agent-tempo 1.7.0 → 2.0.0-beta.2

package/dist/utils/search-attributes.d.ts

@@ -34,9 +34,10 @@ export interface SearchAttributeCarrier {
  *
  * T0.5 (#747): the read-only metadata fields (`gitRoot`, `playerType`,
  * `isConductor`, plus `part`) migrated from search attributes to the workflow
- * memo. The dual-read helpers below prefer the memo (new runs) and fall back
- * to the legacy search attribute (runs started before the v1.8-sa-diet patch)
- * — this file is the single choke point for that migration window.
+ * memo. The memo readers below are now memo-only — #788 pruned the legacy-SA
+ * fallback, since the 2.0 clean cutover (guarded by #786) leaves no pre-v1.8
+ * SA-only run for a 2.0 worker to read. This file is the single choke point
+ * for those reads.
  */
 export interface WorkflowMetaCarrier extends SearchAttributeCarrier {
     memo?: Record<string, unknown>;
@@ -44,7 +45,7 @@ export interface WorkflowMetaCarrier extends SearchAttributeCarrier {
 /**
  * Canonical memo key names (T0.5, #747) — single registry shared by every
  * write site (session workflow, the five `client.workflow.start({ memo })`
- * seeds) and the dual-read helpers below, so a key can never silently
+ * seeds) and the memo readers below, so a key can never silently
  * drift between writer and reader. Wire-stable: renaming a key is a
  * breaking change (docs/WIRE-PROTOCOL.md §Workflow memo).
  *
@@ -59,6 +60,8 @@ export declare const MEMO_KEYS: {
     readonly workDir: "AgentTempoWorkDir";
     readonly agentType: "AgentTempoAgentType";
     readonly gitBranch: "AgentTempoGitBranch";
+    readonly protocol: "AgentTempoProtocol";
+    readonly closeReason: "AgentTempoCloseReason";
 };
 /**
  * Escape a value for use in Temporal visibility query strings — strips
@@ -93,16 +96,24 @@ export declare function getSearchAttrBool(carrier: SearchAttributeCarrier, name:
 export declare function getMemoString(carrier: WorkflowMetaCarrier, name: string): string | undefined;
 /** Read a memo value as a boolean. `undefined` when absent or non-boolean. */
 export declare function getMemoBool(carrier: WorkflowMetaCarrier, name: string): boolean | undefined;
+/** Read a memo value as a number. `undefined` when absent or non-number. */
+export declare function getMemoNumber(carrier: WorkflowMetaCarrier, name: string): number | undefined;
 /**
- * Dual-read a string field: memo first (runs started on or after the
- * v1.8-sa-diet patch), legacy search attribute as fallback (older runs).
+ * #786 — read the 2.0 cutover protocol stamp from a workflow's memo
+ * (`AgentTempoProtocol`). Returns `undefined` for an un-stamped (1.x) workflow.
+ * The boot guard treats any value other than `PROTOCOL_VERSION` (incl.
+ * `undefined`) as un-stamped and refuses to register workers.
+ */
+export declare function getWorkflowProtocol(carrier: WorkflowMetaCarrier): number | undefined;
+/**
+ * Read a string metadata field from the workflow memo.
  *
- * TODO(next major): remove the SA fallback chain here and in
- * {@link getWorkflowMetaBool}, and drop `LEGACY_SEARCH_ATTRIBUTES` in
- * `src/cli/sa-preflight.ts` — see #747 and docs/ops/sa-diet-migration.md.
+ * 2.0 (#788): memo-only. The legacy search-attribute fallback is gone — the
+ * A2 clean cutover (guarded by #786) means no pre-v1.8 SA-only run survives
+ * for a 2.0 worker to read, so every metadata field now lives in the memo.
