ai-foreman 1.7.19 → 1.7.21

package/dist/workflowDb.js

@@ -1,11 +1,25 @@
+import { registerQaGraphJournalWriter, ensureQaGraphJournalGuards } from "./qaDeliveryJournal.js";
+import { canonicalJson } from "./qaProtocolV2.js";
+import { resolveEffectiveQaConfiguration } from "./qaEffectiveConfig.js";
+import { registerGraphDerived, graphDerivedAllowed, currentGraphDerivedAccess } from "./graph/derived.js";
+import { parseContractCoverage, validateContractCoverage } from "./qaContractCoverage.js";
+import { QaPreparationStore, migrateQaPreparation, migrateQaPreparationGuards } from "./qaPreparationStore.js";
+import { GraphStore, migrateGraphStore } from "./graph/storage.js";
+import { reconcileWork } from "./buildWorkReconciliation.js";
+import { migrateBuildInterventions, hasQueuedBuilderGuidance, reconcileGuidance, decisionWorkId, queuedControls, completeControl, verifyGuidance, builderVerificationContext, verifyBuilderGuidance, assertFinalizationControls, reserveGuidance, finishGuidance, instruction } from "./buildInterventions.js";
+import { migrateBuildWork } from "./buildWorkMigration.js";
+import { admitWork, admittedWork, assertAdmittedWork } from "./buildWorkAdmission.js";
+import { cleanupReadiness, inspectReadiness, readinessMetadata } from "./readinessCleanup.js";
+import { originalBuildLease, rememberOriginalLease, forgetOriginalLease, registerLaunchChild, acknowledgeLaunchChild, reconcileLaunch, checkBuildOwnershipSchema, canonicalProject, launchDigest, localBuildAuthority, rememberBuildAuthority, forgetBuildAuthority, migrateBuildAdmission, acquireAdmission, readAdmission, assertAdmission, releaseAdmission, reserveLaunch, setLaunchState, claimLaunch, readLaunch } from "./buildAdmission.js";
 import { createHash, randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import Database from "better-sqlite3";
+import { validateQaFailureReport } from "rafi-spec";
 import { migrateQaHandback, registerHandbackWriter, reportOccurrenceId } from "./qaHandbackMigration.js";
 import { providerSessionKey } from "./sessionIdentity.js";
-import { processStartIdentity } from "./processIdentity.js";
+import { taggedProcesses, classifyProcess, processStartIdentity } from "./processIdentity.js";
 import { initialQaReducerState, qaDigest, reduceQaState, } from "./qaProtocolV2.js";
 export const WORKFLOW_DB_FILE = ".rafi/recovery.sqlite3";
 /** Read the current project lease without creating or migrating recovery state. */
@@ -34,6 +48,7 @@ export function heartbeatCurrentWorkflowLease(projectDir, lease, now = new Date(
     if (!existsSync(path))
         throw new Error("workflow recovery database not found");
     const db = new Database(path, { fileMustExist: true });
+    db.function("rafi_protocol_v3", () => 1);
     registerHandbackWriter(db);
     try {
         const at = now.toISOString();
@@ -50,30 +65,617 @@ export function heartbeatCurrentWorkflowLease(projectDir, lease, now = new Date(
 /** Authoritative persistence for every resumable workflow in a project. */
 export class WorkflowDb {
     projectDir;
+    readinessAccess;
     path;
     db;
-    constructor(projectDir, path = join(resolve(projectDir), WORKFLOW_DB_FILE)) {
+    writerAuthority;
+    writerLease;
+    coordinatorTransition = 0;
+    lineageTransition = 0;
+    workAuthority = 0;
+    constructor(projectDir, path = join(resolve(projectDir), WORKFLOW_DB_FILE), readinessAccess) {
         this.projectDir = projectDir;
+        this.readinessAccess = readinessAccess;
         this.path = path;
-        mkdirSync(dirname(path), { recursive: true });
-        ensureRecoveryGitignore(resolve(projectDir));
-        this.db = new Database(path);
+        if (existsSync(path)) {
+            const preview = new Database(path, { readonly: true, fileMustExist: true });
+            try {
+                checkBuildOwnershipSchema(preview);
+            }
+            finally {
+                preview.close();
+            }
+        }
+        if (!readinessAccess) {
+            mkdirSync(dirname(path), { recursive: true });
+            ensureRecoveryGitignore(resolve(projectDir));
+        }
+        this.db = new Database(path, { fileMustExist: Boolean(readinessAccess) });
+        this.db.function("rafi_protocol_v3", () => 1);
+        this.writerAuthority = localBuildAuthority(projectDir);
+        this.writerLease = originalBuildLease(projectDir);
+        this.db.function("rafi_build_lease_owner", () => this.writerLease?.owner ?? "");
+        this.db.function("rafi_build_lease_generation", () => this.writerLease?.generation ?? -1);
+        this.db.function("rafi_build_writer_token", () => this.writerAuthority?.token ?? "");
+        this.db.function("rafi_build_writer_run", () => this.writerAuthority?.runId ?? "");
+        this.db.function("rafi_work_authority", () => this.workAuthority);
         registerHandbackWriter(this.db);
-        this.db.pragma("journal_mode = WAL");
+        registerQaGraphJournalWriter(this.db);
+        if (!readinessAccess)
+            this.db.pragma("journal_mode = WAL");
         this.db.pragma("synchronous = FULL");
         this.db.pragma("foreign_keys = ON");
         try {
-            this.migrate();
-            this.importLegacyOnce();
+            if (readinessAccess)
+                this.restrictReadinessConnection(readinessAccess);
+            else {
+                this.migrate();
+                migrateQaPreparation(this.db);
+                migrateBuildAdmission(this.db);
+                this.importLegacyOnce();
+                migrateBuildWork(this.db, projectDir);
+                migrateBuildInterventions(this.db);
+                migrateQaPreparationGuards(this.db);
+            }
         }
         catch (error) {
             this.db.close();
             throw error;
         }
     }
+    /** Connection-local SQL fences: helper/reconciler cannot gain general writer rights. */
+    restrictReadinessConnection(access) {
+        const value = "probeId" in access ? access.probeId : access.runId;
+        const literal = this.db.prepare("SELECT quote(?) AS literal").get(value).literal;
+        for (const { name } of this.db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all()) {
+            if (!/^[a-z_]+$/.test(name))
+                throw new Error("Unexpected readiness storage table");
+            for (const action of ["INSERT", "UPDATE", "DELETE"]) {
+                const allowed = name === "build_owned_processes" && action === "UPDATE";
+                const condition = allowed ? `WHEN OLD.${"probeId" in access ? "id" : "run_id"}<>${literal} OR NEW.id<>OLD.id OR NEW.run_id<>OLD.run_id OR NEW.owner<>OLD.owner OR NEW.host<>OLD.host` : "";
+                this.db.exec(`CREATE TEMP TRIGGER readiness_scope_${name}_${action} BEFORE ${action} ON main.${name} ${condition} BEGIN SELECT RAISE(ABORT,'Restricted readiness connection cannot mutate this record'); END`);
+            }
+        }
+    }
     close() { this.db.close(); }
+    qaPreparationStore() { return new QaPreparationStore(this.db, runId => this.assertInstructionOwner(runId), this.projectDir); }
+    graphStore() { migrateGraphStore(this.db); return new GraphStore(this.db); }
+    admitWork(input) {
+        this.assertInstructionOwner(input.runId);
+        this.workAuthority++;
+        try {
+            const result = admitWork(this.db, input);
+            this.qaPreparationStore().metric(input.runId, result.workId, result.requirementsDigest, `metric:approved:${input.runId}:${result.workId}:${result.requirementsDigest}`, "approved");
+            return result;
+        }
+        finally {
+            this.workAuthority--;
+        }
+    }
+    assertInstructionOwner(runId) {
+        if (this.writerAuthority) {
+            assertAdmission(this.db, this.writerAuthority);
+            if (this.writerAuthority.runId !== runId && !this.db.prepare("SELECT 1 FROM build_child_runs WHERE child=? AND parent=?").get(runId, this.writerAuthority.runId))
+                throw new Error("Instruction execution authority belongs to another run");
+            return;
+        }
+        if (this.buildAdmission())
+            throw new Error("Instruction consumption requires the original build owner");
+        if (this.db.prepare("SELECT 1 FROM build_runtime_runs WHERE run_id=?").get(runId)) {
+            const held = this.currentLease();
+            if (!held || !this.writerLease || held.owner !== this.writerLease.owner || held.generation !== this.writerLease.generation || held.runId !== runId)
+                throw new Error("Instruction execution requires the original workflow lease");
+        }
+    }
+    reserveGuidance(runId, workId, recipient, operationId, sourceDigest, text, reserve = true) {
+        this.assertInstructionOwner(runId);
+        return reserveGuidance(this.db, runId, workId, recipient, operationId, sourceDigest, text, reserve);
+    }
+    reconcileInstructionDeliveries(runId, workId) { this.assertInstructionOwner(runId); this.atomic(() => reconcileGuidance(this.db, runId, workId)); }
+    decisionWorkId(decision) { return decisionWorkId(this.db, decision); }
+    finishGuidance(ids, recipient, result) { for (const id of ids)
+        this.assertInstructionOwner(instruction(this.db, id).request.runId); finishGuidance(this.db, ids, recipient, result); }
+    builderVerificationContext(runId, workId, sourceDigest) { return builderVerificationContext(this.db, runId, workId, sourceDigest); }
+    verifyBuilderGuidance(ids, certificate, response, receiptDigest) { for (const id of ids)
+        this.assertInstructionOwner(instruction(this.db, id).request.runId); return this.atomic(() => verifyBuilderGuidance(this.db, ids, certificate, response, receiptDigest)); }
+    verifyGuidance(ids, certificate, response) { for (const id of ids)
+        this.assertInstructionOwner(instruction(this.db, id).request.runId); return this.atomic(() => verifyGuidance(this.db, ids, certificate, response)); }
+    hasQueuedBuilderGuidance(runId, workId) { return hasQueuedBuilderGuidance(this.db, runId, workId); }
+    instruction(id) { return instruction(this.db, id); }
+    assertFinalizationControls(runId, workId) { assertFinalizationControls(this.db, runId, workId); }
+    consumeInstructionControls(runId, workId, kind = "questions") {
+        return this.atomic(() => {
+            this.assertInstructionOwner(runId);
+            const admission = this.assertAdmittedWork(runId, workId);
+            const latestReview = this.qaReviewAttempts(runId, workId).at(-1);
