intentdna 1.9.0 → 1.9.1

package/dist/runtime/run-store.js

@@ -1,7 +1,13 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, readdir, rename, rm, stat, utimes, } from "node:fs/promises";
-import { dirname, join } from "node:path";
-export const RUN_STORE_SCHEMA_VERSION = 1;
+import { link, mkdir, open, readFile, readdir, rename, rm, unlink, } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, relative, sep } from "node:path";
+import { CANONICAL_ACTIVATION_STATE_VALUES, CANONICAL_ACTIVATION_STATE_TRANSITIONS, CANONICAL_RUNTIME_EVENT_TYPE_VALUES, } from "./run-contracts.js";
+import { canonicalizeJson } from "./canonical-json.js";
+import { parseStoredRunBinding, } from "./run-binding.js";
+import { canonicalAttemptOutcomeStatus, validateCanonicalAttemptOutcome, } from "./canonical-attempt-outcome.js";
+export const LEGACY_RUN_STORE_SCHEMA_VERSION = 1;
+export const RUN_STORE_SCHEMA_VERSION = LEGACY_RUN_STORE_SCHEMA_VERSION;
+export const CANONICAL_RUN_STORE_SCHEMA_VERSION = 2;
 export const RUN_STATUS_VALUES = [
     "active",
     "cancelling",
@@ -11,8 +17,8 @@ export const RUN_STATUS_VALUES = [
 ];
 export class RunStoreError extends Error {
     code;
-    constructor(code, message) {
-        super(message);
+    constructor(code, message, options) {
+        super(message, options);
         this.name = "RunStoreError";
         this.code = code;
     }
@@ -21,10 +27,12 @@ const DEFAULT_LOCK_WAIT_MS = 5_000;
 const DEFAULT_LOCK_STALE_MS = 5 * 60_000;
 const DEFAULT_LOCK_RETRY_MS = 25;
 const LEDGER_FILE_NAME = "ledger.json";
-const LOCK_OWNER_FILE_NAME = "owner";
-const LOCK_LEASE_FILE_NAME = "lease";
+const VERSION_DIRECTORY_NAME = "versions";
+const VERSION_FILE_PATTERN = /^(\d{16})\.json$/u;
 const DIRECTORY_MODE = 0o700;
 const FILE_MODE = 0o600;
+const IMMUTABLE_FILE_MODE = 0o400;
+const RFC3339_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,9})?(?:Z|[+-](\d{2}):(\d{2}))$/u;
 function assertPositiveInteger(name, value) {
     if (!Number.isSafeInteger(value) || value <= 0) {
         throw new RunStoreError("invalid_options", `${name} must be a positive safe integer`);
@@ -60,9 +68,6 @@ function isErrno(error, code) {
         "code" in error &&
         error.code === code);
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function stableJson(value) {
     if (Array.isArray(value)) {
         return `[${value.map(stableJson).join(",")}]`;
@@ -78,11 +83,104 @@ function stableJson(value) {
 function recordsEqual(left, right) {
     return stableJson(left) === stableJson(right);
 }
+function legacyEvent(snapshot, offset, input) {
+    return {
+        ...input,
+        event_id: randomUUID(),
+        sequence: snapshot.events.length + offset + 1,
+    };
+}
 function assertString(value, label) {
     if (typeof value !== "string" || value.length === 0) {
         throw new RunStoreError("invalid_record", `${label} must be a non-empty string`);
     }
 }
+function assertCanonicalIdentifier(value, label) {
+    assertString(value, label);
+    if (value.trim() !== value || /[\u0000-\u001f\u007f]/u.test(value)) {
+        throw new RunStoreError("invalid_record", `${label} must be a printable identifier without surrounding whitespace`);
+    }
+}
+function assertCanonicalAbsolutePath(value, label) {
+    assertString(value, label);
+    if (!isAbsolute(value) || normalize(value) !== value || value.includes("\0")) {
+        throw new RunStoreError("invalid_record", `${label} must be a normalized absolute path`);
+    }
+}
+function isContainedPath(root, candidate) {
+    const child = relative(root, candidate);
+    return child === "" || (child !== ".."
+        && !child.startsWith(`..${sep}`)
+        && !isAbsolute(child));
+}
+function isValidGitBranchName(value) {
+    const segments = value.split("/");
+    return value !== "@"
+        && !value.startsWith("/")
+        && !value.endsWith("/")
+        && !value.endsWith(".")
+        && !value.includes("..")
+        && !value.includes("//")
+        && !value.includes("@{")
+        && !/[\u0000-\u0020\u007f~^:?*\\\[]/u.test(value)
+        && segments.every((segment) => (segment.length > 0
+            && !segment.startsWith(".")
+            && !segment.endsWith(".lock")));
+}
+function assertTimestamp(value, label) {
+    assertString(value, label);
+    const match = value.match(RFC3339_PATTERN);
+    const timestamp = Date.parse(value);
+    if (!match || !Number.isFinite(timestamp)) {
+        throw new RunStoreError("invalid_record", `${label} must be a valid RFC3339 timestamp`);
+    }
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText,] = match;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const hour = Number(hourText);
+    const minute = Number(minuteText);
+    const second = Number(secondText);
+    const offsetHour = Number(offsetHourText ?? 0);
+    const offsetMinute = Number(offsetMinuteText ?? 0);
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const monthDays = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    if (month < 1
+        || month > 12
+        || day < 1
+        || day > monthDays[month - 1]
+        || hour > 23
+        || minute > 59
+        || second > 59
+        || offsetHour > 23
+        || offsetMinute > 59) {
+        throw new RunStoreError("invalid_record", `${label} must be a valid RFC3339 timestamp`);
+    }
+    return timestamp;
+}
+function assertNullableString(value, label) {
+    if (value !== null && typeof value !== "string") {
+        throw new RunStoreError("invalid_record", `${label} must be a string or null`);
+    }
+}
+function assertBoolean(value, label) {
+    if (typeof value !== "boolean") {
+        throw new RunStoreError("invalid_record", `${label} must be a boolean`);
+    }
+}
+function assertExactFields(value, label, fields) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new RunStoreError("invalid_record", `${label} must be an object`);
+    }
+    const unknown = Object.keys(value).filter((key) => !fields.includes(key));
+    if (unknown.length > 0) {
+        throw new RunStoreError("invalid_record", `${label} contains unknown field ${unknown[0]}`);
+    }
+    const missing = fields.filter((field) => !Object.prototype.hasOwnProperty.call(value, field));
+    if (missing.length > 0) {
+        throw new RunStoreError("invalid_record", `${label} is missing required field ${missing[0]}`);
+    }
+}
 function assertRunRecord(record, expectedRunId) {
     assertString(record.run_id, "run.run_id");
     assertString(record.workflow_id, "run.workflow_id");
@@ -108,17 +206,193 @@ function assertRunRecord(record, expectedRunId) {
         throw new RunStoreError("invalid_record", "run status and terminal status must agree");
     }
 }
+function assertDigest(value, label) {
+    if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
+        throw new RunStoreError("invalid_record", `${label} must be a lowercase sha256 digest`);
+    }
+}
+function assertWorkspacePhysicalIdentity(value, label, attemptId, allocation) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new RunStoreError("invalid_record", `${label} must be an object`);
+    }
+    const record = value;
+    const allocationFields = allocation
+        ? ["workspace_plan_id", "observed_head", "observed_branch_ref"]
+        : [];
+    const common = ["kind", "workspace_id", "working_directory", "authority_key"];
+    if (record.kind === "none") {
+        assertExactFields(record, label, [...common, ...allocationFields]);
+    }
+    else if (record.kind === "worktree") {
+        assertExactFields(record, label, [
+            ...common,
+            "repository_root", "worktree_root", "branch_name", "base_ref",
+            "base_commit", "ownership_key", ...allocationFields,
+        ]);
+    }
+    else {
+        throw new RunStoreError("invalid_record", `${label}.kind must be none or worktree`);
+    }
+    assertCanonicalIdentifier(record.workspace_id, `${label}.workspace_id`);
+    assertCanonicalIdentifier(record.authority_key, `${label}.authority_key`);
+    assertCanonicalAbsolutePath(record.working_directory, `${label}.working_directory`);
+    if (record.workspace_id !== attemptId) {
+        throw new RunStoreError("identity_conflict", `${label}.workspace_id must match the event attempt`);
+    }
+    if (allocation) {
+        assertDigest(record.workspace_plan_id, `${label}.workspace_plan_id`);
