ai-foreman 1.7.29 → 2.0.1

package/dist/workflowDb.js

@@ -1,11 +1,19 @@
+import { ensureLocalGitExcludes } from "./gitExclude.js";
+import { persistedProviderWireContract } from "rafi-spec";
+import { verifyCheckpointOrigin, verifyContinuityHeads } from "./continuityOrigin.js";
 import { registerQaGraphJournalWriter, ensureQaGraphJournalGuards } from "./qaDeliveryJournal.js";
 import { canonicalJson } from "./qaProtocolV2.js";
+import { hydrateStructuredReceipt, persistedDispatchTuple, sealedDispatchRecord, verifyPersistedDispatch } from "./structuredDispatchRecord.js";
+import { assertStructuredCutoverComplete, cutoverOwnershipMatrix, invalidStructuredRun, purgeStructuredRun, STRUCTURED_CUTOVER_MATRIX_VERSION, STRUCTURED_CUTOVER_REASON, STRUCTURED_AUDIT_CLOSURE } from "./structuredCutover.js";
+import { communicationFileEvidenceReferences, quarantineCommunicationFiles } from "./structuredCutoverFiles.js";
 import { resolveEffectiveQaConfiguration } from "./qaEffectiveConfig.js";
 import { registerGraphDerived, graphDerivedAllowed, currentGraphDerivedAccess } from "./graph/derived.js";
-import { bindCoverageHostFields, parseContractCoverage, validateContractCoverage } from "./qaContractCoverage.js";
+import { bindCoverageHostFields, validateContractCoverage } from "./qaContractCoverage.js";
 import { findHostQaCheck, hostComparisonDigestFromCoverage, hostQaComparisonV1Schema } from "./hostQaComparison.js";
 import { findGraphQaChecks, hostGraphApplicabilityDigestFromCoverage, hostGraphApplicabilityV1Schema } from "./hostGraphApplicability.js";
-import { applyHostQaAugmentations } from "./hostQaAugmentation.js";
+import { assembleFinalQaCoverage } from "./qaCoverageAssembly.js";
+import { retainedQaCommandObservations } from "./qaReviewEvidence.js";
+import { retainedHostBuilderObservations } from "./qaBuilderEvidence.js";
 import { QaPreparationStore, migrateQaPreparation, migrateQaPreparationGuards } from "./qaPreparationStore.js";
 import { GraphStore, migrateGraphStore } from "./graph/storage.js";
 import { reconcileWork } from "./buildWorkReconciliation.js";
@@ -15,20 +23,36 @@ import { admitWork, admittedWork, assertAdmittedWork } from "./buildWorkAdmissio
 import { cleanupReadiness, inspectReadiness, readinessMetadata } from "./readinessCleanup.js";
 import { originalBuildLease, rememberOriginalLease, forgetOriginalLease, registerLaunchChild, acknowledgeLaunchChild, reconcileLaunch, checkBuildOwnershipSchema, canonicalProject, launchDigest, localBuildAuthority, rememberBuildAuthority, forgetBuildAuthority, migrateBuildAdmission, acquireAdmission, readAdmission, assertAdmission, releaseAdmission, reserveLaunch, setLaunchState, claimLaunch, readLaunch } from "./buildAdmission.js";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import Database from "better-sqlite3";
-import { validateQaFailureReport } from "rafi-spec";
+import { validateQaFailureReport, qaVerdictOutput, remediationOutput } from "rafi-spec";
 import { migrateQaHandback, registerHandbackWriter, reportOccurrenceId } from "./qaHandbackMigration.js";
-import { providerSessionKey } from "./sessionIdentity.js";
+import { providerSessionKey, canonicalSessionPath } from "./sessionIdentity.js";
 import { captureFrozenQaSource } from "./qaSnapshot.js";
 import { loadTicketsConfig, resolveTicketPaths } from "./tickets/config.js";
 import { loadTickets } from "./tickets/ticketLoader.js";
 import { processGroupQuiescent, taggedProcesses, classifyProcess, processStartIdentity } from "./processIdentity.js";
 import { initialQaReducerState, qaDigest, reduceQaState, } from "./qaProtocolV2.js";
 export const WORKFLOW_DB_FILE = ".rafi/recovery.sqlite3";
+/** Role steps that change no project files, so an interrupted one can run
+ * again from its beginning with its original inputs. */
+// QA preparation runs in a disposable snapshot, so its steps are restartable too.
+const QA_PREPARATION_STEPS = ["qa-preparation-depth", "qa-preparation-draft", "qa-preparation-assessment", "qa-preparation-challenge"];
+const RESTARTABLE_STEPS = {
+    builder: new Set(["build-preflight", "session-initialization", "handoff-acceptance", "builder-coverage", "branch-dependency-audit", "qa-contract-acceptance", "qa-contract-segment", "status", "escalation", ...QA_PREPARATION_STEPS]),
+    qa: new Set(["session-initialization", "handoff-acceptance", "qa-recovery-acceptance", "qa-contract-acceptance", "qa-contract-segment", ...QA_PREPARATION_STEPS]),
+};
+/** Journal runs for agent calls outside a build use these run-id prefixes. */
+export const NON_BUILD_RUN_PREFIXES = ["operation:", "ticket-population:", "qa-"];
+export function isNonBuildRunId(runId) {
+    return NON_BUILD_RUN_PREFIXES.some(prefix => runId.startsWith(prefix));
+}
+function defaultRunKind(runId) {
+    return isNonBuildRunId(runId) ? "operation" : "build";
+}
 /** Read the current project lease without creating or migrating recovery state. */
 export function readCurrentWorkflowLease(projectDir) {
     const path = join(resolve(projectDir), WORKFLOW_DB_FILE);
@@ -124,6 +148,8 @@ export class WorkflowDb {
         if (existsSync(path)) {
             const preview = new Database(path, { readonly: true, fileMustExist: true });
             try {
+                if (readinessAccess)
+                    assertStructuredCutoverComplete(preview);
                 checkBuildOwnershipSchema(preview);
             }
             finally {
@@ -154,10 +180,13 @@ export class WorkflowDb {
         this.db.pragma("synchronous = FULL");
         this.db.pragma("foreign_keys = ON");
         try {
-            if (readinessAccess)
+            if (readinessAccess) {
+                assertStructuredCutoverComplete(this.db);
                 this.restrictReadinessConnection(readinessAccess);
+            }
             else {
                 this.migrate();
+                this.applyStructuredCommunicationV2Cutover();
                 migrateQaPreparation(this.db);
                 migrateBuildAdmission(this.db);
                 this.importLegacyOnce();
@@ -201,6 +230,7 @@ export class WorkflowDb {
         }
     }
     assertInstructionOwner(runId) {
+        this.assertNativeRunAdmission(runId);
         if (this.writerAuthority) {
             assertAdmission(this.db, this.writerAuthority);
             if (this.writerAuthority.runId !== runId && !this.db.prepare("SELECT 1 FROM build_child_runs WHERE child=? AND parent=?").get(runId, this.writerAuthority.runId))
@@ -334,7 +364,7 @@ export class WorkflowDb {
         }
     }
     admittedWork(runId, workId) { return admittedWork(this.db, runId, workId); }
-    assertAdmittedWork(runId, workId) { return assertAdmittedWork(this.db, runId, workId); }
+    assertAdmittedWork(runId, workId) { this.assertNativeRunAdmission(runId); return assertAdmittedWork(this.db, runId, workId); }
     /** Atomic local changes only; never await provider or filesystem work here. */
     atomic(work) { return this.db.transaction(work).immediate(); }
     buildAdmission() { return readAdmission(this.db); }
@@ -417,6 +447,7 @@ export class WorkflowDb {
             throw new Error("Ownership migration is pending legacy execution cleanup; use rafi resume before starting work");
     }
     acquireBuildAdmission(runId, phase) {
+        this.assertNativeRunAdmission(runId);
         return this.atomic(() => {
             this.assertNoLegacyBuildOwner();
             const lease = this.currentLease();
@@ -426,7 +457,10 @@ export class WorkflowDb {
                 if (owner.state.pid && classifyProcess(owner.state.pid, owner.state.processStart).state !== "dead")
                     throw new Error(`supervisor already active for project (run ${owner.runId})`);
             }
-            const uncertain = this.db.prepare("SELECT run_id FROM operation_journal WHERE kind='provider-dispatch' AND status IN ('in_progress','uncertain') LIMIT 1").get();
+            // Single agent calls outside builds ("operation:<id>" runs: planning,
+            // ticket population, uninstall proposals) are read-only proposals; an
+            // unknown outcome there cannot conflict with a build.
+            const uncertain = this.db.prepare("SELECT run_id FROM operation_journal WHERE kind='provider-dispatch' AND status IN ('in_progress','uncertain') AND run_id NOT LIKE 'operation:%' AND run_id NOT LIKE 'ticket-population:%' AND run_id NOT LIKE 'qa-%' LIMIT 1").get();
             if (uncertain)
                 throw new Error(`Build ${uncertain.run_id} has unresolved provider dispatch; reconcile before another launch`);
             for (const row of this.db.prepare("SELECT DISTINCT run_id FROM build_owned_processes WHERE state<>'quiescent'").all()) {
@@ -447,10 +481,11 @@ export class WorkflowDb {
         });
     }
     acquireBuildRecoveryAdmission(runId) {
+        this.assertNativeRunAdmission(runId);
         return this.atomic(() => {
             this.assertExecutionProtocol();
             this.assertNoLegacyBuildOwner();
-            const otherDispatch = this.db.prepare("SELECT run_id FROM operation_journal WHERE run_id<>? AND kind='provider-dispatch' AND status IN ('in_progress','uncertain') LIMIT 1").get(runId);
+            const otherDispatch = this.db.prepare("SELECT run_id FROM operation_journal WHERE run_id<>? AND kind='provider-dispatch' AND status IN ('in_progress','uncertain') AND run_id NOT LIKE 'operation:%' AND run_id NOT LIKE 'ticket-population:%' AND run_id NOT LIKE 'qa-%' LIMIT 1").get(runId);
             if (otherDispatch)
                 throw new Error(`Build ${otherDispatch.run_id} has unresolved provider dispatch; reconcile before starting another recovery workflow`);
             const current = localBuildAuthority(this.projectDir);
@@ -812,7 +847,7 @@ export class WorkflowDb {
         return { eligible: reasons.length === 0, reasons };
     }
     /** Ensure non-workflow build records can use the same durable event store. */
-    ensureRun(runId, kind = "build", now = new Date()) {
+    ensureRun(runId, kind = defaultRunKind(runId), now = new Date()) {
         const existing = this.getRun(runId);
         if (existing)
             return existing;
@@ -838,6 +873,11 @@ export class WorkflowDb {
             originalWork: input.originalWork ?? {}, remainingWork: input.remainingWork ?? input.originalWork ?? {}, state: input.state ?? {},
             legacy: Boolean(input.legacy), createdAt: at, updatedAt: at,
         };
+        if (run.legacy) {
+            run.status = "superseded";
+            run.checkpoint = STRUCTURED_CUTOVER_REASON;
+            run.state = { ...run.state, structuredCommunicationCutover: { version: 2, reason: STRUCTURED_CUTOVER_REASON, at } };
+        }
         this.db.transaction(() => {
             if (this.writerAuthority)
                 assertAdmission(this.db, this.writerAuthority);
@@ -909,6 +949,7 @@ export class WorkflowDb {
         });
     }
     transition(runId, update, now = new Date()) {
+        this.assertNativeRunAdmission(runId);
         const at = now.toISOString();
         return this.db.transaction(() => {
             if (!this.coordinatorTransition && (this.writerAuthority || this.buildAdmission())) {
@@ -1036,11 +1077,33 @@ export class WorkflowDb {
             this.assertGraphContinuityAccess(row.payload_json);
         return rows.map(continuityEventFromRow);
     }
+    providerCheckpoint(dispatchId, publicationKind) {
+        const row = this.db.prepare("SELECT c.* FROM continuity_checkpoints c JOIN continuity_checkpoint_origins o USING(checkpoint_id) WHERE o.dispatch_id=? AND o.publication_kind=?").get(dispatchId, publicationKind);
+        if (row)
+            verifyCheckpointOrigin(this.db, this.projectDir, row.checkpoint_id);
+        return row ? continuityCheckpointFromRow(row) : undefined;
+    }
     publishContinuityCheckpoint(input, now = new Date()) {
         this.ensureRun(input.runId, "build", now);
         return this.db.transaction(() => {
             const at = now.toISOString();
+            if (input.origin?.kind === "provider") {
+                const prior = this.db.prepare("SELECT c.* FROM continuity_checkpoints c JOIN continuity_checkpoint_origins o USING(checkpoint_id) WHERE c.run_id=? AND c.role=? AND o.dispatch_id=? AND o.publication_kind=?")