+            let authorization = kind === "attempts" && latestReview && ["failed", "passed"].includes(latestReview.status) ? this.db.prepare("SELECT a.authorization_id FROM qa_remediation_authorizations a JOIN build_instruction_deliveries d ON json_extract(d.record_json,'$.receipt.authorizationId')=a.authorization_id JOIN build_instructions i USING(instruction_id) WHERE a.run_id=? AND a.ticket_id=? AND a.review_attempt_id=? AND a.consumed_by IS NULL AND d.state='applied' AND json_extract(i.record_json,'$.requirementsDigest')=? AND json_extract(i.record_json,'$.basis.assignmentId')=? AND json_extract(i.record_json,'$.basis.scopeRevision')=? ORDER BY i.sequence LIMIT 1").get(runId, workId, latestReview.attemptId, admission.requirementsDigest, admission.assignmentId, admission.scopeRevision)?.authorization_id : undefined;
+            if (authorization) {
+                const head = this.qaTicketHead(runId, workId);
+                const eligible = latestReview?.status === "passed"
+                    ? head.state === "passed" && this.hasQueuedBuilderGuidance(runId, workId)
+                    : head.state === "review-failed" && this.unresolvedQaReports(runId, workId).some(report => report.reviewNumber === latestReview.reviewNumber && report.reportDigest === latestReview.reportDigest);
+                if (!eligible)
+                    authorization = undefined;
+            }
+            for (const record of queuedControls(this.db, runId, workId).filter(record => kind === "questions" ? record.request.action === "answer_question" : record.request.action === "request_attempt")) {
+                const priorAuthorization = authorization;
+                try {
+                    this.atomic(() => {
+                        if (record.requirementsDigest !== admission.requirementsDigest)
+                            throw new Error("Instruction requirements are stale");
+                        if (record.request.action === "answer_question") {
+                            const decision = this.humanDecision(record.request.decisionId);
+                            if (!decision || decision.runId !== runId || this.decisionWorkId(decision) !== workId || createHash("sha256").update(json(decision)).digest("hex") !== record.request.decisionRevision)
+                                throw new Error("Pending question identity or revision changed");
+                            const choice = decision.choices.find(choice => choice.id === record.request.text || choice.label === record.request.text) ?? decision.choices.find(choice => choice.id === "custom" || choice.id === "answer");
+                            if (!choice)
+                                throw new Error("Answer must name an offered choice or use a question accepting custom text");
+                            const answer = this.answerHumanDecision(runId, decision.decisionId, choice.id, new Date(), choice.id === "custom" || choice.id === "answer" ? record.request.text : undefined);
+                            completeControl(this.db, record.instructionId, { decisionId: answer.decisionId, status: answer.status });
+                        }
+                        else {
+                            const latest = this.qaReviewAttempts(runId, workId).at(-1);
+                            if (!latest || !["failed", "passed"].includes(latest.status) || latest.attemptId !== record.basis.reviewAttemptId || authorization)
+                                throw new Error("One extra attempt requires the current eligible review; another authorization is already available");
+                            if (record.basis.assignmentId !== admission.assignmentId || record.basis.scopeRevision !== admission.scopeRevision)
+                                throw new Error("Attempt authorization scope changed");
+                            const head = this.qaTicketHead(runId, workId);
+                            if (latest.status === "passed") {
+                                if (head.state !== "passed" || !this.hasQueuedBuilderGuidance(runId, workId))
+                                    throw new Error("Follow-up authorization requires waiting Builder guidance on the current unfinalized pass");
+                                authorization = this.authorizeQaRemediation(runId, workId, latest.attemptId, record.request.text);
+                                completeControl(this.db, record.instructionId, { authorizationId: authorization, reviewAttemptId: latest.attemptId, consumed: false, kind: "builder-guidance-followup" });
+                                return;
+                            }
+                            const report = this.unresolvedQaReports(runId, workId).find(report => report.reviewNumber === latest.reviewNumber && report.reportDigest === latest.reportDigest && report.sourceStateDigest === latest.sourceDigest && report.reviewBasisDigest === head.reviewBasisDigest);
+                            if (!report || !validateQaFailureReport(report.report).valid || head.reviewNumber !== latest.reviewNumber || head.sourceStateDigest !== latest.sourceDigest || !["review-failed", "operator-menu"].includes(head.state) || this.qaRemediationAttempts(runId, workId).some(attempt => attempt.reviewAttemptId === latest.attemptId))
+                                throw new Error("Extra attempt requires an unconsumed validated failed-review basis; reconcile uncertain execution separately");
+                            const decisions = this.db.prepare("SELECT decision_id,status,decision_json FROM human_decisions WHERE run_id=? AND decision_key LIKE ?").all(runId, `${runId}:qa-nonconvergence:%`).filter(row => this.decisionWorkId(parseJson(row.decision_json)) === workId && parseJson(row.decision_json).createdAt >= latest.createdAt);
+                            if (decisions.some(row => row.status === "answered"))
+                                throw new Error("The nonconvergence decision was already answered; resume that decision before requesting another attempt");
+                            authorization = this.authorizeQaRemediation(runId, workId, latest.attemptId, record.request.text);
+                            for (const row of decisions.filter(row => row.status === "pending")) {
+                                const decision = parseJson(row.decision_json);
+                                const at = new Date().toISOString();
+                                this.db.prepare("UPDATE human_decisions SET status='cancelled',decision_json=?,updated_at=? WHERE decision_id=? AND status='pending'").run(json({ ...decision, status: "cancelled", cancellationReason: `Superseded by scoped attempt instruction ${record.instructionId}`, cancelledAt: at }), at, row.decision_id);
+                                this.insertEvent(runId, "human_decision_cancelled", "attempt-authorized", { decisionId: row.decision_id, instructionId: record.instructionId }, at);
+                            }
+                            if (head.state === "operator-menu")
+                                this.transitionQa(runId, workId, head.revision, { type: "failed-review-restored", reviewNumber: latest.reviewNumber, sourceStateDigest: latest.sourceDigest, reportDigest: report.reportDigest });
+                            completeControl(this.db, record.instructionId, { authorizationId: authorization, reviewAttemptId: latest.attemptId, consumed: false });
+                        }
+                    });
+                }
+                catch (error) {
+                    authorization = priorAuthorization;
+                    completeControl(this.db, record.instructionId, undefined, String(error));
+                }
+            }
+            return authorization;
+        });
+    }
+    reconcileWork(request, input) {
+        this.assertInstructionOwner(request.runId);
+        if (this.writerAuthority)
+            assertAdmission(this.db, this.writerAuthority);
+        this.workAuthority++;
+        try {
+            return this.atomic(() => reconcileWork(this.db, request, input));
+        }
+        finally {
+            this.workAuthority--;
+        }
+    }
+    reconciliation(id) {
+        const row = this.db.prepare("SELECT record_json FROM build_reconciliations WHERE reconciliation_id=?").get(id);
+        return row ? JSON.parse(row.record_json) : undefined;
+    }
+    workDefinitions(runId) {
+        return this.db.prepare("SELECT work_id,kind,definition_json FROM build_work_scope WHERE run_id=? AND state='admitted' ORDER BY rowid").all(runId).map(row => ({ workId: row.work_id, kind: row.kind, definition: JSON.parse(row.definition_json) }));
+    }
+    recordWorkAssignment(runId, workId, operationId, record) {
+        this.assertInstructionOwner(runId);
+        const admission = this.assertAdmittedWork(runId, workId);
+        this.qaPreparationStore().metric(runId, workId, admission.requirementsDigest, `metric:started:${runId}:${workId}:${admission.requirementsDigest}`, "implementation-started");
+        this.workAuthority++;
+        try {
+            this.db.prepare("INSERT INTO build_assignments VALUES(?,?,?,?,?)").run(operationId, runId, workId, operationId, json(record));
+        }
+        finally {
+            this.workAuthority--;
+        }
+    }
+    admittedWork(runId, workId) { return admittedWork(this.db, runId, workId); }
+    assertAdmittedWork(runId, workId) { return assertAdmittedWork(this.db, runId, workId); }
     /** Atomic local changes only; never await provider or filesystem work here. */
     atomic(work) { return this.db.transaction(work).immediate(); }
+    buildAdmission() { return readAdmission(this.db); }
+    assertNoLegacyBuildOwner() {
+        for (const row of this.db.prepare("SELECT run_id,state_json FROM workflow_runs WHERE kind='build' AND legacy=1").all()) {
+            const state = parseJson(row.state_json);
+            if (!state.lease || ["completed", "cancelled", "superseded"].includes(state.status ?? ""))
+                continue;
+            const owner = classifyProcess(state.lease.pid, state.lease.processStart, state.lease.hostname ?? "unknown-host");
+            if (owner.state !== "dead")
+                throw new Error(`Legacy build ${row.run_id} ownership is ${owner.state}: ${owner.reason}; reconcile before starting another writer`);
+        }
+    }
+    assertExecutionProtocol() {
+        if (this.db.prepare("SELECT version FROM build_ownership_schema").get().version !== 3)
+            throw new Error("Ownership migration is pending legacy execution cleanup; use rafi resume before starting work");
+    }
+    acquireBuildAdmission(runId, phase) {
+        return this.atomic(() => {
+            this.assertNoLegacyBuildOwner();
+            const lease = this.currentLease();
+            if (lease && classifyProcess(lease.pid, lease.processStart, lease.host).state !== "dead")
+                throw new Error(`project workflow lease is held by ${lease.owner} for run ${lease.runId}`);
+            for (const owner of this.runningSupervisors()) {
+                if (owner.state.pid && classifyProcess(owner.state.pid, owner.state.processStart).state !== "dead")
