immune-brain 3.6.8 → 4.0.0

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -4,9 +4,9 @@
 // the dedicated recoverable workspace transaction. Consumed by the Pi canary
 // host adapter via canary_application.
 
+import { terminalRequestDigest } from "./run_identity";
 import {
 	type MutationAuthorityRegistry,
-	type ValidatedAuthorityV2,
 } from "./authority_port";
 import { asTaskDiffSnapshot } from "./completion";
 import { canonicalIntentHash, readTaskIntent } from "./intent";
@@ -26,6 +26,7 @@ import {
 	commitTerminalLocked,
 	readTaskRecordRaw,
 	readWorkspaceStateRaw,
+	currentRunId,
 	revisionForContent,
 	serializeWorkspace,
 	withKernelStoreLock,
@@ -37,8 +38,6 @@ import type {
 	AuthorityAuditDescriptor,
 	MutationAuthorityCapabilityV2,
 	StoredTaskMutationV3,
-	TaskAction,
-	TaskIntentV1,
 	TaskRecord,
 } from "./types";
 import { TASK_TOMBSTONE_CONTRACT, type TaskTombstone } from "./backend_claim";
@@ -164,9 +163,15 @@ export function applyTaskAction(
 			action.type === "stop" ||
 			action.type === "resolve_user_decision";
 
+		// A capability is opaque: its binding lives in the issuing registry, so
+		// the run this worktree holds is read here and handed to the registry as
+		// the expected identity. Authority issued for another run is refused
+		// before any write, which is what keeps it inside the worktree that
+		// issued it even when task, record, intent and diff content are identical.
 		const expectedAuthority = privileged
 			? {
 					task_id,
+					run_id: currentRunId(root, task_id) ?? undefined,
 					action,
 					expected_record_hash: current.revision,
 					intent_revision: isRevisionAction
@@ -189,6 +194,7 @@ export function applyTaskAction(
 		const inspectedAudit = expectedAuthority
 			? registry.inspect(capability, expectedAuthority, now)
 			: null;
+		const authorityRunId = inspectedAudit?.run_id;
 		const mutation = reduceTask(
 			current.record,
 			action,
@@ -227,9 +233,8 @@ export function applyTaskAction(
 		// All preflight passed: consume tokens and authority, then commit.
 		consumeIntentToken(prior_intent_token);
 		consumeIntentToken(freshRead.token);
-		let consumedAudit: ValidatedAuthorityV2 | null = null;
 		if (expectedAuthority) {
-			consumedAudit = registry.consume(
+			registry.consume(
 				capability as MutationAuthorityCapabilityV2,
 				expectedAuthority,
 				now,
@@ -284,7 +289,17 @@ export function applyTaskAction(
 				next_workspace_content: serializeWorkspace(nextWorkspaceState),
 				...(input.artifact_transition ? { artifact_relocations: input.artifact_transition.relocations } : {}),
 			};
-			commitTerminalLocked(root, task_id, transaction, tombstone);
+			commitTerminalLocked(
+				root,
+				task_id,
+				transaction,
+				tombstone,
+				authorityRunId,
+				// The request this settlement answers: a retry with a different
+				// reason, actor or event time is a different decision and must be
+				// authorized again rather than replayed.
+				terminalRequestDigest(action),
+			);
 			return {
 				revision: canonicalRecordHash(nextRecord),
 				record: nextRecord,
@@ -303,6 +318,7 @@ export function applyTaskAction(
 			workspace.revision,
 			nextWorkspaceState,
 			input.artifact_transition?.relocations,
+			authorityRunId,
 		);
 	});
 }

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -12,9 +12,16 @@
 // "start QA" or "start Review"; it returns Kernel-owned facts only.
 