+                    .get(input.runId, input.role, input.origin.dispatchId, input.origin.publicationKind);
+                if (prior) {
+                    verifyCheckpointOrigin(this.db, this.projectDir, prior.checkpoint_id);
+                    if (canonicalJson(parseJson(prior.delta_json)) !== canonicalJson(input.delta))
+                        throw new Error("Conflicting repeated checkpoint publication");
+                    return continuityCheckpointFromRow(prior);
+                }
+            }
             const previous = this.continuityHead(input.runId, input.role);
+            let origin = input.origin;
+            if (!origin) {
+                const event = this.appendContinuityEvent({ runId: input.runId, role: "host", kind: input.hostEventKind ?? "host_checkpoint", authoritativeStateRevision: input.authoritativeStateRevision,
+                    payload: { checkpointDeltaDigest: createHash("sha256").update(json(sanitizeContinuityValue(input.delta))).digest("hex"), role: input.role } });
+                origin = { kind: "host", eventSequence: event.sequence, inputCheckpointDigests: input.inputCheckpointDigests ?? (previous ? [previous.digest] : []) };
+            }
             const latestEvent = this.db.prepare("SELECT COALESCE(MAX(sequence),0) AS sequence FROM continuity_events WHERE run_id=?").get(input.runId);
             const safeDelta = sanitizeContinuityValue(input.delta);
             const graphAccess = currentGraphDerivedAccess();
@@ -1050,6 +1113,10 @@ export class WorkflowDb {
             const digest = digestJson({ runId: input.runId, role: input.role, sequence: latestEvent.sequence, predecessorDigest: previous?.digest, delta: safeDelta, authoritativeStateRevision: input.authoritativeStateRevision, sessionKey: session.key });
             const result = this.db.prepare(`INSERT INTO continuity_checkpoints(run_id,role,event_sequence,state,delta_json,digest,predecessor_digest,authoritative_state_revision,session_key,session_ref_json,created_at)
         VALUES(?,?,?,?,?,?,?,?,?,?,?)`).run(input.runId, input.role, latestEvent.sequence, input.state ?? "current", json(safeDelta), digest, previous?.digest ?? null, input.authoritativeStateRevision, session.key, session.refJson, at);
+            const checkpointId = Number(result.lastInsertRowid);
+            this.db.prepare("INSERT INTO continuity_checkpoint_origins(checkpoint_id,run_id,origin_json,delta_digest,dispatch_id,publication_kind) VALUES(?,?,?,?,?,?)")
+                .run(checkpointId, input.runId, json(origin), createHash("sha256").update(json(safeDelta)).digest("hex"), origin.kind === "provider" ? origin.dispatchId : null, origin.kind === "provider" ? origin.publicationKind : null);
+            verifyCheckpointOrigin(this.db, this.projectDir, checkpointId);
             const checkpoint = {
                 checkpointId: Number(result.lastInsertRowid), runId: input.runId, role: input.role,
                 sequence: latestEvent.sequence, state: input.state ?? "current", delta: safeDelta, digest,
@@ -1067,14 +1134,18 @@ export class WorkflowDb {
         const rows = role
             ? this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? AND role=? ORDER BY checkpoint_id").all(runId, role)
             : this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? ORDER BY checkpoint_id").all(runId);
-        for (const row of rows)
+        for (const row of rows) {
             this.assertGraphContinuityAccess(row.delta_json);
+            verifyCheckpointOrigin(this.db, this.projectDir, row.checkpoint_id);
+        }
         return rows.map(continuityCheckpointFromRow);
     }
     latestContinuityCheckpoint(runId, role) {
         const row = this.db.prepare("SELECT * FROM continuity_checkpoints WHERE run_id=? AND role=? ORDER BY checkpoint_id DESC LIMIT 1").get(runId, role);
-        if (row)
+        if (row) {
             this.assertGraphContinuityAccess(row.delta_json);
+            verifyCheckpointOrigin(this.db, this.projectDir, row.checkpoint_id);
+        }
         return row ? continuityCheckpointFromRow(row) : undefined;
     }
     assertGraphContinuityAccess(value) {
@@ -1084,6 +1155,8 @@ export class WorkflowDb {
     }
     continuityHead(runId, role) {
         const row = this.db.prepare("SELECT * FROM continuity_heads WHERE run_id=? AND role=?").get(runId, role);
+        if (row)
+            verifyContinuityHeads(this.db, this.projectDir, runId);
         return row ? continuityHeadFromRow(row) : undefined;
     }
     setContinuityHeadState(runId, role, state, now = new Date()) {
@@ -1231,6 +1304,11 @@ export class WorkflowDb {
         return this.db.prepare("SELECT decision_json FROM human_decisions WHERE run_id=? AND status='pending' ORDER BY created_at").all(runId)
             .map((row) => parseJson(row.decision_json));
     }
+    /** Answered decisions for a run, oldest first (e.g. answered with build:decide while no worker waited). */
+    answeredHumanDecisions(runId) {
+        return this.db.prepare("SELECT decision_json FROM human_decisions WHERE run_id=? AND status='answered' ORDER BY created_at").all(runId)
+            .map((row) => parseJson(row.decision_json));
+    }
     decisionContinuationAvailable(runId, decisionId) {
         const prior = this.operations(runId).filter(op => op.kind === "decision-continuation" && op.intent.decisionId === decisionId);
         return prior.every(op => op.status === "failed" && op.result?.dispatchState === "not-sent");
@@ -1313,7 +1391,12 @@ export class WorkflowDb {
         return row ? parseJson(row.state_json) : undefined;
     }
     planOperation(input, now = new Date()) {
+        this.assertNativeRunAdmission(input.runId);
         const at = now.toISOString();
+        const run = this.getRun(input.runId);
+        if (input.kind === "provider-dispatch" && run?.checkpoint === "structured-communication-v2-cutover") {
+            throw new Error("This run was fenced by the structured-communication v2 cutover; start a new native dispatch");
+        }
         if (input.kind === "provider-dispatch" && this.unresolvedPreparationProcesses(input.runId).length)
             throw new Error("Readiness cleanup must be reconciled before provider dispatch");
         this.db.prepare(`INSERT INTO operation_journal(idempotency_key,run_id,kind,status,intent_json,created_at,updated_at)
@@ -1324,12 +1407,294 @@ export class WorkflowDb {
         }
         return operation;
     }
+    /** Seal a previously persisted non-authoritative preparation intent.  This
+     * is intentionally legal only before provider content dispatch begins. */
+    sealPlannedOperationIntent(idempotencyKey, intent, now = new Date()) {
+        const prior = this.operation(idempotencyKey);
+        if (!prior || prior.status !== "planned" || prior.kind !== "provider-dispatch")
+            throw new Error("Only a planned provider dispatch may be sealed");
+        const preparing = prior.intent;
+        if (preparing.protocolVersion !== 2 || preparing.state !== "preparing")
+            throw new Error("Provider dispatch did not begin as a v2 preparation intent");
+        this.db.prepare("UPDATE operation_journal SET intent_json=?,updated_at=? WHERE idempotency_key=? AND status='planned'")
+            .run(json(intent), now.toISOString(), idempotencyKey);
+        return this.operation(idempotencyKey);
+    }
+    /** Called in the gateway's sealing transaction, before the send capability exists. */
+    sealStructuredOwnerDispatch(key, tuple, renderedInstruction) {
+        const sealedDispatch = sealedDispatchRecord(tuple);
+        const transportSession = this.operation(key)?.intent?.sessionRef;
+        const matchesSession = (session) => Boolean(transportSession
+            && ["provider", "sessionId", "role", "stream", "generation", "cwd", "configRoot"].every(field => session[field] === transportSession[field]));
+        const review = this.db.prepare("SELECT intent_json,status FROM qa_turns WHERE operation_id=?").get(key);
+        if (review) {
+            const intent = parseJson(review.intent_json);
+            if (review.status !== "intended" || intent.sealedDispatch || !matchesSession(intent.providerSession) || intent.providerSession.sessionId !== tuple.sessionId || intent.providerSession.generation !== tuple.generation)
+                throw new Error("QA review owner cannot seal a foreign or already dispatched session");
+            this.db.prepare("UPDATE qa_turns SET intent_json=? WHERE operation_id=?").run(json({ ...intent, sealedDispatch }), key);
+        }
+        const delivery = this.db.prepare("SELECT record_json,status FROM qa_delivery_turns WHERE turn_record_id=?").get(key);
+        if (delivery) {
+            const turn = parseJson(delivery.record_json);
+            if (delivery.status !== "intended" || turn.sealedDispatch || !matchesSession(turn.intendedSession) || turn.intendedSession.sessionId !== tuple.sessionId || turn.intendedSession.generation !== tuple.generation)
+                throw new Error("QA remediation owner cannot seal a foreign or already dispatched session");
+            this.db.prepare("UPDATE qa_delivery_turns SET record_json=? WHERE turn_record_id=?").run(json({ ...turn, sealedDispatch }), key);
+            const attempt = this.db.prepare("SELECT record_json FROM qa_remediation_attempts WHERE attempt_id=?").get(turn.operationId);
+            if (!attempt)
+                throw new Error("Remediation dispatch has no durable owner attempt");
+            const fields = parseJson(attempt.record_json);
+            const dispatches = (fields.sealedDispatches ?? {});
+            if (dispatches[key])
+                throw new Error("Remediation dispatch already sealed");
+            this.db.prepare("UPDATE qa_remediation_attempts SET record_json=? WHERE attempt_id=?").run(json({ ...fields, sealedDispatches: { ...dispatches, [key]: sealedDispatch } }), turn.operationId);
+        }
+        this.putEvidence("handoff", Buffer.from(renderedInstruction));
+    }
+    structuredOwnerDispatch(key) {
+        const transport = this.operation(key)?.intent;
+        const verifyOwner = (record) => {
+            persistedDispatchTuple(record);
+            if (json(transport?.sealedDispatch) !== json(record))
+                throw new Error("Domain owner tuple differs from its transport intent");
+        };
+        const review = this.db.prepare("SELECT intent_json FROM qa_turns WHERE operation_id=?").get(key);
+        if (review) {
+            const record = parseJson(review.intent_json).sealedDispatch;
+            if (!record)
+                throw new Error("QA owner has no sealed dispatch");
+            verifyOwner(record);
+            return record;
+        }
+        const delivery = this.db.prepare("SELECT record_json FROM qa_delivery_turns WHERE turn_record_id=?").get(key);
+        if (delivery) {
+            const turn = parseJson(delivery.record_json);
+            const record = turn.sealedDispatch;
+            if (!record)
+                throw new Error("Remediation owner has no sealed dispatch");
+            verifyOwner(record);
+            const attempt = this.db.prepare("SELECT record_json FROM qa_remediation_attempts WHERE attempt_id=?").get(turn.operationId);
+            const sealed = attempt && parseJson(attempt.record_json).sealedDispatches?.[key];
+            if (json(sealed) !== json(record))
+                throw new Error("Remediation attempt tuple differs from its delivery intent");
+            return record;
+        }
+        const intent = this.operation(key)?.intent;
+        if (!intent?.sealedDispatch)
+            throw new Error("Generic owner has no sealed dispatch");
+        persistedDispatchTuple(intent.sealedDispatch);
+        if (canonicalJson(intent.tuple) !== intent.sealedDispatch.tupleJson)
+            throw new Error("Generic intent tuple differs from its sealed canonical bytes");
+        return intent.sealedDispatch;
+    }
+    assertStructuredDispatchAdmission(runId, dispatchId, parentId, operation) {
+        const processing = this.pendingStructuredPostprocessing(runId);
+        const transfers = this.db.prepare("SELECT * FROM structured_handoff_lineage WHERE run_id=? AND state<>'completed'").all(runId);
+        const linked = transfers.length === 1 && transfers[0].predecessor_id === parentId &&
+            (operation === "handoff-acceptance" && transfers[0].state === "acceptance-pending" && !transfers[0].acceptance_id ||
+                transfers[0].state === "continuation-planned" && transfers[0].continuation_id === dispatchId);
+        if (processing.some(id => id !== parentId) || (processing.length || transfers.length) && !linked)
+            throw new Error("Confirmed dispatch postprocessing or handoff is pending; reconcile before unrelated work");
+    }
+    beginStructuredHandoff(predecessorId) {
+        const operation = this.operation(predecessorId);
+        if (!operation || operation.status !== "confirmed")
+            throw new Error("Handoff predecessor must be confirmed");
+        const changed = this.db.prepare("INSERT OR IGNORE INTO structured_handoff_lineage(predecessor_id,run_id,state) VALUES(?,?,'acceptance-pending')").run(predecessorId, operation.runId);
+        if (changed.changes !== 1)
+            throw new Error("Handoff acceptance already started; reconcile persisted lineage before recovery");
+    }
+    linkStructuredHandoffDispatch(dispatchId, parentId, operation) {
+        if (!parentId)
+            return;
+        const row = this.db.prepare("SELECT * FROM structured_handoff_lineage WHERE predecessor_id=?").get(parentId);
+        if (!row)
+            return;
+        if (operation === "handoff-acceptance") {
+            if (row.state !== "acceptance-pending" || row.acceptance_id)
+                throw new Error("Handoff acceptance already dispatched");
+            this.db.prepare("UPDATE structured_handoff_lineage SET acceptance_id=? WHERE predecessor_id=?").run(dispatchId, parentId);
+        }
+        else if (row.state !== "continuation-planned" || row.continuation_id !== dispatchId)
+            throw new Error("Foreign handoff continuation");
+    }
+    planStructuredContinuation(predecessorId, successor) {
+        return this.atomic(() => {
+            const row = this.db.prepare("SELECT * FROM structured_handoff_lineage WHERE predecessor_id=?").get(predecessorId);
+            if (!row || row.state !== "acceptance-pending" || !row.acceptance_id || this.operation(row.acceptance_id)?.status !== "confirmed")
+                throw new Error("Successor lacks confirmed native handoff acceptance lineage");
+            const origin = this.db.prepare("SELECT checkpoint_id FROM continuity_checkpoint_origins WHERE dispatch_id=? AND publication_kind='handoff_acceptance'").get(row.acceptance_id);
+            if (!origin)
+                throw new Error("Successor acceptance checkpoint is missing");
+            verifyCheckpointOrigin(this.db, this.projectDir, origin.checkpoint_id);
+            this.assertAcceptedStructuredSuccessor(row.run_id, origin.checkpoint_id, successor);
+            const accepted = this.retainedStructuredTurn(row.acceptance_id).selectedDispatch;
+            if (accepted.sessionId !== successor.sessionId || accepted.provider !== successor.provider)
+                throw new Error("Successor differs from the accepted provider session");
+            const continuationId = randomUUID();
+            this.db.prepare("UPDATE structured_handoff_lineage SET state='continuation-planned',successor_json=?,continuation_id=? WHERE predecessor_id=?")