+                    throw new Error(`supervisor already active for project (run ${owner.runId})`);
+            }
+            const uncertain = this.db.prepare("SELECT run_id FROM operation_journal WHERE kind='provider-dispatch' AND status IN ('in_progress','uncertain') LIMIT 1").get();
+            if (uncertain)
+                throw new Error(`Build ${uncertain.run_id} has unresolved provider dispatch; reconcile before another launch`);
+            for (const row of this.db.prepare("SELECT DISTINCT run_id FROM build_owned_processes WHERE state<>'quiescent'").all()) {
+                if (this.unresolvedPreparationProcesses(row.run_id).length)
+                    throw new Error(`Build ${row.run_id} has unverified preparation descendants; reconcile before another launch`);
+            }
+            const prior = this.buildAdmission();
+            if (prior && this.unresolvedPreparationProcesses(prior.runId).length)
+                throw new Error(`Build ${prior.runId} has unverified preparation descendants; reconcile before another launch`);
+            if (prior && [...this.unresolvedRoleDispatches(prior.runId, "builder"), ...this.unresolvedRoleDispatches(prior.runId, "qa")].length)
+                throw new Error(`Build ${prior.runId} has unresolved provider dispatch; reconcile before another launch`);
+            this.assertExecutionProtocol();
+            this.ensureRun(runId, "build");
+            const authority = acquireAdmission(this.db, this.projectDir, runId, phase);
+            this.writerAuthority = authority;
+            rememberBuildAuthority(authority);
+            return authority;
+        });
+    }
+    acquireBuildRecoveryAdmission(runId) {
+        return this.atomic(() => {
+            this.assertExecutionProtocol();
+            this.assertNoLegacyBuildOwner();
+            const otherDispatch = this.db.prepare("SELECT run_id FROM operation_journal WHERE run_id<>? AND kind='provider-dispatch' AND status IN ('in_progress','uncertain') LIMIT 1").get(runId);
+            if (otherDispatch)
+                throw new Error(`Build ${otherDispatch.run_id} has unresolved provider dispatch; reconcile before starting another recovery workflow`);
+            const current = localBuildAuthority(this.projectDir);
+            if (current && current.runId === runId && this.buildAdmission()?.token === current.token) {
+                this.writerAuthority = current;
+                return current;
+            }
+            const prior = this.buildAdmission();
+            if (prior && prior.runId !== runId)
+                return this.acquireBuildAdmission(runId, "coordinator");
+            if (this.unresolvedPreparationProcesses(runId).length)
+                throw new Error("Owned preparation descendants require reconciliation before recovery");
+            const lease = this.currentLease();
+            if (lease && classifyProcess(lease.pid, lease.processStart, lease.host).state !== "dead")
+                throw new Error(`project workflow lease is held by ${lease.owner} for run ${lease.runId}`);
+            for (const owner of this.runningSupervisors())
+                if (owner.state.pid && classifyProcess(owner.state.pid, owner.state.processStart).state !== "dead")
+                    throw new Error(`supervisor already active for project (run ${owner.runId})`);
+            const authority = acquireAdmission(this.db, this.projectDir, runId, "coordinator");
+            this.writerAuthority = authority;
+            rememberBuildAuthority(authority);
+            return authority;
+        });
+    }
+    admitLeasedBuild(lease) {
+        return this.atomic(() => {
+            this.assertExecutionProtocol();
+            const held = this.currentLease();
+            if (!held || held.owner !== lease.owner || held.generation !== lease.generation || held.runId !== lease.runId)
+                throw new Error("workflow lease ownership changed");
+            const existing = localBuildAuthority(this.projectDir);
+            const authority = existing && existing.runId === lease.runId && this.buildAdmission()?.token === existing.token ? existing : acquireAdmission(this.db, this.projectDir, lease.runId, "coordinator");
+            this.writerAuthority = authority;
+            rememberBuildAuthority(authority);
+            return authority;
+        });
+    }
+    reacquireBuildCoordinator(runId) {
+        return this.atomic(() => {
+            const owner = this.supervisorState(runId);
+            if (owner?.pid !== process.pid || owner.processStart !== processStartIdentity())
+                throw new Error("Supervisor ownership changed");
+            const authority = acquireAdmission(this.db, this.projectDir, runId, "coordinator");
+            this.writerAuthority = authority;
+            rememberBuildAuthority(authority);
+            return authority;
+        });
+    }
+    assertBuildAdmission(authority) { assertAdmission(this.db, authority); }
+    releaseBuildAdmission(authority) {
+        this.atomic(() => {
+            assertAdmission(this.db, authority);
+            if (this.unresolvedPreparationProcesses(authority.runId).length)
+                throw new Error("Unresolved owned processes or provider dispatch require reconciliation");
+            releaseAdmission(this.db, authority);
+            forgetBuildAuthority(authority);
+            if (this.writerAuthority?.token === authority.token)
+                this.writerAuthority = undefined;
+        });
+    }
+    reserveBuildLaunch(authority, role, digest, protocol) { return reserveLaunch(this.db, authority, role, digest, protocol); }
+    dispatchBuildLaunch(authority, token) { setLaunchState(this.db, authority, token, "dispatching"); }
+    failBuildLaunch(authority, token) { setLaunchState(this.db, authority, token, "failed"); }
+    claimBuildLaunch(runId, token, role, digest) { const authority = claimLaunch(this.db, this.projectDir, runId, token, role, digest); this.writerAuthority = authority; rememberBuildAuthority(authority); return authority; }
+    registerBuildLaunchChild(token) { registerLaunchChild(this.db, token, this.projectDir); }
+    acknowledgeBuildLaunchChild(authority, token, pid) { acknowledgeLaunchChild(this.db, authority, token, pid); }
+    reconcileBuildLaunches(runId, original) {
+        return this.atomic(() => {
+            let result = "retired";
+            for (const row of this.db.prepare("SELECT token FROM build_launches WHERE run_id=? AND state IN ('reserved','dispatching')").all(runId)) {
+                const state = reconcileLaunch(this.db, row.token, original);
+                if (state === "unknown")
+                    return state;
+                if (state === "claimed")
+                    result = state;
+            }
+            return result;
+        });
+    }
+    buildLaunch(token) { return readLaunch(this.db, token); }
+    preparationSuccessor(runId) {
+        const seen = new Set();
+        let current = runId;
+        while (true) {
+            if (seen.has(current))
+                throw new Error("Preparation retry lineage contains a cycle");
+            seen.add(current);
+            const link = this.db.prepare("SELECT successor,project FROM build_retry_lineage WHERE predecessor=?").get(current);
+            if (!link)
+                return current;
+            if (link.project !== canonicalProject(this.projectDir))
+                throw new Error("Preparation lineage belongs to another project");
+            current = link.successor;
+        }
+    }
+    reservePreparationRetry(predecessor, args, expectedStartArgs) {
+        return this.atomic(() => {
+            this.lineageTransition++;
+            try {
+                const existing = this.preparationSuccessor(predecessor);
+                if (existing !== predecessor)
+                    throw new Error(`Preparation already retried as ${existing}; select that successor instead`);
+                const eligibility = this.preparationEligibility(predecessor);
+                if (!eligibility.eligible)
+                    throw new Error(`Preparation requires reconciliation: ${eligibility.reasons.join("; ")}`);
+                const previous = this.getRun(predecessor);
+                if (expectedStartArgs !== undefined && JSON.stringify(previous.state.startArgs ?? null) !== expectedStartArgs)
+                    throw new Error("Saved preparation options changed before launch reservation; select the build again with rafi resume");
+                const authority = this.acquireBuildAdmission(predecessor, "coordinator");
+                if (typeof previous.state.predecessor === "string") {
+                    this.transition(predecessor, { checkpoint: "preparing", state: { ...previous.state, startArgs: args }, event: "preparation_relaunch_reserved" });
+                    return { runId: predecessor, authority, launch: reserveLaunch(this.db, authority, "coordinator", launchDigest(args), "registered-v2") };
+                }
+                const runId = randomUUID();
+                this.ensureRun(runId, "build");
+                for (const row of this.db.prepare("SELECT decision_key,decision_json,created_at,updated_at FROM human_decisions WHERE run_id=? AND status='answered'").all(predecessor)) {
+                    if (!row.decision_key.startsWith(`${predecessor}:`))
+                        throw new Error("Legacy approval key cannot be attributed safely to retry scope");
+                    const decision = { ...JSON.parse(row.decision_json), decisionId: randomUUID(), runId };
+                    this.db.prepare("INSERT INTO human_decisions VALUES(?,?,?,'answered',?,?,?)").run(decision.decisionId, `${runId}:${row.decision_key.slice(predecessor.length + 1)}`, runId, JSON.stringify(decision), row.created_at, row.updated_at);
+                }
+                const policy = this.autonomyPolicy(predecessor);
+                if (policy)
+                    this.freezeAutonomyPolicy(runId, policy);
+                const supervisor = this.supervisorState(predecessor);
+                if (supervisor)
+                    this.putSupervisorState(runId, { ...supervisor, status: "stopped", pid: undefined, workerPid: undefined, processStart: undefined });
+                this.transition(runId, { checkpoint: "preparing", state: { ...previous.state, startArgs: args, predecessor }, event: "preparation_retry_reserved" });
+                this.db.prepare("INSERT INTO build_retry_lineage VALUES(?,?,?,?)").run(predecessor, runId, canonicalProject(this.projectDir), new Date().toISOString());
+                this.transition(predecessor, { status: "superseded", checkpoint: "preparation-superseded", state: { ...previous.state, successor: runId }, event: "preparation_superseded", payload: { successor: runId } });