 import { readBackendClaim, readTaskTombstone } from "./backend_claim";
-import { readTaskRecord, readAuditTaskPair, readWorkspaceStateRaw, reconcileKernelAuthority } from "./storage";
+import {
+	readTaskRecord,
+	readAuditTaskPair,
+	readCommittedRecord,
+	readWorkspaceStateRaw,
+	reconcileKernelAuthority,
+} from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
-import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV2 } from "./types";
+import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
+import type { TaskRecordV2 } from "./legacy_task_record";
 
 export interface TaskDiffSnapshot {
 	diff_hash: string;
@@ -34,6 +41,12 @@ export interface AssuranceAuthorizationReadiness {
 }
 
 export interface AssuranceProjection {
+	/**
+	 * The exact run this projection describes: one worktree owns one store and
+	 * one active run, so the run id is the authority identity a capability must
+	 * bind. Null when no run is committed.
+	 */
+	run_id: string | null;
 	record_revision: string;
 	workspace_revision: string;
 	intent_revision: number;
@@ -83,6 +96,7 @@ export function deriveAssuranceAuthorization(input: {
 
 function emptyProjection(): AssuranceProjection {
 	return {
+		run_id: null,
 		record_revision: "",
 		workspace_revision: "",
 		intent_revision: 0,
@@ -128,6 +142,36 @@ function projectHistoricalTerminal(
 	};
 }
 
+function projectHistoricalTerminalV3(
+	record: TaskRecordV3,
+	recordRevision: string,
+	workspaceRevision: string,
+): AssuranceProjection {
+	const freshAcceptanceIds = [
+		...new Set(
+			record.attestations
+				.filter((item) => item.kind === "qa")
+				.flatMap((item) => item.acceptance_results)
+				.filter((item) => item.status === "passed")
+				.map((item) => item.acceptance_id),
+		),
+	];
+	const approvalKinds = [...new Set(record.attestations.map((item) => item.kind))];
+	return {
+		...emptyProjection(),
+		record_revision: recordRevision,
+		workspace_revision: workspaceRevision,
+		intent_revision: record.intent_snapshot.revision,
+		intent_content_hash: record.intent_ref.content_hash,
+		lifecycle: record.lifecycle,
+		artifact_state: "frozen",
+		risk: record.intent_snapshot.risk,
+		fresh_acceptance_ids: freshAcceptanceIds,
+		fresh_approval_kinds: approvalKinds,
+		completion_ready: record.lifecycle === "done",
+	};
+}
+
 function freshApprovalKinds(
 	record: TaskRecord,
 	currentIntentContentHash: string,
@@ -168,6 +212,8 @@ function projectFromRecord(
 		(finding) => finding.kind === "unresolved_user_decision" && finding.status === "open",
 	).length;
 	return {
+		// Filled by the caller from the committed run row.
+		run_id: null,
 		record_revision: recordRevision,
 		workspace_revision: workspaceRevision,
 		intent_revision: record.intent_snapshot.revision,
@@ -232,9 +278,19 @@ export async function projectAssurance(
 			const tombstone = readTaskTombstone(root, taskId);
 			if (tombstone) {
 				const authority = reconcileKernelAuthority(root, taskId);
-				if (authority.state === "repairable_stale_claim")
+				// A terminal proof keyed by task id may have been exported by
+				// another worktree's run of this same task: it is that run's
+				// evidence, not a conflict with this worktree's own run. The local
+				// store decides, and an active local run keeps its authority.
+				if (authority.state === "active_owner") {
+					// fall through: the local run owns this task here
+				} else if (authority.state === "repairable_stale_claim")
 					return fail(`task ${taskId} has a repairable stale backend claim`, claim);
-				return fail(authority.diagnostic ?? `authority state conflicts for ${taskId}`, claim);
+				else
+					return fail(
+						authority.diagnostic ?? `authority state conflicts for ${taskId}`,
+						claim,
+					);
 			}
 		} else {
 			const authority = reconcileKernelAuthority(root, taskId);
@@ -254,6 +310,28 @@ export async function projectAssurance(
 		}
 		if (!read.record) {
 			if (!terminalOwner) return fail(`task ${taskId} has no TaskRecord v3`, claim);
+			const committedRunId = reconcileKernelAuthority(root, taskId).owner_run_id;
+			// The store keeps the terminal record itself, so a settled task projects
+			// from committed facts even while its audit export is still in flight.
+			const committed = await readCommittedRecord(root, taskId);
+			if (committed) {
+				const workspace = await readWorkspaceStateRaw(root);
+				return {
+					contract: "assurance_kernel/assurance_projection/v1",
+					task_id: taskId,
+					error: null,
+					claim: null,
+					projection: {
+						...projectFromRecord(
+							committed.record,
+							committed.revision,
+							workspace.revision,
+							diffProvider(root, committed.record),
+						),
+						run_id: committedRunId,
+					},
+				};
+			}
 			const auditPair = await readAuditTaskPair(root, taskId);
 			if (!auditPair) return fail(`task ${taskId} has no terminal audit pair`, claim);
 			const workspace = await readWorkspaceStateRaw(root);
@@ -265,6 +343,14 @@ export async function projectAssurance(
 					claim: null,
 					projection: projectHistoricalTerminal(auditPair.record, auditPair.recordRevision, workspace.revision),
 				};
+			if (auditPair.record.contract === "assurance_kernel/task_record/v3")
+				return {
+					contract: "assurance_kernel/assurance_projection/v1",
+					task_id: taskId,
+					error: null,
+					claim: null,
+					projection: projectHistoricalTerminalV3(auditPair.record, auditPair.recordRevision, workspace.revision),
+				};
 			return {
 				contract: "assurance_kernel/assurance_projection/v1",
 				task_id: taskId,
@@ -284,7 +370,10 @@ export async function projectAssurance(
 			task_id: taskId,
 			error: null,
 			claim,
-			projection: projectFromRecord(read.record, read.revision, workspace.revision, snapshot),
+			projection: {
+				...projectFromRecord(read.record, read.revision, workspace.revision, snapshot),
+				run_id: reconcileKernelAuthority(root, taskId).owner_run_id,
+			},
 		};
 	} catch (error) {
 		return fail(error instanceof Error ? error.message : String(error));

