ai-foreman 1.7.20 → 1.7.21

package/dist/buildRuns.js

@@ -1,3 +1,4 @@
+import { loadQaPreparationPolicy } from "./qaEffectiveConfig.js";
 export { withBuildInvocation as withBuildRecoveryInvocation, launchDigest as launchArgumentDigest } from "./buildAdmission.js";
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -14,6 +15,7 @@ import { isTicketsInitialized, loadTicketsConfig, resolveTicketPaths } from "./t
 import { loadTickets } from "./tickets/ticketLoader.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy } from "./recoveryPolicy.js";
 import { classifyProcess, processStartIdentity } from "./processIdentity.js";
+import { assertBuildAssignmentReconciled } from "./buildAssignment.js";
 export const BUILD_RUN_VERSION = 3;
 export const BUILD_RUN_DIRECTORY = ".foreman/runs";
 export const BUILD_HEARTBEAT_MS = 10_000;
@@ -48,6 +50,8 @@ export function createBuildRun(input) {
         runId: input.runId ?? randomUUID(),
         status: "running",
         tickets: [...input.tickets],
+        authorizedBatch: input.authorizedBatch ?? (input.tickets.length && (input.branchMode ?? "current") === "current" ? { tickets: [...input.tickets], requestedSteps: input.tickets.length, scopeRevision: "explicit-create-selection", startedTickets: [] } : undefined),
+        builderCapabilities: input.builderCapabilities,
         deliveryUnit: input.deliveryUnit,
         branchMode: input.branchMode ?? "current",
         checkpoint: "created",
@@ -81,6 +85,7 @@ export function createBuildRun(input) {
     try {
         workflow.ensureRun(run.runId, "build", now);
         const authority = workflow.acquireLease(run.runId, undefined, now, BUILD_LEASE_STALE_MS);
+        workflow.qaPreparationStore().freezePolicy(run.runId, loadQaPreparationPolicy(input.repositoryRoot));
         return saveBuildRun(input.repositoryRoot, bindBuildAuthority(run, authority), now);
     }
     finally {
@@ -130,7 +135,7 @@ function normalizeCapturedSettings(settings) {
         ...settings,
         session_strategy: settings.session_strategy ?? (["builder", "qa", "ticket-maker"].includes(settings.role) ? "compact" : "fresh"),
         display_session_cost: settings.display_session_cost ?? false,
-        auto_compact_threshold_percent: settings.auto_compact_threshold_percent ?? 50,
+        auto_compact_threshold_percent: settings.auto_compact_threshold_percent ?? 65,
         compact_maximum: settings.compact_maximum ?? 10,
         settings_revision: settings.settings_revision ?? 0,
     };
@@ -169,6 +174,8 @@ export function saveBuildRun(projectDir, run, now = new Date()) {
             const frozenPolicy = workflow.freezeAutonomyPolicy(next.runId, next.frozenPolicy, now);
             next = { ...next, frozenPolicy, recoveryAttempts: workflow.recoveryAttempts(next.runId), pendingDecisions: workflow.pendingHumanDecisions(next.runId), supervisor: workflow.supervisorState(next.runId) ?? next.supervisor };
             const existing = workflow.getRun(next.runId);
+            const priorProgress = existing?.state.progress;
+            next = { ...next, progress: { ...next.progress, completedTickets: [...new Set([...next.progress.completedTickets, ...(priorProgress?.completedTickets ?? [])])] } };
             if (existing && ["completed", "cancelled", "superseded"].includes(existing.status) && workflowStatus(next.status) !== existing.status)
                 throw new Error(`cannot rewrite a ${existing.status} build run`);
             if (!existing)
@@ -287,6 +294,7 @@ export function releaseBuildLease(projectDir, run, status = "interrupted") {
     return saved;
 }
 export function completeBuildRun(projectDir, run, now = new Date()) {
+    assertBuildAssignmentReconciled(projectDir, run.runId);
     if (run.status === "completed") {
         const committed = readBuildRuns(projectDir).find(item => item.runId === run.runId);
         if (committed?.status === "completed" && JSON.stringify(committed) === JSON.stringify(run))
@@ -312,6 +320,8 @@ export function finishRecoveredTicketScope(projectDir, run, checkpoint) {
     if (run.branchMode !== "current" || !run.tickets.length || !isTicketsInitialized(projectDir))
         throw new Error("Ticket recovery completion requires an initialized current-branch run scope");
     const { completed, remaining } = currentBranchTicketProgress(projectDir, run);
+    if (!remaining.length && !run.authorizedBatch)
+        return releaseBuildLease(projectDir, checkpointBuildRun(projectDir, run, "legacy-scope-reconciliation-required", { progress: { ...run.progress, completedTickets: completed, remainingTickets: [], nextAction: "Confirm the original authorized batch scope before declaring the build complete" } }), "recoverable");
     if (!remaining.length)
         return completeBuildRun(projectDir, run);
     return releaseBuildLease(projectDir, checkpointBuildRun(projectDir, run, checkpoint, {
@@ -354,10 +364,8 @@ export function readBuildRuns(projectDir) {
             const run = authoritative?.runId ? authoritative : projection;
             let upgraded = upgradeBuildRun(run, projectDir);
             const dbStatus = workflow.getRun(run.runId)?.status;
-            if (dbStatus === "superseded" || dbStatus === "completed")
+            if (dbStatus === "superseded" || dbStatus === "completed" || dbStatus === "cancelled")
                 upgraded = { ...upgraded, status: dbStatus };
-            if (dbStatus === "cancelled")
-                return [];
             if (!["completed", "superseded", "cancelled"].includes(workflow?.getRun(run.runId)?.status ?? "")) {
                 for (const role of ["builder", "qa"]) {
                     const lease = workflow?.roleMutationLease(run.runId, role);
@@ -379,7 +387,7 @@ export function recoverableBuildRuns(projectDir, now = new Date()) {
     const reader = new WorkflowReader(projectDir);
     const databaseLease = reader.currentLease();
     const admission = reader.buildAdmission();
-    const unfinished = readBuildRuns(projectDir).filter(run => !["completed", "superseded"].includes(run.status));
+    const unfinished = readBuildRuns(projectDir).filter(run => !["completed", "cancelled", "superseded"].includes(run.status));
     const cleanupRuns = [...new Set(reader.readinessProcesses().map(row => row.run_id))].filter(id => !unfinished.some(run => run.runId === id)).map(runId => {
         const run = reader.getRun(runId);
         const at = run?.updatedAt ?? new Date(0).toISOString();
@@ -400,7 +408,7 @@ export function recoverableBuildRuns(projectDir, now = new Date()) {
             let owner = owners.find(item => item.state === "live") ?? owners.find(item => item.state === "unknown") ?? { state: "dead", reason: "No live owner recorded" };
             if (owner.state !== "live" && reader.pendingBuildLaunches(run.runId).some(launch => launch.state === "dispatching"))
                 owner = { state: "unknown", reason: "launch dispatch began but no child claim was confirmed; reconcile the launcher and child process evidence before retrying" };
-            return { ...inferLegacyRunTickets(projectDir, run), active: owner.state === "live", ownership: owner.state, ownershipReason: owner.reason };
+            return { ...run, active: owner.state === "live", ownership: owner.state, ownershipReason: owner.reason };
         });
     }
     finally {
@@ -408,18 +416,16 @@ export function recoverableBuildRuns(projectDir, now = new Date()) {
     }
 }
 /**
- * Current-branch runs created before ticket checkpointing did not retain their
- * selected ticket. Recover it from Foreman's tracker events so --ticket can
- * still address those durable runs without rewriting the legacy record.
+ * Timestamp correlations are diagnostic hints, never executable membership.
  */
-function inferLegacyRunTickets(projectDir, run) {
-    if (run.tickets.length > 0 || !isTicketsInitialized(projectDir))
-        return run;
+export function legacyTrackerWorkHints(projectDir, run) {
+    if (!isTicketsInitialized(projectDir))
+        return [];
     let db;
     try {
         const paths = resolveTicketPaths(loadTicketsConfig(projectDir), projectDir);
         if (!existsSync(paths.stateDb))
-            return run;
+            return [];
         db = new Database(paths.stateDb, { readonly: true, fileMustExist: true });
         const rows = db.prepare(`
       SELECT ticket_id
@@ -431,12 +437,10 @@ function inferLegacyRunTickets(projectDir, run) {
       ORDER BY timestamp, id
     `).all(run.createdAt, run.updatedAt);
         const tickets = [...new Set(rows.map((row) => row.ticket_id).filter(Boolean))];
-        if (tickets.length === 0)
-            return run;
-        return { ...run, tickets, currentTicket: tickets.at(-1) };
+        return tickets;
     }
     catch {
-        return run;
+        return [];
     }
     finally {
         db?.close();
@@ -649,6 +653,8 @@ function validateBuildRun(run) {
     }
 }
 function workflowStatus(status) {
+    if (status === "cancelled")
+        return "cancelled";
     if (status === "completed")
         return "completed";
     if (status === "failed")

