codex-orchestrator 2.0.11 → 2.0.13

package/dist/src/v2/run-store.js

@@ -1,208 +1,104 @@
-import { validateDurableMutableInvocation, validateDurableReportInvocation, } from './contained-report-operation.js';
-import { projectTerminalDirectReview, validateDirectReview } from './direct-delivery.js';
-import { validateSpecDelivery } from './spec-delivery.js';
-import { validateRouteExecution, validateRouteReceipt, validateRouteStateInvariant, } from './route-decision.js';
-import { validateWaitingHumanExecution } from './waiting-human.js';
+import { validateActiveAttempt } from './active-attempt.js';
+import { validateDirectReview } from './direct-delivery.js';
+import { validateDeliveryAuthority } from './delivery-authority.js';
+import { constants } from 'node:fs';
 import { posix } from 'node:path';
-import { readFile } from 'node:fs/promises';
+import { open } from 'node:fs/promises';
 import { AtomicStateFile } from './atomic-store.js';
-import { writeDurableAtomicFile } from './adapters/durable-atomic-file.js';
 import { canonicalJson, sha256 } from './containment.js';
-import { validateCandidateBinding, validateCandidateExecutionLease } from './candidate.js';
-import { blockReviewFeedback, createReviewFeedbackBootstrap, validateReviewFeedbackExecution, } from './review-feedback.js';
+import { validateCandidateBinding, validateCandidateMaterialization } from './candidate.js';
+import { validateReviewFeedbackRunData, } from './review-feedback.js';
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const GIT_SHA_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 const UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function createPendingEffect(effect) {
+    return { ...structuredClone(effect), effectId: sha256(canonicalJson(effect)) };
+}
 export class WorkflowGenerationUnrecoverableError extends Error {
     constructor() {
         super('workflow-generation-unrecoverable');
         this.name = 'WorkflowGenerationUnrecoverableError';
     }
 }
-export class RouteInitializationUnrecoverableError extends Error {
+export class IssueInitializationUnrecoverableError extends Error {
     constructor() {
-        super('route-initialization-unrecoverable');
-        this.name = 'RouteInitializationUnrecoverableError';
+        super('issue-initialization-unrecoverable');
+        this.name = 'IssueInitializationUnrecoverableError';
     }
 }
 export class FileRunRecordWriter {
     file;
-    backupPath;
-    migrationMetadataPath;
-    reportLifecycleBackupPath;
-    mutableLifecycleBackupPath;
-    now;
+    maxBytes;
     constructor(path, options = {}) {
         this.file = new AtomicStateFile(path, validateRunStateFile, options);
-        this.backupPath = `${path}.pre-candidate-v3`;
-        this.migrationMetadataPath = `${this.backupPath}.metadata.json`;
-        this.reportLifecycleBackupPath = `${path}.pre-report-lifecycle-v1`;
-        this.mutableLifecycleBackupPath = `${path}.pre-mutable-lifecycle-v1`;
-        this.now = options.now ?? (() => new Date().toISOString());
-    }
-    async read() {
+        this.maxBytes = options.maxBytes ?? 1024 * 1024;
+    }
+    async inspect() {
+        const bytes = await readOptionalStateFile(this.file.path);
+        if (!bytes)
+            return { status: 'absent', rawSha256: null };
+        const rawSha256 = sha256(bytes);
+        if (bytes.length > this.maxBytes)
+            return { status: 'unsupported', rawSha256 };
         try {
-            return await this.file.read() ?? emptyRunState();
+            return { status: 'supported', rawSha256, state: parseRawState(bytes) };
         }
-        catch (error) {
-            return this.migrateLegacyReportLifecycle(error);
+        catch {
+            return { status: 'unsupported', rawSha256 };
         }
     }
+    async read() {
+        const inspection = await this.inspect();
+        if (inspection.status === 'absent')
+            return emptyRunState();
+        if (inspection.status === 'supported')
+            return inspection.state;
+        throw new Error('run state schema is unsupported');
+    }
     async compareAndSwap(expectedGeneration, next) {
         validateRunStateBody(next);
         const candidate = { ...structuredClone(next), generation: expectedGeneration + 1 };
-        return this.file.compareAndSwapWithRaw(expectedGeneration, candidate, async (priorBytes) => {
-            if (!priorBytes)
-                return;
-            const raw = parseRawState(priorBytes);
-            if (raw.version === 3 && next.version !== 3)
-                throw new Error('run state V3 downgrade requires explicit rollback');
-            if (raw.version === 2 && next.version === 3)
-                await this.ensureCandidateMigrationBackup(priorBytes, raw.generation);
-        });
-    }
-    async markPublicationEffectPossible() {
-        await this.file.withExclusiveRaw(async () => {
-            const existing = await readMigrationMetadata(this.migrationMetadataPath);
-            if (!existing?.publicationEffectPossible) {
-                const now = this.now();
-                await writeDurableAtomicFile(this.migrationMetadataPath, `${canonicalJson({
-                    version: 1,
-                    sourceGeneration: existing?.sourceGeneration ?? null,
-                    sourceBytesSha256: existing?.sourceBytesSha256 ?? null,
-                    publicationEffectPossible: true,
-                    createdAt: existing?.createdAt ?? now,
-                    updatedAt: now,
-                })}\n`);
-            }
-            return { result: undefined };
-        });
-    }
-    async rollbackCandidateMigration(input) {
-        return this.file.withExclusiveRaw(async (_currentBytes, current) => {
-            const metadata = await readMigrationMetadata(this.migrationMetadataPath);
-            if (!metadata || metadata.sourceGeneration === null || metadata.sourceBytesSha256 === null)
-                throw new Error('candidate V3 rollback backup is unavailable');
-            if (metadata.publicationEffectPossible)
-                throw new Error('candidate V3 rollback is forbidden after publication boundary');
-            if (!current || current.version !== 3)
-                throw new Error('candidate V3 rollback requires active V3 state');
-            await input.assertNoActiveProcesses();
-            await input.cleanupCandidateState(structuredClone(current));
-            const backup = await readOptionalFile(this.backupPath);
-            if (!backup || sha256(backup) !== metadata.sourceBytesSha256)
-                throw new Error('candidate V3 rollback backup identity is invalid');
-            const restored = parseRawState(backup);
-            if (restored.version !== 2 || restored.generation !== metadata.sourceGeneration)
-                throw new Error('candidate V3 rollback backup generation is invalid');
-            return { result: restored, replacementBytes: backup };
-        });
-    }
-    async ensureCandidateMigrationBackup(rawV2Bytes, generation) {
-        const sourceBytesSha256 = sha256(rawV2Bytes);
-        const existing = await readMigrationMetadata(this.migrationMetadataPath);
-        const backup = await readOptionalFile(this.backupPath);
-        if (existing?.publicationEffectPossible)
-            throw new Error('candidate V3 migration backup cannot change after publication boundary');
