessage } from "../message/message.js";
 import { validateAgentRun } from "../run/agentRun.js";
+import { FileSessionOwnerRegistry } from "../runtime/sessionOwnerRegistry.js";
 import { validateReviewConfig } from "../review/reviewConfig.js";
 import { validateReviewRound } from "../review/reviewRound.js";
 import { sameTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
@@ -18,6 +21,8 @@ import { generateHomeIdentity, validateHomeIdentity } from "../repository/homeId
 import { validateAgentProfile } from "../profile/agentProfile.js";
 import { validateChangeSet } from "../integration/changeSet.js";
 import { validateIntegrationAttempt } from "../integration/integrationAttempt.js";
+import { validateIntegrationQueueEntry } from "../integration/integrationQueueEntry.js";
+import { CURRENT_DURABLE_JOB_SCHEMA_VERSION, validDurableJobTransition, validateDurableJob } from "../job/durableJob.js";
 import { validateGlobalRole, validateTaskRole } from "../role/role.js";
 import { CURRENT_LEADER_FAILURE_SCHEMA_VERSION } from "../scheduler/leaderFailure.js";
 import { CURRENT_OPERATOR_NOTIFICATION_SCHEMA_VERSION } from "../scheduler/operatorNotification.js";
@@ -26,6 +31,7 @@ import { formatAgentRunReceiptId, TASK_RECORD_ID_PREFIXES, validateTaskRecordRef
 import { workItemExecutionGroupById, validateWorkItem } from "../workItem/workItem.js";
 import { isExecutionGroupTransition, validateExecutionGroup } from "../execution/executionGroup.js";
 import { managedWorkspaceKey, validateManagedWorkspace } from "../worktree/managedWorkspace.js";
+import { gateArtifactKey, validateGateArtifact } from "../verification/gateArtifact.js";
 import { writeTextFileAtomically } from "./durableFile.js";
 import { assertHomeWritable } from "./upgradeFence.js";
 import { CURRENT_AGGREGATE_SCHEMA_VERSION, requireCompatibleStorageSchema, requireStorageSchema, writeCurrentStorageManifest } from "./storageSchema.js";
@@ -54,13 +60,15 @@ export const CURRENT_TASK_ROLE_SCHEMA_VERSION = 3;
 export const CURRENT_MANAGED_WORKSPACE_SCHEMA_VERSION = 2;
 export const CURRENT_WORK_ITEM_SCHEMA_VERSION = 9;
 export const CURRENT_REVIEW_ROUND_SCHEMA_VERSION = 4;
-export const CURRENT_CHANGE_SET_SCHEMA_VERSION = 2;
-export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 2;
-export const CURRENT_MESSAGE_SCHEMA_VERSION = 2;
+export const CURRENT_CHANGE_SET_SCHEMA_VERSION = 3;
+export const CURRENT_INTEGRATION_ATTEMPT_SCHEMA_VERSION = 4;
+export const CURRENT_MESSAGE_SCHEMA_VERSION = 3;
 export const CURRENT_INPUT_REQUEST_SCHEMA_VERSION = 2;
 export const CURRENT_DECISION_SCHEMA_VERSION = 1;
 export const CURRENT_MILESTONE_SCHEMA_VERSION = 1;
 export const CURRENT_EVENT_SCHEMA_VERSION = 2;
+export const CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION = 1;
+export const CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION = 1;
 export const CURRENT_WORK_MAILBOX_SCHEMA_VERSION = 1;
 export const CURRENT_ROLE_AGENT_SESSION_SCHEMA_VERSION = 3;
 export const CURRENT_PENDING_WAKEUP_SCHEMA_VERSION = 1;
@@ -80,7 +88,7 @@ export function executionLaneActiveRunKey(executionGroupId, executionLaneId) {
 function encodeLaneKeyPart(value) {
     return encodeURIComponent(value).replace(/:/gu, "%3A");
 }
-function executionLaneActiveRunKeyParts(key) {
+export function executionLaneActiveRunKeyParts(key) {
     const match = /^\/execution-lane\/([^:]+):([^:]+)$/u.exec(key);
     if (match === null)
         return null;
@@ -95,23 +103,40 @@ function executionLaneActiveRunKeyParts(key) {
     }
 }
 /** The schema version of each persisted `state.json#/tasks/*` aggregate. */
-export const CURRENT_STORED_TASK_SCHEMA_VERSION = 14;
+export const CURRENT_STORED_TASK_SCHEMA_VERSION = 16;
 /**
  * Persisted nested-record versions consumed by this store's strict parser.
  * Keep these named at the storage boundary so the upgrade record-axis map can
  * assert it is classifying the same bytes the store reads and writes.
  */
 export const CURRENT_TASK_ROLE_SESSION_SET_SCHEMA_VERSION = 4;
-export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 6;
+/**
+ * v7 combines optional Issue 04 retry/receipt fields and Issue 05 Leader
+ * actionability fields. All are optional, so the v6→v7 migration is a
+ * version-only rewrite.
+ */
+export const CURRENT_AGENT_RUN_SCHEMA_VERSION = 7;
+export const CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION = 1;
 export class FileTaskStore {
     rootDir;
     #transaction = null;
     #readCache = null;
     #normalizeState;
+    #sessionOwnerRegistry;
     constructor(rootDir, options = {}) {
         this.rootDir = rootDir;
         this.#normalizeState = options.normalizeState;
         this.#requireReadableSchema();
+        const snapshot = options.initialStateSnapshot;
+        if (snapshot !== undefined) {
+            // The one-snapshot open already fenced these bytes; run the same strict
+            // parser the lazy path would, then warm the cache under the snapshot's
+            // fingerprint. A later external writer still invalidates it on next read.
+            this.#readCache = {
+                fingerprint: snapshot.fingerprint,
+                state: this.#parseState(snapshot.raw)
+            };
+        }
     }
     rootDirectory() { return this.rootDir; }
     transaction(execute) {
@@ -135,6 +160,34 @@ export class FileTaskStore {
             }
         });
     }
+    withRuntimeEventTransaction(execute) {
+        return this.transaction(() => execute());
+    }
+    async transactionAsync(execute) {
+        if (this.#transaction !== null)
+            return execute(this);
+        const release = acquireStorageLock(this.rootDir);
+        try {
+            const state = this.#readCachedState();
+            this.#transaction = { state, baseRevision: state.revision, dirty: false };
+            try {
+                const result = await execute(this);
+                if (this.#transaction.dirty)
+                    this.#commit(state, this.#transaction.baseRevision);
+                return result;
+            }
+            catch (error) {
+                this.#readCache = null;
+                throw error;
+            }
+            finally {
+                this.#transaction = null;
+            }
+        }
+        finally {
+            release();
+        }
+    }
     getConfig() { return clone(this.#state().config); }
     getHomeIdentity() { return clone(this.#state().homeIdentity); }
     saveConfig(config) {
@@ -325,8 +378,38 @@ export class FileTaskStore {
             state.tasks[stored.id] = aggregate;
         });
     }
-    listTasks() { return values(this.#state().tasks, (aggregate) => aggregate.task.id).map((entry) => clone(entry.task)); }
+    listTasks() {
+        // Clone only the Task headers, not the whole stored aggregate (events,
+        // runs, messages): a scheduler pass lists Tasks per phase, and cloning
+        // each aggregate's full event history turned every phase into a 32 MiB
+        // projection. Callers that need a Task's events read them explicitly.
