@zq-silk/yui 0.6.0 → 0.6.2

package/dist/storage/sqliteStore.js

@@ -35,17 +35,22 @@
  * it performs the same cheap structural checks the file store relies on
  * (identity presence, taskId matching, referential lookups).
  */
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import Database from "better-sqlite3";
 import { mailboxTargetKey } from "../coordination/workMailbox.js";
+import { validateReviewFinding } from "../review/reviewFinding.js";
 import { generateHomeIdentity } from "../repository/homeIdentity.js";
+import { validateIntegrationQueueEntry } from "../integration/integrationQueueEntry.js";
+import { validDurableJobTransition, validateDurableJob } from "../job/durableJob.js";
 import { TASK_RECORD_ID_PREFIXES } from "../task/taskRecordReference.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { assertHomeWritable } from "./upgradeFence.js";
-import { CURRENT_CONFIG_SCHEMA_VERSION, CURRENT_PENDING_WAKEUP_SCHEMA_VERSION, CURRENT_WORK_MAILBOX_SCHEMA_VERSION, executionLaneActiveRunKey, StorageConflictError, StorageCancelledError, StorageRecordError, FileTaskStore } from "./taskStore.js";
+import { CURRENT_CONFIG_SCHEMA_VERSION, CURRENT_PENDING_WAKEUP_SCHEMA_VERSION, CURRENT_WORK_MAILBOX_SCHEMA_VERSION, executionLaneActiveRunKey, executionLaneActiveRunKeyParts, StorageConflictError, StorageCancelledError, StorageRecordError, FileTaskStore, storedCapabilityGrant, storedReleaseWorkflow, isValidCapabilityGrantTransition, isValidReleaseWorkflowTransition, validateYuiConfig } from "./taskStore.js";
+import { gateArtifactKey, validateGateArtifact } from "../verification/gateArtifact.js";
 import { migrateSqliteSchema, SQLITE_AGGREGATE_VERSION, SQLITE_LAYOUT_VERSION, TELEMETRY_KEEP_PER_GENERATION, TELEMETRY_RUN_CAP } from "./sqliteSchema.js";
+import { inspectStorageSchema } from "./storageSchema.js";
 const DEFAULT_CONFIG = { schemaVersion: CURRENT_CONFIG_SCHEMA_VERSION };
 function numericCompare(left, right) {
     return left.localeCompare(right, undefined, { numeric: true });
@@ -97,6 +102,12 @@ export class SqliteTaskStore {
     rootDirectory() { return this.#rootDir; }
     /** Close the underlying database connection. */
     close() { this.#db.close(); }
+    /**
+     * The underlying database connection, for read-only diagnostics
+     * (`PRAGMA journal_mode`, `PRAGMA quick_check`). Callers must not mutate
+     * through this handle.
+     */
+    databaseHandle() { return this.#db; }
     // -- transaction primitives -------------------------------------------------
     #seedHomeMeta() {
         const now = new Date().toISOString();
@@ -166,17 +177,13 @@ export class SqliteTaskStore {
             throw error;
         }
     }
-    /**
-     * The file-store's `transaction(closure)`: a single BEGIN IMMEDIATE … COMMIT.
-     * Nested calls join the outer transaction. The revision is bumped once, at
-     * commit, only when the closure wrote.
-     */
     transaction(execute, options) {
+        const run = execute;
         if (this.#inTransaction)
-            return execute(this);
+            return run(this);
         this.#begin();
         try {
-            const result = execute(this);
+            const result = run(this);
             if (this.#dirty) {
                 this.#prepareWrite();
                 if (options?.requestId !== undefined) {
@@ -196,6 +203,31 @@ export class SqliteTaskStore {
             throw error;
         }
     }
+    /** Async transaction seam used by queue operations that must inspect Git
+     * before committing the durable queue state. The SQLite write transaction
+     * remains open across the awaited callback, matching FileTaskStore's
+     * transactionAsync semantics and preserving the single-writer boundary. */
+    async transactionAsync(execute) {
+        if (this.#inTransaction)
+            return execute(this);
+        this.#prepareWrite();
+        this.#begin();
+        try {
+            const result = await execute(this);
+            if (this.#dirty)
+                this.#bumpRevision();
+            this.#commit();
+            return result;
+        }
+        catch (error) {
+            this.#rollback();
+            throw error;
+        }
+    }
+    /** Bounded runtime-event folds share the same SQLite write transaction. */
+    withRuntimeEventTransaction(execute) {
+        return this.transaction(() => execute());
+    }
     /**
      * Revision CAS (§5.3): run `execute` only when the global revision is still
      * `expectedRevision`; otherwise throw {@link StorageConflictError}. The check
@@ -237,6 +269,7 @@ export class SqliteTaskStore {
         const row = this.#db.prepare("SELECT revision FROM home_meta WHERE id = 1").get();
         return row.revision;
     }
+    getStateRevision() { return this.getRevision(); }
     /**
      * Run an ordered command batch inside one `BEGIN IMMEDIATE … COMMIT`, yielding
      * to the event loop between commands so a cancellation signal can interrupt
@@ -430,9 +463,14 @@ export class SqliteTaskStore {
     // -- config / identity ------------------------------------------------------
     getConfig() {
         const row = this.#db.prepare("SELECT payload FROM config WHERE id = 1").get();
-        return this.#parse(row.payload);
+        const config = this.#parse(row.payload);
+        // Fail closed on malformed durable config, matching the File store:
+        // GC mode and other settings must never silently fall back to defaults.