+                const next = { ...authority, runId };
+                this.db.prepare("UPDATE build_admission SET record_json=? WHERE singleton=1").run(JSON.stringify(next));
+                this.writerAuthority = next;
+                rememberBuildAuthority(next);
+                return { runId, authority: next, launch: reserveLaunch(this.db, next, "coordinator", launchDigest(args), "registered-v2") };
+            }
+            finally {
+                this.lineageTransition--;
+            }
+        });
+    }
+    beginOwnedPreparationProcess(authority, tag, gated = false) {
+        return this.atomic(() => {
+            assertAdmission(this.db, authority);
+            const id = tag ?? randomUUID();
+            if (gated && this.db.prepare("SELECT version FROM build_ownership_schema").get().version !== 3)
+                throw new Error("Legacy build ownership needs reconciliation before readiness protocol migration");
+            if (this.unresolvedPreparationProcesses(authority.runId).length)
+                throw new Error("Previous readiness cleanup is unresolved");
+            this.db.prepare("INSERT INTO build_owned_processes(id,run_id,owner,pid,process_start,host,state,outcome_json) VALUES(?,?,?,NULL,NULL,?,'intended',?)").run(id, authority.runId, authority.token, authority.host, JSON.stringify(gated ? { protocol: "gated-v3", startup: "intended", revision: 0, authority, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() } : { protocol: process.platform === "win32" ? "windows-job-v1" : "tagged-v2" }));
+            return id;
+        });
+    }
+    recordOwnedPreparationProcess(authority, id, pid) {
+        this.atomic(() => {
+            assertAdmission(this.db, authority);
+            const row = this.readinessProcesses().find(row => row.id === id);
+            if (row && readinessMetadata(row).protocol === "gated-v3")
+                throw new Error("Gated readiness requires helper registration");
+            if (this.db.prepare("UPDATE build_owned_processes SET pid=?,process_start=?,state='running' WHERE id=? AND owner=? AND state='intended'").run(pid, processStartIdentity(pid), id, authority.token).changes !== 1)
+                throw new Error("Owned process launch changed");
+        });
+    }
+    finishOwnedPreparationProcess(authority, id, noChild = false, outcome) {
+        this.atomic(() => {
+            assertAdmission(this.db, authority);
+            const row = this.db.prepare("SELECT * FROM build_owned_processes WHERE id=? AND owner=?").get(id, authority.token);
+            if (!row)
+                throw new Error("Owned process record disappeared");
+            const processRow = this.db.prepare("SELECT * FROM build_owned_processes WHERE id=?").get(id);
+            const meta = readinessMetadata(processRow);
+            if (outcome)
+                this.db.prepare("UPDATE build_owned_processes SET outcome_json=? WHERE id=?").run(JSON.stringify({ ...meta, ...outcome }), id);
+            if ((noChild && row.pid === null && meta.protocol !== "gated-v3") || inspectReadiness(processRow).state === "quiescent")
+                this.db.prepare("UPDATE build_owned_processes SET state='quiescent' WHERE id=?").run(id);
+        });
+    }
+    readinessProcesses(runId) {
+        return this.db.prepare("SELECT * FROM build_owned_processes WHERE state<>'quiescent'" + (runId ? " AND run_id=?" : "")).all(...(runId ? [runId] : []));
+    }
+    unresolvedPreparationProcesses(runId) {
+        const parent = this.db.prepare("SELECT parent FROM build_child_runs WHERE child=?").get(runId)?.parent;
+        return this.readinessProcesses().filter(row => row.run_id === runId || row.run_id === parent).map(row => row.id);
+    }
+    registerReadinessHelper(id) {
+        this.atomic(() => {
+            const row = this.readinessProcesses().find(row => row.id === id);
+            const meta = row && readinessMetadata(row);
+            const start = processStartIdentity();
+            if (!row || meta?.protocol !== "gated-v3" || meta.startup !== "intended" || row.pid || row.host !== hostname() || start === "unavailable")
+                throw new Error("Readiness registration rejected");
+            this.db.prepare("UPDATE build_owned_processes SET pid=?,process_start=?,outcome_json=? WHERE id=?").run(process.pid, start, JSON.stringify({ ...meta, startup: "registered", revision: meta.revision + 1, updatedAt: new Date().toISOString() }), id);
+        });
+    }
+    authorizeReadinessHelper(authority, id, pid) {
+        this.atomic(() => {
+            assertAdmission(this.db, authority);
+            const row = this.readinessProcesses().find(row => row.id === id);
+            const meta = row && readinessMetadata(row);
+            if (!row || row.owner !== authority.token || meta?.startup !== "registered" || row.pid !== pid || classifyProcess(pid, row.process_start ?? undefined, row.host).state !== "live")
+                throw new Error("Readiness authorization rejected");
+            this.db.prepare("UPDATE build_owned_processes SET outcome_json=? WHERE id=?").run(JSON.stringify({ ...meta, startup: "authorized", revision: meta.revision + 1, updatedAt: new Date().toISOString() }), id);
+        });
+    }
+    assertReadinessHelper(id) {
+        const row = this.readinessProcesses().find(row => row.id === id);
+        if (!row || readinessMetadata(row).startup !== "authorized" || row.pid !== process.pid || row.process_start !== processStartIdentity() || row.host !== hostname())
+            throw new Error("Readiness execution capability rejected");
+        return row;
+    }
+    recordReadinessCreator(id, pid) {
+        this.atomic(() => {
+            const row = this.assertReadinessHelper(id);
+            const meta = readinessMetadata(row);
+            const start = processStartIdentity(pid);
+            if (meta.creator || start === "unavailable")
+                throw new Error("Windows creator registration rejected");
+            this.db.prepare("UPDATE build_owned_processes SET outcome_json=? WHERE id=?").run(JSON.stringify({ ...meta, creator: { pid, start }, revision: meta.revision + 1, updatedAt: new Date().toISOString() }), id);
+        });
+    }
+    assertReadinessRelationships(runId) {
+        // Inspect each directed lineage separately; cleanup never broadens to siblings.
+        for (const relation of ["parent", "successor", "predecessor"]) {
+            let current = runId;
+            const seen = new Set();
+            while (true) {
+                if (seen.has(current))
+                    throw new Error("Readiness run relationship contains a cycle");
+                seen.add(current);
+                const link = relation === "parent"
+                    ? this.db.prepare("SELECT parent AS target FROM build_child_runs WHERE child=?").get(current)
+                    : this.db.prepare(`SELECT ${relation} AS target,project FROM build_retry_lineage WHERE ${relation === "successor" ? "predecessor" : "successor"}=?`).get(current);
+                if (!link)
+                    break;
+                if (!this.getRun(link.target) || (link.project && canonicalProject(link.project) !== canonicalProject(this.projectDir)))
+                    throw new Error("Readiness relationship is missing or belongs to another project");
+                current = link.target;
+            }
+        }
+    }
+    readinessCleanupDetails(runId) {
+        return this.readinessProcesses(runId).map(row => {
+            const meta = readinessMetadata(row);
+            try {
+                this.assertReadinessRelationships(runId);
+                this.assertReadinessCleanupOwner(row);
+            }
+            catch (error) {
+                return `${row.id}: ${error.message}`;
+            }
+            return `${row.id}: ${meta.cleanup?.reason ?? inspectReadiness(row).reason}`;
+        });
+    }
+    assertReadinessCleanupOwner(row, original) {
+        const held = this.buildAdmission();
+        if (original && held?.token === original.token && row.owner === original.token && original.project === canonicalProject(this.projectDir) && held.project === original.project)
+            return;
+        const recorded = readinessMetadata(row).authority;
+        const owner = recorded?.token === row.owner ? recorded : held?.token === row.owner ? held : undefined;
+        if (owner && (owner.project !== canonicalProject(this.projectDir) || owner.host !== row.host))
+            throw new Error("Readiness ownership belongs to another project or host");
+        if (!owner || classifyProcess(owner.pid, owner.processStart, owner.host).state !== "dead")
+            throw new Error("Readiness owner is live, unknown, or lacks attributable provenance");
+    }
+    revokeReadinessHelper(id, original) {
+        this.atomic(() => {
+            const row = this.readinessProcesses().find(row => row.id === id);
+            if (!row)
+                return;
+            this.assertReadinessCleanupOwner(row, original);
+            const meta = readinessMetadata(row);
+            if (meta.protocol !== "gated-v3" || !["intended", "registered", "revoked"].includes(meta.startup))
+                throw new Error("Authorized readiness cannot be revoked; verify cleanup instead");
+            if (meta.startup === "revoked")
+                return;
+            this.db.prepare("UPDATE build_owned_processes SET outcome_json=? WHERE id=?").run(JSON.stringify({ ...meta, startup: "revoked", revision: meta.revision + 1, updatedAt: new Date().toISOString() }), id);
+        });
+    }
+    async reconcileReadiness(runId, original, deadline = Date.now() + 5000) {
+        // Exact run scope: related/different blockers remain independently selectable.
+        for (const initial of this.readinessProcesses(runId)) {
+            if (Date.now() >= deadline)
+                break;
+            let row = initial;
+            try {
+                this.atomic(() => {
+                    this.assertReadinessRelationships(runId);
+                    this.assertReadinessCleanupOwner(row, original);
+                    const meta = readinessMetadata(row);
+                    if (meta.protocol === "gated-v3" && ["intended", "registered"].includes(meta.startup))
+                        this.revokeReadinessHelper(row.id, original);
+                });
+                row = this.readinessProcesses(runId).find(item => item.id === row.id);
+                if (!row)
+                    continue;
+                const meta = readinessMetadata(row);
+                let evidence = await cleanupReadiness(row, deadline);
+                // tagged-v2 launched directly from its recorded owner, without a delayed helper.