+        return Object.values(this.#state().tasks)
+            .map((aggregate) => clone(aggregate.task))
+            .sort((left, right) => numericCompare(left.id, right.id));
+    }
+    getStateRevision() { return this.#state().revision; }
     getTask(id) { return optional(this.#state().tasks[id]?.task); }
+    readNextActionFacts(taskId) {
+        const aggregate = this.#state().tasks[taskId];
+        if (aggregate === undefined)
+            return null;
+        const agentRuns = values(aggregate.agentRuns, "id");
+        return {
+            task: {
+                id: aggregate.task.id,
+                status: aggregate.task.status,
+                projectBindings: aggregate.task.projectBindings
+            },
+            workItems: values(aggregate.workItems, "id"),
+            changeSets: values(aggregate.changeSets, "id"),
+            integrations: values(aggregate.integrationAttempts, "id"),
+            reviewRounds: values(aggregate.reviewRounds, "id"),
+            openInputRequests: values(aggregate.inputRequests, "id")
+                .filter((request) => request.status === "open"),
+            activeRuns: agentRuns.filter((run) => run.status === "active"),
+            leaderRuns: agentRuns.filter((run) => run.roleName === "leader")
+        };
+    }
     getReviewConfig() {
         return optional(this.#state().config.review);
     }
@@ -352,7 +435,7 @@ export class FileTaskStore {
             throw new StorageRecordError(`ChangeSet belongs to another Task: ${stored.taskId}.`);
         }
         const aggregate = this.#requireTaskForWrite(taskId);
-        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === stored.headCommit);
+        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit, reviewBaseCommit }) => evidenceCommit !== undefined && evidenceCommit !== reviewBaseCommit && evidenceCommit === stored.headCommit);
         if (evidenceRound !== undefined) {
             throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${stored.headCommit} cannot become a ChangeSet.`);
         }
@@ -399,7 +482,7 @@ export class FileTaskStore {
             if (changeSet.projectId !== stored.projectId) {
                 throw new StorageRecordError(`Integration ChangeSet belongs to another Project: ${changeSetId}.`);
             }
-            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit, reviewBaseCommit }) => evidenceCommit !== undefined && evidenceCommit !== reviewBaseCommit && evidenceCommit === changeSet.headCommit);
             if (evidenceRound !== undefined) {
                 throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become an Integration source.`);
             }
@@ -425,6 +508,105 @@ export class FileTaskStore {
     getIntegrationAttempt(taskId, integrationId) {
         return optional(this.#state().tasks[taskId]?.integrationAttempts[integrationId]);
     }
+    nextIntegrationQueueEntryId(taskId) {
+        return this.#nextTaskRecordId(taskId, "integrationQueue");
+    }
+    saveIntegrationQueueEntry(taskId, entry) {
+        const stored = identified(entry, CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION, "id", entry.id, "Integration queue entry");
+        validateIntegrationQueueEntry(stored);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Integration queue entry belongs to another Task: ${stored.taskId}.`);
+        }
+        const aggregate = this.#requireTaskForWrite(taskId);
+        if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === stored.projectId)) {
+            throw new StorageRecordError(`Integration queue Project does not match Task: ${stored.id}.`);
+        }
+        const changeSet = aggregate.changeSets[stored.changeSetId];
+        if (changeSet === undefined) {
+            throw new StorageRecordError(`Integration queue ChangeSet not found: ${stored.changeSetId}.`);
+        }
+        if (changeSet.projectId !== stored.projectId) {
+            throw new StorageRecordError(`Integration queue ChangeSet belongs to another Project: ${stored.changeSetId}.`);
+        }
+        const existing = aggregate.integrationQueue[stored.id];
+        if (existing !== undefined) {
+            if (Date.parse(stored.updatedAt) < Date.parse(existing.updatedAt)) {
+                throw new StorageRecordError(`Integration queue entry updatedAt cannot move backwards: ${stored.id}.`);
+            }
+            if (!validIntegrationQueueTransition(existing, stored)) {
+                throw new StorageRecordError(`Integration queue entry transition is invalid: ${stored.id}.`);
+            }
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "integrationQueue", stored.id);
+            task.integrationQueue[stored.id] = stored;
+        });
+    }
+    listIntegrationQueueEntries(taskId) {
+        return values(this.#requireTask(taskId).integrationQueue, "id");
+    }
+    getIntegrationQueueEntry(taskId, entryId) {
+        return optional(this.#state().tasks[taskId]?.integrationQueue[entryId]);
+    }
+    nextDurableJobId(taskId) {
+        return this.#nextTaskRecordId(taskId, "durableJob");
+    }
+    saveDurableJob(taskId, job) {
+        const stored = identified(job, CURRENT_DURABLE_JOB_SCHEMA_VERSION, "id", job.id, "DurableJob");
+        validateDurableJob(stored);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`DurableJob belongs to another Task: ${stored.taskId}.`);
+        }
+        const aggregate = this.#requireTaskForWrite(taskId);
+        if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === stored.projectId)) {
+            throw new StorageRecordError(`DurableJob Project does not match Task: ${stored.id}.`);
+        }
+        const existing = aggregate.durableJobs[stored.id];
+        if (existing !== undefined) {
+            if (Date.parse(stored.updatedAt) < Date.parse(existing.updatedAt)) {
+                throw new StorageRecordError(`DurableJob updatedAt cannot move backwards: ${stored.id}.`);
+            }
+            if (!validDurableJobTransition(existing, stored)) {
+                throw new StorageRecordError(`DurableJob transition is invalid: ${stored.id}.`);
+            }
+        }
+        this.#mutate((state) => {
+            const task = state.tasks[taskId];
+            observeTaskRecordId(task, "durableJob", stored.id);
+            task.durableJobs[stored.id] = stored;
+        });
+    }
+    listDurableJobs(taskId) {
+        return values(this.#requireTask(taskId).durableJobs, "id");
+    }
+    getDurableJob(taskId, jobId) {
+        return optional(this.#state().tasks[taskId]?.durableJobs[jobId]);
+    }
+    findDurableJobByIdempotencyKey(taskId, key) {
+        const aggregate = this.#state().tasks[taskId];
+        if (aggregate === undefined)
+            return null;
+        const found = Object.values(aggregate.durableJobs)
+            .find((job) => job.idempotencyKey === key);
+        return optional(found);
+    }
+    listAllDurableJobs() {
+        const all = [];
+        for (const aggregate of Object.values(this.#state().tasks)) {
+            all.push(...Object.values(aggregate.durableJobs));
+        }
+        return all.map((job) => clone(job));
+    }
+    hasActiveDurableJobs() {
+        for (const aggregate of Object.values(this.#state().tasks)) {
+            for (const job of Object.values(aggregate.durableJobs)) {
+                if (job.status === "queued" || job.status === "running")
+                    return true;
+            }
+        }
+        return false;
+    }
     saveRole(taskId, role) {
         const aggregate = this.#requireTaskForWrite(taskId);
         const stored = identified(role, CURRENT_TASK_ROLE_SCHEMA_VERSION, "name", role.name, "Task Role");
@@ -564,6 +746,42 @@ export class FileTaskStore {
         const set = this.getRoleSessionSet(taskId, roleName);
         return set === null ? null : optional(set.sessions[set.activeAgentId]);
     }
+    getJobCallerKeyHash(taskId, roleName, agentId) {
+        const hashes = this.#state().tasks[taskId]?.jobCallerKeyHashes;
+        if (hashes === undefined)
+            return null;
+        return optional(hashes[jobCallerKeyHashKey(roleName, agentId)]);
+    }
+    setJobCallerKeyHash(taskId, roleName, agentId, hash) {
+        this.#requireTaskForWrite(taskId);
+        if (!/^[a-f0-9]{64}$/u.test(hash)) {
+            throw new StorageRecordError(`Job caller key hash is invalid: ${taskId}/${roleName}.`);
+        }
+        this.#mutate((state) => {
+            state.tasks[taskId].jobCallerKeyHashes[jobCallerKeyHashKey(roleName, agentId)] = hash;
+        });
+    }
+    saveSessionOwner(identity) {
+        this.#sessionOwners().record(identity);
+    }
+    getSessionOwner(launchId) {
+        return this.#sessionOwners().get(launchId);
+    }
+    listSessionOwners() {
+        return this.#sessionOwners().list();
+    }
+    listSessionOwnersForOwner(owner) {
+        return this.#sessionOwners().listForOwner(owner);
+    }
+    removeSessionOwner(launchId) {
+        this.#sessionOwners().remove(launchId);
+    }
+    #sessionOwners() {
+        if (this.#sessionOwnerRegistry === undefined) {
+            this.#sessionOwnerRegistry = new FileSessionOwnerRegistry(this.rootDir);
+        }
+        return this.#sessionOwnerRegistry;
+    }
     nextWorkItemId(taskId) {
         return this.#nextTaskRecordId(taskId, "workItem");
     }
@@ -617,6 +835,21 @@ export class FileTaskStore {
     }
     getAgentRun(taskId, id) { return optional(this.#state().tasks[taskId]?.agentRuns[id]); }
     listAgentRuns(taskId) { return values(this.#requireTask(taskId).agentRuns, "id"); }
+    listPendingProviderRetries() {
+        // The legacy File store can answer the empty case without a scan fallback.