+        validateYuiConfig(config);
+        return config;
     }
     saveConfig(config) {
+        validateYuiConfig(config);
         this.#mutate(() => {
             this.#db.prepare("UPDATE config SET payload = ?, updated_at = ? WHERE id = 1").run(this.#json(config), this.#now());
         });
@@ -601,6 +639,29 @@ export class SqliteTaskStore {
     getTask(id) {
         return this.#getPayload("task_records", "task_id = ?", [id]);
     }
+    readNextActionFacts(taskId) {
+        const task = this.#getPayload("task_records", "task_id = ?", [taskId]);
+        if (task === null)
+            return null;
+        // One indexed query (idx_agent_runs_role_status) covers both the active
+        // Runs the projection waits on and the Leader Runs the budget consumes.
+        const runs = this.#sortById(this.#listPayload("agent_runs", "task_id = ? AND (status = 'active' OR role_name = 'leader')", [taskId]), (run) => run.id);
+        return {
+            task: {
+                id: task.id,
+                status: task.status,
+                projectBindings: task.projectBindings
+            },
+            workItems: this.#sortById(this.#listPayload("work_items", "task_id = ?", [taskId]), (item) => item.id),
+            changeSets: this.#sortById(this.#listPayload("change_sets", "task_id = ?", [taskId]), (changeSet) => changeSet.id),
+            integrations: this.#sortById(this.#listPayload("integration_attempts", "task_id = ?", [taskId]), (attempt) => attempt.id),
+            reviewRounds: this.#sortById(this.#listPayload("review_rounds", "task_id = ?", [taskId]), (round) => round.id),
+            reviewConfig: this.getReviewConfig(),
+            openInputRequests: this.#sortById(this.#listPayload("input_requests", "task_id = ? AND status = 'open'", [taskId]), (request) => request.id),
+            activeRuns: runs.filter((run) => run.status === "active"),
+            leaderRuns: runs.filter((run) => run.roleName === "leader")
+        };
+    }
     /** Task ids flagged active in the catalog projection (the global active index). */
     listActiveTaskIds() {
         const rows = this.#db.prepare("SELECT task_id FROM tasks_catalog WHERE is_active = 1 ORDER BY task_id").all();
@@ -663,6 +724,139 @@ export class SqliteTaskStore {
     getIntegrationAttempt(taskId, integrationId) {
         return this.#getPayload("integration_attempts", "task_id = ? AND integration_id = ?", [taskId, integrationId]);
     }
+    // -- integration queue -----------------------------------------------------
+    nextIntegrationQueueEntryId(taskId) {
+        return this.#nextTaskRecordId(taskId, "integrationQueue");
+    }
+    saveIntegrationQueueEntry(taskId, entry) {
+        if (entry.taskId !== taskId) {
+            throw new StorageRecordError(`Integration queue entry belongs to another Task: ${entry.taskId}`);
+        }
+        validateIntegrationQueueEntry(entry);
+        this.#requireTask(taskId);
+        const changeSet = this.getChangeSet(taskId, entry.changeSetId);
+        if (changeSet === null) {
+            throw new StorageRecordError(`Integration queue ChangeSet not found: ${entry.changeSetId}`);
+        }
+        if (changeSet.projectId !== entry.projectId) {
+            throw new StorageRecordError(`Integration queue ChangeSet belongs to another Project: ${entry.changeSetId}`);
+        }
+        const existing = this.getIntegrationQueueEntry(taskId, entry.id);
+        if (existing !== null) {
+            if (Date.parse(entry.updatedAt) < Date.parse(existing.updatedAt)) {
+                throw new StorageRecordError(`Integration queue entry updatedAt cannot move backwards: ${entry.id}`);
+            }
+            if (!validIntegrationQueueTransition(existing, entry)) {
+                throw new StorageRecordError(`Integration queue entry transition is invalid: ${entry.id}`);
+            }
+        }
+        this.#mutate(() => {
+            this.#db.prepare(`INSERT INTO integration_queue (queue_id, task_id, project_id, change_set, status, payload, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(queue_id) DO UPDATE SET task_id = excluded.task_id,
+           project_id = excluded.project_id, change_set = excluded.change_set,