-        if (existing?.sourceGeneration === generation && existing.sourceBytesSha256 === sourceBytesSha256
-            && backup?.equals(rawV2Bytes))
-            return;
-        await writeDurableAtomicFile(this.backupPath, rawV2Bytes);
-        const now = this.now();
-        await writeDurableAtomicFile(this.migrationMetadataPath, `${canonicalJson({
-            version: 1,
-            sourceGeneration: generation,
-            sourceBytesSha256,
-            publicationEffectPossible: false,
-            createdAt: now,
-            updatedAt: now,
-        })}\n`);
-    }
-    async migrateLegacyReportLifecycle(originalError) {
-        return this.file.withExclusiveUnparsedRaw(async (priorBytes) => {
-            if (!priorBytes)
-                return { result: emptyRunState() };
-            let raw;
-            try {
-                raw = JSON.parse(priorBytes.toString('utf8'));
-            }
-            catch {
-                throw originalError;
-            }
-            try {
-                return { result: validateRunStateFile(raw) };
-            }
-            catch {
-                const mutable = hasLegacyMutableLifecycle(raw);
-                let backupPath = mutable ? this.mutableLifecycleBackupPath : this.reportLifecycleBackupPath;
-                if (!mutable) {
-                    const priorReportBackup = await readOptionalFile(backupPath);
-                    if (priorReportBackup && !priorReportBackup.equals(priorBytes)) {
-                        const generation = raw.generation;
-                        backupPath = `${backupPath}.g${String(generation)}-${sha256(priorBytes).slice(0, 16)}`;
-                    }
-                }
-                const migrated = canonicalizeLegacyReportLifecycle(raw, backupPath);
-                if (!migrated)
-                    throw originalError;
-                const existingBackup = await readOptionalFile(backupPath);
-                if (existingBackup && !existingBackup.equals(priorBytes))
-                    throw new Error('report lifecycle migration backup conflicts with current source bytes');
-                if (!existingBackup)
-                    await writeDurableAtomicFile(backupPath, priorBytes);
-                return { result: migrated, replacementBytes: Buffer.from(`${canonicalJson(migrated)}\n`) };
-            }
-        });
+        return this.file.compareAndSwap(expectedGeneration, candidate);
     }
 }
 export class InMemoryRunRecordWriter {
-    state = emptyRunState();
+    state;
+    async inspect() {
+        if (!this.state)
+            return { status: 'absent', rawSha256: null };
+        const state = structuredClone(this.state);
+        return {
+            status: 'supported',
+            rawSha256: sha256(`${canonicalJson(state)}\n`),
+            state,
+        };
+    }
     async read() {
-        return structuredClone(this.state);
+        return structuredClone(this.state ?? emptyRunState());
     }
     async compareAndSwap(expectedGeneration, next) {
-        if (this.state.generation !== expectedGeneration)
+        if ((this.state?.generation ?? 0) !== expectedGeneration)
             throw new Error('run state generation conflict');
-        if (this.state.version === 3 && next.version !== 3)
-            throw new Error('run state V3 downgrade requires explicit rollback');
+        validateRunStateBody(next);
         const value = validateRunStateFile({ ...structuredClone(next), generation: expectedGeneration + 1 });
         this.state = value;
         return structuredClone(value);
     }
-    async markPublicationEffectPossible() { }
 }
 export function validateRunStateFile(value) {
-    assertExactObject(value, ['schema', 'version', 'generation', 'runs'], 'run state');
-    if (value.schema !== 'codex-orchestrator.agent-auto-state' || ![1, 2, 3].includes(value.version))
-        throw new Error('run state schema/version is invalid');
+    assertExactObject(value, ['schema', 'generation', 'runs'], 'run state');
+    if (value.schema !== 'codex-orchestrator.run-state')
+        throw new Error('run state schema is invalid');
     if (!Number.isSafeInteger(value.generation) || value.generation <= 0)
         throw new Error('run state generation is invalid');
     validateRuns(value.runs);
-    if (value.version === 1) {
-        for (const run of value.runs) {
-            if (hasOwn(run, 'reviewFeedback'))
-                throw new Error('V1 run state cannot contain review feedback');
-        }
-        return {
-            schema: 'codex-orchestrator.agent-auto-state',
-            version: 2,
-            generation: value.generation,
-            runs: value.runs.map((run) => run.lifecycle === 'review-ready'
-                ? { ...structuredClone(run), reviewFeedback: createReviewFeedbackBootstrap() }
-                : structuredClone(run)),
-        };
-    }
-    if (value.version === 2)
-        assertNoCandidateV3Fields(value.runs);
     return value;
 }
 function validateRunStateBody(value) {
-    assertExactObject(value, ['schema', 'version', 'runs'], 'run state body');
-    if (value.schema !== 'codex-orchestrator.agent-auto-state' || (value.version !== 2 && value.version !== 3))
-        throw new Error('run state schema/version is invalid');
+    assertExactObject(value, ['schema', 'runs'], 'run state body');
+    if (value.schema !== 'codex-orchestrator.run-state')
+        throw new Error('run state schema is invalid');
     validateRuns(value.runs);
-    if (value.version === 2)
-        assertNoCandidateV3Fields(value.runs);
 }
 function validateRuns(value) {
     if (!Array.isArray(value) || value.length > 256)
@@ -217,29 +113,24 @@ function validateRuns(value) {
 }
 function validateRunRecord(value, field) {
     const optional = [
+        'activeAttempt',
         'checkedChangeSha256',
         'proofId',
+        'proofExecution',
         'proofReceipt',
-        'intent',
+        'pendingEffect',
         'outcomeEvidenceId',
         'terminalOutcome',
-        'routeExecution',
-        'routeReceipt',
-        'waitingHuman',
+        'deliveryAuthority',
         'directReview',
-        'specDelivery',
         'reviewFeedback',
-        'checkQualification',
-        'baselineChecks',
         'changeBindingVersion',
         'candidateBinding',
-        'executionLease',
-        'reportInvocation',
-        'mutableInvocation',
+        'candidateMaterialization',
     ].filter((key) => hasOwn(value, key));
     assertExactObject(value, [
         'runId', 'issueNumber', 'canonicalRepository', 'baseSha', 'branchName', 'worktreePath', 'lifecycle', 'cycle',
-        'reportRepairs', 'issueSnapshot', 'frozenCriteria', 'reworkFindings',
+        'reportRepairs', 'transportRetries', 'issueSnapshot', 'frozenCriteria', 'reworkFindings',
         'packageVersion', 'workflowGeneration', 'skillHashes', 'checks', 'createdAt', 'updatedAt', ...optional,
     ], field);
     if (typeof value.runId !== 'string' || !UUID_V4_PATTERN.test(value.runId))
@@ -255,10 +146,12 @@ function validateRunRecord(value, field) {
     }
     if (!isLifecycle(value.lifecycle))
         throw new Error(`${field}.lifecycle is invalid`);
-    if (!Number.isSafeInteger(value.cycle) || value.cycle < 1 || value.cycle > 5)