+        if (record.kind === "none") {
+            const head = record.observed_head;
+            const branch = record.observed_branch_ref;
+            if ((head === null && branch !== null)
+                || (head !== null && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head))
+                || (branch !== null && (typeof branch !== "string"
+                    || !branch.startsWith("refs/heads/")
+                    || !isValidGitBranchName(branch.slice("refs/heads/".length))))) {
+                throw new RunStoreError("invalid_record", `${label} shared workspace Git observation is invalid`);
+            }
+        }
+    }
+    if (record.kind === "worktree") {
+        assertCanonicalAbsolutePath(record.repository_root, `${label}.repository_root`);
+        assertCanonicalAbsolutePath(record.worktree_root, `${label}.worktree_root`);
+        for (const field of ["branch_name", "base_ref", "ownership_key"]) {
+            assertCanonicalIdentifier(record[field], `${label}.${field}`);
+        }
+        assertCanonicalIdentifier(record.base_commit, `${label}.base_commit`);
+        const baseCommit = record.base_commit;
+        const branchName = record.branch_name;
+        if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(baseCommit)
+            || !isContainedPath(record.worktree_root, record.working_directory)
+            || !isValidGitBranchName(branchName)) {
+            throw new RunStoreError("invalid_record", `${label} contains invalid worktree identity or paths`);
+        }
+        if (allocation && (record.observed_head !== baseCommit
+            || record.observed_branch_ref !== `refs/heads/${branchName}`)) {
+            throw new RunStoreError("invalid_record", `${label} observation does not match its planned base and branch`);
+        }
+    }
+    return record;
+}
+function assertCanonicalRunRecord(record, expectedRunId) {
+    assertExactFields(record, "run", [
+        "run_id",
+        "target",
+        "plan_id",
+        "plan_digest",
+        "run_binding",
+        "status",
+        "cancellation",
+        "terminal",
+        "metadata",
+        "created_at",
+        "updated_at",
+    ]);
+    assertString(record.run_id, "run.run_id");
+    if (expectedRunId !== undefined && record.run_id !== expectedRunId) {
+        throw new RunStoreError("identity_conflict", `run record ${record.run_id} does not match ${expectedRunId}`);
+    }
+    if (!record.target
+        || !["workflow", "controller"].includes(record.target.kind)) {
+        throw new RunStoreError("invalid_record", "run.target.kind must be workflow or controller");
+    }
+    assertExactFields(record.target, "run.target", ["kind", "key"]);
+    assertString(record.target.key, "run.target.key");
+    assertDigest(record.plan_id, "run.plan_id");
+    assertDigest(record.plan_digest, "run.plan_digest");
+    if (record.plan_id !== record.plan_digest) {
+        throw new RunStoreError("identity_conflict", "run.plan_id and run.plan_digest must match");
+    }
+    let binding;
+    try {
+        binding = parseStoredRunBinding(record.run_binding);
+    }
+    catch (error) {
+        throw new RunStoreError("invalid_record", "run.run_binding must be a valid stored binding", { cause: error });
+    }
+    if (binding.binding.plan_id !== record.plan_id) {
+        throw new RunStoreError("identity_conflict", "run binding must reference run.plan_id");
+    }
+    const createdAt = assertTimestamp(record.created_at, "run.created_at");
+    const updatedAt = assertTimestamp(record.updated_at, "run.updated_at");
+    if (updatedAt < createdAt) {
+        throw new RunStoreError("invalid_record", "run.updated_at cannot precede run.created_at");
+    }
+    if (!RUN_STATUS_VALUES.includes(record.status)) {
+        throw new RunStoreError("invalid_record", `unsupported run status: ${String(record.status)}`);
+    }
+    if (record.status === "active" && record.terminal !== null) {
+        throw new RunStoreError("invalid_record", "an active run cannot contain a terminal record");
+    }
+    if (record.status === "active" && record.cancellation !== null) {
+        throw new RunStoreError("invalid_record", "an active canonical run cannot contain cancellation intent");
+    }
+    if (["cancelling", "cancelled"].includes(record.status)
+        && record.cancellation === null) {
+        throw new RunStoreError("invalid_record", `canonical run status ${record.status} requires cancellation intent`);
+    }
+    if (["succeeded", "failed"].includes(record.status)
+        && record.cancellation !== null) {
+        throw new RunStoreError("invalid_record", `canonical run status ${record.status} cannot retain cancellation intent`);
+    }
+    if (["succeeded", "failed", "cancelled"].includes(record.status)
+        && record.terminal === null) {
+        throw new RunStoreError("invalid_record", `terminal run status ${record.status} requires a terminal record`);
+    }
+    if (record.terminal !== null
+        && (record.status !== record.terminal.status
+            || !["succeeded", "failed", "cancelled"].includes(record.status))) {
+        throw new RunStoreError("invalid_record", "run status and terminal status must agree");
+    }
+    if (record.cancellation !== null) {
+        assertExactFields(record.cancellation, "run.cancellation", [
+            "requested_at",
+            "reason",
+        ]);
+        const requestedAt = assertTimestamp(record.cancellation.requested_at, "run.cancellation.requested_at");
+        if (requestedAt < createdAt || updatedAt < requestedAt) {
+            throw new RunStoreError("invalid_record", "run cancellation timestamps are inconsistent");
+        }
+        if (record.cancellation.reason !== null
+            && typeof record.cancellation.reason !== "string") {
+            throw new RunStoreError("invalid_record", "run.cancellation.reason must be a string or null");
+        }
+    }
+    if (record.terminal !== null) {
+        assertExactFields(record.terminal, "run.terminal", [
+            "status",
+            "reason_code",
+            "reason",
+            "completed_at",
+        ]);
+        assertString(record.terminal.reason_code, "run.terminal.reason_code");
+        const completedAt = assertTimestamp(record.terminal.completed_at, "run.terminal.completed_at");
+        if (completedAt < createdAt || updatedAt < completedAt) {
+            throw new RunStoreError("invalid_record", "run terminal timestamps are inconsistent");
+        }
+        if (record.terminal.reason !== null
+            && typeof record.terminal.reason !== "string") {
+            throw new RunStoreError("invalid_record", "run.terminal.reason must be a string or null");
+        }
+    }
+    try {
+        canonicalizeJson(record.metadata);
+    }
+    catch (error) {
+        throw new RunStoreError("invalid_record", "run.metadata must be canonical JSON", { cause: error });
+    }
+}
 function assertCorrelatedRunId(actual, expected, label) {
     if (actual !== expected) {
         throw new RunStoreError("identity_conflict", `${label} belongs to run ${actual}, expected ${expected}`);
     }
 }
-function assertSnapshot(value, expectedRunId) {
+function assertLegacySnapshot(value, expectedRunId) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new RunStoreError("invalid_record", "run ledger must be a JSON object");
     }
     const candidate = value;
-    if (candidate.schema_version !== RUN_STORE_SCHEMA_VERSION) {
+    if (candidate.schema_version !== LEGACY_RUN_STORE_SCHEMA_VERSION) {
         throw new RunStoreError("unsupported_schema", `unsupported run-store schema version: ${String(candidate.schema_version)}`);
     }
     if (!Number.isSafeInteger(candidate.record_version) ||
@@ -234,6 +508,1277 @@ function validateCollections(snapshot) {
         }
     }
 }
+function assertNonNegativeSafeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new RunStoreError("invalid_record", `${label} must be a non-negative safe integer`);
+    }
+}
+function assertPositiveSafeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new RunStoreError("invalid_record", `${label} must be a positive safe integer`);
+    }
+}
+function assertAttemptExecutor(value, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new RunStoreError("invalid_record", `${label} must be an object`);
+    }