+        // If durable retry state exists, the db-only capability must fail closed
+        // instead of silently losing the Controller's wake deadline.
+        for (const task of this.listTasks()) {
+            if (task.status !== "active")
+                continue;
+            for (const run of this.listAgentRuns(task.id)) {
+                if (run.status === "active" && run.providerRetry?.nextAttemptAt !== undefined) {
+                    throw new StorageRecordError("Provider retry in place requires the SQLite backend; run `yui update` to migrate this Home.");
+                }
+            }
+        }
+        return [];
+    }
     saveAgentRun(run) {
         const stored = identified(run, CURRENT_AGENT_RUN_SCHEMA_VERSION, "id", run.id, "Agent run");
         validateAgentRun(stored);
@@ -690,6 +923,18 @@ export class FileTaskStore {
             task.reviewRounds[stored.id] = stored;
         });
     }
+    nextReviewFindingId(taskId) {
+        throw new StorageRecordError(`Review findings require the SQLite backend (yui.db); migrate this Home with \`yui update\` before using the finding ledger on Task ${taskId}.`);
+    }
+    getReviewFinding(taskId, reviewFindingId) {
+        throw new StorageRecordError(`Review findings require the SQLite backend (yui.db); migrate this Home with \`yui update\` before using the finding ledger on Task ${taskId}.`);
+    }
+    listReviewFindings(taskId) {
+        throw new StorageRecordError(`Review findings require the SQLite backend (yui.db); migrate this Home with \`yui update\` before using the finding ledger on Task ${taskId}.`);
+    }
+    saveReviewFinding(taskId, finding) {
+        throw new StorageRecordError(`Review findings require the SQLite backend (yui.db); migrate this Home with \`yui update\` before using the finding ledger on Task ${taskId}.`);
+    }
     getActiveAgentRun(taskId, roleName) {
         const aggregate = this.#state().tasks[taskId];
         const pointer = aggregate?.activeRuns[roleName];
@@ -933,6 +1178,209 @@ export class FileTaskStore {
         });
     }
     listEvents(taskId) { return values(this.#requireTask(taskId).events, "id"); }
+    removeEvents(taskId, eventIds) {
+        if (eventIds.length === 0)
+            return 0;
+        let removed = 0;
+        this.#mutate((state) => {
+            const aggregate = requireTaskFromState(state, taskId);
+            for (const id of eventIds) {
+                if (aggregate.events[id] !== undefined) {
+                    delete aggregate.events[id];
+                    removed++;
+                }
+            }
+        });
+        return removed;
+    }
+    nextCapabilityGrantId(taskId) {
+        return this.#nextTaskRecordId(taskId, "capabilityGrant");
+    }
+    saveCapabilityGrant(taskId, grant) {
+        const stored = storedCapabilityGrant(grant);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Capability grant belongs to another Task: ${stored.taskId}`);
+        }
+        this.#mutate((state) => {
+            const aggregate = requireTaskFromState(state, taskId);
+            const existing = aggregate.capabilityGrants[stored.id];
+            if (existing === undefined) {
+                if (stored.revokedAt !== undefined) {
+                    throw new StorageRecordError(`Capability grant must start unrevoked: ${stored.id}`);
+                }
+                if (stored.usesUsed !== 0) {
+                    throw new StorageRecordError(`Capability grant must start unused: ${stored.id}`);
+                }
+            }
+            else if (!isValidCapabilityGrantTransition(existing, stored)) {
+                throw new StorageRecordError(`Capability grant cannot be overwritten: ${taskId}/${stored.id}`);
+            }
+            observeTaskRecordId(aggregate, "capabilityGrant", stored.id);
+            aggregate.capabilityGrants[stored.id] = stored;
+        });
+    }
+    listCapabilityGrants(taskId) {
+        return values(this.#requireTask(taskId).capabilityGrants, "id");
+    }
+    getCapabilityGrant(taskId, grantId) {
+        return this.#requireTask(taskId).capabilityGrants[grantId] ?? null;
+    }
+    nextReleaseWorkflowId(taskId) {
+        return this.#nextTaskRecordId(taskId, "releaseWorkflow");
+    }
+    saveReleaseWorkflow(taskId, workflow) {
+        const stored = storedReleaseWorkflow(workflow);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Release workflow belongs to another Task: ${stored.taskId}`);
+        }
+        this.#mutate((state) => {
+            const aggregate = requireTaskFromState(state, taskId);
+            const existing = aggregate.releaseWorkflows[stored.id];
+            if (existing !== undefined && !isValidReleaseWorkflowTransition(existing, stored)) {
+                throw new StorageRecordError(`Release workflow cannot be overwritten: ${taskId}/${stored.id}`);
+            }
+            observeTaskRecordId(aggregate, "releaseWorkflow", stored.id);
+            aggregate.releaseWorkflows[stored.id] = stored;
+        });
+    }
+    listReleaseWorkflows(taskId) {
+        return values(this.#requireTask(taskId).releaseWorkflows, "id");
+    }
+    getReleaseWorkflow(taskId, workflowId) {
+        return this.#requireTask(taskId).releaseWorkflows[workflowId] ?? null;
+    }
+    // -- Gate artifacts (Issue 08) ---------------------------------------------
+    // FileTaskStore delegates to the file-backed artifact namespace under
+    // `<home>/artifacts/gates/`.  This is the transitional path for Homes that
+    // have not yet migrated to SQLite; the SqliteTaskStore stores the same
+    // records and logs in `gate_artifacts` / `gate_artifact_logs`.