  */
 export declare function getWorkflowMetaString(carrier: WorkflowMetaCarrier, name: string): string | undefined;
-/** Dual-read a boolean field — memo preferred, SA fallback. */
+/** Read a boolean metadata field from the workflow memo (2.0: memo-only — #788). */
 export declare function getWorkflowMetaBool(carrier: WorkflowMetaCarrier, name: string): boolean | undefined;
 /**
  * Read the attachment phase from `AgentTempoAttachmentState`.
@@ -123,19 +134,18 @@ export declare function getAttachmentPhase(carrier: SearchAttributeCarrier): Att
  */
 export declare function getEnsembleName(carrier: SearchAttributeCarrier): string | undefined;
 /**
- * Read the conductor flag — memo `AgentTempoIsConductor` preferred (T0.5),
- * legacy search attribute as fallback for pre-v1.8 runs.
+ * Read the conductor flag from memo `AgentTempoIsConductor` (T0.5; memo-only
+ * after the #788 legacy-SA prune).
  *
- * Returns `undefined` when absent in both (e.g. transiently un-indexed after
- * a conductor spawn). Callers wanting the pre-#178 workflow-id-suffix
+ * Returns `undefined` when absent (e.g. transiently un-indexed after a
+ * conductor spawn). Callers wanting the pre-#178 workflow-id-suffix
  * fallback (`endsWith('-conductor')`) should apply it on `undefined`.
  */
 export declare function getIsConductor(carrier: WorkflowMetaCarrier): boolean | undefined;
 /**
- * Read the player type — memo `AgentTempoPlayerType` preferred (T0.5),
- * legacy search attribute as fallback for pre-v1.8 runs. Callers keep their
- * existing workflow-id-suffix fallback (`endsWith('-maestro')`) on
- * `undefined`.
+ * Read the player type from memo `AgentTempoPlayerType` (T0.5; memo-only
+ * after the #788 legacy-SA prune). Callers keep their existing
+ * workflow-id-suffix fallback (`endsWith('-maestro')`) on `undefined`.
  */
 export declare function getPlayerType(carrier: WorkflowMetaCarrier): string | undefined;
 /**

package/dist/utils/search-attributes.js

@@ -6,6 +6,8 @@ exports.getSearchAttrString = getSearchAttrString;
 exports.getSearchAttrBool = getSearchAttrBool;
 exports.getMemoString = getMemoString;
 exports.getMemoBool = getMemoBool;
+exports.getMemoNumber = getMemoNumber;
+exports.getWorkflowProtocol = getWorkflowProtocol;
 exports.getWorkflowMetaString = getWorkflowMetaString;
 exports.getWorkflowMetaBool = getWorkflowMetaBool;
 exports.getAttachmentPhase = getAttachmentPhase;
@@ -16,7 +18,7 @@ exports.getPart = getPart;
 /**
  * Canonical memo key names (T0.5, #747) — single registry shared by every
  * write site (session workflow, the five `client.workflow.start({ memo })`
- * seeds) and the dual-read helpers below, so a key can never silently
+ * seeds) and the memo readers below, so a key can never silently
  * drift between writer and reader. Wire-stable: renaming a key is a
  * breaking change (docs/WIRE-PROTOCOL.md §Workflow memo).
  *
@@ -34,6 +36,22 @@ exports.MEMO_KEYS = {
     workDir: 'AgentTempoWorkDir',
     agentType: 'AgentTempoAgentType',
     gitBranch: 'AgentTempoGitBranch',
+    // #786 — 2.0 cutover protocol stamp. A NUMBER memo (`PROTOCOL_VERSION`) written
+    // on every 2.0-created workflow's start input + memo. The daemon boot guard
+    // reads it straight off `workflow.list()` results (memo IS returned there) to
+    // refuse booting against un-stamped 1.x Running runs — no per-workflow query.
+    // Memo, not a search attribute: avoids a 6th Keyword (the #747 SA-diet keeps
+    // us at 5/10) and needs no operator registration. See constants.PROTOCOL_VERSION.