+    const executor = value;
+    if (executor.kind === "worker") {
+        assertExactFields(executor, label, ["kind", "worker_session_id"]);
+        assertString(executor.worker_session_id, `${label}.worker_session_id`);
+        return;
+    }
+    if (executor.kind === "system") {
+        assertExactFields(executor, label, [
+            "kind",
+            "service_instance_id",
+            "operation",
+        ]);
+        assertString(executor.service_instance_id, `${label}.service_instance_id`);
+        assertString(executor.operation, `${label}.operation`);
+        return;
+    }
+    if (executor.kind === "human") {
+        assertExactFields(executor, label, [
+            "kind",
+            "principal_ref",
+            "attestation_ref",
+        ]);
+        assertString(executor.principal_ref, `${label}.principal_ref`);
+        assertString(executor.attestation_ref, `${label}.attestation_ref`);
+        return;
+    }
+    throw new RunStoreError("invalid_record", `${label}.kind must be worker, system, or human`);
+}
+function assertRunScopedCanonicalEvent(event) {
+    if (event.step_id !== null
+        || event.activation_id !== null
+        || event.attempt_id !== null
+        || event.result_id !== null) {
+        throw new RunStoreError("invalid_record", `event ${event.event_id} must be run-scoped`);
+    }
+}
+function requireEventAttempt(event, attempts) {
+    if (event.attempt_id === null) {
+        throw new RunStoreError("invalid_record", `event ${event.event_id} requires attempt identity`);
+    }
+    const attempt = attempts.get(event.attempt_id);
+    if (!attempt || attempt.activation_id !== event.activation_id) {
+        throw new RunStoreError("invalid_record", `event ${event.event_id} does not resolve its attempt`);
+    }
+    return attempt;
+}
+function requireAttemptScopedCanonicalEvent(event, attempts) {
+    const attempt = requireEventAttempt(event, attempts);
+    if (event.result_id !== null) {
+        throw new RunStoreError("invalid_record", `event ${event.event_id} must not claim result identity`);
+    }
+    return attempt;
+}
+function assertActivationScopedCanonicalEvent(event) {
+    if (event.activation_id === null
+        || event.attempt_id !== null
+        || event.result_id !== null) {
+        throw new RunStoreError("invalid_record", `event ${event.event_id} must be activation-scoped`);
+    }
+}
+function requirePayloadResult(resultId, label, resultRefs) {
+    assertString(resultId, label);
+    const reference = resultRefs.get(resultId);
+    if (!reference) {
+        throw new RunStoreError("invalid_record", `${label} does not resolve a canonical result`);
+    }
+    return reference;
+}
+function assertCanonicalEventPayload(event, snapshot, activations, attempts, resultRefs) {
+    assertExactFields(event.payload, `event ${event.event_id}.payload`, (() => {
+        switch (event.type) {
+            case "run_created": return ["plan_id", "run_binding_id"];
+            case "run_cancel_requested": return ["reason"];
+            case "run_closed": return ["reason_code", "reason"];
+            case "run_terminal": return ["status", "reason_code", "reason"];
+            case "activation_state_changed": return ["from", "to", "reason_code"];
+            case "attempt_claimed": return [
+                "claim_epoch",
+                "owner_id",
+                "claim_expires_at",
+                "execution_deadline_at",
+            ];
+            case "attempt_attached": return ["claim_epoch", "executor"];
+            case "workspace_planned": return ["workspace_plan_id", "plan"];
+            case "workspace_allocated": return ["workspace_plan_id", "allocation"];
+            case "attempt_heartbeat": return [
+                "claim_epoch",
+                "heartbeat_at",
+                "claim_expires_at",
+            ];
+            case "attempt_released": return ["claim_epoch", "owner_id", "reason_code"];
+            case "attempt_started": return ["executor"];
+            case "attempt_stop_requested": return ["intent"];
+            case "attempt_terminal": return "worker_already_stopped_evidence" in event.payload
+                ? ["executor", "outcome", "worker_stop_receipt", "worker_nonlaunch_attestation", "worker_already_stopped_evidence"]
+                : "worker_nonlaunch_attestation" in event.payload
+                    ? ["executor", "outcome", "worker_stop_receipt", "worker_nonlaunch_attestation"]
+                    : ["executor", "outcome", "worker_stop_receipt"];
+            case "handoff_resolved": return ["binding_id", "source_result_id", "output_name"];
+            case "artifact_captured": return ["capture"];
+            case "result_committed": return [
+                "result_digest",
+                "submission_key_digest",
+                "submission_digest",
+                "worker_stop_receipt_digest",
+                "workspace_allocation_digest",
+                "mutation_authority_instance_id",
+                "mutation_fencing_epoch",
+                "finalization_purpose",
+            ];
+            case "gate_evaluated": return [
+                "gate_id",
+                "predicate",
+                "source_result_id",
+                "passed",
+                "reason_code",
+            ];
+            case "decision_evaluated": return [
+                "decision_id",
+                "value",
+                "source_result_id",
+                "reason_code",
+            ];
+            case "route_selected": return [
+                "route_id",
+                "source_activation_id",
+                "source_result_id",
+                "successor_activation_ids",
+                "reason_code",
+            ];
+            case "retry_segment_scheduled": return [
+                "retry_segment_id",
+                "from_round",
+                "to_round",
+                "prior_activation_ids",
+                "replacement_activation_ids",
+                "retry_from_activation_id",
+                "triggering_result_id",
+                "delay_ms",
+                "ready_at",
+                "reason_code",
+            ];
+            case "retry_scheduled": return [
+                "prior_attempt_id",
+                "replacement_attempt_id",
+                "next_attempt_number",
+                "delay_ms",
+                "reason_code",
+            ];
+            case "interaction_requested": return [
+                "interaction_id",
+                "expected_principal_ref",
+            ];
+            case "interaction_submitted": return [
+                "interaction_id",
+                "principal_ref",
+                "attestation_ref",
+            ];
+        }
+    })());
+    const payload = event.payload;
+    switch (event.type) {
+        case "run_created": {
+            assertRunScopedCanonicalEvent(event);
+            assertDigest(payload.plan_id, `event ${event.event_id}.payload.plan_id`);
+            assertString(payload.run_binding_id, `event ${event.event_id}.payload.run_binding_id`);
+            if (payload.plan_id !== snapshot.run.plan_id
+                || payload.run_binding_id !== snapshot.run.run_binding.binding_id) {
+                throw new RunStoreError("identity_conflict", `run_created event ${event.event_id} does not match the run binding`);
+            }
+            break;
+        }
+        case "run_cancel_requested": {
+            assertRunScopedCanonicalEvent(event);
+            assertNullableString(payload.reason, `event ${event.event_id}.payload.reason`);
+            if (snapshot.run.cancellation === null
+                || snapshot.run.cancellation.reason !== payload.reason) {
+                throw new RunStoreError("invalid_record", `run_cancel_requested event ${event.event_id} does not match cancellation intent`);
+            }
+            break;
+        }
+        case "run_closed": {
+            assertRunScopedCanonicalEvent(event);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            assertNullableString(payload.reason, `event ${event.event_id}.payload.reason`);
+            break;
+        }
+        case "run_terminal": {
+            assertRunScopedCanonicalEvent(event);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            assertNullableString(payload.reason, `event ${event.event_id}.payload.reason`);