package/plugins/immune-brain/runtime/kernel/authority_port.ts

@@ -4,6 +4,7 @@
 // remain here.
 
 import { createHash } from "node:crypto";
+import { canonicalActorId } from "./actor_identity";
 
 import {
 	MUTATION_AUTHORITY_CAPABILITY_BRAND,
@@ -13,18 +14,23 @@ import {
 	type TaskAction,
 } from "./types";
 import { createCapabilityRegistry } from "./capability_registry";
+import type { BaseCapabilityBinding } from "./enrollment_authority";
 
-export interface CapabilityBindingV2 {
+export interface CapabilityBindingV2 extends BaseCapabilityBinding {
 	authority_kind: MutationAuthorityKind;
 	task_id: string;
+	/**
+	 * The exact run this authority was issued for. Two worktrees may each run
+	 * the same logical task with identical record, intent and diff content but
+	 * different run identities, so the task and content bindings alone cannot
+	 * tell them apart.
+	 */
+	run_id?: string;
 	action_digest: string;
 	expected_record_hash: string;
 	intent_revision: number;
 	intent_content_hash: string;
 	diff_hash: string;
-	actor_id: string;
-	confirmation_ref: string;
-	expires_at: string;
 	/** Normalized findings digest required for request_rework; null for other operations. */
 	findings_digest: string | null;
 }
@@ -32,6 +38,7 @@ export interface CapabilityBindingV2 {
 export interface ValidatedAuthorityV2 {
 	audit: AuthorityAuditDescriptor;
 	action_digest: string;
+	run_id?: string;
 	expected_record_hash: string;
 	intent_revision: number;
 	intent_content_hash: string;
@@ -41,6 +48,7 @@ export interface ValidatedAuthorityV2 {
 
 export interface MutationAuthorityInspection {
 	task_id: string;
+	run_id?: string;
 	action: TaskAction;
 	expected_record_hash: string;
 	intent_revision: number;
@@ -82,8 +90,10 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 		{
 			validateBinding(binding, issuedAt) {
 				const missing: string[] = [];
+				if (binding.run_id !== undefined && binding.run_id.length === 0)
+					throw new Error("authority capability run_id must not be empty");
 				for (const [key, value] of Object.entries(binding)) {
-					if (key === "findings_digest") continue;
+					if (key === "findings_digest" || key === "run_id") continue;
 					if (value === undefined || value === null || value === "") missing.push(key);
 				}
 				if (missing.length > 0)
@@ -101,6 +111,12 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 					throw new Error("authority capability action digest mismatch");
 				if (state.task_id !== expected.task_id)
 					throw new Error("authority capability task mismatch");
+				if (
+					state.run_id !== undefined &&
+					expected.run_id !== undefined &&
+					state.run_id !== expected.run_id
+				)
+					throw new Error("authority capability run mismatch");
 				if (state.expected_record_hash !== expected.expected_record_hash)
 					throw new Error("authority capability record hash mismatch");
 				if (state.intent_revision !== expected.intent_revision)
@@ -118,12 +134,17 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 				return {
 					audit: {
 						authority_kind: state.authority_kind,
-						actor_id: state.actor_id,
+						// One recorded spelling: this projection is the single point where
+						// an authority's actor becomes the history entry's audit identity,
+						// so a Host that still supplies the historical `user` spelling is
+						// recorded as the canonical literal user.
+						actor_id: canonicalActorId(state.actor_id),
 						confirmation_ref: state.confirmation_ref,
 						issued_at: state.issued_at,
 						expires_at: state.expires_at,
 					},
 					action_digest: actionDigest,
+					...(state.run_id !== undefined ? { run_id: state.run_id } : {}),
 					expected_record_hash: state.expected_record_hash,
 					intent_revision: state.intent_revision,
 					intent_content_hash: state.intent_content_hash,