package/dist/buildSyntheticWork.d.ts

@@ -0,0 +1,2 @@
+/** Explicit unticketed CLI mode freezes each work definition before its first dispatch. */
+export declare function initializeSyntheticWork(projectDir: string, runId: string, steps: number, authorization: string, approvedPlan?: string): string[];

package/dist/buildSyntheticWork.js

@@ -0,0 +1,30 @@
+import { randomUUID } from "node:crypto";
+import { WorkflowDb } from "./workflowDb.js";
+import { buildScopeRevision } from "./buildApproval.js";
+/** Explicit unticketed CLI mode freezes each work definition before its first dispatch. */
+export function initializeSyntheticWork(projectDir, runId, steps, authorization, approvedPlan = "Explicit unticketed work authorized by the host") {
+    if (!Number.isSafeInteger(steps) || steps < 1 || steps > 10000)
+        throw new Error("Invalid synthetic work step limit");
+    if (!approvedPlan.trim() || Buffer.byteLength(approvedPlan) > 262144)
+        throw new Error("Synthetic work requires a bounded, frozen approved preflight plan");
+    const db = new WorkflowDb(projectDir);
+    try {
+        return db.atomic(() => {
+            db.ensureRun(runId);
+            const existing = db.workDefinitions(runId).filter(work => work.kind === "synthetic");
+            if (existing.length)
+                return existing.map(work => work.workId);
+            const ids = [];
+            for (let step = 1; step <= steps; step++) {
+                const id = `synthetic:${randomUUID()}`;
+                const definition = { id, order: step, title: `Authorized unticketed step ${step}`, area: "project", priority: "P2", size: "M", risk: "Low", depends_on: [], summary: `Implement step ${step} of the explicitly authorized project work`, acceptance: ["Satisfy the approved project requirements and the host preflight plan"], required_tests: ["Run the relevant project validation"], likely_files: [], notes: `Frozen approved preflight plan:\n${approvedPlan}` };
+                db.admitWork({ runId, kind: "synthetic", workId: id, definition, approvalId: `unticketed:${runId}`, scopeRevision: buildScopeRevision(projectDir), provenance: { userTurn: authorization, reason: "Explicit unticketed CLI invocation after approval" } });
+                ids.push(id);
+            }
+            return ids;
+        });
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/buildWorkAdmission.d.ts

@@ -0,0 +1,17 @@
+import type Database from "better-sqlite3";
+import { type BuildWorkAdmissionV1 } from "rafi-spec";
+export type { BuildWorkAdmissionV1 } from "rafi-spec";
+export interface AdmitWorkInput {
+    runId: string;
+    workId?: string;
+    kind: "ticket" | "synthetic";
+    ticketId?: string;
+    definition: unknown;
+    approvalId: string;
+    scopeRevision: string;
+    provenance: BuildWorkAdmissionV1["provenance"];
+}
+export declare function admittedWork(db: Database.Database, runId: string, workId: string): BuildWorkAdmissionV1 | undefined;
+export declare function assertAdmittedWork(db: Database.Database, runId: string, workId: string): BuildWorkAdmissionV1;
+/** Only host approval/reconciliation callers hold this service; reads never call it. */
+export declare function admitWork(db: Database.Database, input: AdmitWorkInput, metadataRepair?: boolean): BuildWorkAdmissionV1;