+                if (!row.pid && meta.protocol === "tagged-v2" && row.host === hostname() && (() => { const owner = this.buildAdmission(); return owner?.token === row.owner && classifyProcess(owner.pid, owner.processStart, owner.host).state === "dead"; })() && taggedProcesses(row.id)?.length === 0)
+                    evidence = { state: "quiescent", reason: "verified dead direct-spawn owner and complete empty tag inventory" };
+                this.atomic(() => {
+                    this.assertReadinessRelationships(runId);
+                    this.assertReadinessCleanupOwner(row, original);
+                    const current = this.readinessProcesses(runId).find(item => item.id === row.id);
+                    if (!current || current.outcome_json !== row.outcome_json || current.pid !== row.pid)
+                        return;
+                    this.db.prepare("UPDATE build_owned_processes SET state=?,outcome_json=? WHERE id=?").run(evidence.state === "quiescent" ? "quiescent" : row.state, JSON.stringify({ ...meta, cleanup: { ...evidence, checkedAt: new Date().toISOString() }, revision: (meta.revision ?? 0) + 1, updatedAt: new Date().toISOString() }), row.id);
+                });
+            }
+            catch { /* Preserve durable blocker, including after storage/authority failures. */ }
+        }
+        return this.readinessProcesses(runId).map(row => row.id);
+    }
+    preparationEligibility(runId) {
+        const run = this.getRun(runId);
+        const reasons = [];
+        for (const row of this.db.prepare("SELECT state_json FROM workflow_runs WHERE kind='legacy' AND legacy=1").all()) {
+            const legacy = parseJson(row.state_json);
+            if (legacy.source && /delivery-sessions/.test(legacy.source) && existsSync(legacy.source) && legacy.record?.sessionId)
+                reasons.push("unattributed legacy branch session requires reconciliation");
+        }
+        if (this.pendingHumanDecisions(runId).length)
+            reasons.push("pending decisions require an answer");
+        if (this.unresolvedPreparationProcesses(runId).length)
+            reasons.push("owned preparation processes are still running or unverified");
+        if (this.incompletePublications().some(item => item.runId === runId))
+            reasons.push("unfinished publication requires reconciliation");
+        if (!run || ["completed", "cancelled", "superseded"].includes(run.status))
+            reasons.push("run is missing or terminal");
+        if (run?.state.version !== undefined || run?.state.runId)
+            reasons.push("implementation snapshot exists");
+        const tables = ["operation_journal", "provider_sessions", "continuity_heads", "handoffs", "role_mutation_leases", "branch_resume_sessions", "qa_ticket_heads", "qa_recovery_heads", "recovery_attempts"];
+        for (const table of tables)
+            if (this.db.prepare(`SELECT 1 FROM ${table} WHERE run_id=? LIMIT 1`).get(runId))
+                reasons.push(`${table} contains execution evidence or decisions`);
+        return { eligible: reasons.length === 0, reasons };
+    }
     /** Ensure non-workflow build records can use the same durable event store. */
     ensureRun(runId, kind = "build", now = new Date()) {
         const existing = this.getRun(runId);
@@ -81,8 +683,14 @@ export class WorkflowDb {
             return existing;
         const at = now.toISOString();
         this.db.transaction(() => {
+            if (this.writerAuthority)
+                assertAdmission(this.db, this.writerAuthority);
             const inserted = this.db.prepare(`INSERT OR IGNORE INTO workflow_runs(run_id,kind,status,checkpoint,original_work_json,remaining_work_json,state_json,legacy,created_at,updated_at)
         VALUES(?,?,'running','durable-baseline','{}','{}','{}',0,?,?)`).run(runId, kind, at, at);
+            if (inserted.changes && this.writerAuthority && this.writerAuthority.runId !== runId) {
+                this.db.prepare("INSERT INTO build_child_runs VALUES(?,?)").run(runId, this.writerAuthority.runId);
+                this.db.prepare("INSERT OR IGNORE INTO build_runtime_runs VALUES(?)").run(runId);
+            }
             if (inserted.changes)
                 this.insertEvent(runId, "durable_baseline", "durable-baseline", { source: "host" }, at);
         })();
@@ -96,8 +704,14 @@ export class WorkflowDb {
             legacy: Boolean(input.legacy), createdAt: at, updatedAt: at,
         };
         this.db.transaction(() => {
+            if (this.writerAuthority)
+                assertAdmission(this.db, this.writerAuthority);
             this.db.prepare(`INSERT INTO workflow_runs(run_id,kind,status,checkpoint,original_work_json,remaining_work_json,state_json,legacy,created_at,updated_at)
         VALUES(?,?,?,?,?,?,?,?,?,?)`).run(run.runId, run.kind, run.status, run.checkpoint, json(run.originalWork), json(run.remainingWork), json(run.state), run.legacy ? 1 : 0, at, at);
+            if (this.writerAuthority && this.writerAuthority.runId !== run.runId) {
+                this.db.prepare("INSERT INTO build_child_runs VALUES(?,?)").run(run.runId, this.writerAuthority.runId);
+                this.db.prepare("INSERT OR IGNORE INTO build_runtime_runs VALUES(?)").run(run.runId);
+            }
             this.insertEvent(run.runId, "run_created", run.checkpoint, { kind: run.kind }, at);
         })();
         return run;
@@ -126,12 +740,45 @@ export class WorkflowDb {
             : this.db.prepare("SELECT * FROM workflow_runs WHERE status NOT IN ('completed','cancelled','superseded') ORDER BY created_at").all();
         return rows.map(rowToRun);
     }
+    /** Supervisors may pause a worker generation; they cannot publish worker state. */
+    transitionSupervisor(runId, workerGeneration, update) {
+        return this.atomic(() => {
+            const owner = this.supervisorState(runId);
+            if (!owner || owner.pid !== process.pid || owner.processStart !== processStartIdentity() || owner.workerGeneration !== workerGeneration)
+                throw new Error("Supervisor generation no longer owns the lifecycle transition");
+            this.coordinatorTransition++;
+            try {
+                return this.transition(runId, update);
+            }
+            finally {
+                this.coordinatorTransition--;
+            }
+        });
+    }
     transition(runId, update, now = new Date()) {
         const at = now.toISOString();
         return this.db.transaction(() => {
+            if (!this.coordinatorTransition && (this.writerAuthority || this.buildAdmission())) {
+                if (!this.writerAuthority)
+                    throw new Error("Workflow transition requires original build admission authority");
+                assertAdmission(this.db, this.writerAuthority);
+                const supersession = update.status === "superseded" && update.state?.supersededBy === this.writerAuthority.runId && this.getRun(this.writerAuthority.runId)?.kind === "recovery";
+                if (!this.lineageTransition && this.writerAuthority.runId !== runId && !this.db.prepare("SELECT 1 FROM build_child_runs WHERE child=? AND parent=?").get(runId, this.writerAuthority.runId) && !supersession)
+                    throw new Error("Workflow authority belongs to another run");
+            }
             const current = this.getRun(runId);
             if (!current)
                 throw new Error(`workflow run not found: ${runId}`);
+            if (["completed", "cancelled", "superseded"].includes(current.status) && update.status && update.status !== current.status)
+                throw new Error(`Cannot reactivate terminal ${current.status} workflow`);
+            if (!this.coordinatorTransition && this.db.prepare("SELECT 1 FROM build_runtime_runs WHERE run_id=?").get(runId) && !this.writerAuthority) {
+                const lease = this.currentLease();
+                if (!this.writerLease || !lease || lease.owner !== this.writerLease.owner || lease.generation !== this.writerLease.generation)
+                    throw new Error("Workflow transition requires original build authority");
+                const supersession = update.status === "superseded" && update.state?.supersededBy === lease.runId && this.getRun(lease.runId)?.kind === "recovery";
+                if (lease.runId !== runId && !supersession)
+                    throw new Error("Workflow authority belongs to another run");
+            }
             const next = { ...current, status: update.status ?? current.status, checkpoint: update.checkpoint, remainingWork: update.remainingWork ?? current.remainingWork, state: update.state ?? current.state, updatedAt: at };
             this.db.prepare("UPDATE workflow_runs SET status=?,checkpoint=?,remaining_work_json=?,state_json=?,updated_at=? WHERE run_id=?")
                 .run(next.status, next.checkpoint, json(next.remainingWork), json(next.state), at, runId);
@@ -206,6 +853,9 @@ export class WorkflowDb {
         this.ensureRun(input.runId, "build", now);
         const at = now.toISOString();
         const safePayload = sanitizeContinuityValue(input.payload);
+        const graphAccess = currentGraphDerivedAccess();
+        if (graphAccess)
+            registerGraphDerived(this.db, json(safePayload), graphAccess);
         const session = sessionParts(input.sessionRef, undefined, input.sessionKey);
         const digest = digestJson({ runId: input.runId, role: input.role, kind: input.kind, payload: safePayload, authoritativeStateRevision: input.authoritativeStateRevision, sessionKey: session.key, at });
         const result = this.db.prepare(`INSERT INTO continuity_events(run_id,role,kind,payload_json,digest,authoritative_state_revision,session_key,session_ref_json,created_at)
@@ -214,6 +864,8 @@ export class WorkflowDb {
     }
     continuityEvents(runId, afterSequence = 0) {
         const rows = this.db.prepare("SELECT * FROM continuity_events WHERE run_id=? AND sequence>? ORDER BY sequence").all(runId, afterSequence);
+        for (const row of rows)
+            this.assertGraphContinuityAccess(row.payload_json);
         return rows.map(continuityEventFromRow);
     }
     publishContinuityCheckpoint(input, now = new Date()) {
@@ -223,6 +875,9 @@ export class WorkflowDb {
             const previous = this.continuityHead(input.runId, input.role);
             const latestEvent = this.db.prepare("SELECT COALESCE(MAX(sequence),0) AS sequence FROM continuity_events WHERE run_id=?").get(input.runId);
             const safeDelta = sanitizeContinuityValue(input.delta);
+            const graphAccess = currentGraphDerivedAccess();
+            if (graphAccess)
+                registerGraphDerived(this.db, json(safeDelta), graphAccess);
             const session = sessionParts(input.sessionRef, undefined, input.sessionKey);
             const digest = digestJson({ runId: input.runId, role: input.role, sequence: latestEvent.sequence, predecessorDigest: previous?.digest, delta: safeDelta, authoritativeStateRevision: input.authoritativeStateRevision, sessionKey: session.key });