+    protocol: 'AgentTempoProtocol',
+    // #704 — typed terminal close-reason stamped on a workflow's memo when it
+    // COMPLETEs via `destroy` (`'destroyed'`) or the booting attach-timeout
+    // watchdog (`'boot-timeout'`). Survives completion and is readable via
+    // `describe().memo`. The bootstrap orphan-guard (`server.ts`) reads it to
+    // self-tombstone a late-launching orphan process whose run was cancelled,
+    // discriminated by the running-run × close-reason PAIR. A string memo (not a
+    // search attribute): avoids a 6th Keyword (the #747 SA-diet keeps us at 5/10)
+    // and needs no operator registration.
+    closeReason: 'AgentTempoCloseReason',
 };
 /**
  * Escape a value for use in Temporal visibility query strings — strips
@@ -86,7 +104,7 @@ function getSearchAttrBool(carrier, name) {
     }
     return undefined;
 }
-// ── T0.5 (#747) — memo readers + dual-read (memo preferred, SA fallback) ──
+// ── T0.5 (#747) — memo readers (memo-only after the #788 legacy-SA prune) ──
 /** Read a memo value as a string. `undefined` when absent or non-string. */
 function getMemoString(carrier, name) {
     const v = carrier.memo?.[name];
@@ -97,20 +115,33 @@ function getMemoBool(carrier, name) {
     const v = carrier.memo?.[name];
     return typeof v === 'boolean' ? v : undefined;
 }
+/** Read a memo value as a number. `undefined` when absent or non-number. */
+function getMemoNumber(carrier, name) {
+    const v = carrier.memo?.[name];
+    return typeof v === 'number' ? v : undefined;
+}
+/**
+ * #786 — read the 2.0 cutover protocol stamp from a workflow's memo
+ * (`AgentTempoProtocol`). Returns `undefined` for an un-stamped (1.x) workflow.
+ * The boot guard treats any value other than `PROTOCOL_VERSION` (incl.
+ * `undefined`) as un-stamped and refuses to register workers.
+ */
+function getWorkflowProtocol(carrier) {
+    return getMemoNumber(carrier, exports.MEMO_KEYS.protocol);
+}
 /**
- * Dual-read a string field: memo first (runs started on or after the
- * v1.8-sa-diet patch), legacy search attribute as fallback (older runs).
+ * Read a string metadata field from the workflow memo.
  *
- * TODO(next major): remove the SA fallback chain here and in
- * {@link getWorkflowMetaBool}, and drop `LEGACY_SEARCH_ATTRIBUTES` in
- * `src/cli/sa-preflight.ts` — see #747 and docs/ops/sa-diet-migration.md.
+ * 2.0 (#788): memo-only. The legacy search-attribute fallback is gone — the
+ * A2 clean cutover (guarded by #786) means no pre-v1.8 SA-only run survives
+ * for a 2.0 worker to read, so every metadata field now lives in the memo.
  */
 function getWorkflowMetaString(carrier, name) {
-    return getMemoString(carrier, name) ?? getSearchAttrString(carrier, name);
+    return getMemoString(carrier, name);
 }
-/** Dual-read a boolean field — memo preferred, SA fallback. */
+/** Read a boolean metadata field from the workflow memo (2.0: memo-only — #788). */
 function getWorkflowMetaBool(carrier, name) {
-    return getMemoBool(carrier, name) ?? getSearchAttrBool(carrier, name);
+    return getMemoBool(carrier, name);
 }
 // ── Typed wrappers for agent-tempo's custom search attributes ──
 //
@@ -140,21 +171,20 @@ function getEnsembleName(carrier) {
     return getSearchAttrString(carrier, 'AgentTempoEnsemble');
 }
 /**
- * Read the conductor flag — memo `AgentTempoIsConductor` preferred (T0.5),
- * legacy search attribute as fallback for pre-v1.8 runs.
+ * Read the conductor flag from memo `AgentTempoIsConductor` (T0.5; memo-only
+ * after the #788 legacy-SA prune).