package/dist/buildWorkAdmission.js

@@ -0,0 +1,57 @@
+import { createHash, randomUUID } from "node:crypto";
+import { qaDigest } from "./qaProtocolV2.js";
+import { validateBuildWorkAdmissionV1 } from "rafi-spec";
+export function admittedWork(db, runId, workId) {
+    const row = db.prepare("SELECT a.record_json FROM build_work_admissions a JOIN build_work_scope s USING(run_id,work_id) WHERE a.run_id=? AND a.work_id=? AND s.state='admitted' ORDER BY a.sequence DESC LIMIT 1").get(runId, workId);
+    return row ? JSON.parse(row.record_json) : undefined;
+}
+export function assertAdmittedWork(db, runId, workId) {
+    const admission = admittedWork(db, runId, workId);
+    if (!admission)
+        throw new Error(`Work ${runId}/${workId} is not admitted; ownership reconciliation is required before dispatch`);
+    return admission;
+}
+/** Only host approval/reconciliation callers hold this service; reads never call it. */
+export function admitWork(db, input, metadataRepair = false) {
+    if (!input.approvalId || !input.scopeRevision || !input.provenance.reason || !(input.provenance.userTurn || input.provenance.decisionId || input.provenance.approvedPlanDigest))
+        throw new Error("Work admission requires explicit authorization provenance and requirements revision");
+    if (input.kind === "ticket" && (!input.ticketId || input.workId && input.workId !== input.ticketId || input.ticketId.startsWith("synthetic:")))
+        throw new Error("Ticket work identity is invalid");
+    const workId = input.kind === "ticket" ? input.ticketId : input.workId ?? `synthetic:${randomUUID()}`;
+    if (input.kind === "synthetic" && !/^synthetic:[a-f0-9-]{36}$/.test(workId))
+        throw new Error("Synthetic work requires a persisted opaque identity");
+    const requirementsDigest = qaDigest("admitted-requirements", input.definition);
+    return db.transaction(() => {
+        const prior = admittedWork(db, input.runId, workId);
+        if (prior?.requirementsDigest === requirementsDigest && prior.scopeRevision === input.scopeRevision)
+            return prior;
+        const run = db.prepare("SELECT status FROM workflow_runs WHERE run_id=?").get(input.runId);
+        if (!run || !metadataRepair && ["completed", "cancelled", "superseded"].includes(run.status))
+            throw new Error("Admission requires a nonterminal build");
+        const quarantined = db.prepare("SELECT state FROM build_work_scope WHERE run_id=? AND work_id=?").get(input.runId, workId);
+        if (quarantined?.state === "quarantined")
+            throw new Error("Historical work requires audited ownership reconciliation before admission");
+        db.prepare("INSERT OR IGNORE INTO build_work_scope VALUES(?,?,?,?, 'admitted',?)").run(input.runId, workId, input.kind, input.ticketId ?? null, JSON.stringify(input.definition));
+        const definitionBytes = Buffer.from(JSON.stringify(input.definition));
+        const definitionDigest = createHash("sha256").update(definitionBytes).digest("hex");
+        db.prepare("INSERT OR IGNORE INTO content_refs VALUES(?,'qa',?,?)").run(definitionDigest, definitionBytes, new Date().toISOString());
+        db.prepare("UPDATE build_work_scope SET definition_json=? WHERE run_id=? AND work_id=?").run(JSON.stringify(input.definition), input.runId, workId);
+        const projectId = db.prepare("SELECT project_id FROM build_project_identity").get().project_id;
+        const record = { version: 1, projectId, runId: input.runId, workId, kind: input.kind, ...(input.ticketId ? { ticketId: input.ticketId } : {}), assignmentId: randomUUID(), approvalId: input.approvalId, scopeRevision: input.scopeRevision, requirementsDigest, definitionDigest, admittedAt: new Date().toISOString(), admittedSequence: 0, provenance: input.provenance };
+        // Reserve sequence explicitly so immutable JSON and its ordinal agree.
+        record.admittedSequence = db.prepare("SELECT COALESCE(MAX(sequence),0)+1 AS n FROM build_work_admissions").get().n;
+        const validation = validateBuildWorkAdmissionV1(record);
+        if (!validation.valid)
+            throw new Error(`Invalid work admission: ${validation.errors.join("; ")}`);
+        db.prepare("INSERT INTO build_work_admissions VALUES(?,?,?,?,?,?,?,?,?,?)").run(record.admittedSequence, randomUUID(), record.runId, workId, record.assignmentId, record.approvalId, record.scopeRevision, requirementsDigest, JSON.stringify(record), record.admittedAt);
+        const snapshot = db.prepare("SELECT state_json FROM workflow_runs WHERE run_id=?").get(input.runId);
+        const state = JSON.parse(snapshot.state_json);
+        if (metadataRepair && !Array.isArray(state.tickets))
+            state.tickets = [];
+        if ((metadataRepair || state.version !== undefined) && Array.isArray(state.tickets) && !state.tickets.includes(workId)) {
+            state.tickets.push(workId);
+            db.prepare("UPDATE workflow_runs SET state_json=? WHERE run_id=?").run(JSON.stringify(state), input.runId);
+        }
+        return record;
+    }).immediate();
+}

package/dist/buildWorkAuthorization.d.ts

@@ -0,0 +1,2 @@
+/** Called by the CLI only after its source-bound approval gate succeeds. */
+export declare function admitApprovedTicket(projectDir: string, runId: string, ticketId: string, approvedRevision: string, authorization: string): void;

package/dist/buildWorkAuthorization.js

@@ -0,0 +1,23 @@
+import { WorkflowDb } from "./workflowDb.js";
+import { buildScopeRevision } from "./buildApproval.js";
+import { loadTicketsConfig, resolveTicketPaths } from "./tickets/config.js";
+import { loadTickets } from "./tickets/ticketLoader.js";
+import { qaDigest } from "./qaProtocolV2.js";
+/** Called by the CLI only after its source-bound approval gate succeeds. */
+export function admitApprovedTicket(projectDir, runId, ticketId, approvedRevision, authorization) {
+    const ticket = loadTickets(resolveTicketPaths(loadTicketsConfig(projectDir), projectDir).tickets).find(ticket => ticket.id === ticketId);
+    if (!ticket || buildScopeRevision(projectDir) !== approvedRevision)
+        throw new Error("Ticket requirements changed after approval; reselect and approve current work");
+    const db = new WorkflowDb(projectDir);
+    try {
+        db.atomic(() => {
+            const current = loadTickets(resolveTicketPaths(loadTicketsConfig(projectDir), projectDir).tickets).find(ticket => ticket.id === ticketId);
+            if (!current || buildScopeRevision(projectDir) !== approvedRevision || JSON.stringify(current) !== JSON.stringify(ticket))
+                throw new Error("Ticket eligibility or requirements changed during admission; reselect approved work");
+            db.admitWork({ runId, kind: "ticket", ticketId, definition: ticket, approvalId: qaDigest("build-work-approval", { runId, approvedRevision, authorization }), scopeRevision: approvedRevision, provenance: { userTurn: authorization, reason: "CLI source-bound build approval gate succeeded" } });
+        });
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/buildWorkContext.d.ts