             const result = this.db.prepare(`INSERT INTO continuity_checkpoints(run_id,role,event_sequence,state,delta_json,digest,predecessor_digest,authoritative_state_revision,session_key,session_ref_json,created_at)
@@ -244,12 +899,21 @@ export class WorkflowDb {
         const rows = role
             ? this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? AND role=? ORDER BY checkpoint_id").all(runId, role)
             : this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? ORDER BY checkpoint_id").all(runId);
+        for (const row of rows)
+            this.assertGraphContinuityAccess(row.delta_json);
         return rows.map(continuityCheckpointFromRow);
     }
     latestContinuityCheckpoint(runId, role) {
         const row = this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? AND role=? ORDER BY checkpoint_id DESC LIMIT 1").get(runId, role);
+        if (row)
+            this.assertGraphContinuityAccess(row.delta_json);
         return row ? continuityCheckpointFromRow(row) : undefined;
     }
+    assertGraphContinuityAccess(value) {
+        const digest = createHash("sha256").update(value).digest("hex");
+        if (!graphDerivedAllowed(this.db, this.projectDir, digest))
+            throw new Error("Continuity contains revoked graph-derived evidence; explicit source-based recovery is required");
+    }
     continuityHead(runId, role) {
         const row = this.db.prepare("SELECT * FROM continuity_heads WHERE run_id=? AND role=?").get(runId, role);
         return row ? continuityHeadFromRow(row) : undefined;
@@ -379,6 +1043,18 @@ export class WorkflowDb {
         })();
         return decision;
     }
+    cancelPendingHumanDecisions(runId, reason, now = new Date()) {
+        this.atomic(() => {
+            for (const decision of this.pendingHumanDecisions(runId)) {
+                const next = { ...decision, status: "cancelled", cancellationReason: reason, cancelledAt: now.toISOString() };
+                this.db.prepare("UPDATE human_decisions SET status='cancelled',decision_json=?,updated_at=? WHERE decision_id=? AND status='pending'").run(json(next), now.toISOString(), decision.decisionId);
+                this.insertEvent(runId, "human_decision_cancelled", "cancelled", { decisionId: decision.decisionId, reason }, now.toISOString());
+            }
+        });
+    }
+    humanDecisionKey(decisionId) {
+        return this.db.prepare("SELECT decision_key FROM human_decisions WHERE decision_id=?").get(decisionId)?.decision_key;
+    }
     humanDecision(decisionId) {
         const row = this.db.prepare("SELECT decision_json FROM human_decisions WHERE decision_id=?").get(decisionId);
         return row ? parseJson(row.decision_json) : undefined;
@@ -387,11 +1063,50 @@ export class WorkflowDb {
         return this.db.prepare("SELECT decision_json FROM human_decisions WHERE run_id=? AND status='pending' ORDER BY created_at").all(runId)
             .map((row) => parseJson(row.decision_json));
     }
+    decisionContinuationAvailable(runId, decisionId) {
+        const prior = this.operations(runId).filter(op => op.kind === "decision-continuation" && op.intent.decisionId === decisionId);
+        return prior.every(op => op.status === "failed" && op.result?.dispatchState === "not-sent");
+    }
+    nextDecisionContinuationKey(runId, decisionId) {
+        if (!this.decisionContinuationAvailable(runId, decisionId))
+            throw new Error("Decision continuation requires reconciliation before replay");
+        const count = this.operations(runId).filter(op => op.kind === "decision-continuation" && op.intent.decisionId === decisionId).length;
+        return `decision-continuation:${decisionId}${count ? `:retry-${count}` : ""}`;
+    }
     answeredTicketDecisions(runId, scopeRevision) {
         return this.db.prepare("SELECT decision_key,decision_json FROM human_decisions WHERE run_id=? AND status='answered'").all(runId)
             .filter(row => row.decision_key.includes(`:${scopeRevision}:`))
             .map(row => parseJson(row.decision_json))
-            .filter(decision => decision.interruptionId.startsWith("ticket:") && !this.operation(`decision-continuation:${decision.decisionId}`));
+            .filter(decision => decision.interruptionId.startsWith("ticket:") && this.decisionContinuationAvailable(runId, decision.decisionId) && !this.operation(`decision-supersession:${decision.decisionId}`));
+    }
+    /** Unconsumed answers to an older definition must not silently reopen a ticket. */
+    staleTicketDecisions(runId, scopeRevision) {
+        return this.db.prepare("SELECT decision_key,decision_json FROM human_decisions WHERE run_id=? AND status='answered'").all(runId)
+            .filter(row => !row.decision_key.includes(`:${scopeRevision}:`))
+            .map(row => parseJson(row.decision_json))
+            .filter(decision => decision.interruptionId.startsWith("ticket:") && this.decisionContinuationAvailable(runId, decision.decisionId) && !this.operation(`decision-supersession:${decision.decisionId}`));
+    }
+    refreshStaleTicketDecisions(runId, scopeRevision, tickets) {
+        this.atomic(() => {
+            for (const prior of this.pendingHumanDecisions(runId)) {
+                const key = this.humanDecisionKey(prior.decisionId) ?? "";
+                if (!prior.interruptionId.startsWith("ticket:") || tickets && !tickets.includes(prior.interruptionId.slice(7)) || key.includes(`:${scopeRevision}:`) || !(key.startsWith(`${runId}:builder:`) || key.startsWith(`${runId}:ticket-question:`)))
+                    continue;
+                this.ensureHumanDecision({ runId, decisionKey: `${runId}:ticket-question:${scopeRevision}:supersedes:${prior.decisionId}`, interruptionId: prior.interruptionId, prompt: prior.prompt, choices: prior.choices, evidence: prior.evidence });
+                this.db.prepare("UPDATE human_decisions SET status='cancelled',decision_json=?,updated_at=? WHERE decision_id=? AND status='pending'").run(json({ ...prior, status: "cancelled", cancellationReason: "ticket scope changed before the question was answered" }), new Date().toISOString(), prior.decisionId);
+                this.insertEvent(runId, "human_decision_superseded", "question-revised", { decisionId: prior.decisionId, scopeRevision }, new Date().toISOString());
+            }
+            for (const prior of this.staleTicketDecisions(runId, scopeRevision)) {
+                if (tickets && !tickets.includes(prior.interruptionId.slice(7)))
+                    continue;
+                const next = this.ensureHumanDecision({ runId, decisionKey: `${runId}:ticket-question:${scopeRevision}:supersedes:${prior.decisionId}`, interruptionId: prior.interruptionId,
+                    prompt: prior.prompt, choices: prior.choices, evidence: prior.evidence });
+                const key = `decision-supersession:${prior.decisionId}`;
+                this.planOperation({ runId, idempotencyKey: key, kind: "decision-supersession", intent: { priorDecisionId: prior.decisionId, replacementDecisionId: next.decisionId, reason: "ticket scope changed before answer was used" } });
+                this.updateOperation(key, "in_progress");
+                this.updateOperation(key, "confirmed");
+            }
+        });
     }
     answerHumanDecision(runId, decisionId, choiceId, now = new Date(), answer) {
         return this.atomic(() => {
@@ -431,6 +1146,8 @@ export class WorkflowDb {
     }
     planOperation(input, now = new Date()) {
         const at = now.toISOString();
+        if (input.kind === "provider-dispatch" && this.unresolvedPreparationProcesses(input.runId).length)
+            throw new Error("Readiness cleanup must be reconciled before provider dispatch");
         this.db.prepare(`INSERT INTO operation_journal(idempotency_key,run_id,kind,status,intent_json,created_at,updated_at)
       VALUES(?,?,?,'planned',?,?,?) ON CONFLICT(idempotency_key) DO NOTHING`).run(input.idempotencyKey, input.runId, input.kind, json(input.intent), at, at);
         const operation = this.operation(input.idempotencyKey);
@@ -441,6 +1158,8 @@ export class WorkflowDb {
     }
     updateOperation(idempotencyKey, status, details = {}, now = new Date()) {
         const prior = this.operation(idempotencyKey);
+        if (prior?.kind === "provider-dispatch" && status === "in_progress" && this.unresolvedPreparationProcesses(prior.runId).length)
+            throw new Error("Readiness cleanup must be reconciled before provider dispatch");
         if (!prior)
             throw new Error(`operation not found: ${idempotencyKey}`);
         const allowed = {
@@ -458,6 +1177,12 @@ export class WorkflowDb {
         this.db.transaction(() => {
             this.db.prepare("UPDATE operation_journal SET status=?,result_json=?,external_id=?,error=?,updated_at=? WHERE idempotency_key=?")
                 .run(status, details.result === undefined ? null : json(details.result), details.externalId ?? null, details.error ?? null, at, idempotencyKey);
+            if (status === "confirmed" && ["ticket-complete", "synthetic-completion"].includes(prior.kind)) {
+                const workId = prior.intent.workId ?? prior.intent.ticket ?? prior.intent.ticketId;
+                const admission = workId && this.admittedWork(prior.runId, workId);
+                if (admission)
+                    this.qaPreparationStore().metric(prior.runId, workId, admission.requirementsDigest, `metric:completed:${prior.runId}:${workId}`, "completed", { status: this.getRun(prior.runId)?.state?.qaEnabled === false ? "disabled" : undefined, at });
+            }
             this.appendContinuityEvent({ runId: prior.runId, role: "host", kind: "operation_receipt", payload: { idempotencyKey, kind: prior.kind, status, externalId: details.externalId, error: details.error }, authoritativeStateRevision: this.continuityHead(prior.runId, "run")?.authoritativeStateRevision ?? 0 }, now);
         })();
         return this.operation(idempotencyKey);
@@ -491,9 +1216,15 @@ export class WorkflowDb {
             throw new Error(`${kind} evidence exceeds the durable ${maximum}-byte item limit`);
         const digest = createHash("sha256").update(bytes).digest("hex");
         this.db.prepare("INSERT OR IGNORE INTO content_refs(digest,kind,content,created_at) VALUES(?,?,?,?)").run(digest, kind, bytes, now.toISOString());
+        const graphAccess = currentGraphDerivedAccess();
+        if (graphAccess && (kind === "qa" || kind === "handoff"))
+            registerGraphDerived(this.db, bytes, graphAccess);
         return digest;
     }
+    registerGraphEvidence(value, access) { registerGraphDerived(this.db, value, access); }
     getEvidence(digest) {
+        if (!graphDerivedAllowed(this.db, this.projectDir, digest))
+            return undefined;
         const row = this.db.prepare("SELECT content FROM content_refs WHERE digest=?").get(digest);
         return row?.content;
     }
@@ -548,6 +1279,11 @@ export class WorkflowDb {
         const next = { ...prior, ...patch, updatedAt: now.toISOString() };
         this.db.prepare("UPDATE qa_review_attempts SET status=?,report_digest=?,record_json=?,updated_at=? WHERE attempt_id=?")