+           status = excluded.status, payload = excluded.payload, updated_at = excluded.updated_at`).run(entry.id, taskId, entry.projectId, entry.changeSetId, entry.status, this.#json(entry), entry.createdAt, entry.updatedAt);
+        });
+    }
+    listIntegrationQueueEntries(taskId) {
+        return this.#sortById(this.#listPayload("integration_queue", "task_id = ?", [taskId]), (entry) => entry.id);
+    }
+    getIntegrationQueueEntry(taskId, entryId) {
+        return this.#getPayload("integration_queue", "task_id = ? AND queue_id = ?", [taskId, entryId]);
+    }
+    // -- durable jobs -----------------------------------------------------------
+    nextDurableJobId(taskId) {
+        return this.#nextTaskRecordId(taskId, "durableJob");
+    }
+    saveDurableJob(taskId, job) {
+        if (job.taskId !== taskId) {
+            throw new StorageRecordError(`DurableJob belongs to another Task: ${job.taskId}`);
+        }
+        validateDurableJob(job);
+        this.#requireTask(taskId);
+        const existing = this.getDurableJob(taskId, job.id);
+        if (existing !== null) {
+            if (Date.parse(job.updatedAt) < Date.parse(existing.updatedAt)) {
+                throw new StorageRecordError(`DurableJob updatedAt cannot move backwards: ${job.id}`);
+            }
+            if (!validDurableJobTransition(existing, job)) {
+                throw new StorageRecordError(`DurableJob transition is invalid: ${job.id}`);
+            }
+        }
+        this.#mutate(() => {
+            this.#db.prepare(`INSERT INTO durable_jobs (job_id, task_id, idempotency_key, status, payload, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(task_id, job_id) DO UPDATE SET idempotency_key = excluded.idempotency_key,
+           status = excluded.status,
+           payload = excluded.payload, updated_at = excluded.updated_at`).run(job.id, taskId, job.idempotencyKey ?? null, job.status, this.#json(job), job.createdAt, job.updatedAt);
+        });
+    }
+    listDurableJobs(taskId) {
+        return this.#sortById(this.#listPayload("durable_jobs", "task_id = ?", [taskId]), (job) => job.id);
+    }
+    getDurableJob(taskId, jobId) {
+        return this.#getPayload("durable_jobs", "task_id = ? AND job_id = ?", [taskId, jobId]);
+    }
+    findDurableJobByIdempotencyKey(taskId, key) {
+        return this.#getPayload("durable_jobs", "task_id = ? AND idempotency_key = ?", [taskId, key]);
+    }
+    listAllDurableJobs() {
+        return this.#listPayload("durable_jobs", "1 = 1", []);
+    }
+    hasActiveDurableJobs() {
+        const row = this.#db.prepare("SELECT 1 FROM durable_jobs WHERE status IN ('queued', 'running') LIMIT 1").get();
+        return row !== undefined;
+    }
+    // -- job caller key hashes (rr13) -------------------------------------------
+    getJobCallerKeyHash(taskId, roleName, agentId) {
+        const row = this.#db.prepare("SELECT hash FROM job_caller_key_hashes WHERE task_id = ? AND role_name = ? AND agent_id = ?").get(taskId, roleName, agentId);
+        return row === undefined ? null : row.hash;
+    }
+    setJobCallerKeyHash(taskId, roleName, agentId, hash) {
+        this.#requireTask(taskId);
+        if (!/^[a-f0-9]{64}$/u.test(hash)) {
+            throw new StorageRecordError(`Job caller key hash is invalid: ${taskId}/${roleName}.`);
+        }
+        this.#mutate(() => {
+            this.#db.prepare(`INSERT INTO job_caller_key_hashes (task_id, role_name, agent_id, hash, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(task_id, role_name, agent_id) DO UPDATE SET hash = excluded.hash, updated_at = excluded.updated_at`).run(taskId, roleName, agentId, hash, this.#now());
+        });
+    }
+    // -- session owners (Issue 03) ----------------------------------------------
+    saveSessionOwner(identity) {
+        const owner = identity.owner;
+        this.#mutate(() => {
+            this.#db.prepare(`INSERT INTO session_owners
+           (launch_id, scope, task_id, role_name, agent_id, native_session_id,
+            provider_root_pid, payload, recorded_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(launch_id) DO UPDATE SET
+           scope = excluded.scope, task_id = excluded.task_id,
+           role_name = excluded.role_name, agent_id = excluded.agent_id,
+           native_session_id = excluded.native_session_id,
+           provider_root_pid = excluded.provider_root_pid,