  *
- * Returns `undefined` when absent in both (e.g. transiently un-indexed after
- * a conductor spawn). Callers wanting the pre-#178 workflow-id-suffix
+ * Returns `undefined` when absent (e.g. transiently un-indexed after a
+ * conductor spawn). Callers wanting the pre-#178 workflow-id-suffix
  * fallback (`endsWith('-conductor')`) should apply it on `undefined`.
  */
 function getIsConductor(carrier) {
     return getWorkflowMetaBool(carrier, exports.MEMO_KEYS.isConductor);
 }
 /**
- * Read the player type — memo `AgentTempoPlayerType` preferred (T0.5),
- * legacy search attribute as fallback for pre-v1.8 runs. Callers keep their
- * existing workflow-id-suffix fallback (`endsWith('-maestro')`) on
- * `undefined`.
+ * Read the player type from memo `AgentTempoPlayerType` (T0.5; memo-only
+ * after the #788 legacy-SA prune). Callers keep their existing
+ * workflow-id-suffix fallback (`endsWith('-maestro')`) on `undefined`.
  */
 function getPlayerType(carrier) {
     return getWorkflowMetaString(carrier, exports.MEMO_KEYS.playerType);

package/dist/utils/visibility-deadline.d.ts

@@ -100,6 +100,22 @@ export declare const VISIBILITY_DEADLINES_MS: {
      * enough to amortize partial scans across many sweeps.
      */
     readonly orphanQueryCleanup: 30000;
+    /**
+     * #786 — `checkProtocolGuard` daemon boot scan. Walks every Running
+     * agent-tempo workflow (the 4 workflow types) reading only the
+     * `AgentTempoProtocol` memo straight off the visibility page — NO
+     * per-workflow query, so it's pure page iteration and far cheaper than
+     * the orphan scan. 30s is generous headroom for a large-but-healthy
+     * namespace (page-streaming even thousands of rows completes in
+     * seconds) while still bounding a wedged visibility backend.
+     *
+     * **Load-bearing: this budget is FAIL-CLOSED.** A timeout here does NOT
+     * yield a best-effort partial — the guard treats an unfinished scan as
+     * "couldn't prove the cutover is clean" and REFUSES to boot (the #845
+     * partial-scan lesson: a 2.0 worker that replays a 1.x history corrupts
+     * deterministically, so an unverified scan must never be read as clean).
+     */
+    readonly protocolGuardBoot: 30000;
 };
 export type VisibilitySite = keyof typeof VISIBILITY_DEADLINES_MS;
 /**

package/dist/utils/visibility-deadline.js

@@ -55,6 +55,22 @@ exports.VISIBILITY_DEADLINES_MS = {
      * enough to amortize partial scans across many sweeps.
      */
     orphanQueryCleanup: 30_000,
+    /**
+     * #786 — `checkProtocolGuard` daemon boot scan. Walks every Running
+     * agent-tempo workflow (the 4 workflow types) reading only the
+     * `AgentTempoProtocol` memo straight off the visibility page — NO
+     * per-workflow query, so it's pure page iteration and far cheaper than
+     * the orphan scan. 30s is generous headroom for a large-but-healthy
+     * namespace (page-streaming even thousands of rows completes in
+     * seconds) while still bounding a wedged visibility backend.
+     *
+     * **Load-bearing: this budget is FAIL-CLOSED.** A timeout here does NOT
+     * yield a best-effort partial — the guard treats an unfinished scan as
+     * "couldn't prove the cutover is clean" and REFUSES to boot (the #845
+     * partial-scan lesson: a 2.0 worker that replays a 1.x history corrupts
+     * deterministically, so an unverified scan must never be read as clean).