             .run(next.status, next.reportDigest ?? null, json({ findingIds: next.findingIds, namespacedFindingIds: next.namespacedFindingIds, detail: next.detail }), next.updatedAt, attemptId);
+        const admission = this.admittedWork(next.runId, next.ticketId);
+        const turns = this.db.prepare("SELECT receipt_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND review_number=? AND status='completed'").all(next.runId, next.ticketId, next.reviewNumber);
+        const terminalBlock = turns.some(row => { const receipt = parseJson(row.receipt_json); const response = receipt.cleanedResponseDigest && this.getEvidence(receipt.cleanedResponseDigest); return receipt.terminalEventObserved && response && /STEP_STATUS:\s*(blocked|needs_input)\b/.test(response.toString()); });
+        if (admission && (next.status === "passed" || next.status === "failed" || terminalBlock))
+            this.qaPreparationStore().metric(next.runId, next.ticketId, admission.requirementsDigest, `metric:review:${attemptId}`, "substantive-review", { status: next.status === "passed" ? "passed" : next.status === "failed" ? "failed" : "blocked", at: now.toISOString(), evidenceRefs: next.reportDigest ? [next.reportDigest] : [] });
         return next;
     }
     qaReviewAttempts(runId, ticketId) {
@@ -603,6 +1339,8 @@ export class WorkflowDb {
             .run(record.invocationId, record.runId, record.ticketId, qaDigest("handback-invocation", intent), json(intent), record.status, json(record), record.startedAt, record.completedAt ?? new Date().toISOString());
     }
     recordQaDeliveryTurn(turn) {
+        if (turn.version === 4)
+            ensureQaGraphJournalGuards(this.db);
         const prior = this.qaDeliveryTurns(turn.operationId).find(t => t.turnRecordId === turn.turnRecordId);
         if (prior) {
             if (prior.status !== "intended") {
@@ -642,7 +1380,8 @@ export class WorkflowDb {
         if (linked.size !== recoveries.length)
             throw new Error("QA remediation budget requires legacy attempt reconciliation");
         const authorized = new Set(this.db.prepare("SELECT consumed_by FROM qa_remediation_authorizations WHERE run_id=? AND ticket_id=? AND consumed_by IS NOT NULL").all(runId, ticketId).map(r => r.consumed_by));
-        return attempts.filter(a => !authorized.has(a.attemptId)).length;
+        const followups = this.operations(runId).filter(operation => operation.kind === "build-assignment" && operation.intent.ticketId === ticketId && operation.intent.managerFollowup);
+        return attempts.filter(a => !authorized.has(a.attemptId)).length + followups.filter(operation => !authorized.has(operation.idempotencyKey)).length;
     }
     authorizeQaRemediation(runId, ticketId, reviewAttemptId, reason) {
         const authorizationId = randomUUID();
@@ -893,6 +1632,12 @@ export class WorkflowDb {
         return this.db.transaction(() => {
             const predecessors = this.unresolvedQaReports(input.runId, input.ticketId);
             const current = this.recordQaReport(input, findingIds, now);
+            const admission = this.admittedWork(input.runId, input.ticketId), preparation = this.qaPreparationStore();
+            if (admission && preparation.policy(input.runId)) {
+                const evidence = preparation.putArtifact("finding-classification-input", { report: input, contractHead: preparation.head(input.runId, input.ticketId, admission.requirementsDigest), evidenceDisposition: "Cause remains unknown until supported assessment" });
+                for (const findingId of findingIds)
+                    preparation.metric(input.runId, input.ticketId, admission.requirementsDigest, `metric:finding-unknown:${current.reportOccurrenceId}:${findingId}`, "finding-classification", { findingId, classifier: "host-evidence-boundary", cause: "unknown", confidence: "unknown", evidenceRefs: [evidence], at: now.toISOString() });
+            }
             for (const predecessor of predecessors) {
                 if (predecessor.reportOccurrenceId === current.reportOccurrenceId)
                     continue;
@@ -964,13 +1709,38 @@ export class WorkflowDb {
         for (const report of this.unresolvedQaReports(runId, ticketId))
             this.setQaReportDisposition(report.reportOccurrenceId, "verified-fixed", "subsequent bound QA review passed", now);
     }
-    commitQaWaiver(runId, ticketId, expectedRevision, reason, now = new Date()) {
+    authorizeContractQaWaiver(runId, workId, decisionId) {
+        this.assertInstructionOwner(runId);
+        const decision = this.humanDecision(decisionId);
+        if (!decision || decision.runId !== runId || decision.status !== "answered" || decision.selectedChoiceId !== "yes" || decision.interruptionId !== `ticket:${workId}` || !this.humanDecisionKey(decisionId)?.startsWith(`${runId}:qa-nonconvergence:`) || !decision.prompt.includes("QA waiver confirmation"))
+            throw new Error("Whole-work waiver requires the actual answered operator confirmation");
+        const admission = this.assertAdmittedWork(runId, workId), store = this.qaPreparationStore(), head = store.head(runId, workId, admission.requirementsDigest), qa = this.qaTicketHead(runId, workId);
+        if (head.state !== "ready" || !head.digest)
+            throw new Error("Whole-work waiver requires a current ready contract");
+        return store.putArtifact("waiver-authorization", { decisionId, runId, workId, admissionDigest: admission.requirementsDigest, contractDigest: head.digest, qaRevision: qa.revision, sourceDigest: qa.sourceStateDigest, reviewBasisDigest: qa.reviewBasisDigest, authorizedAt: decision.answeredAt });
+    }
+    commitQaWaiver(runId, ticketId, expectedRevision, reason, now = new Date(), authorizationRef) {
         return this.db.transaction(() => {
             const head = this.qaTicketHead(runId, ticketId);
             if (head.revision !== expectedRevision)
                 throw new Error(`QA waiver raced for ${runId}/${ticketId}`);
+            const store = this.qaPreparationStore();
+            if (store.policy(runId)?.mode === "enforce") {
+                const admission = this.assertAdmittedWork(runId, ticketId), contractHead = store.head(runId, ticketId, admission.requirementsDigest);
+                if (contractHead.state !== "ready" || !contractHead.digest || !reason.trim())
+                    throw new Error("Whole-work waiver requires exact contract scope and operator reason");
+                const authority = authorizationRef ? store.artifact(authorizationRef, "waiver-authorization") : undefined;
+                const decision = authority && this.humanDecision(authority.decisionId);
+                if (!authority || authority.runId !== runId || authority.workId !== ticketId || authority.admissionDigest !== admission.requirementsDigest || authority.contractDigest !== contractHead.digest || authority.qaRevision !== expectedRevision || authority.sourceDigest !== head.sourceStateDigest || authority.reviewBasisDigest !== head.reviewBasisDigest || decision?.status !== "answered" || decision.selectedChoiceId !== "yes")
+                    throw new Error("Missing or stale whole-work waiver authorization");
+                const contract = store.contract(contractHead.digest), review = this.qaReviewAttempts(runId, ticketId).at(-1);
+                store.event(runId, ticketId, `whole-work-waiver:${runId}:${ticketId}:${head.revision}`, "whole-work-waiver", { version: 1, runId, workId: ticketId, admissionDigest: admission.requirementsDigest, contractDigest: contract.contentDigest, revision: contract.revision, sourceDigest: review?.sourceDigest ?? null, reviewBasisDigest: head.reviewBasisDigest ?? null, mandatoryCheckIds: contract.checks.filter(check => check.obligation === "mandatory").map(check => check.id), unresolvedReports: this.unresolvedQaReports(runId, ticketId).map(report => report.reportOccurrenceId), reason, actor: "operator", authorizationRef, decisionId: authority.decisionId, mechanism: "existing-qa-nonconvergence-decision", at: now.toISOString(), completion: "waived" });
+            }
             for (const report of this.unresolvedQaReports(runId, ticketId))
                 this.setQaReportDisposition(report.reportOccurrenceId, "waived", reason, now);
+            const admission = this.admittedWork(runId, ticketId);
+            if (admission)
+                store.metric(runId, ticketId, admission.requirementsDigest, `metric:waiver:${runId}:${ticketId}:${head.revision}`, "waived", { at: now.toISOString() });
             return this.transitionQa(runId, ticketId, head.revision, { type: "waived" }, now);
         })();
     }
@@ -995,6 +1765,11 @@ export class WorkflowDb {
         return this.db.transaction(() => {
             this.recordBuilderRemediationReceipt(receipt);
             this.markQaReportsRecheckRequired(receipt.runId, receipt.ticketId, "Builder remediation received; QA recheck required", now);
+            const admission = this.admittedWork(receipt.runId, receipt.ticketId);
+            const remediation = this.qaRemediationAttempt(receipt.operationId);
+            const review = remediation ? this.qaReviewAttempt(remediation.reviewAttemptId) : undefined;
+            if (admission)
+                this.qaPreparationStore().metric(receipt.runId, receipt.ticketId, admission.requirementsDigest, `metric:remediation:${receipt.operationId}`, "remediation", { phase: "remediation", findingIds: review?.namespacedFindingIds ?? [], at: now.toISOString() });
             return this.transitionQa(receipt.runId, receipt.ticketId, expectedRevision, { type: "remediation-received" }, now);
         })();
     }
@@ -1016,7 +1791,60 @@ export class WorkflowDb {
             return this.transitionQa(remediation.runId, remediation.ticketId, head.revision, { type: input.outcome === "uncertain" ? "remediation-uncertain" : "remediation-failed" }, now);
         })();
     }
+    assertContractCertificate(input) {
+        const store = this.qaPreparationStore();
+        if (store.policy(input.runId)?.mode !== "enforce")
+            return;
+        const binding = input.contractCoverage;
+        if (!binding || binding.version !== 1)
+            throw new Error("Enforcing pass requires tagged contract coverage authority");
+        const admission = this.assertAdmittedWork(input.runId, input.ticketId);
+        const head = store.head(input.runId, input.ticketId, admission.requirementsDigest);
+        if (head.state !== "ready" || head.digest !== binding.contractDigest)
+            throw new Error("Pass contract is stale or incomplete");
+        const contract = store.contract(binding.contractDigest);
+        if (contract.revision !== binding.revision)
+            throw new Error("Pass revision mismatch");
+        const basisRow = this.db.prepare("SELECT basis_json FROM qa_review_bases WHERE digest=? AND run_id=? AND ticket_id=?").get(input.reviewBasisDigest, input.runId, input.ticketId);
+        if (!basisRow)
+            throw new Error("Pass lacks immutable input basis");
+        const basis = parseJson(basisRow.basis_json);
+        const definition = this.workDefinitions(input.runId).find(work => work.workId === input.ticketId)?.definition;
+        if (!definition || basis.ticketDigest !== qaDigest("ticket", definition))
+            throw new Error("Pass ticket basis differs from frozen admitted scope");
+        const { digest, ...fields } = basis;
+        if (digest !== qaDigest("review-basis-fields", fields) || basis.contractBinding?.digest !== contract.contentDigest || basis.contractBinding.admissionDigest !== admission.requirementsDigest)
+            throw new Error("Pass basis/contract binding mismatch");
+        const configuredMake = this.getRun(input.runId)?.state?.qa?.settings?.make;
+        if (configuredMake && resolveEffectiveQaConfiguration(this.projectDir, { make: configuredMake }).digest !== basis.contractBinding.commonConfigDigest)