+    #gateArtifactRecordPath(projectId, key) {
+        return join(this.rootDir, "artifacts", "gates", projectId, `${key}.json`);
+    }
+    #gateArtifactLogsRoot(projectId, key) {
+        return join(this.rootDir, "artifacts", "gates", projectId, key);
+    }
+    saveGateArtifact(artifact, logs) {
+        validateGateArtifact(artifact);
+        const recordPath = this.#gateArtifactRecordPath(artifact.projectId, artifact.key);
+        const logsRoot = this.#gateArtifactLogsRoot(artifact.projectId, artifact.key);
+        this.#mutate(() => {
+            writeTextFileAtomically(recordPath, `${JSON.stringify(artifact, null, 2)}\n`);
+            mkdirSync(logsRoot, { recursive: true, mode: 0o700 });
+            for (const [stepName, content] of logs) {
+                const logPath = join(logsRoot, stepName);
+                const tmpPath = `${logPath}.tmp-${process.pid}`;
+                writeFileSync(tmpPath, content, { mode: 0o600 });
+                renameSync(tmpPath, logPath);
+            }
+        });
+    }
+    touchGateArtifact(artifact) {
+        validateGateArtifact(artifact);
+        const recordPath = this.#gateArtifactRecordPath(artifact.projectId, artifact.key);
+        if (!existsSync(recordPath)) {
+            throw new StorageRecordError(`Gate artifact not found for touch: ${artifact.key}`);
+        }
+        writeTextFileAtomically(recordPath, `${JSON.stringify(artifact, null, 2)}\n`);
+    }
+    getGateArtifact(projectId, key) {
+        const path = this.#gateArtifactRecordPath(projectId, key);
+        if (!existsSync(path))
+            return null;
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return validateGateArtifact(parsed);
+    }
+    findGateArtifactByIdentity(identity) {
+        return this.getGateArtifact(identity.projectId, gateArtifactKey(identity));
+    }
+    findL2GateArtifactsForCommit(query) {
+        const root = join(this.rootDir, "artifacts", "gates", query.projectId);
+        if (!existsSync(root))
+            return [];
+        const results = [];
+        for (const entry of readdirSync(root)) {
+            if (!entry.endsWith(".json"))
+                continue;
+            let artifact;
+            try {
+                artifact = this.getGateArtifact(query.projectId, entry.slice(0, -".json".length));
+            }
+            catch {
+                continue;
+            }
+            if (artifact === null
+                || artifact.level !== "L2"
+                || artifact.status !== "complete"
+                || artifact.outcome !== "succeeded"
+                || artifact.commit !== query.commit
+                || artifact.planDigest !== query.planDigest
+                || artifact.toolchainDigest !== query.toolchainDigest
+                || artifact.boundary?.targetRef !== query.targetRef) {
+                continue;
+            }
+            results.push(artifact);
+        }
+        return results;
+    }
+    getGateArtifactLogs(artifactKey) {
+        // The artifact key is content-addressed; we need the projectId to build
+        // the path.  Callers that have the artifact should use
+        // getGateArtifactLogsForArtifact; this fallback scans all projects.
+        const gatesRoot = join(this.rootDir, "artifacts", "gates");
+        if (!existsSync(gatesRoot))
+            return new Map();
+        for (const projectId of readdirSync(gatesRoot)) {
+            const logsRoot = join(gatesRoot, projectId, artifactKey);
+            if (existsSync(logsRoot) && statSync(logsRoot).isDirectory()) {
+                return this.#readGateArtifactLogs(logsRoot);
+            }
+        }
+        return new Map();
+    }
+    #readGateArtifactLogs(logsRoot) {
+        const logs = new Map();
+        if (!existsSync(logsRoot))
+            return logs;
+        for (const entry of readdirSync(logsRoot)) {
+            const fullPath = join(logsRoot, entry);
+            if (statSync(fullPath).isFile()) {
+                logs.set(entry, readFileSync(fullPath));
+            }
+        }
+        return logs;
+    }
+    pruneGateArtifacts(projectId, options) {
+        const root = join(this.rootDir, "artifacts", "gates", projectId);
+        if (!existsSync(root))
+            return Object.freeze({ retained: 0, deleted: 0 });
+        let retained = 0;
+        let deleted = 0;
+        for (const entry of readdirSync(root)) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const key = entry.slice(0, -".json".length);
+            let artifact;
+            try {
+                const loaded = this.getGateArtifact(projectId, key);
+                if (loaded === null)
+                    continue;
+                artifact = loaded;
+            }
+            catch {
+                retained += 1;
+                continue;
+            }
+            const age = options.now.getTime() - Date.parse(artifact.lastUsedAt);
+            if (options.isReferenced(key) || age < options.ttlMs) {
+                retained += 1;
+                continue;
+            }
+            rmSync(this.#gateArtifactRecordPath(projectId, key), { force: true });
+            rmSync(this.#gateArtifactLogsRoot(projectId, key), { recursive: true, force: true });
+            deleted += 1;
+        }
+        return Object.freeze({ retained, deleted });
+    }
     getWorkMailbox(target) {
         return optional(this.#state().mailboxes[mailboxTargetKey(target)]);
     }
@@ -1134,7 +1582,14 @@ export class FileTaskStore {
             writeCurrentStorageManifest(this.rootDir);
             this.#normalizeState = undefined;
         }
-        this.#readCache = null;
+        // Keep the state we just wrote as the warm read cache. The atomic write
+        // produced a new fingerprint, so a concurrent external writer is still
+        // detected on the next read; our own mutations no longer re-parse the
+        // whole Home to observe state they already held under the write lock.
+        this.#readCache = {
+            fingerprint: stateFileFingerprint(join(this.rootDir, STORAGE_STATE_FILE)),
+            state
+        };
     }
     #parseState(raw) {
         return parseState(this.#normalizeState?.(raw) ?? raw);
@@ -1155,7 +1610,13 @@ export class FileTaskStore {
             requireCompatibleStorageSchema(this.rootDir);
     }
 }
-function stateFileFingerprint(path) {
+/**
+ * The on-disk identity of a `state.json` the store's read cache is keyed on.
+ * The one-snapshot current-Home open fences its single read with the same
+ * fingerprint, so a writer that changes the file between the fence and the
+ * store's next read is detected exactly like a normal cache invalidation.
+ */
+export function stateFileFingerprint(path) {
     const stat = statSync(path, { bigint: true });
     return [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(":");
 }
@@ -1165,6 +1626,15 @@ export class StorageRecordError extends Error {
 export class StorageConflictError extends Error {
     constructor(message) { super(message); this.name = "StorageConflictError"; }
 }
+/**
+ * Raised by the persistence worker when an `AbortSignal` cancels an in-flight
+ * command batch. The open transaction is rolled back; the database is unchanged.
+ * Already-committed transactions are not undone (their effects are idempotent
+ * and semantically owned by the caller, design §3.1).