+                .run(json(successor), continuationId, predecessorId);
+            return continuationId;
+        });
+    }
+    structuredContinuation(runId, role) {
+        const row = this.db.prepare("SELECT * FROM structured_handoff_lineage WHERE run_id=? AND successor_json IS NOT NULL AND json_extract(successor_json,'$.role')=? ORDER BY rowid DESC LIMIT 1").get(runId, role);
+        if (!row)
+            return;
+        const origin = this.db.prepare("SELECT checkpoint_id FROM continuity_checkpoint_origins WHERE dispatch_id=? AND publication_kind='handoff_acceptance'").get(row.acceptance_id);
+        if (!origin)
+            throw new Error("Handoff continuation lacks its accepted checkpoint");
+        verifyCheckpointOrigin(this.db, this.projectDir, origin.checkpoint_id);
+        this.assertAcceptedStructuredSuccessor(runId, origin.checkpoint_id, parseJson(row.successor_json));
+        return { predecessorId: row.predecessor_id, continuationId: row.continuation_id, state: row.state, successor: parseJson(row.successor_json) };
+    }
+    finishStructuredContinuation(dispatchId) {
+        if (this.operation(dispatchId)?.status !== "confirmed")
+            throw new Error("Unconfirmed continuation cannot complete");
+        this.db.prepare("UPDATE structured_handoff_lineage SET state='completed' WHERE continuation_id=?").run(dispatchId);
+    }
+    assertAcceptedStructuredSuccessor(runId, checkpointId, successor) {
+        const handoff = this.db.prepare("SELECT acceptance_receipt_digest FROM handoffs WHERE run_id=? AND successor_session_key=? AND state='accepted'")
+            .get(runId, providerSessionKey(successor));
+        const checkpoint = this.db.prepare("SELECT digest FROM continuity_checkpoints WHERE checkpoint_id=? AND run_id=?").get(checkpointId, runId);
+        const bytes = handoff?.acceptance_receipt_digest && this.getEvidence(handoff.acceptance_receipt_digest);
+        if (!bytes || createHash("sha256").update(bytes).digest("hex") !== handoff.acceptance_receipt_digest)
+            throw new Error("Successor lacks retained accepted ownership evidence");
+        const receipt = parseJson(bytes.toString());
+        if (receipt.runId !== runId || receipt.acceptanceCheckpointDigest !== checkpoint?.digest
+            || providerSessionKey(receipt.successorSessionRef) !== providerSessionKey(successor))
+            throw new Error("Successor ownership differs from accepted checkpoint lineage");
+    }
+    requireStructuredPostprocessing(dispatchId, context) {
+        const operation = this.operation(dispatchId);
+        this.db.prepare("INSERT INTO structured_dispatch_processing(dispatch_id,run_id,state,context_json) VALUES(?,?,'pending',?)")
+            .run(dispatchId, operation.runId, json(context));
+    }
+    structuredProcessingContext(dispatchId) {
+        const row = this.db.prepare("SELECT context_json FROM structured_dispatch_processing WHERE dispatch_id=?").get(dispatchId);
+        if (!row)
+            throw new Error("Missing persisted post-confirmation intent");
+        return parseJson(row.context_json);
+    }
+    failStructuredPostprocessing(dispatchId, error) {
+        this.db.prepare("UPDATE structured_dispatch_processing SET error=? WHERE dispatch_id=?").run(error.slice(0, 4000), dispatchId);
+    }
+    completeStructuredPostprocessing(dispatchId) {
+        if (this.operation(dispatchId)?.status !== "confirmed")
+            throw new Error("Cannot process an unconfirmed dispatch");
+        this.db.prepare("UPDATE structured_dispatch_processing SET state='completed',error=NULL WHERE dispatch_id=?").run(dispatchId);
+    }
+    pendingStructuredPostprocessing(runId) {
+        return this.db.prepare("SELECT dispatch_id FROM structured_dispatch_processing WHERE run_id=? AND state='pending'").all(runId).map(row => row.dispatch_id);
+    }
+    retainedStructuredTurn(dispatchId) {
+        const owner = this.structuredOwnerDispatch(dispatchId), tuple = persistedDispatchTuple(owner);
+        const descriptor = persistedProviderWireContract(tuple);
+        if (!descriptor)
+            throw new Error("Missing historic dispatch descriptor");
+        this.replayStructuredDispatch(dispatchId, descriptor.canonical);
+        const result = this.operation(dispatchId).result;
+        const retained = JSON.parse(this.getEvidence(result.responseDigest).toString());
+        return { text: result.rawDigest ? this.getEvidence(result.rawDigest)?.toString() ?? "" : "", isError: false, numTurns: 1, costUsd: 0,
+            turnId: retained.hostTurnId, selectedDispatch: tuple, structured: hydrateStructuredReceipt(retained, digest => this.getEvidence(digest)) ?? undefined };
+    }
+    /** A claim is never recycled, even if transport fails before writing bytes. */
+    claimStructuredSubmission(tuple, session) {
+        return this.atomic(() => {
+            const operation = this.operation(tuple.dispatchId);
+            if (!operation || operation.status !== "in_progress" || this.structuredOwnerDispatch(tuple.dispatchId).tupleJson !== canonicalJson(tuple))
+                throw new Error("Cannot mint a send capability without a committed sealed owner intent");
+            this.assertNativeRunAdmission(operation.runId);
+            const frozen = operation.intent.sessionRef;
+            if (!session || canonicalJson(frozen) !== canonicalJson(session))
+                throw new Error("Submission claim requires the frozen provider session");
+            const continuation = this.db.prepare("SELECT successor_json FROM structured_handoff_lineage WHERE continuation_id=? AND state='continuation-planned'").get(tuple.dispatchId);
+            if (continuation && canonicalJson(parseJson(continuation.successor_json)) !== canonicalJson(session))
+                throw new Error("Continuation session differs from accepted lineage");
+            const claimId = randomUUID();
+            const changed = this.db.prepare(`INSERT OR IGNORE INTO structured_submission_claims(dispatch_id,run_id,tuple_digest,claim_id,session_json,state,created_at)
+        VALUES(?,?,?,?,?,'claimed',?)`).run(tuple.dispatchId, operation.runId, tuple.digest, claimId, canonicalJson(session), new Date().toISOString());
+            if (changed.changes !== 1)
+                throw new Error("Structured dispatch already has a submission claim; reconcile before a new dispatch");
+            this.db.prepare("UPDATE structured_handoff_lineage SET state='continuation-claimed' WHERE continuation_id=?").run(tuple.dispatchId);
+            return claimId;
+        });
+    }
+    consumeStructuredSubmission(tuple, claimId, session) {
+        this.atomic(() => {
+            const operation = this.operation(tuple.dispatchId);
+            if (!operation || operation.status !== "in_progress" || this.structuredOwnerDispatch(tuple.dispatchId).tupleJson !== canonicalJson(tuple))
+                throw new Error("Submission owner is no longer in progress or sealed");
+            this.assertNativeRunAdmission(operation.runId);
+            const frozen = operation.intent.sessionRef;
+            if (!session || canonicalJson(frozen) !== canonicalJson(session))
+                throw new Error("Submission session changed after sealing");
+            const owner = this.roleMutationLease(operation.runId, session.role);
+            if (!(tuple.operation === "handoff-acceptance" && operation.intent.purpose === "contract-acceptance") && owner && (owner.providerSessionId !== session.sessionId || owner.sessionKey && owner.sessionKey !== providerSessionKey(session))) {
+                this.assertFreshRecoveryValidation(tuple.dispatchId, session);
+            }
+            const changed = this.db.prepare(`UPDATE structured_submission_claims SET state='consumed',consumed_at=?