@@ -0,0 +1,3 @@
+import type { TicketDef } from "./tickets/ticketSchema.js";
+/** Full authoritative definition, shared by initial/resumed/remediation paths. */
+export declare function renderBuildWorkContext(ticket: TicketDef, checklist: readonly string[]): string;

package/dist/buildWorkContext.js

@@ -0,0 +1,6 @@
+/** Full authoritative definition, shared by initial/resumed/remediation paths. */
+export function renderBuildWorkContext(ticket, checklist) {
+    return ["Full assigned work definition (scope authority):", JSON.stringify(ticket, null, 2),
+        "Project validation checklist:", ...(checklist.length ? checklist.map((item, index) => `${index + 1}. ${item}`) : ["No additional project checklist configured."]),
+        "Implement this assigned work and provide verification evidence. Final QA runs independently in a separate disposable snapshot and fresh reviewer conversation."].join("\n");
+}

package/dist/buildWorkMigration.d.ts

@@ -0,0 +1,9 @@
+import type Database from "better-sqlite3";
+export declare const BUILD_WORK_SCHEMA_VERSION = 4;
+/** A copied database must be rebound by state transfer, never by an ordinary writer. */
+export declare function assertBuildProject(db: Database.Database, projectDir: string): void;
+/** Classify legacy records without converting observed progress into permission. */
+export declare function migrateBuildWork(db: Database.Database, projectDir: string, faults?: {
+    beforeGuards?(): void;
+    beforeCommit?(): void;
+}): void;