+            if (!["succeeded", "failed", "cancelled"].includes(payload.status)
+                || snapshot.run.terminal === null
+                || snapshot.run.terminal.status !== payload.status
+                || snapshot.run.terminal.reason_code !== payload.reason_code
+                || snapshot.run.terminal.reason !== payload.reason) {
+                throw new RunStoreError("invalid_record", `run_terminal event ${event.event_id} does not match terminal run state`);
+            }
+            break;
+        }
+        case "activation_state_changed": {
+            assertActivationScopedCanonicalEvent(event);
+            if (!activations.has(event.activation_id)) {
+                throw new RunStoreError("invalid_record", `activation event ${event.event_id} requires activation identity`);
+            }
+            if (!CANONICAL_ACTIVATION_STATE_VALUES.includes(payload.from)
+                || !CANONICAL_ACTIVATION_STATE_VALUES.includes(payload.to)) {
+                throw new RunStoreError("invalid_record", `activation event ${event.event_id} has invalid states`);
+            }
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            if (payload.from === payload.to
+                || !CANONICAL_ACTIVATION_STATE_TRANSITIONS[payload.from]
+                    .includes(payload.to)) {
+                throw new RunStoreError("invalid_record", `activation event ${event.event_id} has an invalid transition`);
+            }
+            break;
+        }
+        case "attempt_claimed": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertPositiveSafeInteger(payload.claim_epoch, `event ${event.event_id}.payload.claim_epoch`);
+            assertString(payload.owner_id, `event ${event.event_id}.payload.owner_id`);
+            const expiresAt = assertTimestamp(payload.claim_expires_at, `event ${event.event_id}.payload.claim_expires_at`);
+            const deadlineAt = assertTimestamp(payload.execution_deadline_at, `event ${event.event_id}.payload.execution_deadline_at`);
+            const claim = snapshot.claims.find((candidate) => (candidate.attempt_id === attempt.attempt_id
+                && candidate.claim_epoch === payload.claim_epoch));
+            if (!claim
+                || claim.owner_id !== payload.owner_id
+                || claim.execution_deadline_at !== payload.execution_deadline_at
+                || expiresAt > Date.parse(claim.driver_claim_lease.expires_at)
+                || expiresAt > deadlineAt) {
+                throw new RunStoreError("invalid_record", `attempt_claimed event ${event.event_id} does not match a durable claim`);
+            }
+            break;
+        }
+        case "attempt_attached": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertPositiveSafeInteger(payload.claim_epoch, `event ${event.event_id}.payload.claim_epoch`);
+            assertAttemptExecutor(payload.executor, `event ${event.event_id}.payload.executor`);
+            if (attempt.executor === null
+                || !recordsEqual(attempt.executor, payload.executor)
+                || !snapshot.claims.some((claim) => (claim.attempt_id === attempt.attempt_id
+                    && claim.claim_epoch === payload.claim_epoch))) {
+                throw new RunStoreError("invalid_record", `attempt_attached event ${event.event_id} does not match its attempt`);
+            }
+            break;
+        }
+        case "workspace_planned": {
+            requireAttemptScopedCanonicalEvent(event, attempts);
+            if (event.result_id !== null) {
+                throw new RunStoreError("identity_conflict", `workspace_planned event ${event.event_id} must not carry result identity`);
+            }
+            assertDigest(payload.workspace_plan_id, `event ${event.event_id}.payload.workspace_plan_id`);
+            const plan = payload.plan;
+            assertExactFields(plan, `event ${event.event_id}.payload.plan`, ["workspace_plan_id", "payload"]);
+            if (plan.workspace_plan_id !== payload.workspace_plan_id) {
+                throw new RunStoreError("identity_conflict", `workspace_planned event ${event.event_id} has inconsistent plan identity`);
+            }
+            assertWorkspacePhysicalIdentity(plan.payload, `event ${event.event_id}.payload.plan.payload`, event.attempt_id, false);
+            const actualPlanId = `sha256:${createHash("sha256").update(canonicalizeJson(plan.payload)).digest("hex")}`;
+            if (actualPlanId !== payload.workspace_plan_id) {
+                throw new RunStoreError("identity_conflict", `workspace_planned event ${event.event_id} plan digest does not match its payload`);
+            }
+            break;
+        }
+        case "workspace_allocated": {
+            requireAttemptScopedCanonicalEvent(event, attempts);
+            if (event.result_id !== null) {
+                throw new RunStoreError("identity_conflict", `workspace_allocated event ${event.event_id} must not carry result identity`);
+            }
+            assertDigest(payload.workspace_plan_id, `event ${event.event_id}.payload.workspace_plan_id`);
+            const record = assertWorkspacePhysicalIdentity(payload.allocation, `event ${event.event_id}.payload.allocation`, event.attempt_id, true);
+            if (record.workspace_plan_id !== payload.workspace_plan_id) {
+                throw new RunStoreError("identity_conflict", `workspace_allocated event ${event.event_id} has inconsistent plan identity`);
+            }
+            break;
+        }
+        case "attempt_heartbeat": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertPositiveSafeInteger(payload.claim_epoch, `event ${event.event_id}.payload.claim_epoch`);
+            const heartbeatAt = assertTimestamp(payload.heartbeat_at, `event ${event.event_id}.payload.heartbeat_at`);
+            const expiresAt = assertTimestamp(payload.claim_expires_at, `event ${event.event_id}.payload.claim_expires_at`);
+            const claim = snapshot.claims.find((candidate) => (candidate.attempt_id === attempt.attempt_id
+                && candidate.claim_epoch === payload.claim_epoch));
+            if (!claim
+                || heartbeatAt > Date.parse(claim.driver_claim_lease.heartbeat_at)
+                || expiresAt > Date.parse(claim.driver_claim_lease.expires_at)
+                || heartbeatAt > expiresAt) {
+                throw new RunStoreError("invalid_record", `attempt_heartbeat event ${event.event_id} exceeds its durable lease`);
+            }
+            break;
+        }
+        case "attempt_released": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertPositiveSafeInteger(payload.claim_epoch, `event ${event.event_id}.payload.claim_epoch`);
+            assertString(payload.owner_id, `event ${event.event_id}.payload.owner_id`);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            if (!snapshot.claims.some((claim) => (claim.attempt_id === attempt.attempt_id
+                && claim.claim_epoch === payload.claim_epoch
+                && claim.owner_id === payload.owner_id))) {
+                throw new RunStoreError("invalid_record", `attempt_released event ${event.event_id} does not match a durable claim`);
+            }
+            break;
+        }
+        case "attempt_started": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertAttemptExecutor(payload.executor, `event ${event.event_id}.payload.executor`);
+            if (attempt.executor === null || !recordsEqual(attempt.executor, payload.executor)) {
+                throw new RunStoreError("invalid_record", `attempt_started event ${event.event_id} does not match its executor`);
+            }
+            break;
+        }
+        case "attempt_stop_requested": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            const intent = payload.intent;
+            assertExactFields(intent, `event ${event.event_id}.payload.intent`, [
+                "schema_version", "run_id", "step_id", "activation_id", "attempt_id",
+                "claim_epoch", "worker_session_id", "stop_idempotency_key", "purpose",
+                "requested_at", "started_at", "requested_outcome",
+            ]);
+            if (intent.schema_version !== "intentdna.attempt_stop_intent.v1"
+                || intent.run_id !== attempt.run_id
+                || intent.step_id !== attempt.step_id