+           payload = excluded.payload, recorded_at = excluded.recorded_at`).run(identity.launchId, owner.scope, owner.scope === "task" ? owner.taskId : null, owner.roleName, identity.agentId, identity.nativeSessionId ?? null, identity.providerRoot.pid, this.#json(identity), identity.recordedAt);
+        });
+    }
+    getSessionOwner(launchId) {
+        const row = this.#db.prepare("SELECT payload FROM session_owners WHERE launch_id = ?").get(launchId);
+        return row === undefined ? null : this.#parse(row.payload);
+    }
+    listSessionOwners() {
+        return this.#listPayload("session_owners", "1=1", []).sort((left, right) => left.recordedAt.localeCompare(right.recordedAt));
+    }
+    listSessionOwnersForOwner(owner) {
+        if (owner.scope === "global") {
+            return this.#listPayload("session_owners", "scope = 'global' AND role_name = ?", [owner.roleName]);
+        }
+        return this.#listPayload("session_owners", "scope = 'task' AND task_id = ? AND role_name = ?", [owner.taskId, owner.roleName]);
+    }
+    removeSessionOwner(launchId) {
+        this.#mutate(() => {
+            this.#db.prepare("DELETE FROM session_owners WHERE launch_id = ?").run(launchId);
+        });
+    }
     // -- task roles -------------------------------------------------------------
     saveRole(taskId, role) {
         this.#requireTask(taskId);
@@ -778,6 +972,167 @@ export class SqliteTaskStore {
            payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, item.id, item.status, this.#json(item), this.#now());
         });
     }
+    // -- capability grants ------------------------------------------------------
+    nextCapabilityGrantId(taskId) { return this.#nextTaskRecordId(taskId, "capabilityGrant"); }
+    saveCapabilityGrant(taskId, grant) {
+        const stored = storedCapabilityGrant(grant);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Capability grant belongs to another Task: ${stored.taskId}`);
+        }
+        this.#requireTask(taskId);
+        this.#mutate(() => {
+            const existing = this.#getPayload("capability_grants", "task_id = ? AND grant_id = ?", [taskId, stored.id]);
+            if (existing === null) {
+                if (stored.revokedAt !== undefined) {
+                    throw new StorageRecordError(`Capability grant must start unrevoked: ${stored.id}`);
+                }
+                if (stored.usesUsed !== 0) {
+                    throw new StorageRecordError(`Capability grant must start unused: ${stored.id}`);
+                }
+            }
+            else if (!isValidCapabilityGrantTransition(existing, stored)) {
+                throw new StorageRecordError(`Capability grant cannot be overwritten: ${taskId}/${stored.id}`);
+            }
+            this.#db.prepare(`INSERT INTO capability_grants (task_id, grant_id, payload, updated_at) VALUES (?, ?, ?, ?)
+         ON CONFLICT(task_id, grant_id) DO UPDATE SET payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, stored.id, this.#json(stored), this.#now());
+        });
+    }
+    listCapabilityGrants(taskId) {
+        return this.#sortById(this.#listPayload("capability_grants", "task_id = ?", [taskId]), (grant) => grant.id);
+    }
+    getCapabilityGrant(taskId, grantId) {
+        return this.#getPayload("capability_grants", "task_id = ? AND grant_id = ?", [taskId, grantId]);
+    }
+    // -- release workflows ------------------------------------------------------
+    nextReleaseWorkflowId(taskId) { return this.#nextTaskRecordId(taskId, "releaseWorkflow"); }
+    saveReleaseWorkflow(taskId, workflow) {
+        const stored = storedReleaseWorkflow(workflow);
+        if (stored.taskId !== taskId) {
+            throw new StorageRecordError(`Release workflow belongs to another Task: ${stored.taskId}`);
+        }
+        this.#requireTask(taskId);
+        this.#mutate(() => {
+            const existing = this.#getPayload("release_workflows", "task_id = ? AND workflow_id = ?", [taskId, stored.id]);
+            if (existing !== null && !isValidReleaseWorkflowTransition(existing, stored)) {
+                throw new StorageRecordError(`Release workflow cannot be overwritten: ${taskId}/${stored.id}`);
+            }
+            this.#db.prepare(`INSERT INTO release_workflows (task_id, workflow_id, payload, updated_at) VALUES (?, ?, ?, ?)