+    if (!Number.isSafeInteger(value.cycle) || value.cycle < 1)
         throw new Error(`${field}.cycle is invalid`);
-    if (value.reportRepairs !== 0 && value.reportRepairs !== 1)
+    if (!Number.isSafeInteger(value.reportRepairs) || value.reportRepairs < 0)
         throw new Error(`${field}.reportRepairs is invalid`);
+    if (!Number.isSafeInteger(value.transportRetries) || value.transportRetries < 0)
+        throw new Error(`${field}.transportRetries is invalid`);
     validateIssueSnapshot(value.issueSnapshot, `${field}.issueSnapshot`);
     validateFrozenCriteria(value.frozenCriteria, `${field}.frozenCriteria`);
     validateStringList(value.reworkFindings, `${field}.reworkFindings`);
@@ -268,114 +161,91 @@ function validateRunRecord(value, field) {
     if (workflowGeneration.packageVersion !== value.packageVersion) {
         throw new Error(`${field}.workflowGeneration package version mismatch`);
     }
-    const routeGenerationHash = workflowGeneration.generationHash;
-    if (hasOwn(value, 'routeExecution'))
-        validateRouteExecution(value.routeExecution, routeGenerationHash);
-    if (hasOwn(value, 'routeReceipt'))
-        validateRouteReceipt(value.routeReceipt, routeGenerationHash);
+    if (hasOwn(value, 'deliveryAuthority')) {
+        validateDeliveryAuthority(value.deliveryAuthority, {
+            issueNumber: value.issueSnapshot.number,
+            issueUrl: value.issueSnapshot.url,
+            title: value.issueSnapshot.title,
+            body: value.issueSnapshot.body,
+            authorizationLabel: value.deliveryAuthority.authorizationLabel,
+        });
+    }
+    if (['implementing', 'checking', 'proving', 'reviewing', 'publishing', 'review-ready'].includes(value.lifecycle)
+        && !hasOwn(value, 'deliveryAuthority')) {
+        throw new Error(`${field}.deliveryAuthority is required for delivery progression`);
+    }
     validateStringShaRecord(value.skillHashes, `${field}.skillHashes`);
-    if (hasOwn(value, 'baselineChecks'))
-        validateChecks(value.baselineChecks, `${field}.baselineChecks`, false);
     validateChecks(value.checks, `${field}.checks`);
-    let reportInvocation;
-    if (hasOwn(value, 'reportInvocation')) {
-        const invocation = validateDurableReportInvocation(value.reportInvocation);
-        reportInvocation = invocation;
-        const expectedLifecycle = invocation.operation === 'triage' || invocation.operation === 'ambiguity-review'
-            ? 'triaging'
-            : invocation.operation === 'code-review' ? 'implementing' : 'spec-authoring';
-        if (value.lifecycle !== expectedLifecycle)
-            throw new Error(`${field}.reportInvocation lifecycle is invalid`);
-    }
-    if (hasOwn(value, 'mutableInvocation')) {
-        const invocation = validateDurableMutableInvocation(value.mutableInvocation);
-        if (value.lifecycle !== 'implementing')
-            throw new Error(`${field}.mutableInvocation lifecycle is invalid`);
-        if (invocation.worktreePath !== value.worktreePath || invocation.generationHash !== routeGenerationHash) {
-            throw new Error(`${field}.mutableInvocation binding is invalid`);
-        }
-        if (invocation.operation === 'qualification-repair' && !hasOwn(value, 'checkQualification')) {
-            throw new Error(`${field}.qualification mutableInvocation requires check qualification`);
-        }
-        const feedbackActive = hasOwn(value, 'reviewFeedback')
-            && value.reviewFeedback.activeBatch !== null;
-        if ((invocation.operation === 'review-feedback-implementation') !== feedbackActive) {
-            throw new Error(`${field}.mutableInvocation feedback binding is invalid`);
-        }
+    if (hasOwn(value, 'activeAttempt')) {
+        const attempt = validateActiveAttempt(value.activeAttempt);
+        if (attempt.runId !== value.runId)
+            throw new Error(`${field}.activeAttempt run identity is invalid`);
     }
     if (hasOwn(value, 'checkedChangeSha256'))
         assertSha256(value.checkedChangeSha256, `${field}.checkedChangeSha256`);
     if (hasOwn(value, 'proofId'))
         assertNonEmptyString(value.proofId, `${field}.proofId`);
+    if (hasOwn(value, 'proofExecution'))
+        validateProofExecution(value.proofExecution, `${field}.proofExecution`);
     if (hasOwn(value, 'proofReceipt'))
         validateReceipt(value.proofReceipt, `${field}.proofReceipt`);
-    if (hasOwn(value, 'intent'))
-        validateIntent(value.intent, `${field}.intent`);
+    if (hasOwn(value, 'pendingEffect'))
+        validatePendingEffect(value.pendingEffect, `${field}.pendingEffect`);
     if (hasOwn(value, 'outcomeEvidenceId'))
         assertNonEmptyString(value.outcomeEvidenceId, `${field}.outcomeEvidenceId`);
     if (hasOwn(value, 'terminalOutcome'))
         validateTerminalOutcome(value.terminalOutcome, `${field}.terminalOutcome`);
-    if (hasOwn(value, 'waitingHuman')) {
-        if (!routeGenerationHash)
-            throw new WorkflowGenerationUnrecoverableError();
-        validateWaitingHumanExecution(value.waitingHuman, {
-            runId: value.runId,
-            lifecycle: value.lifecycle,
-            workflowGenerationHash: routeGenerationHash,
-            routeReceipt: hasOwn(value, 'routeReceipt') ? value.routeReceipt : undefined,
-            terminalOutcome: hasOwn(value, 'terminalOutcome') ? value.terminalOutcome : undefined,
-        });
-    }
     if (hasOwn(value, 'directReview')) {
-        if (!hasOwn(value, 'routeReceipt') || value.routeReceipt.route !== 'direct') {
-            throw new Error(`${field}.directReview requires a direct route`);
-        }
+        if (!hasOwn(value, 'deliveryAuthority'))
+            throw new Error(`${field}.directReview requires delivery authority`);
         validateDirectReview(value.directReview, {
             lifecycle: value.lifecycle,
             ...(hasOwn(value, 'terminalOutcome') ? { terminalOutcome: directTerminalOutcome(value.terminalOutcome) } : {}),
+            ...(hasOwn(value, 'terminalOutcome') && value.terminalOutcome.status === 'internal-error'
+                ? { terminalCode: value.terminalOutcome.code }
+                : {}),
         });
     }
-    if (hasOwn(value, 'specDelivery')) {
-        if (!hasOwn(value, 'routeReceipt') || value.routeReceipt.route !== 'spec-required') {
-            throw new Error(`${field}.specDelivery requires a spec-required route`);
-        }
-        const spec = validateSpecDelivery(value.specDelivery);
-        if (spec.issueNumber !== value.issueNumber || spec.runId !== value.runId
-            || spec.workflowGenerationSha256 !== routeGenerationHash) {
-            throw new Error(`${field}.specDelivery identity binding is invalid`);
-        }
-    }
     if (hasOwn(value, 'reviewFeedback')) {
-        validateReviewFeedbackExecution(value.reviewFeedback);
+        validateReviewFeedbackRunData(value.reviewFeedback);
         validateReviewFeedbackRunInvariant(value, field);
     }
     if (hasOwn(value, 'changeBindingVersion') && value.changeBindingVersion !== 2)
         throw new Error(`${field}.changeBindingVersion is invalid`);
     if (hasOwn(value, 'candidateBinding'))
         validateCandidateBinding(value.candidateBinding, `${field}.candidateBinding`, value.runId);
-    if (hasOwn(value, 'executionLease'))
-        validateCandidateExecutionLease(value.executionLease, `${field}.executionLease`);