+     */
+    protocolGuardBoot: 30_000,
 };
 /**
  * Thrown by {@link iterateWithDeadline} when the per-iterator deadline

package/dist/workflows/maestro-signals.d.ts

@@ -172,19 +172,6 @@ export declare const maestroEnsemblesQuery: import("@temporalio/workflow").Query
 export declare const maestroPlayersByEnsembleQuery: import("@temporalio/workflow").QueryDefinition<Record<string, MaestroPlayerInfo[]>, [], string>;
 /** Get recent messages across all ensembles (ring buffer, max 500). */
 export declare const maestroRecentMessagesQuery: import("@temporalio/workflow").QueryDefinition<MaestroRelayMessage[], [], string>;
-/**
- * #274 — the `hostname → HostProfile` map maintained by the global maestro.
- *
- * Returned as a plain `Record<string, HostProfile>` (not a `Map`) so the
- * default Temporal payload converter serializes it without a codec tweak.
- * The `src/utils/hosts.ts` join helper consumes this and reconstructs a
- * `Map`-shaped view at the consumer boundary if callers find it useful.
- *
- * Consumers MUST treat the returned profiles as opaque beyond the
- * `hostname` field — per-field validation happens at the join site, not
- * at query time.
- */
-export declare const hostProfilesQuery: import("@temporalio/workflow").QueryDefinition<Record<string, HostProfile>, [], string>;
 /**
  * #280 — combined existence + profiles query.
  *

package/dist/workflows/maestro-signals.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maestroGlobalSendCommandUpdate = exports.maestroFetchConductorHistoryUpdate = exports.maestroFetchPlayerMessagesUpdate = exports.maestroSendMessageUpdate = exports.hostProfilesWithExistenceQuery = exports.hostProfilesQuery = exports.maestroRecentMessagesQuery = exports.maestroPlayersByEnsembleQuery = exports.maestroEnsemblesQuery = exports.hostProfileSignal = exports.maestroNotifyMessageSignal = exports.maestroGetAnswerQuery = exports.maestroPostAnswerUpdate = exports.coatCheckEvictUpdate = exports.coatCheckListQuery = exports.coatCheckGetUpdate = exports.coatCheckPutUpdate = exports.maestroSendCommandUpdate = exports.getTempoSeriesQuery = exports.getCurrentBpmQuery = exports.getEnsembleStartTimeQuery = exports.getEnsembleDescriptionQuery = exports.maestroEnsembleChatQuery = exports.maestroPendingCommandsQuery = exports.maestroPausedQuery = exports.maestroEventsQuery = exports.maestroPlayersQuery = exports.setEnsembleDescriptionSignal = exports.maestroSetPausedSignal = exports.maestroShutdownSignal = exports.ZERO_CHAT_HIGH_WATER = void 0;
+exports.maestroGlobalSendCommandUpdate = exports.maestroFetchConductorHistoryUpdate = exports.maestroFetchPlayerMessagesUpdate = exports.maestroSendMessageUpdate = exports.hostProfilesWithExistenceQuery = exports.maestroRecentMessagesQuery = exports.maestroPlayersByEnsembleQuery = exports.maestroEnsemblesQuery = exports.hostProfileSignal = exports.maestroNotifyMessageSignal = exports.maestroGetAnswerQuery = exports.maestroPostAnswerUpdate = exports.coatCheckEvictUpdate = exports.coatCheckListQuery = exports.coatCheckGetUpdate = exports.coatCheckPutUpdate = exports.maestroSendCommandUpdate = exports.getTempoSeriesQuery = exports.getCurrentBpmQuery = exports.getEnsembleStartTimeQuery = exports.getEnsembleDescriptionQuery = exports.maestroEnsembleChatQuery = exports.maestroPendingCommandsQuery = exports.maestroPausedQuery = exports.maestroEventsQuery = exports.maestroPlayersQuery = exports.setEnsembleDescriptionSignal = exports.maestroSetPausedSignal = exports.maestroShutdownSignal = exports.ZERO_CHAT_HIGH_WATER = void 0;
 const workflow_1 = require("@temporalio/workflow");
 var types_1 = require("../types");
 Object.defineProperty(exports, "ZERO_CHAT_HIGH_WATER", { enumerable: true, get: function () { return types_1.ZERO_CHAT_HIGH_WATER; } });
@@ -127,19 +127,11 @@ exports.maestroEnsemblesQuery = (0, workflow_1.defineQuery)('maestroEnsembles');
 exports.maestroPlayersByEnsembleQuery = (0, workflow_1.defineQuery)('maestroPlayersByEnsemble');
 /** Get recent messages across all ensembles (ring buffer, max 500). */
 exports.maestroRecentMessagesQuery = (0, workflow_1.defineQuery)('maestroRecentMessages');
-/**
- * #274 — the `hostname → HostProfile` map maintained by the global maestro.