package/dist/buildWorkMigration.js

@@ -0,0 +1,206 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, cpSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { classifyProcess } from "./processIdentity.js";
+export const BUILD_WORK_SCHEMA_VERSION = 4;
+const migration = "004_admitted_build_work";
+/** A copied database must be rebound by state transfer, never by an ordinary writer. */
+export function assertBuildProject(db, projectDir) {
+    const identity = db.prepare("SELECT canonical_root FROM build_project_identity WHERE singleton=1").get();
+    if (identity.canonical_root !== realpathSync(projectDir))
+        throw new Error("Build project identity requires explicit state-transfer rebinding");
+}
+/** Classify legacy records without converting observed progress into permission. */
+export function migrateBuildWork(db, projectDir, faults) {
+    if (db.prepare("SELECT 1 FROM recovery_schema_migrations WHERE migration=?").get(migration)) {
+        assertBuildProject(db, projectDir);
+        return;
+    }
+    const lease = db.prepare("SELECT pid,process_start,host FROM project_lease").get();
+    if (lease && classifyProcess(lease.pid, lease.process_start, lease.host).state !== "dead")
+        throw new Error("Work admission upgrade requires stopped, verified writers and a consistent backup");
+    const owner = db.prepare("SELECT record_json FROM build_admission").get();
+    if (owner) {
+        const identity = JSON.parse(owner.record_json);
+        if (classifyProcess(identity.pid, identity.processStart, identity.host).state !== "dead")
+            throw new Error("Work admission upgrade requires a stopped, verified build owner");
+    }
+    const backup = db.serialize();
+    // The coherent WAL-visible backup survives even a rolled-back upgrade.
+    // Publish the packet copy and manifest before enabling any new writer.
+    const backupDigest = createHash("sha256").update(backup).digest("hex");
+    const backupRoot = join(projectDir, ".rafi", "backups", "work-admission-v4");
+    const backupPath = join(backupRoot, backupDigest);
+    mkdirSync(backupRoot, { recursive: true, mode: 0o700 });
+    if (!existsSync(backupPath)) {
+        const staging = join(backupRoot, `${backupDigest}.${randomUUID()}.tmp`);
+        mkdirSync(staging, { mode: 0o700 });
+        const file = join(staging, "recovery.sqlite3");
+        writeFileSync(file, backup, { mode: 0o600 });
+        const descriptor = openSync(file, "r");
+        try {
+            fsyncSync(descriptor);
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        const packets = join(projectDir, ".foreman", "qa-report-recovery");
+        if (existsSync(packets))
+            cpSync(packets, join(staging, "qa-report-recovery"), { recursive: true, dereference: false });
+        const packetFiles = syncBackupTree(staging);
+        const manifest = join(staging, "manifest.json");
+        writeFileSync(manifest, JSON.stringify({ version: 1, databaseDigest: backupDigest, canonicalRoot: realpathSync(projectDir), createdAt: new Date().toISOString(), packetCopy: existsSync(packets), files: packetFiles }), { mode: 0o600 });
+        syncFile(manifest);
+        syncDirectory(staging);
+        renameSync(staging, backupPath);
+        syncDirectory(backupRoot);
+    }
+    if (createHash("sha256").update(readFileSync(join(backupPath, "recovery.sqlite3"))).digest("hex") !== backupDigest)
+        throw new Error("Work admission backup failed integrity verification; preserve state before retry");
+    try {
+        db.transaction(() => {
+            db.exec(`
+      CREATE TABLE build_work_upgrade_backup(singleton INTEGER PRIMARY KEY CHECK(singleton=1),database_bytes BLOB NOT NULL,created_at TEXT NOT NULL);
+      CREATE TABLE build_project_identity(singleton INTEGER PRIMARY KEY CHECK(singleton=1),project_id TEXT NOT NULL UNIQUE,canonical_root TEXT NOT NULL);
+      CREATE TABLE build_work_scope(run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),work_id TEXT NOT NULL,kind TEXT NOT NULL CHECK(kind IN ('ticket','synthetic')),ticket_id TEXT,state TEXT NOT NULL CHECK(state IN ('admitted','quarantined')),definition_json TEXT NOT NULL,PRIMARY KEY(run_id,work_id),UNIQUE(run_id,ticket_id),CHECK((kind='ticket' AND ticket_id=work_id) OR (kind='synthetic' AND ticket_id IS NULL)));
+      CREATE TABLE build_work_admissions(sequence INTEGER PRIMARY KEY AUTOINCREMENT,admission_id TEXT NOT NULL UNIQUE,run_id TEXT NOT NULL,work_id TEXT NOT NULL,assignment_id TEXT NOT NULL,approval_id TEXT NOT NULL,scope_revision TEXT NOT NULL,requirements_digest TEXT NOT NULL,record_json TEXT NOT NULL,admitted_at TEXT NOT NULL,FOREIGN KEY(run_id,work_id) REFERENCES build_work_scope(run_id,work_id));
+      CREATE TABLE build_assignments(assignment_id TEXT PRIMARY KEY,run_id TEXT NOT NULL,work_id TEXT NOT NULL,operation_id TEXT NOT NULL UNIQUE,record_json TEXT NOT NULL,FOREIGN KEY(run_id,work_id) REFERENCES build_work_scope(run_id,work_id));
+      CREATE TABLE build_ownership_conflicts(conflict_id TEXT PRIMARY KEY,run_id TEXT NOT NULL,work_id TEXT NOT NULL,status TEXT NOT NULL,revision INTEGER NOT NULL,record_json TEXT NOT NULL,FOREIGN KEY(run_id,work_id) REFERENCES build_work_scope(run_id,work_id));
+      CREATE TABLE build_work_events(sequence INTEGER PRIMARY KEY AUTOINCREMENT,run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),work_id TEXT NOT NULL,table_name TEXT NOT NULL,record_key TEXT NOT NULL,action TEXT NOT NULL,record_json TEXT NOT NULL,created_at TEXT NOT NULL);
+      CREATE TABLE build_reconciliations(reconciliation_id TEXT PRIMARY KEY,run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),expected_revision TEXT NOT NULL,record_json TEXT NOT NULL,created_at TEXT NOT NULL);
+    `);
+            const now = new Date().toISOString();
+            db.prepare("INSERT INTO build_work_upgrade_backup VALUES(1,?,?)").run(backup, now);
+            db.prepare("INSERT INTO build_project_identity VALUES(1,?,?)").run(randomUUID(), realpathSync(projectDir));
+            const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'qa_%'").all().filter(({ name }) => /^[a-z_]+$/.test(name));
+            for (const { name } of tables) {
+                const columns = db.prepare(`PRAGMA table_info(${name})`).all();
+                if (!columns.some(column => column.name === "run_id") || !columns.some(column => column.name === "ticket_id"))
+                    continue;
+                for (const row of db.prepare(`SELECT DISTINCT run_id,ticket_id FROM ${name}`).all()) {
+                    db.prepare("INSERT OR IGNORE INTO build_work_scope VALUES(?,?,'ticket',?,'quarantined','{}')").run(row.run_id, row.ticket_id, row.ticket_id);
+                    db.prepare("INSERT OR IGNORE INTO build_ownership_conflicts VALUES(?,?,?,'unresolved',1,?)").run(`legacy:${row.run_id}:${row.ticket_id}`, row.run_id, row.ticket_id, JSON.stringify({ reason: "Legacy QA progress is not proof of run-bound approval and assignment", classification: "ownership_unestablished", observedTable: name }));