+    if (hasOwn(value, 'candidateMaterialization'))
+        validateCandidateMaterialization(value.candidateMaterialization, `${field}.candidateMaterialization`);
     if (hasOwn(value, 'candidateBinding') !== hasOwn(value, 'changeBindingVersion'))
         throw new Error(`${field} candidate binding version is incomplete`);
-    if (hasOwn(value, 'executionLease')) {
+    if (hasOwn(value, 'candidateMaterialization')) {
         if (!hasOwn(value, 'candidateBinding'))
-            throw new Error(`${field}.executionLease requires candidate binding`);
+            throw new Error(`${field}.candidateMaterialization requires candidate binding`);
         const binding = value.candidateBinding;
-        const lease = value.executionLease;
-        if (lease.bindingId !== binding.bindingId || lease.candidateCommitSha !== binding.candidateCommitSha)
-            throw new Error(`${field}.executionLease binding is invalid`);
+        const materialization = value.candidateMaterialization;
+        if (materialization.bindingId !== binding.bindingId || materialization.candidateCommitSha !== binding.candidateCommitSha) {
+            throw new Error(`${field}.candidateMaterialization binding is invalid`);
+        }
+    }
+    if (hasOwn(value, 'pendingEffect') && hasOwn(value.pendingEffect, 'candidateRef')) {
+        if (!hasOwn(value, 'candidateBinding'))
+            throw new Error(`${field}.pendingEffect candidate ref requires candidate binding`);
+        const binding = value.candidateBinding;
+        const pendingEffect = value.pendingEffect;
+        if (pendingEffect.candidateRef !== binding.candidateRef || pendingEffect.treeSha !== binding.candidateTreeSha) {
+            throw new Error(`${field}.pendingEffect candidate binding is invalid`);
+        }
     }
-    if (hasOwn(value, 'intent') && hasOwn(value.intent, 'candidateRef')) {
+    if (value.pendingEffect?.kind === 'candidate-pin-release') {
         if (!hasOwn(value, 'candidateBinding'))
-            throw new Error(`${field}.intent candidate ref requires candidate binding`);
+            throw new Error(`${field}.candidate pin cleanup requires candidate binding`);
         const binding = value.candidateBinding;
-        const intent = value.intent;
-        if (intent.candidateRef !== binding.candidateRef || intent.treeSha !== binding.candidateTreeSha) {
-            throw new Error(`${field}.intent candidate binding is invalid`);
+        const pendingEffect = value.pendingEffect;
+        if (pendingEffect.bindingId !== binding.bindingId
+            || pendingEffect.expectedPinnedCommitSha !== binding.candidateCommitSha) {
+            throw new Error(`${field}.candidate pin cleanup binding is invalid`);
         }
     }
-    if (hasOwn(value, 'checkQualification'))
-        validateCheckQualification(value.checkQualification, `${field}.checkQualification`);
     assertTimestamp(value.createdAt, `${field}.createdAt`);
     assertTimestamp(value.updatedAt, `${field}.updatedAt`);
     const terminal = ['review-ready', 'blocked', 'transport-failed', 'cancelled', 'internal-error'].includes(value.lifecycle);
@@ -387,65 +257,31 @@ function validateRunRecord(value, field) {
         || value.checks.some((check) => check.status === 'failed'))) {
         throw new Error(`${field} proving requires passed checks and checked change proof identity`);
     }
-    if (value.lifecycle === 'publishing' && !hasOwn(value, 'proofReceipt'))
-        throw new Error(`${field} publishing requires proofReceipt`);
-    if (value.lifecycle === 'review-ready' && (!hasOwn(value, 'proofReceipt') || hasOwn(value, 'intent'))) {
-        throw new Error(`${field} review-ready requires proofReceipt and no intent`);
+    if ((value.lifecycle === 'reviewing' || value.lifecycle === 'publishing') && !hasOwn(value, 'proofReceipt')) {
+        throw new Error(`${field} review and publication require proofReceipt`);
     }
-    const retainedCandidateIntent = value.lifecycle === 'blocked'
+    if (value.lifecycle === 'safe-halt' && !hasOwn(value, 'activeAttempt'))
+        throw new Error(`${field} safe-halt requires an active attempt`);
+    const reviewReadyEffect = value.pendingEffect?.kind;
+    const reviewReadyEffectAllowed = reviewReadyEffect === undefined
+        || ['review-activation-labels', 'blocked-labels', 'continuation-worktree-create', 'outcome-evidence'].includes(reviewReadyEffect);
+    if (value.lifecycle === 'review-ready' && (!hasOwn(value, 'proofReceipt') || !reviewReadyEffectAllowed)) {
+        throw new Error(`${field} review-ready requires proofReceipt and only a review continuation or terminal effect`);
+    }
+    const retainedCandidateEffect = value.lifecycle === 'blocked'
         && value.terminalOutcome?.status === 'blocked'
         && value.terminalOutcome.kind === 'safety'
         && !value.terminalOutcome.resumable
         && hasOwn(value, 'candidateBinding')
-        && (value.intent?.kind === 'commit' || value.intent?.kind === 'review-update-commit');
-    if (terminal && hasOwn(value, 'intent') && value.lifecycle !== 'transport-failed' && !retainedCandidateIntent)
-        throw new Error(`${field} terminal lifecycle cannot retain intent`);
-    if (value.lifecycle === 'transport-failed' && hasOwn(value, 'intent')
+        && (value.pendingEffect?.kind === 'initial-commit' || value.pendingEffect?.kind === 'review-update-commit');
+    const settlingOutcomeEvidence = value.pendingEffect?.kind === 'outcome-evidence';
+    if (terminal && hasOwn(value, 'pendingEffect') && value.lifecycle !== 'transport-failed'
+        && !retainedCandidateEffect && !settlingOutcomeEvidence)
+        throw new Error(`${field} terminal lifecycle cannot retain pending effect`);
+    if (value.lifecycle === 'transport-failed' && hasOwn(value, 'pendingEffect')
+        && !settlingOutcomeEvidence
         && value.terminalOutcome.resumable) {
-        throw new Error(`${field} resumable transport failure cannot retain intent`);
-    }
-    if (value.lifecycle === 'waiting-human' && !hasOwn(value, 'waitingHuman'))
-        throw new Error(`${field} waiting-human lifecycle requires waitingHuman execution`);
-    if (reportInvocation)
-        validateReportInvocationBinding(value, reportInvocation, routeGenerationHash, field);
-    validateRouteStateInvariant({
-        lifecycle: value.lifecycle,
-        routeExecution: value.routeExecution,
-        routeReceipt: value.routeReceipt,
-        generationHash: routeGenerationHash,
-    });
-}
-function validateReportInvocationBinding(record, invocation, generationHash, field) {
-    if (invocation.generationHash !== generationHash)
-        throw new Error(`${field}.reportInvocation generation is invalid`);
-    if (invocation.operation === 'triage') {
-        if (!record.routeExecution || !['triage-in-flight', 'repair-in-flight'].includes(record.routeExecution.phase)) {
-            throw new Error(`${field}.triage reportInvocation phase is invalid`);
-        }
-        return;
-    }
-    if (invocation.operation === 'ambiguity-review') {
-        if (record.routeExecution?.phase !== 'review-in-flight')
-            throw new Error(`${field}.ambiguity reportInvocation phase is invalid`);
-        return;
-    }
-    if (invocation.operation === 'code-review') {
-        if (record.directReview?.status !== 'active'