+         ON CONFLICT(task_id, workflow_id) DO UPDATE SET payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, stored.id, this.#json(stored), this.#now());
+        });
+    }
+    listReleaseWorkflows(taskId) {
+        return this.#sortById(this.#listPayload("release_workflows", "task_id = ?", [taskId]), (workflow) => workflow.id);
+    }
+    getReleaseWorkflow(taskId, workflowId) {
+        return this.#getPayload("release_workflows", "task_id = ? AND workflow_id = ?", [taskId, workflowId]);
+    }
+    // -- gate artifacts (Issue 08) ----------------------------------------------
+    saveGateArtifact(artifact, logs) {
+        validateGateArtifact(artifact);
+        this.#mutate(() => {
+            const targetRef = artifact.boundary?.targetRef ?? null;
+            const completedAt = artifact.completedAt ?? null;
+            this.#db.prepare(`INSERT INTO gate_artifacts
+           (key, project_id, level, commit_sha, plan_digest, toolchain_digest,
+            target_ref, status, outcome, payload, created_at, completed_at, last_used_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(key) DO UPDATE SET
+           project_id = excluded.project_id,
+           level = excluded.level,
+           commit_sha = excluded.commit_sha,
+           plan_digest = excluded.plan_digest,
+           toolchain_digest = excluded.toolchain_digest,
+           target_ref = excluded.target_ref,
+           status = excluded.status,
+           outcome = excluded.outcome,
+           payload = excluded.payload,
+           completed_at = excluded.completed_at,
+           last_used_at = excluded.last_used_at`).run(artifact.key, artifact.projectId, artifact.level, artifact.commit, artifact.planDigest, artifact.toolchainDigest, targetRef, artifact.status, artifact.outcome, this.#json(artifact), artifact.createdAt, completedAt, artifact.lastUsedAt);
+            // Replace all logs for this artifact in the same transaction.
+            this.#db.prepare("DELETE FROM gate_artifact_logs WHERE artifact_key = ?").run(artifact.key);
+            const insertLog = this.#db.prepare(`INSERT INTO gate_artifact_logs (artifact_key, step_name, log_content, log_digest, log_bytes)
+         VALUES (?, ?, ?, ?, ?)`);
+            for (const [stepName, content] of logs) {
+                const step = artifact.steps.find((s) => s.name === stepName);
+                if (step === undefined) {
+                    throw new StorageRecordError(`Gate artifact log has no matching step: ${artifact.key}/${stepName}`);
+                }
+                insertLog.run(artifact.key, stepName, content, step.logDigest, step.logBytes);
+            }
+        });
+    }
+    touchGateArtifact(artifact) {
+        validateGateArtifact(artifact);
+        this.#mutate(() => {
+            const result = this.#db.prepare(`UPDATE gate_artifacts SET payload = ?, last_used_at = ? WHERE key = ?`).run(this.#json(artifact), artifact.lastUsedAt, artifact.key);
+            if (result.changes === 0) {
+                throw new StorageRecordError(`Gate artifact not found for touch: ${artifact.key}`);
+            }
+        });
+    }
+    getGateArtifact(projectId, key) {
+        const artifact = this.#getPayload("gate_artifacts", "project_id = ? AND key = ?", [projectId, key]);
+        return artifact === null ? null : validateGateArtifact(artifact);
+    }
+    findGateArtifactByIdentity(identity) {
+        return this.getGateArtifact(identity.projectId, gateArtifactKey(identity));
+    }
+    findL2GateArtifactsForCommit(query) {
+        const rows = this.#listPayload("gate_artifacts", `project_id = ? AND commit_sha = ? AND level = 'L2'
+       AND plan_digest = ? AND toolchain_digest = ? AND target_ref = ?
+       AND status = 'complete' AND outcome = 'succeeded'`, [query.projectId, query.commit, query.planDigest, query.toolchainDigest, query.targetRef]);
+        const valid = [];
+        for (const row of rows) {
+            try {
+                valid.push(validateGateArtifact(row));
+            }
+            catch {
+                // Skip corrupt rows; a direct lookup fails closed.