+                }
+            }
+            faults?.beforeGuards?.();
+            // Replace V3 guards atomically. Old connections register 3 and fail even on heartbeat writes.
+            for (const trigger of db.prepare("SELECT name,sql FROM sqlite_master WHERE type='trigger' AND name LIKE 'handback_v3_%'").all()) {
+                db.exec(`DROP TRIGGER "${trigger.name}"`);
+                db.exec(trigger.sql.replace("rafi_writer_protocol() != 3", "rafi_writer_protocol() != 4"));
+            }
+            db.function("rafi_writer_protocol", () => 4);
+            for (const { name } of db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'build_%'").all()) {
+                if (!/^[a-z_]+$/.test(name))
+                    throw new Error("Unexpected build storage table");
+                for (const action of ["INSERT", "UPDATE", "DELETE"])
+                    db.exec(`CREATE TRIGGER IF NOT EXISTS work_v4_protocol_${name}_${action} BEFORE ${action} ON ${name} BEGIN SELECT CASE WHEN rafi_writer_protocol()<>4 THEN RAISE(ABORT,'incompatible work admission writer') END; END`);
+            }
+            for (const { name } of tables) {
+                const columns = db.prepare(`PRAGMA table_info(${name})`).all();
+                let scope;
+                if (columns.some(column => column.name === "run_id") && columns.some(column => column.name === "ticket_id"))
+                    scope = target => `s.run_id=${target}.run_id AND s.work_id=${target}.ticket_id`;
+                else if (columns.some(column => column.name === "run_id") && columns.some(column => column.name === "work_id"))
+                    scope = target => `s.run_id=${target}.run_id AND s.work_id=${target}.work_id`;
+                else if (name === "qa_preparation_attempts" || name === "qa_preparation_progress")
+                    scope = target => `EXISTS(SELECT 1 FROM qa_preparation_budgets b WHERE b.id=${target}.budget_id AND b.run_id=s.run_id AND b.work_id=s.work_id)`;
+                else if (name === "qa_contract_receipts")
+                    scope = target => `EXISTS(SELECT 1 FROM qa_verification_contracts c WHERE c.digest=${target}.contract_digest AND c.run_id=s.run_id AND c.work_id=s.work_id)`;
+                else if (columns.some(column => column.name === "report_occurrence_id"))
+                    scope = target => `EXISTS(SELECT 1 FROM qa_reports r WHERE r.report_occurrence_id=${target}.report_occurrence_id AND r.run_id=s.run_id AND r.ticket_id=s.work_id)`;
+                else if (columns.some(column => column.name === "operation_id"))
+                    scope = target => `EXISTS(SELECT 1 FROM qa_turns t WHERE t.operation_id=${target}.operation_id AND t.run_id=s.run_id AND t.ticket_id=s.work_id)`;
+                else
+                    continue;
+                for (const action of ["INSERT", "UPDATE", "DELETE"]) {
+                    const target = action === "DELETE" ? "OLD" : "NEW";
+                    db.exec(`CREATE TRIGGER work_v4_scope_${name}_${action} BEFORE ${action} ON ${name} WHEN NOT EXISTS(SELECT 1 FROM build_work_scope s WHERE ${scope(target)} AND s.state='admitted') BEGIN SELECT RAISE(ABORT,'QA work is not admitted; reconcile ownership first'); END`);
+                }
+            }
+            for (const { name } of tables) {
+                const columns = db.prepare(`PRAGMA table_info(${name})`).all();
+                if (!columns.some(column => column.name === "run_id") || !columns.some(column => column.name === "ticket_id"))
+                    continue;
+                const keys = columns.filter(column => column.pk).sort((a, b) => a.pk - b.pk).map(column => `NEW.${column.name}`);
+                const retained = columns.filter(column => column.pk || ["status", "state", "disposition", "review_number", "from_revision", "to_revision", "source_digest", "source_state_digest", "report_digest", "review_basis_digest", "certificate_id", "generation", "request_digest", "response_digest", "summary_digest", "event_json"].includes(column.name)).flatMap(column => [`'${column.name}'`, `NEW.${column.name}`]);
+                for (const action of ["INSERT", "UPDATE"])
+                    db.exec(`CREATE TRIGGER work_v4_order_${name}_${action} AFTER ${action} ON ${name} BEGIN INSERT INTO build_work_events(run_id,work_id,table_name,record_key,action,record_json,created_at) VALUES(NEW.run_id,NEW.ticket_id,'${name}',json_array(${keys.join(",")}), '${action.toLowerCase()}',json_object(${retained.join(",")}),strftime('%Y-%m-%dT%H:%M:%fZ','now')); END`);
+            }
+            for (const { name } of tables) {
+                const columns = db.prepare(`PRAGMA table_info(${name})`).all();
+                if (columns.some(column => column.name === "run_id") && columns.some(column => column.name === "ticket_id"))
+                    db.exec(`CREATE TRIGGER work_v4_identity_${name} BEFORE UPDATE ON ${name} WHEN NEW.run_id<>OLD.run_id OR NEW.ticket_id<>OLD.ticket_id BEGIN SELECT RAISE(ABORT,'Scoped QA identity is immutable'); END`);
+            }
+            for (const action of ["INSERT", "UPDATE"]) {
+                db.exec(`CREATE TRIGGER work_v4_report_parent_${action} BEFORE ${action} ON qa_reports WHEN NOT EXISTS(SELECT 1 FROM qa_review_attempts p WHERE p.run_id=NEW.run_id AND p.ticket_id=NEW.ticket_id AND p.review_number=NEW.review_number AND p.source_digest=NEW.source_state_digest AND p.report_digest=NEW.report_digest) BEGIN SELECT RAISE(ABORT,'QA report parent ownership mismatch'); END;
+        CREATE TRIGGER work_v4_chain_parent_${action} BEFORE ${action} ON qa_report_chains WHEN NOT EXISTS(SELECT 1 FROM qa_reports p JOIN qa_reports s ON p.run_id=s.run_id AND p.ticket_id=s.ticket_id WHERE p.report_occurrence_id=NEW.predecessor_occurrence_id AND s.report_occurrence_id=NEW.successor_occurrence_id AND p.report_digest=NEW.predecessor_report_digest AND s.report_digest=NEW.successor_report_digest) BEGIN SELECT RAISE(ABORT,'QA report chain parent ownership mismatch'); END;
+        CREATE TRIGGER work_v4_assignment_${action} BEFORE ${action} ON operation_journal WHEN NEW.kind='build-assignment' AND NOT EXISTS(SELECT 1 FROM build_work_scope s WHERE s.run_id=NEW.run_id AND s.work_id=json_extract(NEW.intent_json,'$.ticketId') AND s.state='admitted') BEGIN SELECT RAISE(ABORT,'Builder assignment is not admitted'); END;
+        CREATE TRIGGER work_v4_branch_${action} BEFORE ${action} ON branch_resume_sessions WHEN NOT EXISTS(SELECT 1 FROM build_work_scope s WHERE s.run_id=NEW.run_id AND s.work_id=NEW.ticket AND s.state='admitted') BEGIN SELECT RAISE(ABORT,'Branch work is not admitted'); END;`);
+            }