-            || !['review-full', 'review-closure'].includes(record.directReview.stage ?? '')
-            || record.executionLease?.operation !== 'direct-review') {
-            throw new Error(`${field}.code-review reportInvocation binding is invalid`);
-        }
-        return;
-    }
-    if (invocation.operation === 'spec-author') {
-        if (!record.specDelivery || !['authoring', 'author-repair'].includes(record.specDelivery.stage)
-            || record.specDelivery.authorSessionId === null) {
-            throw new Error(`${field}.spec-author reportInvocation binding is invalid`);
-        }
-        return;
-    }
-    if (!record.specDelivery || !['review-full', 'review-closure'].includes(record.specDelivery.stage)) {
-        throw new Error(`${field}.spec-review reportInvocation binding is invalid`);
+        throw new Error(`${field} resumable transport failure cannot retain pending effect`);
     }
 }
 function directTerminalOutcome(outcome) {
@@ -467,7 +303,7 @@ function validateWorkflowGeneration(value, field) {
     }
     assertSha256(value.contentSha256, `${field}.contentSha256`);
 }
-function validateChecks(value, field, allowUnchangedFailure = true) {
+function validateChecks(value, field) {
     if (!Array.isArray(value) || value.length > 256)
         throw new Error(`${field} is invalid`);
     const ids = new Set();
@@ -479,35 +315,19 @@ function validateChecks(value, field, allowUnchangedFailure = true) {
         ], `${field}[${index}]`);
         assertNonEmptyString(check.id, `${field}[${index}].id`);
         assertNonEmptyString(check.command, `${field}[${index}].command`);
-        if (check.status !== 'passed' && check.status !== 'failed'
-            && (check.status !== 'unchanged-failure' || !allowUnchangedFailure))
+        if (check.status !== 'passed' && check.status !== 'failed')
             throw new Error(`${field}[${index}].status is invalid`);
         assertSha256(check.outputSha256, `${field}[${index}].outputSha256`);
         if (candidate) {
             assertSha256(check.bindingId, `${field}[${index}].bindingId`);
             assertGitSha(check.candidateTreeSha, `${field}[${index}].candidateTreeSha`);
             assertSha256(check.checkPolicySha256, `${field}[${index}].checkPolicySha256`);
-            if (check.status === 'unchanged-failure')
-                throw new Error(`${field}[${index}] candidate status is invalid`);
         }
         if (ids.has(check.id))
             throw new Error(`${field} IDs must be unique`);
         ids.add(check.id);
     }
 }
-function validateCheckQualification(value, field) {
-    const optional = hasOwn(value, 'repairFindings') ? ['repairFindings'] : [];
-    assertExactObject(value, ['version', 'checkPolicySha256', 'repairAttempts', 'checks', ...optional], field);
-    if (value.version !== 1)
-        throw new Error(`${field}.version is invalid`);
-    assertSha256(value.checkPolicySha256, `${field}.checkPolicySha256`);
-    if (!Number.isSafeInteger(value.repairAttempts) || value.repairAttempts < 0 || value.repairAttempts > 5) {
-        throw new Error(`${field}.repairAttempts is invalid`);
-    }
-    validateChecks(value.checks, `${field}.checks`, false);
-    if (hasOwn(value, 'repairFindings'))
-        validateStringList(value.repairFindings, `${field}.repairFindings`);
-}
 function validateIssueSnapshot(value, field) {
     const optional = hasOwn(value, 'comments') ? ['comments'] : [];
     assertExactObject(value, ['number', 'title', 'body', 'url', 'state', 'labels', ...optional], field);
@@ -564,48 +384,49 @@ function validateStringList(value, field) {
     for (const item of value)
         assertNonEmptyString(item, field);
 }
-function validateIntent(value, field) {
+function validatePendingEffect(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         throw new Error(`${field} is invalid`);
     const kind = value.kind;
-    if (kind === 'claim-labels' || kind === 'labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'expected'], field);
+    const identity = ['effectId', 'kind'];
+    if (kind === 'claim-labels' || kind === 'final-labels') {
+        assertExactObject(value, [...identity, 'issueNumber', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         validateStringArray(value.expected, `${field}.expected`);
     }
-    else if (kind === 'commit') {
-        assertExactObject(value, ['kind', 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
+    else if (kind === 'initial-commit') {
+        assertExactObject(value, [...identity, 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
         assertGitSha(value.parentSha, `${field}.parentSha`);
         assertGitSha(value.treeSha, `${field}.treeSha`);
         assertNonEmptyString(value.message, `${field}.message`);
         if (hasOwn(value, 'candidateRef'))
             assertCandidateRef(value.candidateRef, `${field}.candidateRef`);
     }
-    else if (kind === 'push') {
-        assertExactObject(value, ['kind', 'branch', 'sha'], field);
+    else if (kind === 'initial-push') {
+        assertExactObject(value, [...identity, 'branch', 'sha'], field);
         assertNonEmptyString(value.branch, `${field}.branch`);
         assertGitSha(value.sha, `${field}.sha`);
     }
-    else if (kind === 'pr') {
-        assertExactObject(value, ['kind', 'owner', 'repo', 'head', 'base', 'issueNumber', 'marker'], field);
+    else if (kind === 'draft-pr') {
+        assertExactObject(value, [...identity, 'owner', 'repo', 'head', 'base', 'issueNumber', 'marker'], field);
         for (const key of ['owner', 'repo', 'head', 'base', 'marker'])
             assertNonEmptyString(value[key], `${field}.${key}`);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
     }
-    else if (kind === 'comment') {
-        assertExactObject(value, ['kind', 'issueNumber', 'marker', 'bodySha256'], field);
+    else if (kind === 'claim-comment' || kind === 'handoff-comment') {
+        assertExactObject(value, [...identity, 'issueNumber', 'marker', 'bodySha256'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertNonEmptyString(value.marker, `${field}.marker`);
         assertSha256(value.bodySha256, `${field}.bodySha256`);
     }
     else if (kind === 'review-activation-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'expected'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         validateStringArray(value.expected, `${field}.expected`);
     }
     else if (kind === 'review-update-commit') {
-        assertExactObject(value, ['kind', 'batchId', 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
+        assertExactObject(value, [...identity, 'batchId', 'parentSha', 'treeSha', 'message', ...(hasOwn(value, 'candidateRef') ? ['candidateRef'] : [])], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertGitSha(value.parentSha, `${field}.parentSha`);
         assertGitSha(value.treeSha, `${field}.treeSha`);
@@ -614,7 +435,7 @@ function validateIntent(value, field) {
             assertCandidateRef(value.candidateRef, `${field}.candidateRef`);
     }
     else if (kind === 'review-update-push') {
-        assertExactObject(value, ['kind', 'batchId', 'branch', 'priorRemoteSha', 'sha', 'treeSha'], field);
+        assertExactObject(value, [...identity, 'batchId', 'branch', 'priorRemoteSha', 'sha', 'treeSha'], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertNonEmptyString(value.branch, `${field}.branch`);