+            }
+        }
+        return valid;
+    }
+    getGateArtifactLogs(artifactKey) {
+        const rows = this.#db.prepare("SELECT step_name, log_content FROM gate_artifact_logs WHERE artifact_key = ?").all(artifactKey);
+        const logs = new Map();
+        for (const row of rows) {
+            logs.set(row.step_name, Buffer.from(row.log_content));
+        }
+        return logs;
+    }
+    pruneGateArtifacts(projectId, options) {
+        // Snapshot candidates outside the write transaction so the isReferenced
+        // callback never holds the SQLite write lock.
+        const rows = this.#db.prepare("SELECT key, payload, last_used_at FROM gate_artifacts WHERE project_id = ?").all(projectId);
+        const toDelete = [];
+        let retained = 0;
+        for (const row of rows) {
+            let artifact;
+            try {
+                artifact = validateGateArtifact(JSON.parse(row.payload));
+            }
+            catch {
+                retained += 1;
+                continue;
+            }
+            const age = options.now.getTime() - Date.parse(artifact.lastUsedAt);
+            if (options.isReferenced(artifact.key) || age < options.ttlMs) {
+                retained += 1;
+                continue;
+            }
+            toDelete.push(artifact.key);
+        }
+        if (toDelete.length === 0) {
+            return Object.freeze({ retained, deleted: 0 });
+        }
+        return this.#mutate(() => {
+            const deleteArtifact = this.#db.prepare("DELETE FROM gate_artifacts WHERE key = ?");
+            for (const key of toDelete) {
+                deleteArtifact.run(key);
+            }
+            return Object.freeze({ retained, deleted: toDelete.length });
+        });
+    }
     // -- agent runs -------------------------------------------------------------
     nextAgentRunId(taskId) { return this.#nextTaskRecordId(taskId, "agentRun"); }
     peekNextAgentRunId(taskId) { return this.#peekTaskRecordId(taskId, "agentRun"); }
@@ -796,6 +1151,21 @@ export class SqliteTaskStore {
            payload = excluded.payload, updated_at = excluded.updated_at`).run(run.taskId, run.id, run.roleName, run.status, this.#json(run), this.#now());
         });
     }
+    /**
+     * Issue 04: SQLite-native pending retry query.  A single indexed scan
+     * replaces the adapter's per-Task in-memory sweep, so Controller deadline
+     * arming no longer materializes every Task and Run in JavaScript.
+     */
+    listPendingProviderRetries() {
+        const rows = this.#db.prepare(`SELECT ar.task_id AS taskId, ar.run_id AS runId, ar.role_name AS roleName,
+              json_extract(ar.payload, '$.providerRetry.nextAttemptAt') AS nextAttemptAt
+       FROM agent_runs ar
+       JOIN tasks_catalog tc ON tc.task_id = ar.task_id
+       WHERE ar.status = 'active'
+         AND tc.is_active = 1
+         AND json_extract(ar.payload, '$.providerRetry.nextAttemptAt') IS NOT NULL`).all();
+        return rows;
+    }
     // -- review rounds ----------------------------------------------------------
     nextReviewRoundId(taskId) { return this.#nextTaskRecordId(taskId, "reviewRound"); }
     getReviewRound(taskId, reviewRoundId) {
@@ -814,6 +1184,27 @@ export class SqliteTaskStore {
            payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, round.id, round.status, this.#json(round), this.#now());
         });
     }
+    // -- review findings --------------------------------------------------------
+    nextReviewFindingId(taskId) { return this.#nextTaskRecordId(taskId, "reviewFinding"); }
+    getReviewFinding(taskId, findingId) {
+        return this.#getPayload("review_findings", "task_id = ? AND finding_id = ?", [taskId, findingId]);
+    }
+    listReviewFindings(taskId) {
+        return this.#sortById(this.#listPayload("review_findings", "task_id = ?", [taskId]), (finding) => finding.id);
+    }
+    saveReviewFinding(taskId, finding) {
+        validateReviewFinding(finding);
+        if (finding.taskId !== taskId) {
+            throw new StorageRecordError(`Review finding belongs to another Task: ${finding.taskId}`);
+        }
+        this.#requireTask(taskId);
+        this.#mutate(() => {
+            this.#db.prepare(`INSERT INTO review_findings (task_id, finding_id, stable_key, severity, payload, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(task_id, finding_id) DO UPDATE SET stable_key = excluded.stable_key,
+           severity = excluded.severity, payload = excluded.payload, updated_at = excluded.updated_at`).run(taskId, finding.id, finding.stableKey, finding.severity, this.#json(finding), this.#now());
+        });
+    }
     // -- active runs ------------------------------------------------------------
     #saveActiveRun(taskId, pointer, runId) {
         this.#mutate(() => {
@@ -837,10 +1228,29 @@ export class SqliteTaskStore {
         return this.#getActiveRun(taskId, roleName);
     }
     saveActiveAgentRun(run) {
+        if (run.executionGroupId !== undefined && run.executionLaneId !== undefined) {
+            this.saveActiveExecutionLaneRun(run);
+            return;
+        }
         this.#saveActiveRun(run.taskId, run.roleName, run.id);
     }
     clearActiveAgentRun(taskId, roleName) {
+        // Older Controller paths only know the Role key.  When that key points
+        // at a lane-backed Run, remove the matching lane pointer too; preserve
+        // every other lane for the same Role in a multi-lane group.