- *
- * Returned as a plain `Record<string, HostProfile>` (not a `Map`) so the
- * default Temporal payload converter serializes it without a codec tweak.
- * The `src/utils/hosts.ts` join helper consumes this and reconstructs a
- * `Map`-shaped view at the consumer boundary if callers find it useful.
- *
- * Consumers MUST treat the returned profiles as opaque beyond the
- * `hostname` field — per-field validation happens at the join site, not
- * at query time.
- */
-exports.hostProfilesQuery = (0, workflow_1.defineQuery)('hostProfiles');
+// 2.0 (#788): the legacy `hostProfilesQuery` ('hostProfiles') was removed —
+// superseded by `hostProfilesWithExistenceQuery` below, which folds the
+// running-check + profiles into a single round-trip. Every consumer uses the
+// WithExistence form. Consumers MUST still treat the returned profiles as
+// opaque beyond the `hostname` field (validation happens at the join site).
 /**
  * #280 — combined existence + profiles query.
  *

package/dist/workflows/maestro.js

@@ -4,6 +4,8 @@ exports.resolveRefreshIntervalMs = resolveRefreshIntervalMs;
 exports.agentMaestroWorkflow = agentMaestroWorkflow;
 exports.agentGlobalMaestroWorkflow = agentGlobalMaestroWorkflow;
 const workflow_1 = require("@temporalio/workflow");
+const search_attributes_1 = require("../utils/search-attributes");
+const constants_1 = require("../constants");
 /**
  * Workflow-deterministic clock — mirrors the helper in `src/workflows/session.ts`.
  *
@@ -30,7 +32,7 @@ const validation_1 = require("../utils/validation");
 // ── Activity Proxies ──
 // Only proxy activities actually used in the workflow.
 // fetchConductorHistory is available in the activities but reserved for Phase 2 (TUI).
-const { refreshEnsembleState, refreshEnsembleStateV2, relayCommandToConductor, fetchEnsembleChat } = (0, workflow_1.proxyActivities)({
+const { refreshEnsembleStateV2, relayCommandToConductor, fetchEnsembleChat } = (0, workflow_1.proxyActivities)({
     startToCloseTimeout: '30 seconds',
     retry: { maximumAttempts: 3 },
 });
@@ -79,15 +81,16 @@ const TEMPO_BPM_WINDOW_MS = 60_000;
 // Per-Ensemble Maestro (existing — unchanged)
 // ══════════════════════════════════════════════════════════════════════════════
 async function agentMaestroWorkflow(input) {
-    (0, workflow_1.patched)('v0.17-initial');
+    // #786 — 2.0 cutover protocol stamp (see constants.PROTOCOL_VERSION). Memo,
+    // re-upserted every run incl. CAN successors, so the daemon boot guard sees
+    // every Running 2.0 maestro as stamped; a 1.x maestro never runs this → its
+    // memo is undefined → guard refuses. Unconditional — #786 is first on the 2.0
+    // line, no pre-stamp v2 histories to protect.