package/plugins/immune-brain/runtime/kernel/backend_claim.ts

@@ -1,19 +1,24 @@
 // P2B2 backend claim ownership. NOT exported from kernel/index.ts.
-// The ignored state-layout `.imm/state/active-claim.json` is the unique
-// workspace-active claim and may be `active | draining` only; terminal state
-// lives exclusively in the immutable tracked audit proof
+// The workspace-active claim is DERIVED from the single active run in the
+// worktree authority store (`.imm/state/kernel.sqlite`); terminal state lives
+// exclusively in the immutable tracked audit proof
 // `.imm/audit/<task-id>/terminal-proof.json`. No writer is exported from this
-// module: every claim change goes through the recoverable Kernel store
-// transactions owned by storage.ts (enrollment, drain, terminalization).
+// module: every claim change goes through the Kernel store transactions owned
+// by storage.ts (enrollment, drain, terminalization).
 
 import { lstatSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 
-import { auditTerminalProofPath, stateClaimPath } from "./storage_paths";
+import { auditEvidencePaths, auditRunTerminalProofPath } from "./storage_paths";
+import {
+	activeRunId,
+	readRunRowById,
+	readRunRowByTask,
+	withKernelRead,
+	type KernelRunRow,
+} from "./sqlite_store";
 import type { TaskLifecycle } from "./types";
 
-const CLAIM_PATH = stateClaimPath();
-
 export type BackendLifecycleStatus = "active" | "draining";
 
 export interface BackendClaim {
@@ -114,9 +119,28 @@ export function parseBackendClaim(raw: Record<string, unknown>): BackendClaim {
 }
 
 export function readBackendClaim(root: string): BackendClaim | null {
-	const raw = readJsonOrNull(join(root, CLAIM_PATH));
-	if (!raw) return null;
-	return parseBackendClaim(raw);
+	return (
+		withKernelRead(root, (db) => {
+			const run = readRunRowById(db, activeRunId(db) ?? "");
+			if (!run || run.state !== "active" || run.claim_status === null) return null;
+			return claimFromRunRow(run);
+		}) ?? null
+	);
+}
+
+/** Project the workspace claim from the committed run row that owns it. */
+export function claimFromRunRow(run: KernelRunRow): BackendClaim {
+	return parseBackendClaim({
+		contract: "assurance_kernel/backend_claim/v2",
+		backend: "kernel",
+		task_id: run.task_id,
+		intent_revision: run.intent_revision,
+		intent_content_hash: run.intent_content_hash,
+		enrollment_event_id: run.enrollment_event_id,
+		lifecycle_status: run.claim_status ?? "active",
+		created_at: run.created_at,
+		updated_at: run.updated_at,
+	});
 }
 