+        const rolePointer = this.#getActiveRun(taskId, roleName);
         this.#clearActiveRun(taskId, roleName);
+        if (rolePointer === null)
+            return;
+        const laneRows = this.#db.prepare("SELECT task_id, pointer FROM active_runs WHERE task_id = ?").all(taskId);
+        for (const row of laneRows) {
+            if (executionLaneActiveRunKeyParts(row.pointer) !== null) {
+                const laneRun = this.#getActiveRun(taskId, row.pointer);
+                if (laneRun !== null && laneRun.id === rolePointer.id) {
+                    this.#clearActiveRun(taskId, row.pointer);
+                }
+            }
+        }
     }
     getActiveExecutionLaneRun(taskId, executionGroupId, executionLaneId) {
         return this.#getActiveRun(taskId, executionLaneActiveRunKey(executionGroupId, executionLaneId));
@@ -939,6 +1349,19 @@ export class SqliteTaskStore {
     listEvents(taskId) {
         return this.#sortById(this.#listPayload("events", "task_id = ?", [taskId]), (event) => event.id);
     }
+    removeEvents(taskId, eventIds) {
+        if (eventIds.length === 0)
+            return 0;
+        this.#requireTask(taskId);
+        return this.#mutate(() => {
+            const deleteEvent = this.#db.prepare("DELETE FROM events WHERE task_id = ? AND event_id = ?");
+            let removed = 0;
+            for (const eventId of eventIds) {
+                removed += deleteEvent.run(taskId, eventId).changes;
+            }
+            return removed;
+        });
+    }
     // -- high-water maintenance ---------------------------------------------------
     /** Extract the numeric suffix of a `<prefix>-<n>` record id. */
     #idSequence(id, kind) {
@@ -1191,6 +1614,26 @@ export class SqliteTaskStore {
         });
     }
 }
+function validIntegrationQueueTransition(before, after) {
+    if (before.id !== after.id
+        || before.taskId !== after.taskId
+        || before.projectId !== after.projectId
+        || before.changeSetId !== after.changeSetId
+        || before.targetRef !== after.targetRef
+        || !isDeepStrictEqual(before.checkCommands, after.checkCommands)
+        || !isDeepStrictEqual(before.evidenceRefs, after.evidenceRefs)
+        || before.createdAt !== after.createdAt)
+        return false;
+    const allowed = {
+        queued: ["queued", "running", "validated", "superseded"],
+        running: ["running", "conflicted", "committed"],
+        conflicted: ["conflicted", "running", "committed", "queued", "superseded"],
+        validated: ["validated", "running", "queued", "superseded"],
+        committed: ["committed"],
+        superseded: ["superseded"]
+    };
+    return allowed[before.status].includes(after.status);
+}
 /**
  * Open a {@link TaskStore} for the given backend. `file` returns the existing
  * {@link FileTaskStore}; `sqlite` returns the in-process {@link SqliteTaskStore}.
@@ -1212,11 +1655,42 @@ export function openTaskStore(home, backend, options) {
 export function resolveTaskStoreBackend(env = process.env) {
     return env.YUI_STORE_BACKEND?.toLowerCase() === "sqlite" ? "sqlite" : "file";
 }
+/**
+ * Resolve the storage backend from the Home's verified manifest (Issue 01).