+        WHERE dispatch_id=? AND run_id=? AND tuple_digest=? AND claim_id=? AND session_json=? AND state='claimed'`)
+                .run(new Date().toISOString(), tuple.dispatchId, operation.runId, tuple.digest, claimId, canonicalJson(session));
+            if (changed.changes !== 1)
+                throw new Error("Structured submission claim already consumed or revoked");
+        });
+    }
+    assertNativeRunAdmission(runId) {
+        assertStructuredCutoverComplete(this.db);
+        const run = this.getRun(runId);
+        if (run?.legacy || run?.checkpoint === STRUCTURED_CUTOVER_REASON || run?.state.structuredCommunicationCutover)
+            throw new Error("structured-communication-v2-cutover: start a new native dispatch; this workflow cannot resume");
+    }
+    recordCommunicationEvidenceRefs(ownerId, digests) {
+        for (const digest of new Set(digests))
+            this.db.prepare("INSERT OR IGNORE INTO communication_evidence_refs(owner_kind,owner_id,evidence_digest,created_at) VALUES('provider-dispatch',?,?,?)").run(ownerId, digest, new Date().toISOString());
+    }
+    replayStructuredDispatch(key, contract) {
+        const operation = this.operation(key);
+        const result = operation?.result;
+        if (operation?.status !== "confirmed" || result?.validation !== "accepted" || !result.responseDigest)
+            throw new Error("Structured dispatch has no confirmed persisted receipt");
+        return this.verifyRetainedStructuredDispatch(key, contract, result.responseDigest);
+    }
+    assertStructuredProviderTurn(key, providerTurnId) {
+        const result = this.operation(key)?.result;
+        const bytes = result?.responseDigest ? this.getEvidence(result.responseDigest) : undefined;
+        if (!bytes)
+            throw new Error("Structured dispatch receipt evidence is missing");
+        const retained = JSON.parse(bytes.toString());
+        if (!providerTurnId || retained?.receipt?.state !== "candidate" || retained.hostTurnId !== providerTurnId)
+            throw new Error("Domain receipt has a foreign native provider turn identity");
+    }
+    verifyRetainedStructuredDispatch(key, contract, responseDigest) {
+        const readVerifiedEvidence = (digest) => {
+            const bytes = this.getEvidence(digest);
+            if (bytes && (!graphDerivedAllowed(this.db, this.projectDir, digest) || createHash("sha256").update(bytes).digest("hex") !== digest))
+                throw new Error("Structured receipt evidence digest mismatch");
+            return bytes;
+        };
+        const bytes = readVerifiedEvidence(responseDigest);
+        if (!bytes)
+            throw new Error("Structured dispatch receipt evidence is missing");
+        const retained = JSON.parse(bytes.toString());
+        const owner = this.structuredOwnerDispatch(key);
+        if (retained.version !== 2 || retained.tupleDigest !== owner.tupleDigest)
+            throw new Error("Stored receipt does not match persisted owner tuple");
+        return verifyPersistedDispatch(contract, owner, hydrateStructuredReceipt(retained, readVerifiedEvidence));
+    }
     updateOperation(idempotencyKey, status, details = {}, now = new Date()) {
         const prior = this.operation(idempotencyKey);
         if (prior?.kind === "provider-dispatch" && status === "in_progress" && this.unresolvedPreparationProcesses(prior.runId).length)
             throw new Error("Readiness cleanup must be reconciled before provider dispatch");
         if (!prior)
             throw new Error(`operation not found: ${idempotencyKey}`);
+        if (prior.kind === "provider-dispatch" && status === "confirmed") {
+            const owner = this.structuredOwnerDispatch(idempotencyKey), tuple = persistedDispatchTuple(owner);
+            const descriptor = persistedProviderWireContract(tuple);
+            const result = details.result;
+            if (!descriptor || result?.validation !== "accepted" || !result.responseDigest)
+                throw new Error("Provider confirmation requires verified persisted receipt evidence");
+            this.verifyRetainedStructuredDispatch(idempotencyKey, descriptor.canonical, result.responseDigest);
+        }
         const allowed = {
             planned: ["planned", "in_progress", "failed"],
             in_progress: ["in_progress", "confirmed", "failed", "uncertain"],
@@ -1389,6 +1754,84 @@ export class WorkflowDb {
             registerGraphDerived(this.db, bytes, graphAccess);
         return digest;
     }
+    /** Create an append-only provider page artifact before its first dispatch. */
+    populationPageRecords(artifactId) {
+        return this.db.prepare("SELECT content FROM page_ledger_pages WHERE artifact_id=? ORDER BY ordinal").all(artifactId)
+            .map(row => row.content.toString("utf8"));
+    }
+    populationPageLedger(artifactId) {
+        const row = this.db.prepare("SELECT tuple_digest,state,page_count FROM page_ledgers WHERE artifact_id=?").get(artifactId);
+        return row && { tupleDigest: row.tuple_digest, state: row.state, pageCount: row.page_count };
+    }
+    beginPageLedger(input, now = new Date()) {
+        if (!/^[A-Za-z0-9_.:-]{1,256}$/.test(input.artifactId) || !/^[A-Za-z0-9_.:-]{1,256}$/.test(input.lineageId) || !/^[A-Za-z0-9_.:-]{1,256}$/.test(input.leaseId) || !/^[a-f0-9]{64}$/.test(input.tupleDigest))
+            throw new Error("Invalid page ledger identity");
+        this.ensureRun(input.runId);
+        this.db.prepare(`INSERT INTO page_ledgers(artifact_id,run_id,lineage_id,tuple_digest,lease_id,state,page_count,total_bytes,created_at,updated_at)
+      VALUES(?,?,?,?,?,'open',0,0,?,?) ON CONFLICT(artifact_id) DO NOTHING`).run(input.artifactId, input.runId, input.lineageId, input.tupleDigest, input.leaseId, now.toISOString(), now.toISOString());
+        const row = this.db.prepare("SELECT run_id,lineage_id,tuple_digest,lease_id FROM page_ledgers WHERE artifact_id=?").get(input.artifactId);
+        if (row.run_id !== input.runId || row.lineage_id !== input.lineageId || row.tuple_digest !== input.tupleDigest || row.lease_id !== input.leaseId)
+            throw new Error("Page ledger identity collision");
+    }
+    /**
+     * Atomically appends a page.  Duplicate delivery is accepted only when every
+     * immutable byte and linkage field agrees; a provider cannot fill gaps,
+     * rewrite history, or append after the terminal page.
+     */
+    appendPageLedger(input, now = new Date()) {
+        if (!Number.isInteger(input.ordinal) || input.ordinal < 0 || input.ordinal >= 60)
+            throw new Error("Page ordinal exceeds the 60-page limit");
+        let canonical;
+        let ticketCount;
+        try {
+            const parsed = JSON.parse(input.content);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("page must be a JSON object");
+            const tickets = parsed.tickets;
+            if (!Array.isArray(tickets))
+                throw new Error("page must contain tickets");
+            ticketCount = tickets.length;
+            canonical = canonicalJson(parsed);
+        }
+        catch (error) {
+            throw new Error(`Page ledger content must be canonical ticket-page JSON: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (canonical !== input.content)
+            throw new Error("Page ledger content must use canonical JSON bytes");
+        if (ticketCount > 150)
+            throw new Error("Page exceeds the 150-ticket limit");
+        const bytes = Buffer.byteLength(input.content);
+        if (bytes > 750 * 1024)
+            throw new Error("Page exceeds the 750 KiB limit");
+        const digest = createHash("sha256").update(input.content).digest("hex");
+        return this.atomic(() => {
+            const header = this.db.prepare("SELECT lineage_id,tuple_digest,lease_id,state,page_count,total_bytes FROM page_ledgers WHERE artifact_id=?").get(input.artifactId);
+            if (!header || header.lineage_id !== input.lineageId || header.tuple_digest !== input.tupleDigest || header.lease_id !== input.leaseId)
+                throw new Error("Unknown or foreign page ledger");
+            const existing = this.db.prepare("SELECT predecessor_digest,content_digest,content,terminal FROM page_ledger_pages WHERE artifact_id=? AND ordinal=?").get(input.artifactId, input.ordinal);
+            if (existing) {
+                if (existing.terminal)
+                    throw new Error("Duplicate terminal page");
+                if (existing.predecessor_digest === input.predecessorDigest && existing.content_digest === digest && existing.content.equals(Buffer.from(input.content)) && Boolean(existing.terminal) === input.terminal)
+                    return { digest, duplicate: true };
+                throw new Error("Conflicting duplicate page");
+            }
+            if (header.state !== "open")
+                throw new Error("Cannot append after terminal page");
+            if (input.ordinal !== header.page_count)
+                throw new Error("Page ordinal is out of order or has a gap");
+            const prior = input.ordinal === 0 ? null : this.db.prepare("SELECT content_digest FROM page_ledger_pages WHERE artifact_id=? AND ordinal=?").get(input.artifactId, input.ordinal - 1);
+            if ((prior?.content_digest ?? null) !== input.predecessorDigest)
+                throw new Error("Page predecessor digest does not match");
+            if (header.total_bytes + bytes > 6 * 1024 * 1024)
+                throw new Error("Page ledger exceeds the 6 MiB aggregate limit");
+            this.db.prepare("INSERT INTO page_ledger_pages(artifact_id,ordinal,predecessor_digest,content_digest,content,terminal,created_at) VALUES(?,?,?,?,?,?,?)")
+                .run(input.artifactId, input.ordinal, input.predecessorDigest, digest, Buffer.from(input.content), input.terminal ? 1 : 0, now.toISOString());
+            this.db.prepare("UPDATE page_ledgers SET page_count=?,total_bytes=?,state=?,updated_at=? WHERE artifact_id=?")
+                .run(header.page_count + 1, header.total_bytes + bytes, input.terminal ? "terminal" : "open", now.toISOString(), input.artifactId);
+            return { digest, duplicate: false };
+        });
+    }
     registerGraphEvidence(value, access) { registerGraphDerived(this.db, value, access); }
     getEvidence(digest) {
         if (!graphDerivedAllowed(this.db, this.projectDir, digest))
@@ -1449,7 +1892,16 @@ export class WorkflowDb {
             .run(next.status, next.reportDigest ?? null, json({ findingIds: next.findingIds, namespacedFindingIds: next.namespacedFindingIds, detail: next.detail }), next.updatedAt, attemptId);
         const admission = this.admittedWork(next.runId, next.ticketId);
         const turns = this.db.prepare("SELECT receipt_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND review_number=? AND status='completed'").all(next.runId, next.ticketId, next.reviewNumber);
-        const terminalBlock = turns.some(row => { const receipt = parseJson(row.receipt_json); const response = receipt.cleanedResponseDigest && this.getEvidence(receipt.cleanedResponseDigest); return receipt.terminalEventObserved && response && /STEP_STATUS:\s*(blocked|needs_input)\b/.test(response.toString()); });
+        const terminalBlock = turns.some(row => {
+            const receipt = parseJson(row.receipt_json);
+            const response = receipt.structuredResponseDigest && this.getEvidence(receipt.structuredResponseDigest);
+            if (!receipt.terminalEventObserved || !response)
+                return false;
+            // A retained response alone is not authority in v2: this legacy receipt
+            // has no sealed tuple/descriptor record to verify.  It may be inspected,
+            // but cannot advance a review state.
+            return false;
+        });
         if (admission && (next.status === "passed" || next.status === "failed" || terminalBlock))
             this.qaPreparationStore().metric(next.runId, next.ticketId, admission.requirementsDigest, `metric:review:${attemptId}`, "substantive-review", { status: next.status === "passed" ? "passed" : next.status === "failed" ? "failed" : "blocked", at: now.toISOString(), evidenceRefs: next.reportDigest ? [next.reportDigest] : [] });
         return next;
@@ -1489,8 +1941,9 @@ export class WorkflowDb {
         if (!prior)
             throw new Error(`QA remediation attempt not found: ${attemptId}`);
         const next = { ...prior, ...patch, status, updatedAt: now.toISOString() };
+        const raw = this.db.prepare("SELECT record_json FROM qa_remediation_attempts WHERE attempt_id=?").get(attemptId);
         this.db.prepare("UPDATE qa_remediation_attempts SET status=?,response_digest=?,summary_digest=?,record_json=?,updated_at=? WHERE attempt_id=?")