+ */
+export class StorageCancelledError extends Error {
+    constructor(message) { super(message); this.name = "StorageCancelledError"; }
+}
 export function resolveYuiHome(env) {
     return env.YUI_HOME === undefined || env.YUI_HOME.length === 0
         ? join(homedir(), ".yui")
@@ -1186,6 +1656,10 @@ function emptyState() {
         mailboxes: {}
     };
 }
+/** rr13: Durable map key for a Session's job caller key hash. */
+function jobCallerKeyHashKey(roleName, agentId) {
+    return `${roleName}\0${agentId}`;
+}
 function emptyStoredTask(task) {
     return {
         schemaVersion: CURRENT_STORED_TASK_SCHEMA_VERSION,
@@ -1194,9 +1668,12 @@ function emptyStoredTask(task) {
         brief: null,
         changeSets: {},
         integrationAttempts: {},
+        integrationQueue: {},
+        durableJobs: {},
         roles: {},
         managedWorkspaces: {},
         roleSessionSets: {},
+        jobCallerKeyHashes: {},
         workItems: {},
         agentRuns: {},
         reviewRounds: {},
@@ -1206,6 +1683,8 @@ function emptyStoredTask(task) {
         decisions: {},
         milestones: {},
         events: {},
+        capabilityGrants: {},
+        releaseWorkflows: {},
         leaderFailure: null,
         operatorNotification: null
     };
@@ -1215,13 +1694,18 @@ function emptyTaskIdHighWaterMarks() {
         workItem: 0,
         agentRun: 0,
         reviewRound: 0,
+        reviewFinding: 0,
         changeSet: 0,
         integrationAttempt: 0,
+        integrationQueue: 0,
+        durableJob: 0,
         message: 0,
         inputRequest: 0,
         decision: 0,
         milestone: 0,
-        event: 0
+        event: 0,
+        capabilityGrant: 0,
+        releaseWorkflow: 0
     };
 }
 function nextTaskRecordSequence(aggregate, taskId, kind) {
@@ -1397,9 +1881,12 @@ function parseStoredTask(value, taskId) {
         "brief",
         "changeSets",
         "integrationAttempts",
+        "integrationQueue",
+        "durableJobs",
         "roles",
         "managedWorkspaces",
         "roleSessionSets",
+        "jobCallerKeyHashes",
         "workItems",
         "agentRuns",
         "reviewRounds",
@@ -1409,6 +1896,8 @@ function parseStoredTask(value, taskId) {
         "decisions",
         "milestones",
         "events",
+        "capabilityGrants",
+        "releaseWorkflows",
         "leaderFailure",
         "operatorNotification"
     ], `Task aggregate ${taskId}`);
@@ -1428,6 +1917,25 @@ function parseStoredTask(value, taskId) {
         validateIntegrationAttempt(attempt);
         return attempt;
     }, "integrationAttempts");
+    parseMap(aggregate.integrationQueue, (record, key) => {
+        const entry = identified(record, CURRENT_INTEGRATION_QUEUE_SCHEMA_VERSION, "id", key, "Integration queue entry");
+        if (entry.taskId !== taskId) {
+            throw new StorageRecordError(`Integration queue entry belongs to another Task: ${entry.taskId}.`);
+        }
+        if (aggregate.changeSets[entry.changeSetId] === undefined) {
+            throw new StorageRecordError(`Integration queue entry ChangeSet not found: ${entry.changeSetId}.`);
+        }
+        validateIntegrationQueueEntry(entry);
+        return entry;
+    }, "integrationQueue");
+    parseMap(aggregate.durableJobs, (record, key) => {
+        const job = identified(record, CURRENT_DURABLE_JOB_SCHEMA_VERSION, "id", key, "DurableJob");
+        if (job.taskId !== taskId) {
+            throw new StorageRecordError(`DurableJob belongs to another Task: ${job.taskId}.`);
+        }
+        validateDurableJob(job);
+        return job;
+    }, "durableJobs");
     versioned(aggregate, CURRENT_STORED_TASK_SCHEMA_VERSION, `Task aggregate ${taskId}`);
     validateTaskIdHighWaterMarks(aggregate.idHighWaterMarks, taskId);
     validateTask(identified(aggregate.task, CURRENT_TASK_SCHEMA_VERSION, "id", taskId, "Task"));
@@ -1453,6 +1961,12 @@ function parseStoredTask(value, taskId) {
     }, "managedWorkspaces");
     parseMap(aggregate.roleSessionSets, (record, key) => { const set = taskSessions(record); if (set.owner.taskId !== taskId || set.owner.roleName !== key)
         throw new StorageRecordError(`Task Role session set identity is inconsistent: ${taskId}/${key}`); return set; }, "roleSessionSets");
+    parseMap(aggregate.jobCallerKeyHashes, (hash, key) => {
+        if (typeof hash !== "string" || !/^[a-f0-9]{64}$/u.test(hash)) {
+            throw new StorageRecordError(`Job caller key hash is invalid: ${taskId}/${key}.`);
+        }
+        return hash;
+    }, "jobCallerKeyHashes");
     parseMap(aggregate.workItems, (record, key) => {
         const item = identified(record, CURRENT_WORK_ITEM_SCHEMA_VERSION, "id", key, "Work item");
         if (item.taskId !== taskId) {
@@ -1539,6 +2053,26 @@ function parseStoredTask(value, taskId) {
         }
         return event;
     }, "events");
+    parseMap(aggregate.capabilityGrants, (record, key) => {
+        const grant = storedCapabilityGrant(record);
+        if (grant.id !== key) {
+            throw new StorageRecordError(`Capability grant identity is inconsistent: ${key}.`);
+        }
+        if (grant.taskId !== taskId) {
+            throw new StorageRecordError(`Capability grant belongs to another Task: ${grant.taskId}`);
+        }
+        return grant;
+    }, "capabilityGrants");
+    parseMap(aggregate.releaseWorkflows, (record, key) => {
+        const workflow = storedReleaseWorkflow(record);
+        if (workflow.id !== key) {
+            throw new StorageRecordError(`Release workflow identity is inconsistent: ${key}.`);
+        }
+        if (workflow.taskId !== taskId) {
+            throw new StorageRecordError(`Release workflow belongs to another Task: ${workflow.taskId}`);
+        }
+        return workflow;
+    }, "releaseWorkflows");
     for (const [key, label] of [["leaderFailure", "Leader failure"], ["operatorNotification", "Operator notification"]]) {
         const record = aggregate[key];
         if (record !== null) {
@@ -1556,13 +2090,20 @@ function validateTaskIdHighWaterCoverage(aggregate, taskId) {
         workItem: aggregate.workItems,
         agentRun: aggregate.agentRuns,
         reviewRound: aggregate.reviewRounds,
+        // Issue 06 dbonly: review findings are SQLite-native; the file aggregate
+        // never carries them, so coverage is trivially empty.
+        reviewFinding: {},
         changeSet: aggregate.changeSets,
         integrationAttempt: aggregate.integrationAttempts,
+        integrationQueue: aggregate.integrationQueue,
+        durableJob: aggregate.durableJobs,
         message: aggregate.messages,
         inputRequest: aggregate.inputRequests,
         decision: aggregate.decisions,
         milestone: aggregate.milestones,
-        event: aggregate.events
+        event: aggregate.events,
+        capabilityGrant: aggregate.capabilityGrants,
+        releaseWorkflow: aggregate.releaseWorkflows
     };
     for (const kind of Object.keys(TASK_RECORD_ID_PREFIXES)) {
         const pattern = new RegExp(`^${TASK_RECORD_ID_PREFIXES[kind]}-(\\d+)$`);
@@ -1586,12 +2127,15 @@ function observeTaskRecordId(aggregate, kind, id) {
     const sequence = Number.parseInt(match[1], 10);
     aggregate.idHighWaterMarks[kind] = Math.max(aggregate.idHighWaterMarks[kind], sequence);
 }
-function validateYuiConfig(config) {
+export function validateYuiConfig(config) {
     try {
         reconciliationIntervalMilliseconds(config.reconciliationIntervalSeconds);
         resolveTimeZone(config.timeZone);
         if (config.review !== undefined)
             validateReviewConfig(config.review);
+        resolveLeaderNextActionMode(config.leaderNextActionMode);
+        resolveResourcesGcMode(config.resourcesGcMode);
+        resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
     }
     catch (error) {
         throw new StorageRecordError(error instanceof Error ? error.message : "Yui reconciliation interval is invalid.");
@@ -1732,6 +2276,372 @@ function storedTaskEvent(value) {
     requireTimestamp(event.createdAt, "Task event createdAt");
     return event;
 }
+export function storedCapabilityGrant(value) {
+    const grant = versioned(value, CURRENT_CAPABILITY_GRANT_SCHEMA_VERSION, "Capability grant");
+    const fields = [