+                || intent.activation_id !== attempt.activation_id
+                || intent.attempt_id !== attempt.attempt_id
+                || attempt.executor?.kind !== "worker"
+                || intent.worker_session_id !== attempt.executor.worker_session_id
+                || intent.started_at !== attempt.started_at
+                || typeof intent.purpose !== "string"
+                || !["cancel", "execution_deadline", "peer_terminal"].includes(intent.purpose)) {
+                throw new RunStoreError("invalid_record", `attempt stop intent ${event.event_id} does not match its worker attempt`);
+            }
+            assertPositiveSafeInteger(intent.claim_epoch, `event ${event.event_id}.payload.intent.claim_epoch`);
+            assertDigest(intent.stop_idempotency_key, `event ${event.event_id}.payload.intent.stop_idempotency_key`);
+            const expectedStopKey = `sha256:${createHash("sha256").update(canonicalizeJson({
+                run_id: attempt.run_id,
+                step_id: attempt.step_id,
+                activation_id: attempt.activation_id,
+                attempt_id: attempt.attempt_id,
+                claim_epoch: intent.claim_epoch,
+                worker_session_id: intent.worker_session_id,
+            })).digest("hex")}`;
+            if (intent.stop_idempotency_key !== expectedStopKey) {
+                throw new RunStoreError("identity_conflict", `attempt stop intent ${event.event_id} has an invalid execution identity digest`);
+            }
+            assertTimestamp(intent.requested_at, `event ${event.event_id}.payload.intent.requested_at`);
+            try {
+                validateCanonicalAttemptOutcome(attempt.executor, intent.requested_outcome);
+            }
+            catch (error) {
+                throw new RunStoreError("invalid_record", `attempt stop intent ${event.event_id} has invalid outcome`, { cause: error });
+            }
+            if (!snapshot.claims.some((claim) => claim.attempt_id === attempt.attempt_id && claim.claim_epoch === intent.claim_epoch)) {
+                throw new RunStoreError("invalid_record", `attempt stop intent ${event.event_id} does not match a durable claim`);
+            }
+            const duplicate = snapshot.events.filter((candidate) => candidate.type === "attempt_stop_requested" && candidate.attempt_id === attempt.attempt_id);
+            if (duplicate.length !== 1 || duplicate[0]?.event_id !== event.event_id) {
+                throw new RunStoreError("immutable_record", `attempt ${attempt.attempt_id} can have only one durable stop intent`);
+            }
+            break;
+        }
+        case "attempt_terminal": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            try {
+                validateCanonicalAttemptOutcome(payload.executor, payload.outcome);
+            }
+            catch (error) {
+                throw new RunStoreError("invalid_record", `attempt_terminal event ${event.event_id} has invalid outcome`, { cause: error });
+            }
+            if (attempt.phase !== "terminal"
+                || attempt.executor === null
+                || !recordsEqual(attempt.executor, payload.executor)
+                || !recordsEqual(attempt.terminal_outcome, payload.outcome)) {
+                throw new RunStoreError("invalid_record", `attempt_terminal event ${event.event_id} does not match terminal attempt state`);
+            }
+            if (attempt.executor.kind === "worker") {
+                const receipt = payload.worker_stop_receipt;
+                const nonlaunch = payload.worker_nonlaunch_attestation ?? null;
+                const alreadyStopped = payload.worker_already_stopped_evidence ?? null;
+                if ([receipt, nonlaunch, alreadyStopped].filter((item) => item !== null).length !== 1) {
+                    throw new RunStoreError("invalid_record", `worker attempt_terminal event ${event.event_id} requires exactly one execution authority evidence`);
+                }
+                if (alreadyStopped !== null) {
+                    assertExactFields(alreadyStopped, `event ${event.event_id}.payload.worker_already_stopped_evidence`, [
+                        "evidence_digest", "payload",
+                    ]);
+                    assertDigest(alreadyStopped.evidence_digest, `event ${event.event_id}.payload.worker_already_stopped_evidence.evidence_digest`);
+                    const fact = alreadyStopped.payload;
+                    assertExactFields(fact, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload`, [
+                        "schema_version", "run_id", "step_id", "activation_id", "attempt_id",
+                        "claim_epoch", "worker_session_id", "execution_instance_id", "authority_kind",
+                        "authority_instance_id", "fencing_epoch", "started_at", "completed_at",
+                        "observed_outcome", "process_tree_drained", "stop_idempotency_key",
+                        "stop_requested_at", "stop_purpose", "stop_requested_outcome", "source_evidence_digest",
+                    ]);
+                    const stopIntent = snapshot.events.find((candidate) => (candidate.type === "attempt_stop_requested" && candidate.attempt_id === attempt.attempt_id));
+                    if (fact.schema_version !== "intentdna.worker_already_stopped_evidence.v1"
+                        || fact.run_id !== attempt.run_id
+                        || fact.step_id !== attempt.step_id
+                        || fact.activation_id !== attempt.activation_id
+                        || fact.attempt_id !== attempt.attempt_id
+                        || fact.worker_session_id !== attempt.executor.worker_session_id
+                        || fact.started_at !== attempt.started_at
+                        || fact.completed_at !== attempt.completed_at
+                        || fact.process_tree_drained !== true
+                        || !["local_process", "host_attested"].includes(fact.authority_kind)
+                        || stopIntent?.type !== "attempt_stop_requested"
+                        || fact.claim_epoch !== stopIntent.payload.intent.claim_epoch
+                        || fact.stop_idempotency_key !== stopIntent.payload.intent.stop_idempotency_key
+                        || fact.stop_requested_at !== stopIntent.payload.intent.requested_at
+                        || fact.stop_purpose !== stopIntent.payload.intent.purpose
+                        || !recordsEqual(fact.stop_requested_outcome, stopIntent.payload.intent.requested_outcome)) {
+                        throw new RunStoreError("invalid_record", `worker already-stopped evidence on event ${event.event_id} does not match its durable stop intent`);
+                    }
+                    assertPositiveSafeInteger(fact.claim_epoch, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.claim_epoch`);
+                    assertPositiveSafeInteger(fact.fencing_epoch, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.fencing_epoch`);
+                    assertTimestamp(fact.completed_at, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.completed_at`);
+                    assertTimestamp(fact.stop_requested_at, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.stop_requested_at`);
+                    assertString(fact.execution_instance_id, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.execution_instance_id`);
+                    assertString(fact.authority_instance_id, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.authority_instance_id`);
+                    assertDigest(fact.stop_idempotency_key, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.stop_idempotency_key`);
+                    assertDigest(fact.source_evidence_digest, `event ${event.event_id}.payload.worker_already_stopped_evidence.payload.source_evidence_digest`);
+                    try {
+                        validateCanonicalAttemptOutcome(attempt.executor, fact.observed_outcome);
+                        validateCanonicalAttemptOutcome(attempt.executor, fact.stop_requested_outcome);
+                    }
+                    catch (error) {
+                        throw new RunStoreError("invalid_record", `worker already-stopped evidence on event ${event.event_id} has invalid observed outcome`, { cause: error });
+                    }