         assertGitSha(value.priorRemoteSha, `${field}.priorRemoteSha`);
@@ -622,7 +443,7 @@ function validateIntent(value, field) {
         assertGitSha(value.treeSha, `${field}.treeSha`);
     }
     else if (kind === 'review-summary') {
-        assertExactObject(value, ['kind', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'marker', 'bodySha256', 'epochHeadSha'], field);
+        assertExactObject(value, [...identity, 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'marker', 'bodySha256', 'epochHeadSha'], field);
         assertSha256(value.batchId, `${field}.batchId`);
         assertPositiveInteger(value.pullRequestNumber, `${field}.pullRequestNumber`);
         assertNonEmptyString(value.pullRequestNodeId, `${field}.pullRequestNodeId`);
@@ -631,7 +452,7 @@ function validateIntent(value, field) {
         assertGitSha(value.epochHeadSha, `${field}.epochHeadSha`);
     }
     else if (kind === 'review-final-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'epochHeadSha', 'expected'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'pullRequestNumber', 'pullRequestNodeId', 'epochHeadSha', 'expected'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         assertPositiveInteger(value.pullRequestNumber, `${field}.pullRequestNumber`);
@@ -640,27 +461,61 @@ function validateIntent(value, field) {
         validateStringArray(value.expected, `${field}.expected`);
     }
     else if (kind === 'review-blocked-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'batchId', 'expected', 'blockKind', 'evidenceCode'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'batchId', 'expected', 'blockKind', 'evidenceCode'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         assertSha256(value.batchId, `${field}.batchId`);
         validateStringArray(value.expected, `${field}.expected`);
-        if (value.blockKind !== 'safety' && value.blockKind !== 'exhausted')
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.blockKind)) {
             throw new Error(`${field}.blockKind is invalid`);
+        }
         assertNonEmptyString(value.evidenceCode, `${field}.evidenceCode`);
     }
     else if (kind === 'blocked-labels') {
-        assertExactObject(value, ['kind', 'issueNumber', 'expected', 'blockKind', 'resumable', 'evidenceCode'], field);
+        assertExactObject(value, [...identity, 'issueNumber', 'expected', 'blockKind', 'resumable', 'evidenceCode'], field);
         assertPositiveInteger(value.issueNumber, `${field}.issueNumber`);
         validateStringArray(value.expected, `${field}.expected`);
-        if (!['external', 'safety', 'exhausted'].includes(value.blockKind))
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.blockKind))
             throw new Error(`${field}.blockKind is invalid`);
         if (typeof value.resumable !== 'boolean')
             throw new Error(`${field}.resumable is invalid`);
         assertNonEmptyString(value.evidenceCode, `${field}.evidenceCode`);
     }
+    else if (kind === 'worktree-create') {
+        assertExactObject(value, [...identity, 'worktreePath', 'branchName', 'baseBranch', 'baseSha'], field);
+        assertAbsolutePath(value.worktreePath, `${field}.worktreePath`);
+        assertNonEmptyString(value.branchName, `${field}.branchName`);
+        assertNonEmptyString(value.baseBranch, `${field}.baseBranch`);
+        assertGitSha(value.baseSha, `${field}.baseSha`);
+    }
+    else if (kind === 'continuation-worktree-create') {
+        assertExactObject(value, [...identity, 'worktreePath', 'branchName', 'baseBranch', 'publishedHeadSha'], field);
+        assertAbsolutePath(value.worktreePath, `${field}.worktreePath`);
+        assertNonEmptyString(value.branchName, `${field}.branchName`);
+        assertNonEmptyString(value.baseBranch, `${field}.baseBranch`);
+        assertGitSha(value.publishedHeadSha, `${field}.publishedHeadSha`);
+    }
+    else if (kind === 'candidate-pin-release') {
+        assertExactObject(value, [...identity, 'bindingId', 'expectedPinnedCommitSha'], field);
+        assertSha256(value.bindingId, `${field}.bindingId`);
+        assertGitSha(value.expectedPinnedCommitSha, `${field}.expectedPinnedCommitSha`);
+    }
+    else if (kind === 'outcome-evidence') {
+        assertExactObject(value, [...identity, 'path', 'runId', 'code', 'summary', 'recordedAt', 'bytesSha256'], field);
+        assertNonEmptyString(value.path, `${field}.path`);
+        if (typeof value.runId !== 'string' || !UUID_V4_PATTERN.test(value.runId))
+            throw new Error(`${field}.runId is invalid`);
+        assertNonEmptyString(value.code, `${field}.code`);
+        assertNonEmptyString(value.summary, `${field}.summary`);
+        assertTimestamp(value.recordedAt, `${field}.recordedAt`);
+        assertSha256(value.bytesSha256, `${field}.bytesSha256`);
+    }
     else {
         throw new Error(`${field}.kind is invalid`);
     }
+    assertSha256(value.effectId, `${field}.effectId`);
+    const { effectId, ...payload } = value;
+    if (effectId !== sha256(canonicalJson(payload)))
+        throw new Error(`${field}.effectId does not match its payload`);
 }
 function validateTerminalOutcome(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
@@ -673,11 +528,13 @@ function validateTerminalOutcome(value, field) {
             assertGitSha(value.continuationEpoch, `${field}.continuationEpoch`);
     }
     else if (status === 'blocked') {
-        assertExactObject(value, ['status', 'kind', 'resumable', 'evidencePath'], field);
-        if (!['external', 'safety', 'exhausted'].includes(value.kind))
+        assertExactObject(value, ['status', 'kind', 'resumable', 'evidencePath', ...(hasOwn(value, 'blocker') ? ['blocker'] : [])], field);
+        if (!['external', 'safety', 'decision-delta', 'out-of-scope', 'authority-boundary'].includes(value.kind))
             throw new Error(`${field}.kind is invalid`);
         if (typeof value.resumable !== 'boolean')
             throw new Error(`${field}.resumable is invalid`);
+        if (hasOwn(value, 'blocker'))
+            validateBlockerDetail(value.blocker, `${field}.blocker`);
     }
     else if (status === 'transport-failed') {
         assertExactObject(value, ['status', 'resumable', 'evidencePath'], field);
@@ -696,6 +553,19 @@ function validateTerminalOutcome(value, field) {
     }
     assertNonEmptyString(value.evidencePath, `${field}.evidencePath`);
 }
+function validateBlockerDetail(value, field) {
+    assertExactObject(value, ['kind', 'summary', 'attempted', 'resumable', ...(hasOwn(value, 'reviewerRejectionDetail') ? ['reviewerRejectionDetail'] : [])], field);
+    assertNonEmptyString(value.kind, `${field}.kind`);
+    assertNonEmptyString(value.summary, `${field}.summary`);
+    if (!Array.isArray(value.attempted) || value.attempted.length > 256)
+        throw new Error(`${field}.attempted is invalid`);
+    for (const attempted of value.attempted)
+        assertNonEmptyString(attempted, `${field}.attempted`);
+    if (typeof value.resumable !== 'boolean')
+        throw new Error(`${field}.resumable is invalid`);
+    if (hasOwn(value, 'reviewerRejectionDetail'))
+        assertNonEmptyString(value.reviewerRejectionDetail, `${field}.reviewerRejectionDetail`);
+}
 function validateReceipt(value, field) {