+        "schemaVersion", "id", "taskId", "granter", "scope", "actions",
+        "parameterBounds", "usesUsed", "irreversibilityCeiling", "createdAt", "updatedAt"
+    ];
+    if (grant.expiresAt !== undefined)
+        fields.push("expiresAt");
+    if (grant.maxUses !== undefined)
+        fields.push("maxUses");
+    if (grant.useReservations !== undefined)
+        fields.push("useReservations");
+    if (grant.revokedAt !== undefined)
+        fields.push("revokedAt");
+    if (grant.revokedBy !== undefined)
+        fields.push("revokedBy");
+    exact(grant, fields, "Capability grant");
+    requireRecordIdentity(grant.id, "Capability grant id");
+    requireRecordIdentity(grant.taskId, "Capability grant Task id");
+    validateTaskRecordReference({ taskId: grant.taskId, localId: grant.id }, "capabilityGrant");
+    requireNormalizedText(grant.granter, "Capability grant granter");
+    storedCapabilityGrantScope(grant.scope, grant.taskId);
+    if (!Array.isArray(grant.actions) || grant.actions.length === 0) {
+        throw new StorageRecordError("Capability grant actions must be a non-empty array.");
+    }
+    const actions = grant.actions.map((action) => requireNormalizedText(action, "Capability grant action"));
+    if (new Set(actions).size !== actions.length) {
+        throw new StorageRecordError("Capability grant actions must be unique.");
+    }
+    const bounds = object(grant.parameterBounds, "Capability grant parameterBounds");
+    for (const [name, allowed] of Object.entries(bounds)) {
+        requireRecordIdentity(name, "Capability grant parameter");
+        if (!Array.isArray(allowed) || allowed.length === 0) {
+            throw new StorageRecordError(`Capability grant parameter bound must list allowed values: ${name}.`);
+        }
+        const values = allowed.map((entry) => requireNormalizedText(entry, `Capability grant parameter ${name} value`));
+        if (new Set(values).size !== values.length) {
+            throw new StorageRecordError(`Capability grant parameter bound values must be unique: ${name}.`);
+        }
+    }
+    if (grant.expiresAt !== undefined) {
+        requireTimestamp(grant.expiresAt, "Capability grant expiresAt");
+    }
+    if (grant.maxUses !== undefined
+        && (!Number.isSafeInteger(grant.maxUses) || grant.maxUses < 1)) {
+        throw new StorageRecordError("Capability grant maxUses must be a positive integer.");
+    }
+    if (!Number.isSafeInteger(grant.usesUsed) || grant.usesUsed < 0) {
+        throw new StorageRecordError("Capability grant usesUsed must be a non-negative integer.");
+    }
+    if (grant.maxUses !== undefined && grant.usesUsed > grant.maxUses) {
+        throw new StorageRecordError("Capability grant usesUsed cannot exceed maxUses.");
+    }
+    if (!["none", "reversible", "irreversible"].includes(grant.irreversibilityCeiling)) {
+        throw new StorageRecordError(`Capability grant irreversibility ceiling is invalid: ${String(grant.irreversibilityCeiling)}.`);
+    }
+    if ((grant.revokedAt === undefined) !== (grant.revokedBy === undefined)) {
+        throw new StorageRecordError("Capability grant revocation requires both revokedAt and revokedBy.");
+    }
+    if (grant.revokedAt !== undefined) {
+        requireTimestamp(grant.revokedAt, "Capability grant revokedAt");
+        requireNormalizedText(grant.revokedBy, "Capability grant revokedBy");
+    }
+    requireTimestamp(grant.createdAt, "Capability grant createdAt");
+    requireTimestamp(grant.updatedAt, "Capability grant updatedAt");
+    try {
+        return validateCapabilityGrant(grant);
+    }
+    catch (error) {
+        throw new StorageRecordError(error instanceof Error ? error.message : String(error));
+    }
+}
+function storedCapabilityGrantScope(scope, taskId) {
+    const value = object(scope, "Capability grant scope");
+    const fields = [];
+    if (value.taskId !== undefined)
+        fields.push("taskId");
+    if (value.projectIds !== undefined)
+        fields.push("projectIds");
+    if (value.repositories !== undefined)
+        fields.push("repositories");
+    if (value.packages !== undefined)
+        fields.push("packages");
+    if (value.homePath !== undefined)
+        fields.push("homePath");
+    exact(value, fields, "Capability grant scope");
+    if (fields.length === 0) {
+        throw new StorageRecordError(`Capability grant scope requires at least one selector: ${taskId}.`);
+    }
+    if (value.taskId !== undefined) {
+        requireRecordIdentity(value.taskId, "Capability grant scope taskId");
+    }
+    if (value.projectIds !== undefined) {
+        if (!Array.isArray(value.projectIds) || value.projectIds.length === 0) {
+            throw new StorageRecordError("Capability grant scope projectIds must be a non-empty array.");
+        }
+        const projectIds = value.projectIds.map((entry) => requireRecordIdentity(entry, "Capability grant scope Project"));
+        if (new Set(projectIds).size !== projectIds.length) {
+            throw new StorageRecordError("Capability grant scope Project ids must be unique.");
+        }
+    }
+    if (value.repositories !== undefined) {
+        if (!Array.isArray(value.repositories) || value.repositories.length === 0) {
+            throw new StorageRecordError("Capability grant scope repositories must be a non-empty array.");
+        }
+        const repositories = value.repositories.map((entry) => {
+            const repository = object(entry, "Capability grant scope repository");
+            exact(repository, ["owner", "name"], "Capability grant scope repository");
+            return {
+                owner: requireNormalizedText(repository.owner, "Capability grant scope repository owner"),
+                name: requireNormalizedText(repository.name, "Capability grant scope repository name")
+            };
+        });
+        const keys = new Set(repositories.map(({ owner, name }) => `${owner}/${name}`));
+        if (keys.size !== repositories.length) {
+            throw new StorageRecordError("Capability grant scope repositories must be unique.");
+        }
+    }
+    if (value.packages !== undefined) {
+        if (!Array.isArray(value.packages) || value.packages.length === 0) {
+            throw new StorageRecordError("Capability grant scope packages must be a non-empty array.");
+        }
+        const packages = value.packages.map((entry) => requireNormalizedText(entry, "Capability grant scope package"));
+        if (new Set(packages).size !== packages.length) {
+            throw new StorageRecordError("Capability grant scope packages must be unique.");
+        }
+    }
+    if (value.homePath !== undefined) {
+        requireNormalizedText(value.homePath, "Capability grant scope homePath");
+    }
+}
+export function isValidCapabilityGrantTransition(existing, candidate) {
+    if (existing.revokedAt !== undefined) {
+        // Idempotent re-revoke: the domain returns the revoked record unchanged.
+        return isDeepStrictEqual(candidate, existing);
+    }
+    const immutable = candidate.id === existing.id
+        && candidate.taskId === existing.taskId
+        && candidate.granter === existing.granter
+        && isDeepStrictEqual(candidate.scope, existing.scope)
+        && isDeepStrictEqual(candidate.actions, existing.actions)
+        && isDeepStrictEqual(candidate.parameterBounds, existing.parameterBounds)
+        && candidate.expiresAt === existing.expiresAt
+        && candidate.maxUses === existing.maxUses
+        && candidate.irreversibilityCeiling === existing.irreversibilityCeiling
+        && candidate.createdAt === existing.createdAt;
+    if (!immutable)
+        return false;
+    if (candidate.revokedAt !== undefined) {
+        // Revocation consumes no uses and records no reservations.
+        return candidate.usesUsed === existing.usesUsed
+            && isDeepStrictEqual(candidate.useReservations, existing.useReservations)
+            && Date.parse(candidate.updatedAt) >= Date.parse(existing.updatedAt);
+    }
+    // A use record must advance the counter (compare-and-swap): a stale equal
+    // increment from a concurrent reader is rejected, so two workflows cannot
+    // spend the same maxUses slot. Reservations are append-only, one per use.