+    (0, workflow_1.upsertMemo)({ [search_attributes_1.MEMO_KEYS.protocol]: constants_1.PROTOCOL_VERSION });
     // T0.1 (#748) — input-driven, NOT patched-gated: pre-#748 runs have no
     // costProfile field, so they resolve to the legacy 5s default and the V1
     // refresh activity — identical commands on replay.
     const cloudProfile = input.costProfile === 'cloud';
-    // T0.6 (#760) — the chat gate NEEDS a marker (unlike T0.1's V2 switch):
-    // post-#759 cloud maestros recorded chat-fetch activities on unwatched
-    // ticks, so skipping those without a marker would mismatch their replay.
-    const chatGateEnabled = (0, workflow_1.patched)('v1.8-t06-chat-gate');
     let refreshIntervalMs = resolveRefreshIntervalMs(input, /* observersPresent */ true);
     let players = input.players ?? [];
     const events = input.events ?? [];
@@ -461,16 +464,16 @@ async function agentMaestroWorkflow(input) {
             // activity: SA/memo-based ensemble-scoped scan + the daemon's SSE
             // observer presence, which drives next tick's cadence (20s watched /
             // 60s unwatched via resolveRefreshIntervalMs).
-            let newPlayers;
+            // 2.0 (#788): single refresh activity (V2). It honors the daemon cost
+            // profile internally (cloud → SA/memo scan, local → legacy scan) and
+            // returns `observersPresent`. Only the cloud profile uses presence to
+            // stretch the refresh cadence; local keeps its fixed interval.
+            const v2 = await refreshEnsembleStateV2({ ensemble: input.ensemble });
+            const newPlayers = v2.players;
+            observersPresent = v2.observersPresent;
             if (cloudProfile) {
-                const v2 = await refreshEnsembleStateV2({ ensemble: input.ensemble });
-                newPlayers = v2.players;
-                observersPresent = v2.observersPresent;
                 refreshIntervalMs = resolveRefreshIntervalMs(input, observersPresent);
             }
-            else {
-                newPlayers = await refreshEnsembleState(input.ensemble);
-            }
             const nowDate = workflowNow();
             const now = nowDate.toISOString();
             const nowMs = nowDate.getTime();
@@ -563,14 +566,10 @@ async function agentMaestroWorkflow(input) {
         // the maestro's cache — so an unwatched ensemble loses nothing;
         // staleness inherits the accepted T0.1 cadence-stretch contract (the
         // first watched tick re-fetches from the durable high-water marks).
-        // Gated behind its own patched marker: post-#759 cloud maestros have
-        // chat activities RECORDED on unwatched ticks, so an ungated skip
-        // would be a replay command mismatch (input-driven gating only
-        // protects pre-#748 runs — verified, contra the initial "no marker
-        // expected" estimate).
-        if ((0, workflow_1.patched)('v0.19-ensemble-chat')) {
+        // (2.0: was patched()-gated for 1.x replay determinism; now unconditional — #787.)
+        {
             // Unwatched cloud tick → skip; cache + high-water marks stay untouched.
-            const skipChatThisTick = chatGateEnabled && cloudProfile && !observersPresent;
+            const skipChatThisTick = cloudProfile && !observersPresent;
             if (!skipChatThisTick) {
                 try {
                     const chatResult = await fetchEnsembleChat({
@@ -710,7 +709,10 @@ const globalActivities = (0, workflow_1.proxyActivities)({
     retry: { maximumAttempts: 3 },
 });
 async function agentGlobalMaestroWorkflow(input) {
-    (0, workflow_1.patched)('v0.18-global-maestro');
+    // #786 — 2.0 cutover protocol stamp (the namespace-wide global maestro is
+    // stamped too, so the boot guard's scan never sees it as un-stamped). See
+    // constants.PROTOCOL_VERSION + agentMaestroWorkflow's stamp note.