+                    const actual = `sha256:${createHash("sha256").update(canonicalizeJson(fact), "utf8").digest("hex")}`;
+                    if (alreadyStopped.evidence_digest !== actual) {
+                        throw new RunStoreError("invalid_record", `worker already-stopped evidence on event ${event.event_id} has an invalid digest`);
+                    }
+                    break;
+                }
+                if (nonlaunch !== null) {
+                    assertExactFields(nonlaunch, `event ${event.event_id}.payload.worker_nonlaunch_attestation`, [
+                        "attestation_digest", "payload",
+                    ]);
+                    assertDigest(nonlaunch.attestation_digest, `event ${event.event_id}.payload.worker_nonlaunch_attestation.attestation_digest`);
+                    const fact = nonlaunch.payload;
+                    assertExactFields(fact, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload`, [
+                        "schema_version", "run_id", "step_id", "activation_id", "attempt_id",
+                        "claim_epoch", "worker_session_id", "execution_instance_id", "authority_kind",
+                        "authority_instance_id", "fencing_epoch", "started_at", "attested_at",
+                        "failure_idempotency_key", "launch_state", "source_evidence_digest",
+                    ]);
+                    if (fact.schema_version !== "intentdna.worker_nonlaunch_attestation.v1"
+                        || fact.run_id !== attempt.run_id
+                        || fact.step_id !== attempt.step_id
+                        || fact.activation_id !== attempt.activation_id
+                        || fact.attempt_id !== attempt.attempt_id
+                        || fact.worker_session_id !== attempt.executor.worker_session_id
+                        || fact.started_at !== attempt.started_at
+                        || fact.launch_state !== "never_launched"
+                        || fact.authority_kind !== "local_process" && fact.authority_kind !== "host_attested") {
+                        throw new RunStoreError("invalid_record", `worker nonlaunch attestation on event ${event.event_id} does not match its attempt`);
+                    }
+                    assertPositiveSafeInteger(fact.claim_epoch, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.claim_epoch`);
+                    assertPositiveSafeInteger(fact.fencing_epoch, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.fencing_epoch`);
+                    assertTimestamp(fact.attested_at, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.attested_at`);
+                    assertString(fact.execution_instance_id, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.execution_instance_id`);
+                    assertString(fact.authority_instance_id, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.authority_instance_id`);
+                    assertDigest(fact.failure_idempotency_key, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.failure_idempotency_key`);
+                    assertDigest(fact.source_evidence_digest, `event ${event.event_id}.payload.worker_nonlaunch_attestation.payload.source_evidence_digest`);
+                    const actual = `sha256:${createHash("sha256").update(canonicalizeJson(fact), "utf8").digest("hex")}`;
+                    if (nonlaunch.attestation_digest !== actual) {
+                        throw new RunStoreError("invalid_record", `worker nonlaunch attestation on event ${event.event_id} has an invalid digest`);
+                    }
+                    const attached = snapshot.events.find((candidate) => (candidate.type === "attempt_attached"
+                        && candidate.attempt_id === attempt.attempt_id
+                        && candidate.payload.claim_epoch === fact.claim_epoch));
+                    const claim = snapshot.claims.find((candidate) => (candidate.attempt_id === attempt.attempt_id
+                        && candidate.claim_epoch === fact.claim_epoch));
+                    const started = snapshot.events.find((candidate) => (candidate.type === "attempt_started"
+                        && candidate.attempt_id === attempt.attempt_id));
+                    const stopIntent = snapshot.events.find((candidate) => (candidate.type === "attempt_stop_requested"
+                        && candidate.attempt_id === attempt.attempt_id));
+                    if (attached?.type !== "attempt_attached"
+                        || !recordsEqual(attached.payload.executor, attempt.executor)
+                        || claim === undefined
+                        || started?.type !== "attempt_started"
+                        || !recordsEqual(started.payload.executor, attempt.executor)
+                        || started.occurred_at !== fact.started_at) {
+                        throw new RunStoreError("invalid_record", `worker nonlaunch attestation on event ${event.event_id} does not match its durable attach identity`);
+                    }
+                    if (stopIntent?.type === "attempt_stop_requested" && (fact.failure_idempotency_key !== stopIntent.payload.intent.stop_idempotency_key
+                        || fact.claim_epoch !== stopIntent.payload.intent.claim_epoch
+                        || fact.worker_session_id !== stopIntent.payload.intent.worker_session_id
+                        || fact.started_at !== stopIntent.payload.intent.started_at
+                        || Date.parse(String(fact.attested_at))
+                            < Date.parse(String(stopIntent.payload.intent.requested_at)))) {
+                        throw new RunStoreError("invalid_record", `worker nonlaunch attestation on event ${event.event_id} does not confirm its durable stop intent`);
+                    }
+                    break;
+                }
+                if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt)) {
+                    throw new RunStoreError("invalid_record", `worker attempt_terminal event ${event.event_id} lacks stopped-execution evidence`);
+                }
+                assertExactFields(receipt, `event ${event.event_id}.payload.worker_stop_receipt`, [
+                    "receipt_digest",
+                    "payload",
+                ]);
+                assertDigest(receipt.receipt_digest, `event ${event.event_id}.payload.worker_stop_receipt.receipt_digest`);
+                const stop = receipt.payload;
+                assertExactFields(stop, `event ${event.event_id}.payload.worker_stop_receipt.payload`, [
+                    "schema_version", "run_id", "step_id", "activation_id", "attempt_id",
+                    "claim_epoch", "worker_session_id", "execution_instance_id",
+                    "authority_kind", "authority_instance_id", "fencing_epoch", "started_at",
+                    "stopped_at", "terminal_outcome", "process_tree_drained",
+                    "source_evidence_digest",
+                ]);
+                if (stop.schema_version !== "intentdna.worker_stop_receipt.v1"
+                    || stop.run_id !== attempt.run_id
+                    || stop.step_id !== attempt.step_id
+                    || stop.activation_id !== attempt.activation_id
+                    || stop.attempt_id !== attempt.attempt_id
+                    || stop.worker_session_id !== attempt.executor.worker_session_id
+                    || stop.started_at !== attempt.started_at
+                    || stop.stopped_at !== attempt.completed_at
+                    || stop.process_tree_drained !== true
+                    || !recordsEqual(stop.terminal_outcome, attempt.terminal_outcome)) {
+                    throw new RunStoreError("invalid_record", `worker stop receipt on event ${event.event_id} does not match its terminal attempt`);
+                }
+                assertPositiveSafeInteger(stop.claim_epoch, `event ${event.event_id}.payload.worker_stop_receipt.payload.claim_epoch`);
+                assertPositiveSafeInteger(stop.fencing_epoch, `event ${event.event_id}.payload.worker_stop_receipt.payload.fencing_epoch`);
+                assertString(stop.execution_instance_id, `event ${event.event_id}.payload.worker_stop_receipt.payload.execution_instance_id`);
+                assertString(stop.authority_instance_id, `event ${event.event_id}.payload.worker_stop_receipt.payload.authority_instance_id`);