+    return candidate.usesUsed > existing.usesUsed
+        && reservationsAppendOnly(existing.useReservations, candidate.useReservations)
+        && Date.parse(candidate.updatedAt) >= Date.parse(existing.updatedAt);
+}
+function reservationsAppendOnly(existing, candidate) {
+    if (existing === undefined || existing.length === 0)
+        return true;
+    if (candidate === undefined || candidate.length < existing.length)
+        return false;
+    return existing.every((key, index) => candidate[index] === key);
+}
+export function storedReleaseWorkflow(value) {
+    const workflow = versioned(value, CURRENT_RELEASE_WORKFLOW_SCHEMA_VERSION, "Release workflow");
+    const fields = [
+        "schemaVersion", "id", "taskId", "grantId", "source", "plan", "steps",
+        "createdAt", "updatedAt"
+    ];
+    exact(workflow, fields, "Release workflow");
+    requireRecordIdentity(workflow.id, "Release workflow id");
+    requireRecordIdentity(workflow.taskId, "Release workflow Task id");
+    validateTaskRecordReference({ taskId: workflow.taskId, localId: workflow.id }, "releaseWorkflow");
+    requireNormalizedText(workflow.grantId, "Release workflow grantId");
+    storedReleaseWorkflowSource(workflow.source);
+    if (!Array.isArray(workflow.plan) || workflow.plan.length === 0) {
+        throw new StorageRecordError("Release workflow plan must be a non-empty array.");
+    }
+    const planIds = new Set();
+    for (const entry of workflow.plan) {
+        const plan = object(entry, "Release workflow plan entry");
+        const planFields = ["id", "kind", "idempotencyKey"];
+        if (plan.params !== undefined)
+            planFields.push("params");
+        if (plan.irreversibility !== undefined)
+            planFields.push("irreversibility");
+        exact(plan, planFields, "Release workflow plan entry");
+        const planId = requireRecordIdentity(plan.id, "Release step id");
+        if (planIds.has(planId)) {
+            throw new StorageRecordError(`Release workflow plan ids must be unique: ${planId}.`);
+        }
+        planIds.add(planId);
+        if (!RELEASE_WORKFLOW_KINDS.has(plan.kind)) {
+            throw new StorageRecordError(`Release step kind is invalid: ${String(plan.kind)}.`);
+        }
+        requireNormalizedText(plan.idempotencyKey, "Release step idempotencyKey");
+        if (plan.params !== undefined) {
+            const params = object(plan.params, "Release step params");
+            for (const [name, paramValue] of Object.entries(params)) {
+                requireRecordIdentity(name, "Release step param");
+                requireNormalizedText(paramValue, `Release step param ${name}`);
+            }
+        }
+        if (plan.irreversibility !== undefined
+            && !["none", "reversible", "irreversible"].includes(plan.irreversibility)) {
+            throw new StorageRecordError(`Release step irreversibility is invalid: ${String(plan.irreversibility)}.`);
+        }
+    }
+    const steps = object(workflow.steps, "Release workflow steps");
+    for (const planId of planIds) {
+        if (!Object.hasOwn(steps, planId)) {
+            throw new StorageRecordError(`Release workflow step record is missing: ${planId}.`);
+        }
+    }
+    for (const key of Object.keys(steps)) {
+        if (!planIds.has(key)) {
+            throw new StorageRecordError(`Release workflow step record has no plan entry: ${key}.`);
+        }
+    }
+    for (const planId of planIds) {
+        storedReleaseStep(steps[planId], planId);
+    }
+    requireTimestamp(workflow.createdAt, "Release workflow createdAt");
+    requireTimestamp(workflow.updatedAt, "Release workflow updatedAt");
+    try {
+        return validateReleaseWorkflow(workflow);
+    }
+    catch (error) {
+        throw new StorageRecordError(error instanceof Error ? error.message : String(error));
+    }
+}
+function storedReleaseWorkflowSource(source) {
+    const value = object(source, "Release workflow source");
+    const sourceFields = ["repository", "commit"];
+    if (value.artifact !== undefined)
+        sourceFields.push("artifact");
+    exact(value, sourceFields, "Release workflow source");
+    const repository = object(value.repository, "Release workflow source repository");
+    exact(repository, ["owner", "name"], "Release workflow source repository");
+    requireNormalizedText(repository.owner, "Release workflow source repository owner");
+    requireNormalizedText(repository.name, "Release workflow source repository name");
+    requireNormalizedText(value.commit, "Release workflow source commit");
+    if (value.artifact !== undefined) {
+        const artifact = object(value.artifact, "Release workflow source artifact");
+        exact(artifact, ["name", "integrity"], "Release workflow source artifact");
+        requireNormalizedText(artifact.name, "Release workflow source artifact name");
+        requireNormalizedText(artifact.integrity, "Release workflow source artifact integrity");
+    }
+}
+function storedReleaseStep(step, planId) {
+    const value = object(step, `Release step record ${planId}`);
+    const stepFields = ["planId", "status", "attempts", "logs"];
+    if (value.externalId !== undefined)
+        stepFields.push("externalId");
+    if (value.externalIdentity !== undefined)
+        stepFields.push("externalIdentity");
+    if (value.lastAttemptAt !== undefined)
+        stepFields.push("lastAttemptAt");
+    if (value.terminalAt !== undefined)
+        stepFields.push("terminalAt");
+    exact(value, stepFields, `Release step record ${planId}`);
+    requireNormalizedText(value.planId, `Release step planId ${planId}`);
+    if (value.planId !== planId) {
+        throw new StorageRecordError(`Release step record planId ${String(value.planId)} does not match its key: ${planId}.`);
+    }
+    if (!RELEASE_WORKFLOW_STATUSES.has(value.status)) {
+        throw new StorageRecordError(`Release step status is invalid: ${String(value.status)}.`);
+    }
+    if (!Number.isSafeInteger(value.attempts) || value.attempts < 0) {
+        throw new StorageRecordError(`Release step attempts must be a non-negative integer: ${planId}.`);
+    }
+    if (value.externalId !== undefined) {
+        requireNormalizedText(value.externalId, `Release step externalId ${planId}`);
+    }
+    if (value.externalIdentity !== undefined) {
+        const identity = object(value.externalIdentity, `Release step externalIdentity ${planId}`);
+        exact(identity, ["kind", "value"], `Release step externalIdentity ${planId}`);
+        requireNormalizedText(identity.kind, `Release step externalIdentity kind ${planId}`);
+        requireNormalizedText(identity.value, `Release step externalIdentity value ${planId}`);
+    }
+    // An `unknown` step without an externalIdentity is a crash-recovery state:
+    // the process died during executeStep after the effect may have landed, but
+    // before an identity was recorded. The domain validation permits it and the
+    // engine fails closed (unconfirmed) on resume; the store must persist it.
+    if (!Array.isArray(value.logs)) {
+        throw new StorageRecordError(`Release step logs must be an array: ${planId}.`);
+    }
+    for (const line of value.logs) {
+        requireNormalizedText(line, `Release step log ${planId}`);
+    }
+    if (value.lastAttemptAt !== undefined) {
+        requireTimestamp(value.lastAttemptAt, `Release step lastAttemptAt ${planId}`);
+    }
+    if (value.status === "running" && value.lastAttemptAt === undefined) {
+        throw new StorageRecordError(`Release step running status requires lastAttemptAt: ${planId}.`);
+    }
+    if (value.terminalAt !== undefined) {
+        requireTimestamp(value.terminalAt, `Release step terminalAt ${planId}`);
+    }
+    if ((value.status === "succeeded" || value.status === "skipped") && value.terminalAt === undefined) {
+        throw new StorageRecordError(`Release step ${String(value.status)} status requires terminalAt: ${planId}.`);
+    }
+}
+const RELEASE_WORKFLOW_KINDS = new Set([
+    "pr-create-or-reuse", "ci-confirm", "merge", "version-tag",
+    "npm-publish", "fresh-install-smoke", "cli-update",
+    "controller-replace", "project-migrate", "post-verify"
+]);
+const RELEASE_WORKFLOW_STATUSES = new Set([
+    "pending", "running", "succeeded", "failed", "unknown", "skipped"
+]);
+/**
+ * Workflow records only move forward in time: a save with an older updatedAt
+ * than the stored record is rejected. Equal updatedAt permits idempotent
+ * re-saves of the same record. The exact source and the predeclared plan are
+ * immutable after create, and each step status may only follow the release
+ * state machine (no rewinds that could re-trigger a side effect).