 /** Serialize a validated claim to the canonical file bytes. Transaction-only writer consumers. */
@@ -163,7 +187,14 @@ export function parseTaskTombstone(raw: Record<string, unknown>): TaskTombstone
 /** Fail-closed task-scoped tombstone read. Malformed/unreadable/symlinked state throws; only ENOENT means absent. */
 export function readTaskTombstone(root: string, taskId: string): TaskTombstone | null {
 	validateTaskId(taskId);
-	const raw = readJsonOrNull(join(resolve(root), auditTerminalProofPath(taskId)));
+	// A local run's proof is that run's evidence. Directory counting cannot
+	// choose among several run directories, and a foreign run must not be
+	// adopted while this worktree has its own run.
+	const localRun = withKernelRead(root, (db) => readRunRowByTask(db, taskId));
+	const proofPath = localRun
+		? auditRunTerminalProofPath(taskId, localRun.run_id)
+		: auditEvidencePaths(root, taskId).proof;
+	const raw = readJsonOrNull(join(resolve(root), proofPath));
 	if (!raw) return null;
 	const tombstone = parseTaskTombstone(raw);
 	if (tombstone.task_id !== taskId)
@@ -191,7 +222,3 @@ export function assertNoKernelBackendForV3(root: string, _commandTask?: string):
 		`backend-owned workspace: task ${claim.task_id} is managed by the Kernel backend (${claim.lifecycle_status}); v3 managed mutation is rejected`,
 	);
 }
-
-export function backendClaimPath(root: string): string {
-	return join(resolve(root), stateClaimPath());
-}

package/plugins/immune-brain/runtime/kernel/batch_authority.ts

@@ -9,7 +9,8 @@
 
 import { createHash } from "node:crypto";
 import { createCapabilityRegistry } from "./capability_registry";
-import type { EnrollmentCapabilityBinding } from "./enrollment_authority";
+import { isLiteralUserActor } from "./actor_identity";
+import type { BaseCapabilityBinding, EnrollmentCapabilityBinding } from "./enrollment_authority";
 import { preparePiCanary, type PiCanaryPreparation } from "./pi_canary_prepare";
 
 export const BATCH_AUTHORITY_CAPABILITY_BRAND = Symbol.for(
@@ -42,16 +43,13 @@ export interface BatchBudget {
 	qa_failure_limit: number;
 }
 
-export interface BatchAuthorizationBinding {
+export interface BatchAuthorizationBinding extends BaseCapabilityBinding {
 	batch_id: string;
 	initiative_slug: string;
 	plan_digest: string;
 	branch: string;
 	base_head: string;
 	budget: BatchBudget;
-	actor_id: string;
-	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 
@@ -214,7 +212,10 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 		{
 			validateBinding(binding, issuedAt) {
 				requireNonEmpty(binding);
-				if (binding.actor_id !== "user")
+				// Both the canonical literal-user spelling and the historical `user`
+				// spelling are read, so a batch authorized before the convergence keeps
+				// validating; new bindings are written canonically.
+				if (!isLiteralUserActor(binding.actor_id))
 					throw new Error("batch authorization requires a literal-user actor_id");
 				if (!GIT_COMMIT_ID.test(binding.base_head))
 					throw new Error("batch authorization base_head must be a committed 40-hex commit id");
@@ -256,6 +257,9 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 					branch: state.branch,
 					base_head: state.base_head,
 					budget: { ...state.budget },
+					// Kept faithful to the stored state: a batch authorized before the
+					// convergence resumes with the spelling it was issued under, and the
+					// recorded audit identity is canonicalized once, where it is written.
 					actor_id: state.actor_id,
 					confirmation_ref: state.confirmation_ref,
 					issued_at: state.issued_at,

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -8,6 +8,7 @@
 // once inside the Pi lifecycle extension activation closure; tests use
 // tests/fixtures/mutation-authority-test-seam.ts.
 
+import { terminalRequestDigest } from "./run_identity";
 import {
 	type MutationAuthorityRegistry,
 } from "./authority_port";
@@ -24,13 +25,15 @@ import {
 	type BackendClaim,
 } from "./backend_claim";
 import { canonicalIntentHash } from "./intent";
+import { boundSpecPath, readBoundActiveSpec } from "./spec_binding";
 import { parseTaskRecord } from "./validation";
 import type { TaskIntentIdentityToken } from "./intent_token_registry";
 import {
 	commitDrainLocked,
 	commitTaskRecordLocked,
-	readSecureProjectFile,
 	readTaskRecordRaw,
+	currentRunId,
+	readCommittedTerminalResult,
 	readWorkspaceStateRaw,
 	revisionForContent,
 	withKernelStoreLock,
@@ -167,69 +170,29 @@ export function capabilityActionFor(input: {
 	}
 }
 