+            throw new Error("Effective QA configuration changed before pass authority; reconcile contract");
+        const attempt = this.qaReviewAttempt(binding.attemptId);
+        if (!attempt || attempt.runId !== input.runId || attempt.ticketId !== input.ticketId || attempt.sourceDigest !== input.sourceStateDigest || attempt.reviewNumber !== this.qaTicketHead(input.runId, input.ticketId).reviewNumber)
+            throw new Error("Coverage review attempt is stale or foreign");
+        const coverage = store.artifact(binding.coverageDigest, "final-coverage");
+        for (const check of contract.checks)
+            for (const method of check.verification)
+                if (method.equivalentAuthorityId && !store.equivalentResolver()(method.equivalentAuthorityId, contract, check, method, input.sourceStateDigest))
+                    throw new Error("Equivalent verification authority is stale or foreign");
+        const errors = validateContractCoverage(contract, coverage, { phase: "qa", sourceDigest: input.sourceStateDigest, inputBasisDigest: input.reviewBasisDigest, attemptId: binding.attemptId, sessionId: binding.sessionId });
+        if (errors.length)
+            throw new Error(errors.join("; "));
+        const initialTurns = this.db.prepare("SELECT intent_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND review_number=? AND source_state_digest=? AND review_basis_digest=?").all(input.runId, input.ticketId, attempt.reviewNumber, input.sourceStateDigest, input.reviewBasisDigest);
+        const initial = initialTurns.map(row => parseJson(row.intent_json)).find(turn => turn.slot === "initial");
+        if (!initial || initial.providerSession.sessionId !== binding.sessionId)
+            throw new Error("Coverage lacks the actual fresh review dispatch identity");
+        const dispatchedInstruction = this.getEvidence(initial.instructionDigest)?.toString();
+        const envelope = `\nImmutable input-basis digest: ${basis.digest}. Coverage must bind this inputBasisDigest.`;
+        if (basis.contractBinding.transportVersion !== 1 || !dispatchedInstruction?.endsWith(envelope) || qaDigest("instruction", dispatchedInstruction.slice(0, -envelope.length)) !== basis.instructionDigest)
+            throw new Error("Actual review dispatch differs from frozen base instruction and tagged input-basis envelope");
+        const receipts = this.db.prepare("SELECT receipt_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND source_state_digest=? AND review_basis_digest=? AND status='completed'").all(input.runId, input.ticketId, input.sourceStateDigest, input.reviewBasisDigest);
+        const receipt = receipts.map(row => parseJson(row.receipt_json)).find(row => qaDigest("turn-receipt", row) === input.turnReceiptDigest && row.terminalEventObserved);
+        const response = receipt?.cleanedResponseDigest ? this.getEvidence(receipt.cleanedResponseDigest) : undefined;
+        if (!receipt || !response || canonicalJson(parseContractCoverage(response.toString())) !== canonicalJson(coverage))
+            throw new Error("Coverage is not bound to the retained terminal review receipt");
+    }
     issueQaPassCertificate(input, now = new Date()) {
+        this.assertContractCertificate(input);
         if (this.unresolvedQaReports(input.runId, input.ticketId).length)
             throw new Error("cannot issue QA pass certificate while reports remain unresolved");
         const certificate = { version: 2, certificateId: qaDigest("pass-certificate", { ...input, issuedAt: now.toISOString() }), ...input, unresolvedReportCount: 0, issuedAt: now.toISOString() };
@@ -1041,6 +1869,7 @@ export class WorkflowDb {
                 || attempt.sourceDigest !== input.sourceStateDigest || attempt.status !== "started") {
                 throw new Error(`QA pass attempt binding mismatch: ${attemptId}`);
             }
+            this.assertContractCertificate(input);
             this.finishQaReviewAttempt(attemptId, { status: "passed", detail }, now);
             return this.commitQaPass(input, expectedRevision, now);
         })();
@@ -1052,6 +1881,7 @@ export class WorkflowDb {
                 throw new Error("QA pass certificate is missing or scoped to another run/ticket");
             if (row.consumed_at)
                 throw new Error("QA pass certificate has already been consumed");
+            this.assertContractCertificate(parseJson(row.certificate_json));
             if (this.unresolvedQaReports(runId, ticketId).length)
                 throw new Error("QA pass certificate cannot be consumed with unresolved reports");
             const at = now.toISOString();
@@ -1062,9 +1892,9 @@ export class WorkflowDb {
             return certificate;
         })();
     }
-    invalidateUnconsumedQaPassCertificates(runId, ticketId, reason, now = new Date()) {
+    invalidateUnconsumedQaPassCertificates(runId, ticketId, reason, now = new Date(), issuedBefore) {
         const at = now.toISOString();
-        this.db.prepare("UPDATE qa_pass_certificates SET consumed_at=?,consumed_by=? WHERE run_id=? AND ticket_id=? AND consumed_at IS NULL").run(at, `invalidated:${reason}`, runId, ticketId);
+        this.db.prepare("UPDATE qa_pass_certificates SET consumed_at=?,consumed_by=? WHERE run_id=? AND ticket_id=? AND consumed_at IS NULL AND (? IS NULL OR issued_at<=?)").run(at, `invalidated:${reason}`, runId, ticketId, issuedBefore ?? null, issuedBefore ?? null);
     }
     invalidateQaPassBeforeFinalization(input, now = new Date()) {
         return this.db.transaction(() => {
@@ -1080,6 +1910,7 @@ export class WorkflowDb {
     }
     beginQaFinalization(input, now = new Date()) {
         return this.db.transaction(() => {
+            this.assertFinalizationControls(input.runId, input.ticketId);
             const head = this.qaTicketHead(input.runId, input.ticketId);
             if (head.revision !== input.expectedRevision || head.state !== "passed")
                 throw new Error(`QA finalization start raced for ${input.runId}/${input.ticketId}`);
@@ -1156,10 +1987,14 @@ export class WorkflowDb {
     }
     completeQaFinalization(runId, ticketId, expectedRevision, receipt, now = new Date()) {
         return this.db.transaction(() => {
+            this.assertFinalizationControls(runId, ticketId);
             const head = this.qaTicketHead(runId, ticketId);
             if (head.revision !== expectedRevision || head.state !== "finalizing")
                 throw new Error(`QA finalization completion raced for ${runId}/${ticketId}`);
             this.finishPendingQaFinalizationSteps(runId, ticketId, receipt, now);
+            const admission = this.admittedWork(runId, ticketId);
+            if (admission)
+                this.qaPreparationStore().metric(runId, ticketId, admission.requirementsDigest, `metric:completed:${runId}:${ticketId}`, "completed", { at: now.toISOString() });
             return this.transitionQa(runId, ticketId, head.revision, { type: "completed" }, now);
         })();
     }
@@ -1475,16 +2310,36 @@ export class WorkflowDb {
         const pid = process.pid;
         const processStart = processStartIdentity();
         return this.db.transaction(() => {
+            const admission = this.buildAdmission();
+            if (admission) {
+                const local = localBuildAuthority(this.projectDir);
+                if (!local || local.token !== admission.token || local.runId !== runId) {
+                    const state = classifyProcess(admission.pid, admission.processStart, admission.host);
+                    if (state.state !== "dead")
+                        throw new Error(`Build ${admission.runId} admission is ${state.state}: ${state.reason}`);
+                    if (this.db.prepare("SELECT 1 FROM build_launches WHERE run_id=? AND state IN ('reserved','dispatching')").get(admission.runId))
+                        throw new Error("Unresolved build launch requires reconciliation");
+                }
+                else
+                    assertAdmission(this.db, local);
+            }
             const current = this.currentLease();
             if (current && leaseVerifiedLive(current, now, staleMs))
                 throw new Error(`project workflow lease is held by ${current.owner} for run ${current.runId}`);
-            const generation = (current?.generation ?? 0) + 1;
+            const sequence = this.db.prepare("SELECT generation FROM workflow_lease_sequence WHERE singleton=1").get();
+            const generation = Math.max(sequence.generation, current?.generation ?? 0) + 1;
+            this.db.prepare("UPDATE workflow_lease_sequence SET generation=? WHERE singleton=1").run(generation);
             this.db.prepare(`INSERT INTO project_lease(singleton,owner,generation,pid,host,process_start,heartbeat_at,run_id)
         VALUES(1,?,?,?,?,?,?,?) ON CONFLICT(singleton) DO UPDATE SET owner=excluded.owner,generation=excluded.generation,pid=excluded.pid,host=excluded.host,process_start=excluded.process_start,heartbeat_at=excluded.heartbeat_at,run_id=excluded.run_id`)
                 .run(owner, generation, pid, host, processStart, at, runId);
             this.db.prepare("UPDATE workflow_runs SET lease_generation=? WHERE run_id=?").run(generation, runId);
             this.insertEvent(runId, current ? "lease_takeover" : "lease_acquired", "lease", { owner, generation, previous: current?.owner }, at);
-            return { owner, generation, pid, host, processStart, heartbeatAt: at, runId };
+            const lease = { owner, generation, pid, host, processStart, heartbeatAt: at, runId };
+            this.writerLease = lease;
+            rememberOriginalLease(this.projectDir, lease);
+            if (this.getRun(runId)?.kind === "build")
+                this.db.prepare("INSERT OR IGNORE INTO build_runtime_runs VALUES(?)").run(runId);
+            return lease;
         }).immediate();
     }
     heartbeatLease(lease, now = new Date()) {
@@ -1497,6 +2352,8 @@ export class WorkflowDb {
     releaseLease(lease, now = new Date()) {
         this.db.transaction(() => {
             const result = this.db.prepare("DELETE FROM project_lease WHERE singleton=1 AND owner=? AND generation=?").run(lease.owner, lease.generation);
+            if (result.changes === 1)
+                forgetOriginalLease(this.projectDir, lease);
             if (result.changes === 1)
                 this.insertEvent(lease.runId, "lease_released", "lease", { generation: lease.generation }, now.toISOString());
         })();
@@ -1741,25 +2598,12 @@ function sanitizeContinuityValue(value, depth = 0) {
 function leaseVerifiedLive(lease, now, staleMs) {
     void now;
     void staleMs;
-    // Heartbeat expiry is not proof of process death. Remote or inaccessible
-    // identities require operator reconciliation; only proven-dead owners move.
-    if (lease.host !== hostname())
-        return true;
-    try {
-        process.kill(lease.pid, 0);
-    }
-    catch (error) {
-        return error.code !== "ESRCH";
-    }
-    const actual = processStartIdentity(lease.pid);
-    if (actual === "unavailable" || lease.processStart === "unavailable")
-        return true;
-    return actual === lease.processStart;
+    return classifyProcess(lease.pid, lease.processStart, lease.host).state !== "dead";
 }
 function ensureRecoveryGitignore(projectDir) {
     const localExclude = join(projectDir, ".git", "info", "exclude");
     const path = existsSync(localExclude) ? localExclude : join(projectDir, ".gitignore");
-    const entries = [WORKFLOW_DB_FILE, `${WORKFLOW_DB_FILE}-wal`, `${WORKFLOW_DB_FILE}-shm`, ".rafi/cache/handoffs/"];
+    const entries = [WORKFLOW_DB_FILE, `${WORKFLOW_DB_FILE}-wal`, `${WORKFLOW_DB_FILE}-shm`, ".rafi/cache/handoffs/", ".rafi/backups/work-admission-v4/"];
     const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
     const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
     if (missing.length)