-            .run(status, next.responseDigest ?? null, next.summaryDigest ?? null, json({ detail: next.detail, recoveryAttemptId: next.recoveryAttemptId }), next.updatedAt, attemptId);
+            .run(status, next.responseDigest ?? null, next.summaryDigest ?? null, json({ ...parseJson(raw.record_json), detail: next.detail, recoveryAttemptId: next.recoveryAttemptId }), next.updatedAt, attemptId);
         return next;
     }
     qaRemediationAttempts(runId, ticketId) {
@@ -1511,6 +1964,11 @@ export class WorkflowDb {
             ensureQaGraphJournalGuards(this.db);
         const prior = this.qaDeliveryTurns(turn.operationId).find(t => t.turnRecordId === turn.turnRecordId);
         if (prior) {
+            if (prior.sealedDispatch) {
+                if (turn.sealedDispatch && json(turn.sealedDispatch) !== json(prior.sealedDispatch))
+                    throw new Error("Delivery owner tuple is immutable");
+                turn.sealedDispatch = prior.sealedDispatch;
+            }
             if (prior.status !== "intended") {
                 if (json(prior) !== json(turn))
                     throw new Error(`conflicting completed delivery turn ${turn.turnRecordId}`);
@@ -1521,6 +1979,14 @@ export class WorkflowDb {
                     throw new Error(`delivery turn intent mismatch: ${key}`);
             }
         }
+        if (turn.status === "completed") {
+            const transport = this.operation(turn.turnRecordId);
+            if (!prior?.sealedDispatch || json(turn.sealedDispatch) !== json(prior.sealedDispatch)
+                || turn.structuredResponseDigest !== transport?.result?.responseDigest)
+                throw new Error("Completed delivery requires its persisted sealed native receipt");
+            this.replayStructuredDispatch(turn.turnRecordId, remediationOutput);
+            this.assertStructuredProviderTurn(turn.turnRecordId, turn.providerTurnId);
+        }
         this.db.prepare(`INSERT INTO qa_delivery_turns(turn_record_id,operation_id,report_occurrence_id,turn_index,kind,status,record_json,created_at,updated_at)
       VALUES(?,?,?,?,?,?,?,?,?) ON CONFLICT(turn_record_id) DO UPDATE SET status=excluded.status,record_json=excluded.record_json,updated_at=excluded.updated_at`)
             .run(turn.turnRecordId, turn.operationId, turn.reportOccurrenceId, turn.turnIndex, turn.kind, turn.status, json(turn), turn.startedAt, turn.completedAt ?? turn.startedAt);
@@ -1646,6 +2112,7 @@ export class WorkflowDb {
     }
     /** Compare-and-swap the authoritative QA reducer head and append its event atomically. */
     transitionQa(runId, ticketId, expectedRevision, event, now = new Date()) {
+        this.assertNativeRunAdmission(runId);
         this.ensureRun(runId);
         return this.db.transaction(() => {
             const current = this.qaTicketHead(runId, ticketId);
@@ -1734,7 +2201,18 @@ export class WorkflowDb {
         const row = this.db.prepare("SELECT receipt_json FROM qa_handoffs WHERE operation_id=? AND status='accepted'").get(operationId);
         return row?.receipt_json ? parseJson(row.receipt_json) : undefined;
     }
+    /**
+     * Structured authority is admitted only after the one-way v2 cutover has
+     * committed.  Keeping this at the common admission boundary prevents a
+     * caller that opens WorkflowDb directly from bypassing the migration.
+     */
+    enableStructuredCommunication() {
+        this.applyStructuredCommunicationV2Cutover();
+        ensureQaGraphJournalGuards(this.db);
+    }
     beginQaTurn(intent) {
+        if (intent.outputContract)
+            this.enableStructuredCommunication();
         const at = intent.intendedAt;
         this.db.transaction(() => {
             const existing = this.db.prepare("SELECT intent_json FROM qa_turns WHERE operation_id=?").get(intent.operationId);
@@ -1746,6 +2224,50 @@ export class WorkflowDb {
                 .run(intent.runId, intent.ticketId, intent.reviewNumber, intent.sessionGeneration, intent.slot, intent.operationId, at);
         })();
     }
+    /** Retire this run's unresolved dispatches on a provider session the host
+     * has just closed after a failed call. The closed provider can no longer
+     * act, so the call's outcome is final: unknown, never replayed. */
+    retireClosedSessionDispatches(runId, sessionId, reason) {
+        if (!sessionId)
+            return [];
+        const dispatches = [...this.unresolvedRoleDispatches(runId, "builder"), ...this.unresolvedRoleDispatches(runId, "qa")]
+            .filter(dispatch => dispatch.intent.sessionRef?.sessionId === sessionId);
+        this.atomic(() => {
+            for (const dispatch of dispatches)
+                this.updateOperation(dispatch.idempotencyKey, "failed", { result: { recovery: "provider-closed", outcomeUnknown: true, providerReplayAuthorized: false, priorResult: dispatch.result }, error: reason });
+        });
+        return dispatches.map(dispatch => dispatch.idempotencyKey);
+    }
+    /** Retire interrupted role turns that are not implementation or bound QA
+     * review work (for example build preflight, coverage, or handoff
+     * acceptance) so the step restarts from its beginning. Implementation and
+     * review turns keep their own recovery. The interrupted outcome stays unknown and is
+     * never replayed or treated as a result. Returns the retired dispatch IDs. */
+    reconcileInterruptedSteps(runId, role) {
+        // Only steps that are safe to run again from their beginning. Implementation
+        // turns, bound QA review turns and turns of unknown kind keep their own recovery.
+        const reviewTurn = this.db.prepare("SELECT 1 FROM qa_turns WHERE operation_id=?");
+        const dispatches = this.unresolvedRoleDispatches(runId, role).filter(dispatch => {
+            const operation = String(dispatch.intent.operation ?? "");
+            return RESTARTABLE_STEPS[role].has(operation) && (role === "builder" || !reviewTurn.get(dispatch.idempotencyKey));
+        });
+        if (!dispatches.length)
+            return [];
+        const lease = this.currentLease();
+        if (lease?.runId !== runId || lease.pid !== process.pid)
+            throw new Error("Step recovery requires the original build recovery lease");
+        const worker = this.events(runId).filter(event => event.type === "worker_started").at(-1)?.payload;
+        if (!worker?.workerPid || classifyProcess(worker.workerPid, worker.processStart, worker.host).state !== "dead" || !processGroupQuiescent(worker.workerPid)
+            || this.readinessProcesses().length)
+            throw new Error("The interrupted step and all owned provider processes must be verified stopped before it restarts");
+        const reconciliationId = `${role}-step-restart:${runId}:${randomUUID()}`;
+        this.atomic(() => {
+            for (const dispatch of dispatches)
+                this.updateOperation(dispatch.idempotencyKey, "failed", { result: { recovery: "step-restart", reconciliationId, outcomeUnknown: true, providerReplayAuthorized: false, operation: dispatch.intent.operation ?? null, priorResult: dispatch.result }, error: "Interrupted step outcome remains unknown; the step restarts from its beginning with its original inputs" });
+            this.appendContinuityEvent({ runId, role: "host", kind: "interrupted_step_restarted", payload: { role, reconciliationId, dispatchIds: dispatches.map(dispatch => dispatch.idempotencyKey), outcomeUnknown: true, providerReplayAuthorized: false }, authoritativeStateRevision: this.continuityHead(runId, "run")?.authoritativeStateRevision ?? 0 });
+        });
+        return dispatches.map(dispatch => dispatch.idempotencyKey);
+    }
     /** Retire an interrupted, proven read-only review transport, never a QA pass
      * or Builder remediation. A fresh immutable review must still run afterward. */
     reconcileInterruptedQaDispatch(runId, ticketId) {
@@ -1772,17 +2294,20 @@ export class WorkflowDb {
         // A cancellation can have a durable host terminal receipt while the
         // provider dispatch is still unknown. Exact frozen-turn bindings remain
         // required; the old receipt is never promoted to an accepted QA result.
+        // A QA turn and its provider dispatch share one ID: the turn's operation ID
+        // is the dispatch's idempotency key. Instruction digests are not comparable
+        // across the two records (the dispatch hashes the full rendered provider
+        // instruction), so binding is by that shared ID.
+        // A host-completed turn is recoverable only when its dispatch recorded a
+        // typed unknown provider outcome.
         const rows = this.db.prepare("SELECT status,intent_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND status IN ('intended','uncertain','unknown','completed')").all(runId, ticketId);
-        const turns = rows.flatMap(row => {
+        const turns = new Map(rows.flatMap(row => {
             const turn = parseJson(row.intent_json);
-            if (row.status === "completed" && !dispatches.some(dispatch => {
-                const result = dispatch.result;
-                return result?.isError === true && result.failure?.dispatchState === "unknown"
-                    && dispatch.intent.instructionDigest === turn.instructionDigest;
-            }))
+            const result = dispatches.find(dispatch => dispatch.idempotencyKey === turn.operationId)?.result;
+            if (row.status === "completed" && !(result?.isError === true && result.failure?.dispatchState === "unknown"))
                 return [];
-            return [turn];
-        });
+            return [[turn.operationId, turn]];
+        }));
         const bindings = dispatches.map(dispatch => {
             const intent = dispatch.intent;
             const ref = intent.sessionRef;
@@ -1790,9 +2315,10 @@ export class WorkflowDb {
                 || !ref.configRoot || canonicalProject(ref.configRoot) !== canonicalProject(this.projectDir) || !ref.validatedAt || Number.isNaN(Date.parse(ref.validatedAt))
                 || ref.source !== "observed" || providerSessionKey(ref) !== owner.sessionKey)
                 throw new Error("QA dispatch has no validated owner binding");
-            const turn = turns.find(turn => turn.reviewNumber === head.reviewNumber && turn.instructionDigest === intent.instructionDigest
-                && turn.providerSession.sessionId === ref.sessionId && turn.providerSession.provider === ref.provider && turn.providerSession.generation === ref.generation
-                && turn.providerSession.cwd === ref.cwd && turn.providerSession.configRoot === ref.configRoot);
+            const candidate = turns.get(dispatch.idempotencyKey);
+            const turn = candidate && candidate.reviewNumber === head.reviewNumber
+                && candidate.providerSession.sessionId === ref.sessionId && candidate.providerSession.provider === ref.provider && candidate.providerSession.generation === ref.generation
+                && candidate.providerSession.cwd === ref.cwd && candidate.providerSession.configRoot === ref.configRoot ? candidate : undefined;
             if (!turn || turn.sourceStateDigest !== head.sourceStateDigest || turn.reviewBasisDigest !== head.reviewBasisDigest)
                 throw new Error("QA dispatch does not match the frozen review turn");
             const sessions = this.db.prepare("SELECT session_json FROM qa_sessions WHERE run_id=? AND ticket_id=? AND generation=? AND source_state_digest=? AND review_basis_digest=?").all(runId, ticketId, ref.generation, turn.sourceStateDigest, turn.reviewBasisDigest);
@@ -1839,9 +2365,24 @@ export class WorkflowDb {
     }
     finishQaTurn(receipt) {
         this.db.transaction(() => {
-            const prior = this.db.prepare("SELECT source_state_digest,review_basis_digest,status FROM qa_turns WHERE operation_id=?").get(receipt.operationId);
+            const prior = this.db.prepare("SELECT source_state_digest,review_basis_digest,status,intent_json FROM qa_turns WHERE operation_id=?").get(receipt.operationId);
             if (!prior)
                 throw new Error(`QA turn intent not found: ${receipt.operationId}`);
+            const intent = parseJson(prior.intent_json);
+            if (receipt.dispatch === "completed") {
+                if (!intent.outputContract)
+                    throw new Error("Completed QA receipt requires its sealed native contract");
+                const owner = this.structuredOwnerDispatch(receipt.operationId);
+                if (json(receipt.sealedDispatch) !== json(owner))
+                    throw new Error("QA receipt differs from sealed owner intent");
+                if (receipt.structuredResponseDigest !== this.operation(receipt.operationId)?.result?.responseDigest)
+                    throw new Error("QA receipt references foreign native evidence");
+                const descriptor = persistedProviderWireContract(persistedDispatchTuple(owner));
+                if (!descriptor)
+                    throw new Error("QA receipt contract is unavailable");
+                this.replayStructuredDispatch(receipt.operationId, descriptor.canonical);
+                this.assertStructuredProviderTurn(receipt.operationId, receipt.providerTurnId);
+            }
             if (prior.source_state_digest !== receipt.sourceStateDigest || prior.review_basis_digest !== receipt.reviewBasisDigest)
                 throw new Error("QA turn receipt binding mismatch");
             if (prior.status === "completed") {
@@ -2000,6 +2541,13 @@ export class WorkflowDb {
         const row = this.db.prepare("SELECT receipt_json FROM qa_remediation_receipts WHERE operation_id=?").get(operationId);
         return row ? parseJson(row.receipt_json) : undefined;
     }
+    verifiedBuilderRemediationReceipt(operationId) {
+        const receipt = this.builderRemediationReceipt(operationId);
+        if (!receipt)
+            return undefined;
+        this.assertBuilderRemediationReceipt(receipt);
+        return receipt;
+    }
     hasConfirmedQaRemediationForRecheck(runId, ticketId) {
         const head = this.qaTicketHead(runId, ticketId);
         const attempt = this.qaRemediationAttempts(runId, ticketId).at(-1);
@@ -2007,6 +2555,8 @@ export class WorkflowDb {
             || attempt.generation !== head.remediationGeneration || this.unresolvedRoleDispatches(runId, "builder").length)
             return false;
         const receipt = this.builderRemediationReceipt(attempt.attemptId);
+        if (receipt)
+            this.assertBuilderRemediationReceipt(receipt);
         const review = this.qaReviewAttempt(attempt.reviewAttemptId);
         const transition = this.db.prepare("SELECT to_revision,event_json FROM qa_transitions WHERE run_id=? AND ticket_id=? ORDER BY to_revision DESC LIMIT 1").get(runId, ticketId);
         return Boolean(receipt && review && review.status === "failed" && receipt.runId === runId && receipt.ticketId === ticketId
@@ -2016,6 +2566,7 @@ export class WorkflowDb {
             && transition?.to_revision === head.revision && parseJson(transition.event_json).type === "remediation-received");
     }
     recordBuilderRemediationReceipt(receipt) {
+        this.assertBuilderRemediationReceipt(receipt);
         const text = json(receipt);
         const existing = this.db.prepare("SELECT receipt_json FROM qa_remediation_receipts WHERE operation_id=?").get(receipt.operationId);
         if (existing && json(parseJson(existing.receipt_json)) !== text)
@@ -2028,6 +2579,30 @@ export class WorkflowDb {
         this.db.prepare("INSERT OR IGNORE INTO qa_remediation_receipts(operation_id,run_id,ticket_id,report_digest,report_occurrence_id,receipt_json,created_at) VALUES(?,?,?,?,?,?,?)")