+    (0, workflow_1.upsertMemo)({ [search_attributes_1.MEMO_KEYS.protocol]: constants_1.PROTOCOL_VERSION });
     // T0.1 (#748) — input-driven (see agentMaestroWorkflow): pre-#748 runs
     // have no costProfile field → legacy 5s + V1 refresh, identical commands.
     const cloudProfile = input.costProfile === 'cloud';
@@ -774,8 +776,6 @@ async function agentGlobalMaestroWorkflow(input) {
     (0, workflow_1.setHandler)(maestro_signals_1.maestroRecentMessagesQuery, () => recentMessages);
     (0, workflow_1.setHandler)(maestro_signals_1.maestroEventsQuery, () => events);
     (0, workflow_1.setHandler)(maestro_signals_1.maestroPendingCommandsQuery, () => pendingCommands);
-    // Return a defensive copy so callers can't mutate workflow state.
-    (0, workflow_1.setHandler)(maestro_signals_1.hostProfilesQuery, () => ({ ...hostProfiles }));
     // #280 — combined query: reaching this handler proves the workflow is
     // running, so `exists` is always `true` here. Callers infer "missing"
     // by catching transport-level errors (workflow not found, etc.).
@@ -889,15 +889,10 @@ async function agentGlobalMaestroWorkflow(input) {
         let observersPresent = true;
         for (const ensemble of knownEnsembles) {
             try {
-                let newPlayers;
-                if (cloudProfile) {
-                    const v2 = await globalActivities.refreshEnsembleStateV2({ ensemble });
-                    newPlayers = v2.players;
-                    observersPresent = v2.observersPresent;
-                }
-                else {
-                    newPlayers = await globalActivities.refreshEnsembleState(ensemble);
-                }
+                // 2.0 (#788): single refresh activity (V2) — see the per-ensemble note above.
+                const v2 = await globalActivities.refreshEnsembleStateV2({ ensemble });
+                const newPlayers = v2.players;
+                observersPresent = v2.observersPresent;
                 const oldPlayers = playersByEnsemble[ensemble] ?? [];
                 const now = new Date().toISOString();
                 // Diff snapshots to generate events

package/dist/workflows/scheduler.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentSchedulerWorkflow = agentSchedulerWorkflow;
 const workflow_1 = require("@temporalio/workflow");
+const search_attributes_1 = require("../utils/search-attributes");
+const constants_1 = require("../constants");
 const scheduler_signals_1 = require("./scheduler-signals");
 const { fireSchedule, computeNextCronFire } = (0, workflow_1.proxyActivities)({
     startToCloseTimeout: '30 seconds',
@@ -10,6 +12,10 @@ const { fireSchedule, computeNextCronFire } = (0, workflow_1.proxyActivities)({
 /** Default self-termination grace period — 30 000 ms (see §scheduler "empty self-terminate"). */
 const DEFAULT_GRACE_PERIOD_MS = 30_000;
 async function agentSchedulerWorkflow(input) {
+    // #786 — 2.0 cutover protocol stamp (see constants.PROTOCOL_VERSION). Memo,
+    // re-upserted every run incl. CAN, so the boot guard sees every Running 2.0
+    // scheduler as stamped; a 1.x scheduler never runs this → guard refuses.
+    (0, workflow_1.upsertMemo)({ [search_attributes_1.MEMO_KEYS.protocol]: constants_1.PROTOCOL_VERSION });
     let entries = input.entries ?? [];
     let dirty = false; // flag to wake the loop when signals arrive
     let schedulerPaused = input.paused ?? false;
@@ -126,7 +132,7 @@ async function agentSchedulerWorkflow(input) {
             else if (entry.type === 'interval' && entry.interval) {
                 entry.nextFireAt = new Date(Date.now() + entry.interval).toISOString();
             }
-            else if ((0, workflow_1.patched)('v0.12-cron-schedule') && entry.type === 'cron' && entry.cronExpression) {
+            else if (entry.type === 'cron' && entry.cronExpression) {
                 const nextFire = await computeNextCronFire({
                     cronExpression: entry.cronExpression,
                     timezone: entry.timezone,