-function archivePath(path: string): string {
-	const matched = path.match(/^docs\/(plans|specs)\/([^/]+)$/);
-	if (!matched) throw new KernelInvariantError([`artifact path is not active: ${path}`]);
-	return `docs/${matched[1]}/archive/${matched[2]}`;
-}
-
-function boundSpecPath(intent: TaskIntentV1): string | undefined {
-	const candidates = intent.scope_hint.filter(
-		(path) => /^docs\/specs\/(?!archive\/)[^/]+\.spec\.md$/.test(path) && intent.scope_hint.includes(archivePath(path)),
-	);
-	if (candidates.length > 1)
-		throw new KernelInvariantError([`artifact transition requires at most one scope-bound Spec; found ${candidates.length}`]);
-	return candidates[0];
-}
-
-function readBoundActiveSpec(
-	root: string,
-	intent: TaskIntentV1,
-	required = true,
-): { path: string; content: string } | undefined {
-	const specPath = boundSpecPath(intent);
-	if (!specPath) {
-		if (required) throw new KernelInvariantError(["artifact freeze requires one scope-bound active Spec"]);
-		return undefined;
-	}
-	try {
-		return { path: specPath, content: readSecureProjectFile(root, specPath) };
-	} catch (error) {
-		if (error instanceof Error && error.message.startsWith("source_missing:") && !required) return undefined;
-		throw error;
-	}
-}
-
 function transitionFor(
 	root: string,
 	record: { intent_ref: { path: string }; intent_snapshot: TaskIntentV1; artifact_state: "active" | "frozen" },
 	direction: "freeze" | "restore",
-	allowIntentOnly = false,
+	allowMissingSpec = false,
 ) {
 	const activeIntent = `docs/plans/${record.intent_snapshot.task_id}.intent.json`;
-	const frozenIntent = archivePath(activeIntent);
 	if (direction === "freeze") {
 		if (record.intent_ref.path !== activeIntent)
 			throw new KernelInvariantError(["artifact freeze requires the active intent path"]);
-		const spec = readBoundActiveSpec(root, record.intent_snapshot, !allowIntentOnly);
-		const intentContent = readSecureProjectFile(root, activeIntent);
+		const spec = readBoundActiveSpec(root, record.intent_snapshot);
+		if (boundSpecPath(record.intent_snapshot) && !spec && !allowMissingSpec)
+			throw new KernelInvariantError([`source_missing: ${boundSpecPath(record.intent_snapshot)}`]);
 		return {
-			relocations: [
-				{ from_path: activeIntent, to_path: frozenIntent, content_hash: revisionForContent(intentContent) },
-				...(spec ? [{ from_path: spec.path, to_path: archivePath(spec.path), content_hash: revisionForContent(spec.content) }] : []),
-			],
-			next_intent_path: frozenIntent,
+			relocations: [] as { from_path: string; to_path: string; content_hash: string }[],
+			next_intent_path: activeIntent,
 			next_artifact_state: "frozen" as const,
 		};
 	}
-	if (record.intent_ref.path !== frozenIntent || record.artifact_state !== "frozen")
+	if (record.artifact_state !== "frozen")
 		throw new KernelInvariantError(["artifact restore requires a frozen TaskRecord"]);
-	const specPath = boundSpecPath(record.intent_snapshot);
 	return {
-		relocations: [
-			{ from_path: frozenIntent, to_path: activeIntent, content_hash: revisionForContent(readSecureProjectFile(root, frozenIntent)) },
-			...(specPath ? [{ from_path: archivePath(specPath), to_path: specPath, content_hash: revisionForContent(readSecureProjectFile(root, archivePath(specPath))) }] : []),
-		],
+		relocations: [] as { from_path: string; to_path: string; content_hash: string }[],
 		next_intent_path: activeIntent,
 		next_artifact_state: "active" as const,
 	};
@@ -279,7 +242,7 @@ export function createCanaryApplication(
 						type: "freeze_artifacts",
 						from_state: "active:active",
 						to_state: "active:frozen",
-						reason: `TaskIntent and Spec frozen at ${transition.next_intent_path}`,
+						reason: `TaskIntent frozen in place at ${transition.next_intent_path}`,
 					},
 				],
 			});
@@ -302,6 +265,35 @@ export function createCanaryApplication(
 		const now = input.now ?? new Date().toISOString();
 		const operation = input.operation;
 		const at = now;
+		// A settled run clears the active record, so a lost settlement response can