+ *
+ * The Home decides: a layout-7 Home's authoritative backend is SQLite WAL, so
+ * ordinary CLI/Controller startup opens SQLite without requiring
+ * `YUI_STORE_BACKEND=sqlite`. An explicit `YUI_STORE_BACKEND` env value still
+ * wins — it is reserved for tests and explicit recovery commands — and any
+ * other value (including unset) defers to the Home. A Home whose manifest
+ * cannot be read falls back to the file store; the classifier/doctor surfaces
+ * the manifest problem separately.
+ */
+export function resolveTaskStoreBackendForHome(home, env = process.env) {
+    const explicit = env.YUI_STORE_BACKEND?.toLowerCase();
+    if (explicit === "sqlite" || explicit === "file")
+        return explicit;
+    const schema = inspectStorageSchema(home);
+    const layout = schema.status === "current" || schema.status === "unsupported"
+        ? schema.currentLayoutVersion
+        : 0;
+    if (layout < 7)
+        return "file";
+    // Issue 01: a layout-7 Home's authoritative backend is SQLite WAL, but only
+    // when yui.db actually exists. A pseudo-layout-7 Home (manifest 7, no
+    // yui.db) is classified NEEDS_STORAGE_REPAIR; until repair runs, the file
+    // store remains the readable fallback. This keeps the Controller's backend
+    // resolution consistent with openCompatibleFileTaskStore's physical check.
+    // Uses the literal "yui.db" (not COMMITTED_DATABASE_FILENAME) to avoid a
+    // circular import: sqliteStateMigration.ts imports SqliteTaskStore from here.
+    return existsSync(join(home, "yui.db")) ? "sqlite" : "file";
+}
 /**
  * Convenience: open the store for the backend resolved from the environment
- * (`YUI_STORE_BACKEND`, default `file`). CLI/controller entry points that want
- * the env-driven switch call this instead of {@link openTaskStore} directly.
+ * and the Home's verified manifest (see {@link resolveTaskStoreBackendForHome}).
+ * CLI/controller entry points call this instead of {@link openTaskStore}
+ * directly so a layout-7 Home opens SQLite without an env opt-in.
  */
 export function openConfiguredTaskStore(home, options, env = process.env) {
-    return openTaskStore(home, resolveTaskStoreBackend(env), options);
+    return openTaskStore(home, resolveTaskStoreBackendForHome(home, env), options);
 }

package/dist/storage/storeRpc.js

@@ -23,6 +23,7 @@
  */
 import { BoundedRpcClient, nextRequestId } from "../core/boundedRpc.js";
 import { StorageCancelledError, StorageConflictError, StorageRecordError } from "./taskStore.js";
+import { resolveTaskStoreBackendForHome } from "./sqliteStore.js";
 // -- Read-only classification ------------------------------------------------
 /**
  * TaskStore methods that do not mutate. Reads use the worker's read pool
@@ -47,6 +48,7 @@ const READ_ONLY_STORE_METHODS = new Set([
     "listGlobalRoleSessionSets",
     "listTasks",
     "getTask",
+    "readNextActionFacts",
     "listActiveTaskIds",
     "getTaskBrief",
     "listChangeSets",
@@ -70,6 +72,7 @@ const READ_ONLY_STORE_METHODS = new Set([
     "listWorkItems",
     "getAgentRun",
     "listAgentRuns",
+    "listPendingProviderRetries",
     "peekNextAgentRunId",
     "getReviewRound",
     "listReviewRuns",
@@ -275,3 +278,21 @@ export function resolveStoreWorkerEnabled(env = process.env) {
     const flag = env.YUI_STORE_WORKER;
     return flag === "1" || flag?.toLowerCase() === "true";
 }
+/**
+ * Resolve whether the persistence worker is enabled, from the Home's verified
+ * manifest (Issue 01). A Home-decided SQLite backend (layout 7, no explicit
+ * `YUI_STORE_BACKEND`) runs the worker by default — that is the product
+ * commitment layout 7 makes. An env-decided SQLite backend keeps the
+ * historical opt-in (`YUI_STORE_WORKER=1`). `YUI_STORE_WORKER=0/false`
+ * disables the worker in both cases (in-process SQLite still applies).
+ */
+export function resolveStoreWorkerEnabledForHome(home, env = process.env) {
+    if (resolveTaskStoreBackendForHome(home, env) !== "sqlite")
+        return false;
+    const flag = env.YUI_STORE_WORKER?.toLowerCase();
+    if (flag === "1" || flag === "true")
+        return true;
+    if (flag === "0" || flag === "false")
+        return false;
+    return env.YUI_STORE_BACKEND?.toLowerCase() !== "sqlite";
+}