             .run(receipt.operationId, receipt.runId, receipt.ticketId, receipt.reportDigest, occurrence.reportOccurrenceId, text, receipt.completedAt);
     }
+    assertBuilderRemediationReceipt(receipt) {
+        if (receipt.version !== 3)
+            throw new Error("Legacy Builder receipt cannot authorize native remediation");
+        this.assertNativeRunAdmission(receipt.runId);
+        const attempt = this.qaRemediationAttempt(receipt.operationId);
+        const review = attempt && this.qaReviewAttempt(attempt.reviewAttemptId);
+        const turn = this.qaDeliveryTurns(receipt.operationId).find(value => value.turnRecordId === receipt.turnRecordId);
+        if (!attempt || !review || !turn || turn.status !== "completed" || attempt.status !== "succeeded"
+            || attempt.runId !== receipt.runId || attempt.ticketId !== receipt.ticketId
+            || review.sourceDigest !== receipt.sourceStateDigest || review.reportDigest !== receipt.reportDigest
+            || attempt.requestDigest !== receipt.requestDigest || attempt.responseDigest !== receipt.responseDigest
+            || attempt.summaryDigest !== receipt.summaryDigest || turn.rawResponseDigest !== receipt.responseDigest
+            || turn.providerTurnId !== receipt.providerTurnId || turn.reportOccurrenceId !== receipt.reportOccurrenceId)
+            throw new Error("Builder receipt differs from its persisted remediation owner");
+        const transport = this.operation(turn.turnRecordId);
+        if (turn.structuredResponseDigest !== transport?.result?.responseDigest)
+            throw new Error("Builder receipt has a foreign native evidence reference");
+        const result = this.replayStructuredDispatch(turn.turnRecordId, remediationOutput);
+        this.assertStructuredProviderTurn(turn.turnRecordId, receipt.providerTurnId);
+        const handoff = this.db.prepare("SELECT handoff_id FROM qa_failure_handoffs WHERE operation_id=?").get(receipt.operationId);
+        if (result.result.kind !== "completed" || result.result.payload.status !== "done" || result.result.payload.report.handoff_id !== handoff?.handoff_id
+            || createHash("sha256").update(result.result.payload.report.summary).digest("hex") !== receipt.summaryDigest)
+            throw new Error("Builder receipt requires its completed native remediation result and summary");
+    }
     commitBuilderRemediationSuccess(receipt, expectedRevision, now = new Date()) {
         return this.db.transaction(() => {
             this.recordBuilderRemediationReceipt(receipt);
@@ -2058,6 +2633,47 @@ export class WorkflowDb {
             return this.transitionQa(remediation.runId, remediation.ticketId, head.revision, { type: input.outcome === "uncertain" ? "remediation-uncertain" : "remediation-failed" }, now);
         })();
     }
+    assertNativeQaCertificate(input, phase, certificateId) {
+        this.assertNativeRunAdmission(input.runId);
+        const head = this.qaTicketHead(input.runId, input.ticketId);
+        const rows = this.db.prepare("SELECT * FROM qa_turns WHERE run_id=? AND ticket_id=? AND source_state_digest=? AND review_basis_digest=? AND status='completed'")
+            .all(input.runId, input.ticketId, input.sourceStateDigest, input.reviewBasisDigest);
+        const row = rows.find(row => {
+            try {
+                return qaDigest("turn-receipt", parseJson(row.receipt_json)) === input.turnReceiptDigest;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!row)
+            throw new Error("Pass requires the persisted sealed native QA owner receipt");
+        const receipt = parseJson(row.receipt_json);
+        const intent = parseJson(row.intent_json);
+        if (!receipt.terminalEventObserved || receipt.dispatch !== "completed" || receipt.operationId !== row.operation_id || intent.operationId !== row.operation_id ||
+            intent.runId !== input.runId || intent.ticketId !== input.ticketId || intent.reviewNumber !== head.reviewNumber || intent.reviewNumber !== row.review_number || intent.sessionGeneration !== head.sessionGeneration ||
+            intent.sourceStateDigest !== input.sourceStateDigest || intent.reviewBasisDigest !== input.reviewBasisDigest ||
+            receipt.sourceStateDigest !== input.sourceStateDigest || receipt.reviewBasisDigest !== input.reviewBasisDigest ||
+            !receipt.sealedDispatch || canonicalJson(receipt.sealedDispatch) !== canonicalJson(this.structuredOwnerDispatch(receipt.operationId)))
+            throw new Error("Native pass owner/source/review binding mismatch");
+        this.assertStructuredProviderTurn(receipt.operationId, receipt.providerTurnId);
+        const verdict = this.replayStructuredDispatch(receipt.operationId, qaVerdictOutput);
+        if (verdict.result.kind !== "completed" || verdict.result.payload.kind !== "passed")
+            throw new Error("Pass requires a verified native passed verdict");
+        const operation = this.operation(receipt.operationId);
+        const tuple = persistedDispatchTuple(this.structuredOwnerDispatch(receipt.operationId));
+        if (operation.runId !== input.runId || intent.providerSession.sessionId !== tuple.sessionId || intent.providerSession.generation !== tuple.generation || intent.providerSession.provider !== tuple.provider)
+            throw new Error("Native pass session/tuple binding mismatch");
+        const attempt = this.qaReviewAttempt(operation.intent.logicalActionId ?? "");
+        if (operation.intent.logicalActionId && !attempt)
+            throw new Error("Native pass review attempt is missing");
+        if (attempt && (attempt.runId !== input.runId || attempt.ticketId !== input.ticketId || attempt.reviewNumber !== head.reviewNumber || attempt.sourceDigest !== input.sourceStateDigest || attempt.status !== "passed"))
+            throw new Error("Native pass review attempt is not completed and bound");
+        if (head.sourceStateDigest !== input.sourceStateDigest || head.reviewBasisDigest !== input.reviewBasisDigest ||
+            (phase === "issue" ? head.state !== "turn-intended" || input.qaRevision !== head.revision + 1 :
+                head.passCertificateId !== certificateId || (phase === "consume" ? head.state !== "passed" || input.qaRevision !== head.revision : head.state !== "finalizing" || input.qaRevision + 1 !== head.revision)))
+            throw new Error("Native pass certificate does not match the reducer phase/revision");
+    }
     assertContractCertificate(input) {
         const store = this.qaPreparationStore();
         if (store.policy(input.runId)?.mode !== "enforce")
@@ -2065,6 +2681,7 @@ export class WorkflowDb {
         const binding = input.contractCoverage;
         if (!binding || binding.version !== 1)
             throw new Error("Enforcing pass requires tagged contract coverage authority");
+        const verifiedBinding = binding;
         const admission = this.assertAdmittedWork(input.runId, input.ticketId);
         const head = store.head(input.runId, input.ticketId, admission.requirementsDigest);
         if (head.state !== "ready" || head.digest !== binding.contractDigest)
@@ -2085,17 +2702,17 @@ export class WorkflowDb {
         const configuredMake = this.getRun(input.runId)?.state?.qa?.settings?.make;
         if (configuredMake && resolveEffectiveQaConfiguration(this.projectDir, { make: configuredMake }).digest !== basis.contractBinding.commonConfigDigest)
             throw new Error("Effective QA configuration changed before pass authority; reconcile contract");
-        const attempt = this.qaReviewAttempt(binding.attemptId);
+        const attempt = this.qaReviewAttempt(verifiedBinding.attemptId);
         if (!attempt || attempt.runId !== input.runId || attempt.ticketId !== input.ticketId || attempt.sourceDigest !== input.sourceStateDigest || attempt.reviewNumber !== this.qaTicketHead(input.runId, input.ticketId).reviewNumber)
             throw new Error("Coverage review attempt is stale or foreign");
-        const coverage = store.artifact(binding.coverageDigest, "final-coverage");
+        const coverage = store.artifact(verifiedBinding.coverageDigest, "final-coverage");
         for (const check of contract.checks)
             for (const method of check.verification)
                 if (method.equivalentAuthorityId && !store.equivalentResolver()(method.equivalentAuthorityId, contract, check, method, input.sourceStateDigest))
                     throw new Error("Equivalent verification authority is stale or foreign");
         const initialTurns = this.db.prepare("SELECT intent_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND review_number=? AND source_state_digest=? AND review_basis_digest=?").all(input.runId, input.ticketId, attempt.reviewNumber, input.sourceStateDigest, input.reviewBasisDigest);
         const initial = initialTurns.map(row => parseJson(row.intent_json)).find(turn => turn.slot === "initial");
-        if (!initial || initial.providerSession.sessionId !== binding.sessionId)
+        if (!initial || initial.providerSession.sessionId !== verifiedBinding.sessionId)
             throw new Error("Coverage lacks the actual fresh review dispatch identity");
         const dispatchedInstruction = this.getEvidence(initial.instructionDigest)?.toString();
         const envelope = `\nImmutable input-basis digest: ${basis.digest}. Coverage must bind this inputBasisDigest.`;
@@ -2103,49 +2720,65 @@ export class WorkflowDb {
             throw new Error("Actual review dispatch differs from frozen base instruction and tagged input-basis envelope");
         const receipts = this.db.prepare("SELECT receipt_json FROM qa_turns WHERE run_id=? AND ticket_id=? AND source_state_digest=? AND review_basis_digest=? AND status='completed'").all(input.runId, input.ticketId, input.sourceStateDigest, input.reviewBasisDigest);
         const receipt = receipts.map(row => parseJson(row.receipt_json)).find(row => qaDigest("turn-receipt", row) === input.turnReceiptDigest && row.terminalEventObserved);
-        const response = receipt?.cleanedResponseDigest ? this.getEvidence(receipt.cleanedResponseDigest) : undefined;
-        const retainedProviderCoverage = receipt && response
-            ? bindCoverageHostFields(parseContractCoverage(response.toString()), contract, {
-                phase: "qa",
-                sourceDigest: input.sourceStateDigest,
-                inputBasisDigest: input.reviewBasisDigest,
-                attemptId: binding.attemptId,
-                sessionId: binding.sessionId,
-            })
-            : undefined;
+        const response = receipt?.structuredResponseDigest ? this.getEvidence(receipt.structuredResponseDigest) : undefined;
+        if (!response || !receipt)
+            throw new Error("Pass requires a retained native QA verdict receipt");
+        const owner = this.structuredOwnerDispatch(receipt.operationId);
+        if (json(receipt.sealedDispatch) !== json(owner))
+            throw new Error("Pass receipt lacks its persisted v2 owner tuple");
+        if (persistedDispatchTuple(owner).sessionId !== verifiedBinding.sessionId)
+            throw new Error("Pass native receipt has a foreign session");
+        const verdict = this.replayStructuredDispatch(receipt.operationId, qaVerdictOutput);
+        if (verdict.result.kind !== "completed" || verdict.result.payload.kind !== "passed" || !verdict.result.payload.coverage)
+            throw new Error("Pass requires complete coverage in the retained native passed verdict");
+        const retainedProviderCoverage = bindCoverageHostFields(verdict.result.payload.coverage, contract, {
+            phase: "qa", sourceDigest: input.sourceStateDigest, inputBasisDigest: input.reviewBasisDigest,
+            attemptId: verifiedBinding.attemptId, sessionId: verifiedBinding.sessionId,
+        });
         let retainedCoverage = retainedProviderCoverage;
         let retainedHostComparison;
         const hostCheck = findHostQaCheck(contract);
-        if (hostCheck) {
+        if (hostCheck !== undefined) {
             const hostDigest = hostComparisonDigestFromCoverage(coverage, hostCheck.id);
             if (!hostDigest)
                 throw new Error("Coverage is missing the host-owned comparison artifact reference");