+		// only be answered from the committed operation — and only with the
+		// committed result. This runs before the record, token and capability
+		// checks, which a terminal run can no longer satisfy.
+		if (operation.op === "complete" || operation.op === "stop") {
+			const replayed = readCommittedTerminalResult(
+				input.root,
+				input.task_id,
+				`${operation.op}:${input.task_id}:${at}`,
+				terminalRequestDigest({
+					type: operation.op,
+					event_id: `${operation.op}:${input.task_id}:${at}`,
+					at,
+					actor_id: operation.actor_id,
+					reason: "reason" in operation ? operation.reason : undefined,
+				}),
+			);
+			if (replayed)
+				return {
+					// The committed result is the answer: same record identity, same
+					// cleared workspace, no second write.
+					revision: revisionForContent(`${JSON.stringify(replayed.record, null, 2)}\n`),
+					record: replayed.record,
+					workspace: {
+						revision: revisionForContent(`${JSON.stringify(replayed.workspace, null, 2)}\n`),
+						state: replayed.workspace,
+					},
+				};
+		}
 		// Preflight snapshot inside the store lock derives the exact current
 		// identities; authoritative CAS revalidation still happens inside the
 		// locked application port, so any concurrent change fails closed.
@@ -324,10 +316,7 @@ export function createCanaryApplication(
 		const diffHash = asTaskDiffSnapshot(input.diffProvider(input.root, snapshot.record)).diff_hash;
 		if (operation.op === "stop" && !("capability" in operation))
 			throw new KernelInvariantError(["stop requires user authority capability"]);
-		const hasBoundSpec = snapshot.intent_snapshot.scope_hint.some(
-			(path) => /^docs\/specs\/(?!archive\/)[^/]+\.spec\.md$/.test(path)
-				&& snapshot.intent_snapshot.scope_hint.includes(archivePath(path)),
-		);
+		const hasBoundSpec = boundSpecPath(snapshot.intent_snapshot) !== undefined;
 		if (operation.op === "complete" && hasBoundSpec && snapshot.record.artifact_state !== "frozen")
 			throw new KernelInvariantError(["complete requires frozen planning artifacts"]);
 		const artifactTransition =
@@ -390,13 +379,7 @@ export function createCanaryApplication(
 					type: "revise_intent",
 					next_intent: operation.next_intent,
 					next_intent_ref: {
-						// revise_intent never unfreezes artifacts, so a revision
-						// while frozen must keep the archived sidecar path that
-						// record validation enforces (active path otherwise).
-						path:
-							snapshot.record.artifact_state === "frozen"
-								? `docs/plans/archive/${operation.next_intent.task_id}.intent.json`
-								: `docs/plans/${operation.next_intent.task_id}.intent.json`,
+						path: `docs/plans/${operation.next_intent.task_id}.intent.json`,
 						content_hash: canonicalIntentHash(operation.next_intent),
 					},
 				};
@@ -460,6 +443,7 @@ export function createCanaryApplication(
 		root: string;
 		task_id: string;
 		capability: object;
+		run_id?: string | null;
 		now?: string;
 	}): BackendClaim {
 		if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.task_id))
@@ -498,9 +482,11 @@ export function createCanaryApplication(
 				throw new KernelInvariantError([
 					`workspace is not owned by task ${input.task_id}`,
 				]);
-			// The capability is bound to the canonical begin_drain action.
-			registry.consume(input.capability as never, {
+			// The capability is bound to the canonical begin_drain action *and* to
+			// the run this worktree holds.
+			const validated = registry.consume(input.capability as never, {
 				task_id: input.task_id,
+				run_id: currentRunId(input.root, input.task_id) ?? undefined,
 				action: beginDrainCapabilityAction(input.task_id, now),
 				expected_record_hash: current.revision,
 				intent_revision: current.record.intent_snapshot.revision,
@@ -518,6 +504,7 @@ export function createCanaryApplication(
 				serializeBackendClaim(claim),
 				serializeBackendClaim(nextClaim),
 				now,
+				validated.run_id,
 			);
 		});
 	}