+                if (!["local_process", "host_attested"].includes(stop.authority_kind)) {
+                    throw new RunStoreError("invalid_record", `event ${event.event_id}.payload.worker_stop_receipt.payload.authority_kind is unsupported`);
+                }
+                assertDigest(stop.source_evidence_digest, `event ${event.event_id}.payload.worker_stop_receipt.payload.source_evidence_digest`);
+                const actualReceiptDigest = `sha256:${createHash("sha256")
+                    .update(canonicalizeJson(stop), "utf8")
+                    .digest("hex")}`;
+                if (receipt.receipt_digest !== actualReceiptDigest) {
+                    throw new RunStoreError("invalid_record", `worker stop receipt on event ${event.event_id} has an invalid digest`);
+                }
+                const stopIntent = snapshot.events.find((candidate) => (candidate.type === "attempt_stop_requested" && candidate.attempt_id === attempt.attempt_id));
+                if (stopIntent?.type === "attempt_stop_requested") {
+                    const intent = stopIntent.payload.intent;
+                    if (stop.claim_epoch !== intent.claim_epoch
+                        || stop.worker_session_id !== intent.worker_session_id
+                        || stop.started_at !== intent.started_at
+                        || typeof stop.stopped_at !== "string"
+                        || Date.parse(stop.stopped_at) < Date.parse(intent.requested_at)
+                        || !recordsEqual(stop.terminal_outcome, intent.requested_outcome)) {
+                        throw new RunStoreError("invalid_record", `worker stop receipt on event ${event.event_id} does not confirm its durable stop intent`);
+                    }
+                }
+            }
+            else if (payload.worker_stop_receipt !== null || (payload.worker_nonlaunch_attestation ?? null) !== null || (payload.worker_already_stopped_evidence ?? null) !== null) {
+                throw new RunStoreError("invalid_record", `non-worker attempt_terminal event ${event.event_id} cannot carry worker stop evidence`);
+            }
+            break;
+        }
+        case "handoff_resolved": {
+            requireAttemptScopedCanonicalEvent(event, attempts);
+            assertString(payload.binding_id, `event ${event.event_id}.payload.binding_id`);
+            requirePayloadResult(payload.source_result_id, `event ${event.event_id}.payload.source_result_id`, resultRefs);
+            assertString(payload.output_name, `event ${event.event_id}.payload.output_name`);
+            break;
+        }
+        case "artifact_captured": {
+            requireAttemptScopedCanonicalEvent(event, attempts);
+            assertExactFields(payload.capture, `event ${event.event_id}.payload.capture`, [
+                "capture_id",
+                "artifact_id",
+                "artifact_kind",
+                "run_id",
+                "activation_id",
+                "attempt_id",
+                "output_name",
+                "source_workspace_id",
+                "source_path",
+                "captured_at",
+            ]);
+            const capture = payload.capture;
+            for (const field of [
+                "capture_id",
+                "run_id",
+                "activation_id",
+                "attempt_id",
+                "output_name",
+                "source_workspace_id",
+                "source_path",
+            ]) {
+                assertString(capture[field], `event ${event.event_id}.payload.capture.${field}`);
+            }
+            assertDigest(capture.artifact_id, `event ${event.event_id}.payload.capture.artifact_id`);
+            assertTimestamp(capture.captured_at, `event ${event.event_id}.payload.capture.captured_at`);
+            if (!["file", "directory", "git_commit"].includes(capture.artifact_kind)
+                || capture.run_id !== event.run_id
+                || capture.activation_id !== event.activation_id
+                || capture.attempt_id !== event.attempt_id) {
+                throw new RunStoreError("identity_conflict", `artifact_captured event ${event.event_id} has mismatched capture identity`);
+            }
+            break;
+        }
+        case "result_committed": {
+            const attempt = requireEventAttempt(event, attempts);
+            if (event.result_id === null) {
+                throw new RunStoreError("invalid_record", `result_committed event ${event.event_id} requires result identity`);
+            }
+            assertDigest(payload.result_digest, `event ${event.event_id}.payload.result_digest`);
+            assertDigest(payload.submission_key_digest, `event ${event.event_id}.payload.submission_key_digest`);
+            assertDigest(payload.submission_digest, `event ${event.event_id}.payload.submission_digest`);
+            if (payload.worker_stop_receipt_digest !== null) {
+                assertDigest(payload.worker_stop_receipt_digest, `event ${event.event_id}.payload.worker_stop_receipt_digest`);
+            }
+            if ((attempt.executor?.kind === "worker") !== (payload.worker_stop_receipt_digest !== null)) {
+                throw new RunStoreError("invalid_record", `result_committed event ${event.event_id} has inconsistent worker stop authority`);
+            }
+            const finalizationPurpose = payload.finalization_purpose;
+            if (typeof finalizationPurpose !== "string" || !new Set(["finalize_result", "reconcile_published_result", "system_operation"]).has(finalizationPurpose)) {
+                throw new RunStoreError("invalid_record", `event ${event.event_id}.payload.finalization_purpose is invalid`);
+            }
+            if (finalizationPurpose === "system_operation") {
+                if (attempt.executor?.kind !== "system"
+                    || payload.workspace_allocation_digest !== null
+                    || payload.mutation_authority_instance_id !== null
+                    || payload.mutation_fencing_epoch !== null) {
+                    throw new RunStoreError("invalid_record", `result_committed event ${event.event_id} has invalid system finalization authority`);
+                }
+            }
+            else {
+                assertDigest(payload.workspace_allocation_digest, `event ${event.event_id}.payload.workspace_allocation_digest`);
+                assertCanonicalIdentifier(payload.mutation_authority_instance_id, `event ${event.event_id}.payload.mutation_authority_instance_id`);
+                const mutationFencingEpoch = payload.mutation_fencing_epoch;
+                if (typeof mutationFencingEpoch !== "number" || !Number.isSafeInteger(mutationFencingEpoch) || mutationFencingEpoch <= 0) {
+                    throw new RunStoreError("invalid_record", `event ${event.event_id}.payload.mutation_fencing_epoch must be a positive safe integer`);
+                }
+            }
+            const reference = resultRefs.get(event.result_id);
+            if (!reference
+                || reference.attempt_id !== attempt.attempt_id
+                || reference.step_id !== event.step_id
+                || reference.result_digest !== payload.result_digest) {
+                throw new RunStoreError("invalid_record", `result_committed event ${event.event_id} does not match its result reference`);
+            }
+            break;
+        }
+        case "gate_evaluated":
+        case "decision_evaluated": {
+            if (event.activation_id === null || event.attempt_id !== null) {
+                throw new RunStoreError("invalid_record", `${event.type} event ${event.event_id} requires activation identity`);
+            }
+            const idField = event.type === "gate_evaluated" ? "gate_id" : "decision_id";
+            assertString(payload[idField], `event ${event.event_id}.payload.${idField}`);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            if (payload.source_result_id !== null) {
+                requirePayloadResult(payload.source_result_id, `event ${event.event_id}.payload.source_result_id`, resultRefs);
+            }
+            if (event.result_id !== payload.source_result_id) {
+                throw new RunStoreError("identity_conflict", `${event.type} event ${event.event_id} result identity does not match its source`);
+            }
+            if (event.type === "gate_evaluated") {