-            const hostResult = hostQaComparisonV1Schema.parse(store.artifact(hostDigest, "host-qa-comparison"));
-            retainedHostComparison = { result: hostResult, resultDigest: hostDigest };
+            const verifiedHostDigest = hostDigest;
+            const hostResult = hostQaComparisonV1Schema.parse(store.artifact(verifiedHostDigest, "host-qa-comparison"));
+            retainedHostComparison = { result: hostResult, resultDigest: verifiedHostDigest };
         }
+        const commandObservations = [
+            ...retainedQaCommandObservations(this.projectDir, input.runId, input.ticketId, false),
+            ...retainedHostBuilderObservations(this, input.runId, input.ticketId),
+        ];
         const graphCheck = findGraphQaChecks(contract)[0];
+        let retainedHostGraph;
         if (graphCheck) {
             const graphDigest = hostGraphApplicabilityDigestFromCoverage(coverage, graphCheck.id);
             if (!graphDigest)
                 throw new Error("Coverage is missing the host-owned Graphify applicability artifact reference");
-            const graphResult = hostGraphApplicabilityV1Schema.parse(store.artifact(graphDigest, "host-graph-applicability"));
-            const retainedHostGraph = { result: graphResult, resultDigest: graphDigest };
-            retainedCoverage = retainedCoverage
-                ? applyHostQaAugmentations({ coverage: retainedCoverage, contract, projectDir: this.projectDir, hostComparison: retainedHostComparison, hostGraph: retainedHostGraph })
-                : undefined;
-        }
-        else if (retainedCoverage && retainedHostComparison) {
-            retainedCoverage = applyHostQaAugmentations({ coverage: retainedCoverage, contract, projectDir: this.projectDir, hostComparison: retainedHostComparison });
+            const verifiedGraphDigest = graphDigest;
+            const graphResult = hostGraphApplicabilityV1Schema.parse(store.artifact(verifiedGraphDigest, "host-graph-applicability"));
+            retainedHostGraph = { result: graphResult, resultDigest: verifiedGraphDigest };
         }
+        if (retainedCoverage)
+            retainedCoverage = assembleFinalQaCoverage({
+                providerCoverage: retainedCoverage,
+                contract,
+                projectDir: this.projectDir,
+                commandObservations,
+                hostComparison: retainedHostComparison,
+                hostGraph: retainedHostGraph,
+            });
         if (!retainedCoverage)
             throw new Error("Coverage lacks the retained terminal review receipt and authorized host augmentation");
-        const errors = validateContractCoverage(contract, coverage, { phase: "qa", sourceDigest: input.sourceStateDigest, inputBasisDigest: input.reviewBasisDigest, attemptId: binding.attemptId, sessionId: binding.sessionId });
+        const errors = validateContractCoverage(contract, retainedCoverage, { phase: "qa", sourceDigest: input.sourceStateDigest, inputBasisDigest: input.reviewBasisDigest, attemptId: verifiedBinding.attemptId, sessionId: verifiedBinding.sessionId });
         if (errors.length)
             throw new Error(errors.join("; "));
         if (!receipt || !retainedCoverage || canonicalJson(retainedCoverage) !== canonicalJson(coverage))
             throw new Error("Coverage is not bound to the retained terminal review receipt and authorized host augmentation");
     }
     issueQaPassCertificate(input, now = new Date()) {
+        this.assertNativeQaCertificate(input, "issue");
         this.assertContractCertificate(input);
         if (this.unresolvedQaReports(input.runId, input.ticketId).length)
             throw new Error("cannot issue QA pass certificate while reports remain unresolved");
@@ -2178,11 +2811,16 @@ export class WorkflowDb {
     }
     consumeQaPassCertificate(runId, ticketId, certificateId, consumer, now = new Date()) {
         return this.db.transaction(() => {
-            const row = this.db.prepare("SELECT certificate_json,consumed_at FROM qa_pass_certificates WHERE certificate_id=? AND run_id=? AND ticket_id=?").get(certificateId, runId, ticketId);
+            const row = this.db.prepare("SELECT * FROM qa_pass_certificates WHERE certificate_id=? AND run_id=? AND ticket_id=?").get(certificateId, runId, ticketId);
             if (!row)
                 throw new Error("QA pass certificate is missing or scoped to another run/ticket");
             if (row.consumed_at)
                 throw new Error("QA pass certificate has already been consumed");
+            const value = parseJson(row.certificate_json);
+            if (value.certificateId !== row.certificate_id || value.runId !== runId || value.ticketId !== ticketId || value.qaRevision !== row.qa_revision ||
+                value.sourceStateDigest !== row.source_state_digest || value.reviewBasisDigest !== row.review_basis_digest || value.turnReceiptDigest !== row.turn_receipt_digest || value.issuedAt !== row.issued_at)
+                throw new Error("Pass certificate SQL identity mismatch");
+            this.assertNativeQaCertificate(value, "consume", certificateId);
             this.assertContractCertificate(parseJson(row.certificate_json));
             if (this.unresolvedQaReports(runId, ticketId).length)
                 throw new Error("QA pass certificate cannot be consumed with unresolved reports");
@@ -2231,6 +2869,26 @@ export class WorkflowDb {
             return next;
         })();
     }
+    assertQaFinalizationAuthority(runId, ticketId) {
+        const steps = this.qaFinalizationSteps(runId, ticketId).filter(step => step.status !== "invalidated");
+        if (!steps.length)
+            throw new Error("QA finalization intent is missing");
+        for (const step of steps) {
+            const row = this.db.prepare("SELECT * FROM qa_pass_certificates WHERE certificate_id=? AND run_id=? AND ticket_id=?")
+                .get(step.certificateId, runId, ticketId);
+            if (!row || !row.consumed_at || row.consumed_by !== step.kind)
+                throw new Error("Finalization certificate consumer binding mismatch");
+            const certificate = parseJson(row.certificate_json);
+            if (certificate.consumedAt !== row.consumed_at || certificate.consumedBy !== row.consumed_by
+                || certificate.certificateId !== row.certificate_id || certificate.runId !== row.run_id || certificate.ticketId !== row.ticket_id
+                || certificate.qaRevision !== row.qa_revision || certificate.sourceStateDigest !== row.source_state_digest
+                || certificate.reviewBasisDigest !== row.review_basis_digest || certificate.turnReceiptDigest !== row.turn_receipt_digest
+                || certificate.issuedAt !== row.issued_at)
+                throw new Error("Finalization certificate SQL identity mismatch");
+            this.assertNativeQaCertificate(certificate, "resume", step.certificateId);
+            this.assertContractCertificate(certificate);
+        }
+    }
     planQaFinalizationStep(input, now = new Date()) {
         const at = now.toISOString();
         const intentText = json(input.intent);
@@ -2290,6 +2948,7 @@ export class WorkflowDb {
     completeQaFinalization(runId, ticketId, expectedRevision, receipt, now = new Date()) {
         return this.db.transaction(() => {
             this.assertFinalizationControls(runId, ticketId);
+            this.assertQaFinalizationAuthority(runId, ticketId);
             const head = this.qaTicketHead(runId, ticketId);
             if (head.revision !== expectedRevision || head.state !== "finalizing")
                 throw new Error(`QA finalization completion raced for ${runId}/${ticketId}`);
@@ -2550,6 +3209,31 @@ export class WorkflowDb {
             : this.db.prepare(`SELECT COUNT(*) AS count FROM compaction_attempts WHERE run_id=? AND role=? AND provider_session_id=? AND session_key IS NULL AND status='succeeded'`).get(runId, role, session.id);
         return row.count;
     }
+    freshRecoveryValidation(runId, role) {
+        const decision = this.recoveryDecisions(runId).at(-1);
+        const predecessor = this.roleMutationLease(runId, role);
+        if (!decision || decision.mode !== "fresh-recovery-only" || decision.role !== role || !predecessor)
+            throw new Error("Fresh recovery validation requires an explicit current recovery decision and predecessor lease");
+        return { decisionDigest: digestJson(decision), predecessor };
+    }
+    /** This grants one response-only initialization, never ownership or business work. */
+    assertFreshRecoveryValidation(dispatchId, session) {
+        const operation = this.operation(dispatchId);
+        const intent = operation?.intent;
+        const authorization = intent?.freshRecoveryValidation;
+        const decision = operation && this.recoveryDecisions(operation.runId).at(-1);
+        if (!operation || !authorization || !decision || intent?.operation !== "session-initialization" || intent.responseOnly !== true ||
+            canonicalJson(intent.sessionRef) !== canonicalJson(session) ||
+            (session.role !== "builder" && session.role !== "qa") || decision.mode !== "fresh-recovery-only" || decision.role !== session.role ||
+            authorization.decisionDigest !== digestJson(decision) || dispatchId !== `fresh-recovery:${authorization.decisionDigest}` ||
+            canonicalJson(this.roleMutationLease(operation.runId, session.role)) !== canonicalJson(authorization.predecessor) ||
+            decision.runId !== operation.runId || canonicalSessionPath(session.cwd) !== canonicalSessionPath(decision.worktree) ||
+            session.provider !== (decision.requestedSuccessor?.agent ?? decision.settings.make) ||
+            session.sessionId === authorization.predecessor.providerSessionId ||
+            decision.predecessorSessionId && decision.predecessorSessionId !== authorization.predecessor.providerSessionId ||
+            decision.predecessorSessionRef && providerSessionKey(decision.predecessorSessionRef) !== authorization.predecessor.sessionKey)
+            throw new Error("Submission session no longer owns its role: fresh recovery decision or predecessor changed");
+    }
     recordRecoveryDecision(receipt) {
         this.ensureRun(receipt.runId);
         const digest = digestJson(receipt);
@@ -2728,12 +3412,12 @@ export class WorkflowDb {
                         parsed = { unreadable: true };
                     }
                     const record = parsed && typeof parsed === "object" ? parsed : undefined;
+                    if (record?.communicationProtocolVersion === 2)
+                        continue;
                     const isBuild = (record?.version === 1 || record?.version === 2) && typeof record.runId === "string";
                     const runId = isBuild ? String(record.runId) : `legacy_${digest.slice(0, 24)}`;
                     if (!this.getRun(runId)) {
                         this.createRun({ runId, kind: isBuild ? "build" : "legacy", checkpoint: isBuild && typeof record?.checkpoint === "string" ? record.checkpoint : "legacy-imported", originalWork: isBuild ? { tickets: record?.tickets ?? [] } : { source: path }, remainingWork: isBuild ? { tickets: record?.tickets ?? [] } : {}, state: isBuild ? record : { source: path, record: parsed }, legacy: true }, now);
-                        if (!isBuild)
-                            this.transition(runId, { status: "superseded", checkpoint: "legacy-imported", remainingWork: {}, event: "legacy_record_preserved" }, now);
                     }
                     this.db.prepare("INSERT INTO legacy_imports(source_path,digest,run_id,imported_at) VALUES(?,?,?,?)").run(path, digest, runId, now.toISOString());
                     count += 1;
@@ -2861,6 +3545,119 @@ export class WorkflowDb {
             this.db.prepare("INSERT INTO recovery_schema_migrations(migration,completed_at) VALUES(?,?)").run(`${migration}:${migrationDigest}`, new Date().toISOString());
         migrateQaHandback(this.db);
     }
+    /**
+     * One-way cutover fence.  We deliberately do not attempt to convert an old
+     * receipt into authority: any pre-existing run with legacy state or a
+     * provider dispatch that lacks a sealed tuple is terminally superseded.