     assertExactObject(value, ['proofId', 'bindingSha256', 'summary', 'publishableEvidence', 'localEvidenceId'], field);
     assertNonEmptyString(value.proofId, `${field}.proofId`);
@@ -713,6 +583,18 @@ function validateReceipt(value, field) {
         assertNonEmptyString(evidence.description, `${field}.publishableEvidence.description`);
     }
 }
+function validateProofExecution(value, field) {
+    assertExactObject(value, ['startedAt', 'transportRetryCount', 'reportRepairCount', 'reportRepairFindings'], field);
+    assertTimestamp(value.startedAt, `${field}.startedAt`);
+    if (!Number.isSafeInteger(value.transportRetryCount) || value.transportRetryCount < 0)
+        throw new Error(`${field}.transportRetryCount is invalid`);
+    if (!Number.isSafeInteger(value.reportRepairCount) || value.reportRepairCount < 0)
+        throw new Error(`${field}.reportRepairCount is invalid`);
+    validateStringList(value.reportRepairFindings, `${field}.reportRepairFindings`);
+    if ((value.reportRepairCount === 0) !== (value.reportRepairFindings.length === 0)) {
+        throw new Error(`${field} report repair state is invalid`);
+    }
+}
 function validateStringShaRecord(value, field) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         throw new Error(`${field} is invalid`);
@@ -733,154 +615,7 @@ function validateStringArray(value, field) {
         throw new Error(`${field} must be sorted and unique`);
 }
 function emptyRunState() {
-    return { schema: 'codex-orchestrator.agent-auto-state', version: 3, generation: 0, runs: [] };
-}
-function canonicalizeLegacyReportLifecycle(value, backupPath) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value))
-        return undefined;
-    const raw = value;
-    if (raw.schema !== 'codex-orchestrator.agent-auto-state' || (raw.version !== 2 && raw.version !== 3)
-        || !Number.isSafeInteger(raw.generation) || raw.generation <= 0 || !Array.isArray(raw.runs))
-        return undefined;
-    const runs = structuredClone(raw.runs);
-    const changed = runs.map((run) => canonicalizeLegacyReportRun(run, backupPath)).some(Boolean);
-    if (!changed)
-        return undefined;
-    return validateRunStateFile({ schema: raw.schema, version: raw.version, generation: raw.generation + 1, runs });
-}
-function canonicalizeLegacyReportRun(run, backupPath) {
-    let changed = false, unsafe = false, routeInFlight = false;
-    const mutable = canonicalizeLegacyMutableRun(run);
-    changed ||= mutable.changed;
-    unsafe ||= mutable.unsafe;
-    const route = run.routeExecution;
-    if (route) {
-        const triageTransport = hasOwn(route, 'triageTransportRetries'), ambiguityTransport = hasOwn(route, 'ambiguityTransportRetries');
-        if (triageTransport !== ambiguityTransport)
-            throw new Error('legacy route transport budgets are incomplete');
-        if (triageTransport) {
-            legacyBits([route.triageTransportRetries, route.ambiguityTransportRetries], 'route');
-            delete route.triageTransportRetries;
-            delete route.ambiguityTransportRetries;
-            changed = true;
-        }
-        if (hasOwn(route, 'previousAttemptId')) {
-            delete route.previousAttemptId;
-            changed = true;
-        }
-        routeInFlight = ['triage-in-flight', 'review-in-flight', 'repair-in-flight'].includes(route.phase);
-        if (routeInFlight) {
-            unsafe = true;
-            delete route.attemptId;
-            delete route.startedAt;
-        }
-    }
-    const direct = run.directReview;
-    if (direct?.review && hasOwn(direct.review, 'transportRetries')) {
-        legacyBits([direct.review.transportRetries], 'direct review');
-        delete direct.review.transportRetries;
-        changed = true;
-    }
-    if (direct && hasOwn(direct, 'invocation')) {
-        delete direct.invocation;
-        unsafe = changed = true;
-    }
-    const spec = run.specDelivery;
-    if (spec?.budgets?.author && hasOwn(spec.budgets.author, 'transportRetries')) {
-        legacyBits([spec.budgets.author.transportRetries], 'spec author');
-        delete spec.budgets.author.transportRetries;
-        changed = true;
-    }
-    if (spec?.budgets?.review && hasOwn(spec.budgets.review, 'transportRetries')) {
-        legacyBits([spec.budgets.review.transportRetries], 'spec review');
-        delete spec.budgets.review.transportRetries;
-        changed = true;
-    }
-    if (spec?.review && !hasOwn(spec.review, 'reviewerSessionId')) {
-        spec.review.reviewerSessionId = spec.review.reviewer?.sessionId ?? (spec.invocation?.purpose === 'review' ? spec.invocation.sessionId : null);
-        changed = true;
-    }
-    if (spec?.invocation?.purpose === 'review') {
-        delete spec.invocation;
-        unsafe = changed = true;
-    }
-    if (spec?.invocation?.purpose === 'author') {
-        if (spec.invocation.status === 'launched')
-            unsafe = true;
-        if (spec.authorSessionId === null)
-            spec.authorSessionId = spec.invocation.sessionId;
-        else if (spec.authorSessionId !== spec.invocation.sessionId)
-            unsafe = true;
-        delete spec.invocation;
-        changed = true;
-    }
-    if (run.reportInvocation && !hasOwn(run.reportInvocation, 'promptFactsSha256')) {
-        delete run.reportInvocation;
-        unsafe = changed = true;
-    }
-    if (run.process && ['route', 'code-review', 'spec-author', 'spec-review', 'proof'].includes(run.process.purpose)) {
-        delete run.process;
-        unsafe = changed = true;
-    }
-    if (!unsafe)
-        return changed;
-    if (routeInFlight)
-        delete run.routeExecution;
-    delete run.reportInvocation;
-    delete run.process;
-    delete run.intent;
-    if (direct)
-        run.directReview = projectTerminalDirectReview(direct, { status: 'blocked', kind: 'safety' }, 'report-lifecycle-migration-identity-unavailable');
-    run.lifecycle = 'blocked';
-    run.outcomeEvidenceId = `report-lifecycle-migration:${String(run.runId)}`;
-    run.terminalOutcome = { status: 'blocked', kind: 'safety', resumable: false, evidencePath: backupPath };
-    return true;
-}
-function hasLegacyMutableLifecycle(value) {
-    if (typeof value !== 'object' || value === null || !Array.isArray(value.runs))
-        return false;
-    return (value.runs).some((run) => hasOwn(run, 'transportRetries') || run.process?.purpose === 'implementation'
-        || hasOwn(run.checkQualification, 'implementationStarted') || hasOwn(run.checkQualification, 'repairInvocation')
-        || hasOwn(run.checkQualification, 'deniedPathsBaseline') || hasOwn(run.reviewFeedback, 'implementationInvocation'));
-}
-function canonicalizeLegacyMutableRun(run) {
-    let changed = false, unsafe = false;
-    if (hasOwn(run, 'transportRetries')) {
-        legacyBits([run.transportRetries], 'mutable invocation');
-        delete run.transportRetries;
-        changed = true;
-    }
-    const qualification = run.checkQualification;
-    if (qualification) {
-        if (qualification.repairInvocation?.phase === 'launched')
-            unsafe = true;
-        for (const field of ['implementationStarted', 'repairInvocation', 'deniedPathsBaseline'])
-            if (hasOwn(qualification, field)) {
-                delete qualification[field];
-                changed = true;
-            }
-    }
-    const feedback = run.reviewFeedback;