+ */
+export function isValidReleaseWorkflowTransition(existing, candidate) {
+    if (Date.parse(candidate.updatedAt) < Date.parse(existing.updatedAt))
+        return false;
+    if (!isDeepStrictEqual(candidate.source, existing.source))
+        return false;
+    if (!isDeepStrictEqual(candidate.plan, existing.plan))
+        return false;
+    const existingKeys = Object.keys(existing.steps);
+    const candidateKeys = Object.keys(candidate.steps);
+    if (existingKeys.length !== candidateKeys.length)
+        return false;
+    for (const key of existingKeys) {
+        const from = existing.steps[key];
+        const to = candidate.steps[key];
+        if (from === undefined || to === undefined)
+            return false;
+        if (!isLegalStepTransition(from.status, to.status))
+            return false;
+        if (to.attempts < from.attempts)
+            return false;
+    }
+    return true;
+}
+/**
+ * The legal step-status transitions. Self-transitions are always allowed
+ * (idempotent re-saves). `pending -> failed` is permitted because the engine
+ * records an authorization denial atomically (start then fail in one save).
+ * `failed -> succeeded` is permitted only via an authoritative query that
+ * proves the effect landed (confirmFailedStep).
+ */
+const LEGAL_STEP_TRANSITIONS = {
+    pending: ["running", "skipped", "failed"],
+    running: ["running", "succeeded", "failed", "unknown"],
+    failed: ["running", "succeeded"],
+    unknown: ["running", "succeeded"],
+    succeeded: [],
+    skipped: []
+};
+function isLegalStepTransition(from, to) {
+    if (from === to)
+        return true;
+    return LEGAL_STEP_TRANSITIONS[from]?.includes(to) ?? false;
+}
 function isValidDecisionSupersession(existing, candidate) {
     return existing.status === "active"
         && candidate.status === "superseded"
@@ -1857,7 +2767,7 @@ function values(records, identity) {
     return Object.values(records).map(clone).sort((left, right) => numericCompare(typeof identity === "function" ? identity(left) : String(left[identity]), typeof identity === "function" ? identity(right) : String(right[identity])));
 }
 function numericCompare(left, right) { return left.localeCompare(right, undefined, { numeric: true }); }
-function pendingWakeupProjection(mailbox) {
+export function pendingWakeupProjection(mailbox) {
     if (mailbox === null || mailbox.target.kind !== "role" || mailbox.target.roleName !== "leader"
         || mailbox.pending === null) {
         return null;
@@ -2034,7 +2944,7 @@ function validateCanonicalTaskReferences(state, aggregate) {
         if (!aggregate.task.projectBindings.some(({ projectId }) => projectId === changeSet.projectId)) {
             throw new StorageRecordError(`ChangeSet Project does not match Task: ${changeSet.id}.`);
         }
-        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+        const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit, reviewBaseCommit }) => evidenceCommit !== undefined && evidenceCommit !== reviewBaseCommit && evidenceCommit === changeSet.headCommit);
         if (evidenceRound !== undefined) {
             throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become a ChangeSet.`);
         }
@@ -2051,7 +2961,7 @@ function validateCanonicalTaskReferences(state, aggregate) {
             if (changeSet.projectId !== integration.projectId) {
                 throw new StorageRecordError(`Integration ChangeSet belongs to another Project: ${integration.id}/${changeSetId}.`);
             }
-            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit }) => evidenceCommit === changeSet.headCommit);
+            const evidenceRound = Object.values(aggregate.reviewRounds).find(({ evidenceCommit, reviewBaseCommit }) => evidenceCommit !== undefined && evidenceCommit !== reviewBaseCommit && evidenceCommit === changeSet.headCommit);
             if (evidenceRound !== undefined) {
                 throw new StorageRecordError(`ReviewRound evidence commit ${evidenceRound.id}/${changeSet.headCommit} cannot become an Integration source.`);
             }
@@ -2200,11 +3110,38 @@ function validIntegrationTransition(before, after) {
         running: ["running", "blocked", "validating", "failed"],
         blocked: ["blocked", "validating", "failed"],
         validating: ["validating", "committed", "failed"],
-        committed: ["committed"],
+        committed: ["committed", "superseded"],
+        superseded: ["superseded"],
         failed: ["failed"]
     };
     return allowed[before.status].includes(after.status);
 }
+/**
+ * Storage-level defence in depth for the integration queue state machine: the
+ * identity fields and the check/evidence lists are immutable once written, and
+ * a status may only move along the queue's legal transitions.  The service
+ * owns the CAS claim; this rejects a stale or forged write that slipped past it.
+ */
+function validIntegrationQueueTransition(before, after) {
+    if (before.id !== after.id
+        || before.taskId !== after.taskId
+        || before.projectId !== after.projectId
+        || before.changeSetId !== after.changeSetId
+        || before.targetRef !== after.targetRef
+        || !isDeepStrictEqual(before.checkCommands, after.checkCommands)
+        || !isDeepStrictEqual(before.evidenceRefs, after.evidenceRefs)
+        || before.createdAt !== after.createdAt)
+        return false;
+    const allowed = {
+        queued: ["queued", "running", "validated", "superseded"],
+        running: ["running", "conflicted", "committed"],
+        conflicted: ["conflicted", "running", "committed", "queued", "superseded"],
+        validated: ["validated", "running", "queued", "superseded"],
+        committed: ["committed"],
+        superseded: ["superseded"]
+    };
+    return allowed[before.status].includes(after.status);
+}
 function assertAcyclicWorkItems(items) {
     const visiting = new Set();
     const visited = new Set();
@@ -2527,7 +3464,13 @@ function validReviewRoundTransition(existing, candidate) {
         || !isDeepStrictEqual(existing.taskCandidate, candidate.taskCandidate)
         || !sameTaskFinalReviewContract(existing.taskFinalReviewContract, candidate.taskFinalReviewContract)
         || !compatibleExecutionGroups(existing.executionGroup, candidate.executionGroup)
-        || existing.requestedBy !== candidate.requestedBy
+        // Issue 06: a Leader retry resets a failed Task-final Round to pending;
+        // the retry is itself a Leader request, so requestedBy may change from
+        // the original policy/contract value to "leader".
+        || (existing.requestedBy !== candidate.requestedBy
+            && !(existing.status === "failed"
+                && candidate.status === "pending"
+                && (candidate.scope ?? "work-item") === "task"))
         || existing.createdAt !== candidate.createdAt)
         return false;
     if (existing.status === "pending") {
@@ -2568,6 +3511,24 @@ function validReviewRoundTransition(existing, candidate) {
             && existing.reviewerRunId === candidate.reviewerRunId
             && isDeepStrictEqual(existing.workspace, candidate.workspace);
     }
+    // Issue 06: a failed Task-final execution attempt may be reset to pending
+    // under the same semantic Round ID. AgentRun history remains the attempt
+    // trail; terminal Review metadata is cleared by retryTaskReviewRound.
+    if (existing.status === "failed"
+        && candidate.status === "pending"
+        && (candidate.scope ?? "work-item") === "task") {
+        return candidate.reviewerRunId === undefined
+            && candidate.summary === undefined
+            && candidate.report === undefined
+            && candidate.checks === undefined
+            && candidate.evidenceCommit === undefined
+            && candidate.endedAt === undefined
+            && candidate.workspaceDisposition === undefined
+            && (existing.workspace === undefined
+                || candidate.workspace === undefined
+                || isDeepStrictEqual(existing.workspace, candidate.workspace))
+            && compatibleExecutionGroups(existing.executionGroup, candidate.executionGroup);
+    }
     if (existing.status === candidate.status
         && (existing.status === "completed" || existing.status === "failed")) {
         const { workspaceDisposition: _existingDisposition, ...existingResult } = existing;