+     * User/project artifacts remain in their own tables; only workflow authority
+     * is fenced.  The marker is committed atomically with the classification.
+     */
+    applyStructuredCommunicationV2Cutover() {
+        const migration = STRUCTURED_AUDIT_CLOSURE;
+        this.db.transaction(() => {
+            this.db.exec(`CREATE TABLE IF NOT EXISTS structured_communication_cutover(migration TEXT PRIMARY KEY,completed_at TEXT NOT NULL,details_json TEXT NOT NULL);
+        CREATE TABLE IF NOT EXISTS structured_cutover_quarantine(run_id TEXT NOT NULL,table_name TEXT NOT NULL,row_json TEXT NOT NULL);
+        CREATE TABLE IF NOT EXISTS structured_handoff_lineage(predecessor_id TEXT PRIMARY KEY REFERENCES operation_journal(idempotency_key),run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),state TEXT NOT NULL,acceptance_id TEXT UNIQUE,successor_json TEXT,continuation_id TEXT UNIQUE);
+        CREATE TABLE IF NOT EXISTS continuity_checkpoint_origins(checkpoint_id INTEGER PRIMARY KEY REFERENCES continuity_checkpoints(checkpoint_id),run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),origin_json TEXT NOT NULL,delta_digest TEXT NOT NULL,dispatch_id TEXT,publication_kind TEXT,UNIQUE(run_id,dispatch_id,publication_kind));
+        CREATE TABLE IF NOT EXISTS structured_dispatch_processing(dispatch_id TEXT PRIMARY KEY REFERENCES operation_journal(idempotency_key),run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),state TEXT NOT NULL CHECK(state IN ('pending','completed')),context_json TEXT NOT NULL,error TEXT);
+        CREATE TABLE IF NOT EXISTS structured_submission_claims(dispatch_id TEXT PRIMARY KEY REFERENCES operation_journal(idempotency_key),run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),tuple_digest TEXT NOT NULL,claim_id TEXT NOT NULL UNIQUE,session_json TEXT NOT NULL,state TEXT NOT NULL CHECK(state IN ('claimed','consumed')),created_at TEXT NOT NULL,consumed_at TEXT);
+        CREATE TABLE IF NOT EXISTS communication_evidence_refs(owner_kind TEXT NOT NULL,owner_id TEXT NOT NULL,evidence_digest TEXT NOT NULL,created_at TEXT NOT NULL,PRIMARY KEY(owner_kind,owner_id,evidence_digest));
+        CREATE TABLE IF NOT EXISTS page_ledgers(artifact_id TEXT PRIMARY KEY,run_id TEXT NOT NULL REFERENCES workflow_runs(run_id),lineage_id TEXT NOT NULL,tuple_digest TEXT NOT NULL,lease_id TEXT NOT NULL,state TEXT NOT NULL CHECK(state IN ('open','terminal','cancelled')),page_count INTEGER NOT NULL,total_bytes INTEGER NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL);
+        CREATE TABLE IF NOT EXISTS page_ledger_pages(artifact_id TEXT NOT NULL REFERENCES page_ledgers(artifact_id),ordinal INTEGER NOT NULL,predecessor_digest TEXT,content_digest TEXT NOT NULL,content BLOB NOT NULL,terminal INTEGER NOT NULL CHECK(terminal IN (0,1)),created_at TEXT NOT NULL,PRIMARY KEY(artifact_id,ordinal));`);
+            const prior = this.db.prepare("SELECT details_json FROM structured_communication_cutover WHERE migration=?").get(migration);
+            if (this.db.prepare("SELECT 1 FROM structured_communication_cutover WHERE migration='003_structured_communication_v2_cutover'").get() && prior && JSON.parse(prior.details_json).ownershipMatrixVersion === STRUCTURED_CUTOVER_MATRIX_VERSION)
+                return;
+            // Upgrade only an unambiguous host baseline. Historical provider deltas
+            // without an exact dispatch origin remain fenced; timestamps are not proof.
+            for (const checkpoint of this.db.prepare(`SELECT c.* FROM continuity_checkpoints c JOIN workflow_runs r USING(run_id)
+        WHERE json_valid(r.state_json) AND c.session_ref_json IS NULL
+        AND NOT EXISTS(SELECT 1 FROM continuity_checkpoint_origins o WHERE o.checkpoint_id=c.checkpoint_id)`).all()) {
+                let delta;
+                try {
+                    delta = parseJson(checkpoint.delta_json);
+                }
+                catch {
+                    continue;
+                }
+                if (!delta || delta.version !== 1 || delta.nextAction !== "Await the first role action." ||
+                    [delta.decisions, delta.constraints, delta.discoveries, delta.completedActions, delta.evidence, delta.failures, delta.blockers, delta.openWork].some(items => !Array.isArray(items) || items.length))
+                    continue;
+                const baseline = this.db.prepare("SELECT sequence,payload_json FROM continuity_events WHERE run_id=? AND role='host' AND kind='role_baseline' AND sequence<=? ORDER BY sequence DESC LIMIT 1")
+                    .get(checkpoint.run_id, checkpoint.event_sequence);
+                if (!baseline || JSON.parse(baseline.payload_json).role !== checkpoint.role)
+                    continue;
+                const deltaDigest = createHash("sha256").update(checkpoint.delta_json).digest("hex");
+                const event = this.appendContinuityEvent({ runId: checkpoint.run_id, role: "host", kind: "host_checkpoint", authoritativeStateRevision: checkpoint.authoritative_state_revision,
+                    payload: { checkpointDeltaDigest: deltaDigest, sourceBaselineSequence: baseline.sequence, role: checkpoint.role } });
+                this.db.prepare("INSERT INTO continuity_checkpoint_origins(checkpoint_id,run_id,origin_json,delta_digest) VALUES(?,?,?,?)")
+                    .run(checkpoint.checkpoint_id, checkpoint.run_id, json({ kind: "host", eventSequence: event.sequence, inputCheckpointDigests: [] }), deltaDigest);
+            }
+            const matrix = cutoverOwnershipMatrix(this.db);
+            const fileReferences = communicationFileEvidenceReferences(this.projectDir);
+            const affected = this.db.prepare("SELECT * FROM workflow_runs").all().filter(run => invalidStructuredRun(this.db, run, this.projectDir));
+            const lease = this.db.prepare("SELECT run_id,pid,process_start,host FROM project_lease WHERE singleton=1").get();
+            if (lease && affected.some(run => run.run_id === lease.run_id) && classifyProcess(lease.pid, lease.process_start, lease.host).state !== "dead")
+                throw new Error("v2-cutover-pending: stop the existing workflow owner before structured communication cutover");
+            if (this.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='build_owned_processes'").get()) {
+                const processes = this.db.prepare("SELECT run_id,pid,process_start,host FROM build_owned_processes WHERE state<>'quiescent'").all();
+                if (processes.some(process => affected.some(run => run.run_id === process.run_id)
+                    && (!process.pid || !process.process_start || classifyProcess(process.pid, process.process_start, process.host).state !== "dead")))
+                    throw new Error("v2-cutover-pending: reconcile owned build processes before structured communication cutover");
+            }
+            if (this.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='build_admission'").get()) {
+                const row = this.db.prepare("SELECT record_json FROM build_admission WHERE singleton=1").get();
+                if (row) {
+                    let admission;
+                    try {
+                        admission = JSON.parse(row.record_json);
+                    }
+                    catch {
+                        throw new Error("v2-cutover-pending: malformed build admission requires reconciliation");
+                    }
+                    if (affected.some(run => run.run_id === admission.runId) && classifyProcess(admission.pid, admission.processStart, admission.host).state !== "dead")
+                        throw new Error("v2-cutover-pending: stop the existing build owner before structured communication cutover");
+                }
+            }
+            // Existing domain guards must not block the authorized cutover. Restore
+            // them in this same transaction, omitting only superseded v1 comms guards.
+            const triggers = this.db.prepare("SELECT name,sql FROM sqlite_master WHERE type='trigger' AND sql IS NOT NULL").all();
+            for (const trigger of triggers) {
+                if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/.test(trigger.name))
+                    throw new Error("Unexpected cutover trigger identity");
+                this.db.exec(`DROP TRIGGER "${trigger.name}"`);
+            }
+            const now = new Date().toISOString();
+            for (const { run_id } of affected) {
+                const row = this.db.prepare("SELECT state_json FROM workflow_runs WHERE run_id=?").get(run_id);
+                const originalBytesDigest = createHash("sha256").update(row.state_json).digest("hex");
+                this.db.prepare("INSERT INTO structured_cutover_quarantine(run_id,table_name,row_json) VALUES(?,?,?)").run(run_id, "workflow_runs.state_json", json({ originalBytes: row.state_json, originalBytesDigest }));
+                let original = {};
+                try {
+                    const parsed = parseJson(row.state_json);
+                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                        original = parsed;
+                }
+                catch { /* quarantined verbatim above */ }
+                const state = { ...original, structuredCommunicationCutover: { version: 2, reason: "structured-communication-v2-cutover", originalBytesDigest, at: now } };
+                purgeStructuredRun(this.db, run_id, matrix, fileReferences);
+                this.db.prepare("UPDATE workflow_runs SET status='superseded',checkpoint='structured-communication-v2-cutover',state_json=?,updated_at=? WHERE run_id=?")
+                    .run(json(state), now, run_id);
+            }
+            quarantineCommunicationFiles(this.projectDir, this.db);
+            for (const trigger of triggers)
+                if (!trigger.name.startsWith("structured_comms_v1_"))
+                    this.db.exec(trigger.sql);
+            this.db.prepare("INSERT INTO structured_communication_cutover(migration,completed_at,details_json) VALUES(?,?,?) ON CONFLICT(migration) DO UPDATE SET completed_at=excluded.completed_at,details_json=excluded.details_json")
+                .run(migration, now, json({ ownershipMatrixVersion: STRUCTURED_CUTOVER_MATRIX_VERSION, ownershipMatrix: matrix, fencedRuns: affected.map(row => row.run_id), policy: "legacy-or-unsealed-provider-authority-is-non-resumable" }));
+            this.db.prepare("INSERT OR IGNORE INTO structured_communication_cutover(migration,completed_at,details_json) VALUES(?,?,?)")
+                .run("003_structured_communication_v2_cutover", now, json({ ownershipMatrixVersion: STRUCTURED_CUTOVER_MATRIX_VERSION }));
+            ensureQaGraphJournalGuards(this.db);
+            this.db.exec(`CREATE TRIGGER IF NOT EXISTS structured_cutover_terminal_run BEFORE UPDATE ON workflow_runs
+        WHEN OLD.checkpoint='structured-communication-v2-cutover'
+        BEGIN SELECT CASE WHEN NEW.status<>'superseded' OR NEW.checkpoint<>OLD.checkpoint OR NEW.state_json<>OLD.state_json
+          THEN RAISE(ABORT,'structured-communication-v2-cutover: workflow permanently non-resumable') END; END;`);
+        })();
+    }
     ensureColumn(table, column, definition) {
         const columns = this.db.prepare(`PRAGMA table_info(${table})`).all();
         if (!columns.some((existing) => existing.name === column)) {
@@ -2912,11 +3709,5 @@ function leaseVerifiedLive(lease, now, staleMs) {
     return classifyProcess(lease.pid, lease.processStart, lease.host).state !== "dead";
 }
 function ensureRecoveryGitignore(projectDir) {
-    const localExclude = join(projectDir, ".git", "info", "exclude");
-    const path = existsSync(localExclude) ? localExclude : join(projectDir, ".gitignore");
-    const entries = [WORKFLOW_DB_FILE, `${WORKFLOW_DB_FILE}-wal`, `${WORKFLOW_DB_FILE}-shm`, ".rafi/cache/handoffs/", ".rafi/backups/work-admission-v4/"];
-    const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
-    const missing = entries.filter((entry) => !existing.split(/\r?\n/).includes(entry));
-    if (missing.length)
-        appendFileSync(path, `${existing && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`, "utf8");
+    ensureLocalGitExcludes(projectDir, [WORKFLOW_DB_FILE, `${WORKFLOW_DB_FILE}-wal`, `${WORKFLOW_DB_FILE}-shm`, ".rafi/cache/handoffs/", ".rafi/backups/work-admission-v4/"], { fallbackToGitignore: true });
 }