+            db.exec(`CREATE TRIGGER work_v4_membership_update BEFORE UPDATE OF state_json ON workflow_runs WHEN EXISTS(SELECT 1 FROM build_work_admissions a WHERE a.run_id=NEW.run_id AND NOT EXISTS(SELECT 1 FROM json_each(NEW.state_json,'$.tickets') j WHERE j.value=a.work_id)) AND json_extract(NEW.state_json,'$.version') IS NOT NULL BEGIN SELECT RAISE(ABORT,'Build snapshot cannot drop admitted work'); END;
+      CREATE TRIGGER work_v4_admission_update BEFORE UPDATE ON build_work_admissions BEGIN SELECT RAISE(ABORT,'Work admissions are immutable'); END;
+      CREATE TRIGGER work_v4_admission_delete BEFORE DELETE ON build_work_admissions BEGIN SELECT RAISE(ABORT,'Work admissions are immutable'); END;
+      CREATE TRIGGER work_v4_scope_identity BEFORE UPDATE ON build_work_scope WHEN NEW.run_id<>OLD.run_id OR NEW.work_id<>OLD.work_id OR NEW.kind<>OLD.kind OR NEW.ticket_id IS NOT OLD.ticket_id BEGIN SELECT RAISE(ABORT,'Work identity is immutable'); END;
+      CREATE TRIGGER work_v4_scope_delete BEFORE DELETE ON build_work_scope BEGIN SELECT RAISE(ABORT,'Work scope must be retained'); END;`);
+            for (const table of ["build_work_scope", "build_work_admissions", "build_assignments", "build_ownership_conflicts", "build_reconciliations"]) {
+                for (const action of ["INSERT", "UPDATE", "DELETE"])
+                    db.exec(`CREATE TRIGGER work_v4_authority_${table}_${action} BEFORE ${action} ON ${table} WHEN rafi_work_authority()=0 BEGIN SELECT RAISE(ABORT,'Restricted work admission authority required'); END`);
+            }
+            for (const action of ["INSERT", "UPDATE"])
+                db.exec(`CREATE TRIGGER work_v4_remediation_parent_${action} BEFORE ${action} ON qa_remediation_attempts WHEN NOT EXISTS(SELECT 1 FROM qa_review_attempts p WHERE p.attempt_id=NEW.review_attempt_id AND p.run_id=NEW.run_id AND p.ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'Remediation parent ownership mismatch'); END;
+      CREATE TRIGGER work_v4_finalization_parent_${action} BEFORE ${action} ON qa_finalization_steps WHEN NOT EXISTS(SELECT 1 FROM qa_pass_certificates p WHERE p.certificate_id=NEW.certificate_id AND p.run_id=NEW.run_id AND p.ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'Finalization parent ownership mismatch'); END;
+      CREATE TRIGGER work_v4_handoff_parent_${action} BEFORE ${action} ON qa_failure_handoffs WHEN NOT EXISTS(SELECT 1 FROM qa_reports p JOIN qa_review_attempts a ON a.run_id=p.run_id AND a.ticket_id=p.ticket_id AND a.review_number=p.review_number WHERE p.report_occurrence_id=NEW.report_occurrence_id AND p.run_id=NEW.run_id AND p.ticket_id=NEW.ticket_id AND p.report_digest=NEW.report_digest AND a.attempt_id=NEW.review_attempt_id) BEGIN SELECT RAISE(ABORT,'Failure handoff parent ownership mismatch'); END;
+      CREATE TRIGGER work_v4_authorization_parent_${action} BEFORE ${action} ON qa_remediation_authorizations WHEN NOT EXISTS(SELECT 1 FROM qa_review_attempts p WHERE p.attempt_id=NEW.review_attempt_id AND p.run_id=NEW.run_id AND p.ticket_id=NEW.ticket_id) BEGIN SELECT RAISE(ABORT,'Authorization parent ownership mismatch'); END;`);
+            for (const action of ["INSERT", "UPDATE"]) {
+                db.exec(`CREATE TRIGGER work_v4_delivery_parent_${action} BEFORE ${action} ON qa_delivery_turns WHEN NOT EXISTS(SELECT 1 FROM qa_failure_handoffs h WHERE h.operation_id=NEW.operation_id AND h.report_occurrence_id=NEW.report_occurrence_id) BEGIN SELECT RAISE(ABORT,'QA delivery parent ownership mismatch'); END`);
+                for (const table of ["qa_findings", "qa_report_dispositions"])
+                    db.exec(`CREATE TRIGGER work_v4_occurrence_digest_${table}_${action} BEFORE ${action} ON ${table} WHEN NOT EXISTS(SELECT 1 FROM qa_reports r WHERE r.report_occurrence_id=NEW.report_occurrence_id AND r.report_digest=NEW.report_digest) BEGIN SELECT RAISE(ABORT,'QA occurrence digest ownership mismatch'); END`);
+            }
+            db.exec(`CREATE TRIGGER work_v4_delivery_identity BEFORE UPDATE ON qa_delivery_turns WHEN NEW.operation_id<>OLD.operation_id OR NEW.report_occurrence_id<>OLD.report_occurrence_id OR NEW.turn_index<>OLD.turn_index OR NEW.turn_record_id<>OLD.turn_record_id BEGIN SELECT RAISE(ABORT,'QA delivery identity is immutable'); END`);
+            for (const action of ["INSERT", "UPDATE"])
+                db.exec(`CREATE TRIGGER work_v4_certificate_parent_${action} BEFORE ${action} ON qa_pass_certificates WHEN NOT EXISTS(SELECT 1 FROM qa_turns t JOIN qa_turn_events e ON e.operation_id=t.operation_id AND e.event_index=0 WHERE t.run_id=NEW.run_id AND t.ticket_id=NEW.ticket_id AND t.source_state_digest=NEW.source_state_digest AND t.review_basis_digest=NEW.review_basis_digest AND t.status='completed' AND e.event_digest=NEW.turn_receipt_digest AND e.event_json=t.receipt_json AND json_extract(t.receipt_json,'$.terminalEventObserved')=1 AND length(json_extract(t.receipt_json,'$.providerTurnId'))>0) BEGIN SELECT RAISE(ABORT,'QA certificate completion receipt ownership mismatch'); END`);
+            for (const table of ["build_reconciliations", "build_work_events"])
+                for (const action of ["UPDATE", "DELETE"])
+                    db.exec(`CREATE TRIGGER work_v4_immutable_${table}_${action} BEFORE ${action} ON ${table} BEGIN SELECT RAISE(ABORT,'Build audit history is immutable'); END`);
+            faults?.beforeCommit?.();
+            if (db.pragma("foreign_key_check").length || db.pragma("integrity_check", { simple: true }) !== "ok")
+                throw new Error("Work admission upgrade integrity failure");
+            db.prepare("INSERT INTO recovery_schema_migrations VALUES(?,?)").run(migration, now);
+            db.pragma("user_version = 4");
+        }).immediate();
+    }
+    catch (error) {
+        db.function("rafi_writer_protocol", () => 3);
+        throw error;
+    }
+}
+function syncFile(path) { const descriptor = openSync(path, "r"); try {
+    fsyncSync(descriptor);
+}
+finally {
+    closeSync(descriptor);
+} }
+function syncDirectory(path) { if (process.platform !== "win32")
+    syncFile(path); }
+function syncBackupTree(root) {
+    const files = [];
+    const visit = (directory) => {
+        chmodSync(directory, 0o700);
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory())
+                visit(path);
+            else {
+                const bytes = entry.isSymbolicLink() ? Buffer.from(readlinkSync(path)) : readFileSync(path);
+                if (!entry.isSymbolicLink()) {
+                    chmodSync(path, 0o600);
+                    syncFile(path);
+                }
+                files.push({ path: relative(root, path), kind: entry.isSymbolicLink() ? "symlink" : "file", digest: createHash("sha256").update(bytes).digest("hex") });
+            }
+        }
+        syncDirectory(directory);
+    };
+    visit(root);
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+}