-    if (feedback && hasOwn(feedback, 'implementationInvocation')) {
-        if (feedback.implementationInvocation?.phase === 'launched')
-            unsafe = true;
-        delete feedback.implementationInvocation;
-        changed = true;
-    }
-    if (run.process?.purpose === 'implementation') {
-        delete run.process;
-        changed = unsafe = true;
-    }
-    if (!unsafe)
-        return { changed, unsafe };
-    delete run.mutableInvocation;
-    if (feedback?.activeBatch)
-        run.reviewFeedback = blockReviewFeedback(feedback, 'safety', String(run.updatedAt));
-    return { changed: true, unsafe: true };
-}
-function legacyBits(values, owner) {
-    if (values.some((value) => value !== 0 && value !== 1))
-        throw new Error(`legacy ${owner} transport budget is invalid`);
+    return { schema: 'codex-orchestrator.run-state', generation: 0, runs: [] };
 }
 function parseRawState(bytes) {
     let value;
@@ -892,50 +627,24 @@ function parseRawState(bytes) {
     }
     return validateRunStateFile(value);
 }
-async function readOptionalFile(path) {
+async function readOptionalStateFile(path) {
+    let handle;
     try {
-        return await readFile(path);
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     }
     catch (error) {
         if (isErrorCode(error, 'ENOENT'))
             return undefined;
         throw error;
     }
-}
-async function readMigrationMetadata(path) {
-    const bytes = await readOptionalFile(path);
-    if (!bytes)
-        return undefined;
-    let value;
     try {
-        value = JSON.parse(bytes.toString('utf8'));
+        const stat = await handle.stat();
+        if (!stat.isFile())
+            throw new Error(`${path} is not a regular file`);
+        return await handle.readFile();
     }
-    catch {
-        throw new Error('candidate migration metadata is malformed');
-    }
-    assertExactObject(value, [
-        'version', 'sourceGeneration', 'sourceBytesSha256', 'publicationEffectPossible', 'createdAt', 'updatedAt',
-    ], 'candidate migration metadata');
-    if (value.version !== 1)
-        throw new Error('candidate migration metadata version is invalid');
-    if (value.sourceGeneration !== null && (!Number.isSafeInteger(value.sourceGeneration) || value.sourceGeneration <= 0)) {
-        throw new Error('candidate migration source generation is invalid');
-    }
-    if (value.sourceBytesSha256 !== null)
-        assertSha256(value.sourceBytesSha256, 'candidate migration source hash');
-    if ((value.sourceGeneration === null) !== (value.sourceBytesSha256 === null))
-        throw new Error('candidate migration source identity is incomplete');
-    if (typeof value.publicationEffectPossible !== 'boolean')
-        throw new Error('candidate migration publication watermark is invalid');
-    assertTimestamp(value.createdAt, 'candidate migration createdAt');
-    assertTimestamp(value.updatedAt, 'candidate migration updatedAt');
-    return value;
-}
-function assertNoCandidateV3Fields(runs) {
-    for (const run of runs) {
-        if (run.changeBindingVersion !== undefined || run.candidateBinding !== undefined || run.executionLease !== undefined) {
-            throw new Error('V2 run state cannot contain candidate V3 fields');
-        }
+    finally {
+        await handle.close();
     }
 }
 function isErrorCode(error, code) {
@@ -949,22 +658,18 @@ function validateReviewFeedbackRunInvariant(run, field) {
         || batch.priorPublishedHeadSha !== feedback.previousPublishedHeadSha)) {
         throw new Error(`${field}.reviewFeedback active batch identity binding is invalid`);
     }
-    const retainedQuiescentHistory = (feedback.phase === 'idle' || feedback.phase === 'bootstrap-required') && !batch
-        && run.lifecycle === 'blocked' && run.terminalOutcome?.status === 'blocked';
-    if ((feedback.phase === 'bootstrap-required' || feedback.phase === 'idle')
-        && run.lifecycle !== 'review-ready' && !retainedQuiescentHistory) {
-        throw new Error(`${field}.reviewFeedback quiescent phase requires review-ready lifecycle`);
-    }
-    if (['frozen', 'repairing'].includes(feedback.phase) && !['implementing', 'reworking', 'checking', 'proving'].includes(run.lifecycle)) {
-        throw new Error(`${field}.reviewFeedback active repair phase has invalid lifecycle`);
-    }
-    if (feedback.phase === 'verified' && run.lifecycle !== 'publishing') {
-        throw new Error(`${field}.reviewFeedback verified phase requires publishing lifecycle`);
+    const retainedQuiescentHistory = !batch && run.lifecycle === 'blocked' && run.terminalOutcome?.status === 'blocked';
+    if (!batch && run.lifecycle !== 'review-ready' && !retainedQuiescentHistory) {
+        throw new Error(`${field}.reviewFeedback quiescent data requires review-ready lifecycle`);
     }
-    if (feedback.phase === 'publishing' && run.lifecycle !== 'publishing') {
-        throw new Error(`${field}.reviewFeedback publishing phase requires publishing lifecycle`);
+    if (batch && !feedback.verifiedReceipt
+        && !['implementing', 'checking', 'proving', 'reviewing', 'safe-halt'].includes(run.lifecycle)) {
+        throw new Error(`${field}.reviewFeedback active batch has invalid lifecycle`);
     }
-    if (feedback.phase === 'verified' || feedback.phase === 'publishing') {
+    if (feedback.verifiedReceipt) {
+        if (run.lifecycle !== 'reviewing' && run.lifecycle !== 'publishing') {
+            throw new Error(`${field}.reviewFeedback verified batch requires review or publication lifecycle`);
+        }
         const verified = feedback.verifiedReceipt;
         if (!verified || verified.batchId !== batch?.batchId
             || verified.checkedChangeSha256 !== run.checkedChangeSha256
@@ -973,16 +678,10 @@ function validateReviewFeedbackRunInvariant(run, field) {
             throw new Error(`${field}.reviewFeedback verification receipt binding is invalid`);
         }
     }
-    if (feedback.phase === 'blocked-safety' || feedback.phase === 'blocked-exhausted') {
-        if (run.lifecycle !== 'blocked' || run.terminalOutcome?.status !== 'blocked' || run.terminalOutcome.resumable
-            || run.terminalOutcome.kind !== (feedback.phase === 'blocked-safety' ? 'safety' : 'exhausted')) {
-            throw new Error(`${field}.reviewFeedback terminal projection mismatch`);
-        }
-    }
 }
 function isLifecycle(value) {
     return typeof value === 'string' && [
-        'claimed', 'triaging', 'routed', 'waiting-human', 'spec-authoring', 'implementing', 'reworking', 'checking', 'proving', 'publishing',
+        'claimed', 'implementing', 'checking', 'proving', 'reviewing', 'publishing', 'safe-halt',
         'review-ready', 'blocked', 'transport-failed', 'cancelled', 'internal-error',
     ].includes(value);
 }
@@ -1001,6 +700,10 @@ function assertNonEmptyString(value, field) {
     if (typeof value !== 'string' || value.length === 0 || value.length > 16 * 1024)
         throw new Error(`${field} is invalid`);
 }
+function assertAbsolutePath(value, field) {
+    if (typeof value !== 'string' || !value.startsWith('/') || posix.normalize(value) !== value)
+        throw new Error(`${field} is invalid`);
+}
 function assertPositiveInteger(value, field) {
     if (!Number.isSafeInteger(value) || value <= 0)
         throw new Error(`${field} is invalid`);