package/dist/buildWorkReconciliation.d.ts

@@ -0,0 +1,12 @@
+import type Database from "better-sqlite3";
+import { type BuildOwnershipRepairV1 } from "rafi-spec";
+export type { BuildOwnershipRepairV1 } from "rafi-spec";
+export declare function validateOwnershipRepair(value: unknown): asserts value is BuildOwnershipRepairV1;
+/** Audited metadata repair; source separation/restoration must be inspected before this commit. */
+export declare function reconcileWork(db: Database.Database, request: BuildOwnershipRepairV1, input: {
+    revision: string;
+    sourceDigest: string;
+    definition: unknown;
+    requiredPaths: string[];
+    userTurn: string;
+}): Record<string, unknown>;

package/dist/buildWorkReconciliation.js

@@ -0,0 +1,70 @@
+import { realpathSync } from "node:fs";
+import { admitWork } from "./buildWorkAdmission.js";
+import { qaDigest } from "./qaProtocolV2.js";
+import { validateBuildOwnershipRepairV1 } from "rafi-spec";
+export function validateOwnershipRepair(value) {
+    const validation = validateBuildOwnershipRepairV1(value);
+    if (!validation.valid)
+        throw new Error(`Invalid ownership repair: ${validation.errors.join("; ")}`);
+    const request = value;
+    if ([request.authorization, request.attestation].some(text => !text.trim() || Buffer.byteLength(text) > 16384))
+        throw new Error("Repair requires bounded authorization and attestation");
+    if (new Set(request.mapping.map(item => item.path)).size !== request.mapping.length)
+        throw new Error("Repair mapping paths must be unique");
+}
+/** Audited metadata repair; source separation/restoration must be inspected before this commit. */
+export function reconcileWork(db, request, input) {
+    const prior = db.prepare("SELECT record_json FROM build_reconciliations WHERE reconciliation_id=?").get(request.requestId);
+    if (prior) {
+        const receipt = JSON.parse(prior.record_json);
+        if (receipt.requestDigest !== qaDigest("ownership-repair-request", request))
+            throw new Error("Repair idempotency key collision");
+        return receipt;
+    }
+    if (request.expectedRevision !== input.revision || request.inspectedSourceDigest !== input.sourceDigest)
+        throw new Error("Ownership or inspected source changed; inspect the current revision before repair");
+    if (input.requiredPaths.some(path => !request.mapping.some(item => item.path === path && item.workId === request.workId)))
+        throw new Error("Every preserved change must have an inspected mapping to the authorized target work");
+    if (request.mapping.some(item => item.workId !== request.workId || !input.requiredPaths.includes(item.path)))
+        throw new Error("Mapping contains a foreign work identity or an uninspected path");
+    const uncertain = db.prepare("SELECT 1 FROM operation_journal WHERE run_id=? AND kind='provider-dispatch' AND status IN ('in_progress','uncertain')").get(request.runId);
+    if (uncertain)
+        throw new Error("Provider dispatch must be reconciled separately before ownership repair; attestation cannot establish nonexecution");
+    if (request.choice === "link_provenance") {
+        const decision = request.decisionId ? db.prepare("SELECT * FROM human_decisions WHERE decision_id=? AND run_id=? AND status='answered'").get(request.decisionId, request.runId) : undefined;
+        const approval = decision ? JSON.parse(decision.decision_json) : undefined;
+        const assignments = db.prepare("SELECT intent_json,result_json FROM operation_journal WHERE run_id=? AND kind='build-assignment' AND json_extract(intent_json,'$.ticketId')=? AND status='confirmed'").all(request.runId, request.workId);
+        const assignment = assignments.some(row => {
+            const intent = JSON.parse(row.intent_json), result = JSON.parse(row.result_json), session = result.providerMetadata?.sessionRef;
+            if (result.rejection || result.sourceError || !result.turnId || !result.responseDigest || !result.after?.digest || !intent.before?.digest || intent.requirementsDigest !== qaDigest("admitted-requirements", input.definition) || !session || session.source !== "observed" || !session.validatedAt || session.role !== "builder" || session.ticketId !== request.workId)
+                return false;
+            try {
+                if (realpathSync(session.cwd) !== realpathSync(intent.worktree))
+                    return false;
+            }
+            catch {
+                return false;
+            }
+            return !!db.prepare("SELECT 1 FROM provider_sessions WHERE run_id=? AND role='builder' AND session_id=? AND session_ref_json=?").get(request.runId, session.sessionId, JSON.stringify(session));
+        });
+        const checkpoint = db.prepare("SELECT 1 FROM workflow_events WHERE run_id=? AND (json_extract(payload_json,'$.ticketId')=? OR json_extract(payload_json,'$.currentTicket')=?)").get(request.runId, request.workId, request.workId);
+        if (!decision?.decision_key.includes(request.scopeRevision) || approval?.selectedChoiceId !== "proceed" || !assignment || !checkpoint)
+            throw new Error("Approval, assignment and checkpoint provenance is incomplete; use explicit mapped-work authorization instead");
+    }
+    const now = new Date().toISOString();
+    const state = db.prepare("SELECT state FROM qa_ticket_heads WHERE run_id=? AND ticket_id=?").get(request.runId, request.workId)?.state;
+    const requiresFreshQa = request.choice !== "quarantine" && state !== "completed" && state !== "waived";
+    const receipt = { version: 1, reconciliationId: request.requestId, runId: request.runId, workId: request.workId, requestDigest: qaDigest("ownership-repair-request", request), request, userTurn: input.userTurn, beforeRevision: input.revision, sourceDigest: input.sourceDigest, historicalAuthorityProven: request.choice === "link_provenance", requiresFreshQa, executionDisposition: request.choice === "quarantine" ? "quarantined" : state === "completed" ? "terminal_metadata_repaired" : state === "waived" ? "existing_waiver_policy" : "fresh_qa_required", executionReopened: false, providerReplayAuthorized: false, createdAt: now };
+    db.prepare("INSERT INTO build_reconciliations VALUES(?,?,?,?,?)").run(request.requestId, request.runId, request.expectedRevision, JSON.stringify(receipt), now);
+    if (request.choice === "quarantine") {
+        db.prepare("UPDATE build_work_scope SET state='quarantined' WHERE run_id=? AND work_id=?").run(request.runId, request.workId);
+        db.prepare("UPDATE build_ownership_conflicts SET record_json=json_set(record_json,'$.manualDecision',?),revision=revision+1 WHERE run_id=? AND work_id=? AND status='unresolved'").run(request.requestId, request.runId, request.workId);
+        return receipt;
+    }
+    db.prepare("UPDATE build_work_scope SET state='admitted' WHERE run_id=? AND work_id=?").run(request.runId, request.workId);
+    admitWork(db, { runId: request.runId, kind: "ticket", ticketId: request.workId, definition: input.definition, approvalId: request.requestId, scopeRevision: request.scopeRevision, provenance: { userTurn: input.userTurn, decisionId: request.decisionId, reason: request.choice === "link_provenance" ? "Audited run-bound authorization provenance" : "Operator explicitly authorized inspected preserved changes for fresh verification" } }, true);
+    db.prepare("UPDATE build_ownership_conflicts SET status='reconciled',revision=revision+1,record_json=json_set(record_json,'$.reconciliationId',?) WHERE run_id=? AND work_id=? AND status='unresolved'").run(request.requestId, request.runId, request.workId);
+    // Retain every old byte and outcome. The audit permits fresh QA, never replay of this turn.
+    db.prepare("UPDATE operation_journal SET result_json=json_set(COALESCE(result_json,'{}'),'$.reconciliationId',?,'$.replayForbidden',1),updated_at=? WHERE run_id=? AND kind='build-assignment' AND json_extract(intent_json,'$.ticketId')=?").run(request.requestId, now, request.runId, request.workId);
+    return receipt;
+}