+                assertBoolean(payload.passed, `event ${event.event_id}.payload.passed`);
+            }
+            break;
+        }
+        case "route_selected": {
+            if (event.activation_id === null || event.attempt_id !== null) {
+                throw new RunStoreError("invalid_record", `route_selected event ${event.event_id} requires activation identity`);
+            }
+            assertString(payload.route_id, `event ${event.event_id}.payload.route_id`);
+            assertString(payload.source_activation_id, `event ${event.event_id}.payload.source_activation_id`);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            if (payload.source_activation_id !== event.activation_id) {
+                throw new RunStoreError("identity_conflict", `route_selected event ${event.event_id} source activation does not match envelope`);
+            }
+            if (payload.source_result_id !== null) {
+                const source = requirePayloadResult(payload.source_result_id, `event ${event.event_id}.payload.source_result_id`, resultRefs);
+                if (source.activation_id !== event.activation_id) {
+                    throw new RunStoreError("identity_conflict", `route_selected event ${event.event_id} source result does not match activation`);
+                }
+            }
+            if (event.result_id !== payload.source_result_id) {
+                throw new RunStoreError("identity_conflict", `route_selected event ${event.event_id} result identity does not match its source`);
+            }
+            if (!Array.isArray(payload.successor_activation_ids)) {
+                throw new RunStoreError("invalid_record", `event ${event.event_id}.payload.successor_activation_ids must be an array`);
+            }
+            const successors = new Set();
+            for (const successorId of payload.successor_activation_ids) {
+                assertString(successorId, `event ${event.event_id}.payload.successor_activation_ids[]`);
+                if (successorId === event.activation_id
+                    || successors.has(successorId)
+                    || !activations.has(successorId)) {
+                    throw new RunStoreError("identity_conflict", `route_selected event ${event.event_id} has invalid successor ${successorId}`);
+                }
+                successors.add(successorId);
+            }
+            break;
+        }
+        case "retry_segment_scheduled": {
+            if (event.activation_id === null || event.attempt_id !== null) {
+                throw new RunStoreError("invalid_record", `retry_segment_scheduled event ${event.event_id} requires activation identity`);
+            }
+            const label = `event ${event.event_id}.payload`;
+            assertCanonicalIdentifier(payload.retry_segment_id, `${label}.retry_segment_id`);
+            assertPositiveSafeInteger(payload.from_round, `${label}.from_round`);
+            assertPositiveSafeInteger(payload.to_round, `${label}.to_round`);
+            assertNonNegativeSafeInteger(payload.delay_ms, `${label}.delay_ms`);
+            const readyAt = assertTimestamp(payload.ready_at, `${label}.ready_at`);
+            assertString(payload.reason_code, `${label}.reason_code`);
+            assertCanonicalIdentifier(payload.retry_from_activation_id, `${label}.retry_from_activation_id`);
+            if (payload.to_round !== payload.from_round + 1
+                || readyAt !== Date.parse(event.occurred_at) + payload.delay_ms) {
+                throw new RunStoreError("invalid_record", `retry_segment_scheduled event ${event.event_id} has invalid round or delay timing`);
+            }
+            if (!Array.isArray(payload.prior_activation_ids)
+                || !Array.isArray(payload.replacement_activation_ids)
+                || payload.prior_activation_ids.length === 0
+                || payload.prior_activation_ids.length !== payload.replacement_activation_ids.length) {
+                throw new RunStoreError("invalid_record", `retry_segment_scheduled event ${event.event_id} requires paired activation arrays`);
+            }
+            const priorIds = new Set();
+            const replacementIds = new Set();
+            for (let index = 0; index < payload.prior_activation_ids.length; index += 1) {
+                const priorId = payload.prior_activation_ids[index];
+                const replacementId = payload.replacement_activation_ids[index];
+                assertCanonicalIdentifier(priorId, `${label}.prior_activation_ids[${index}]`);
+                assertCanonicalIdentifier(replacementId, `${label}.replacement_activation_ids[${index}]`);
+                const prior = activations.get(priorId);
+                const replacement = activations.get(replacementId);
+                if (priorIds.has(priorId)
+                    || replacementIds.has(replacementId)
+                    || priorId === replacementId
+                    || !prior
+                    || !replacement
+                    || !["succeeded", "failed", "skipped", "cancelled"].includes(prior.state)
+                    || prior.step_id !== replacement.step_id
+                    || prior.workflow_round !== payload.from_round
+                    || replacement.workflow_round !== payload.to_round) {
+                    throw new RunStoreError("identity_conflict", `retry_segment_scheduled event ${event.event_id} has invalid activation pair`);
+                }
+                priorIds.add(priorId);
+                replacementIds.add(replacementId);
+            }
+            if (!priorIds.has(event.activation_id)
+                || !replacementIds.has(payload.retry_from_activation_id)) {
+                throw new RunStoreError("identity_conflict", `retry_segment_scheduled event ${event.event_id} trigger or retry-from replacement is invalid`);
+            }
+            if (payload.triggering_result_id !== null) {
+                const triggeringResult = requirePayloadResult(payload.triggering_result_id, `${label}.triggering_result_id`, resultRefs);
+                if (triggeringResult.activation_id !== event.activation_id) {
+                    throw new RunStoreError("identity_conflict", `retry_segment_scheduled event ${event.event_id} triggering result does not match retry source`);
+                }
+            }
+            if (event.result_id !== payload.triggering_result_id) {
+                throw new RunStoreError("identity_conflict", `retry_segment_scheduled event ${event.event_id} result identity does not match trigger`);
+            }
+            break;
+        }
+        case "retry_scheduled": {
+            const envelopeAttempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertString(payload.prior_attempt_id, `event ${event.event_id}.payload.prior_attempt_id`);
+            assertString(payload.replacement_attempt_id, `event ${event.event_id}.payload.replacement_attempt_id`);
+            assertPositiveSafeInteger(payload.next_attempt_number, `event ${event.event_id}.payload.next_attempt_number`);
+            assertNonNegativeSafeInteger(payload.delay_ms, `event ${event.event_id}.payload.delay_ms`);
+            assertString(payload.reason_code, `event ${event.event_id}.payload.reason_code`);
+            const prior = attempts.get(payload.prior_attempt_id);
+            const replacement = attempts.get(payload.replacement_attempt_id);
+            if (!prior
+                || !replacement
+                || envelopeAttempt.attempt_id !== prior.attempt_id
+                || prior.activation_id !== replacement.activation_id
+                || replacement.attempt_number !== prior.attempt_number + 1
+                || replacement.attempt_number !== payload.next_attempt_number) {
+                throw new RunStoreError("identity_conflict", `retry_scheduled event ${event.event_id} does not match attempt history`);
+            }
+            break;
+        }
+        case "interaction_requested": {
+            requireAttemptScopedCanonicalEvent(event, attempts);
+            assertString(payload.interaction_id, `event ${event.event_id}.payload.interaction_id`);
+            assertNullableString(payload.expected_principal_ref, `event ${event.event_id}.payload.expected_principal_ref`);
+            break;
+        }
+        case "interaction_submitted": {
+            const attempt = requireAttemptScopedCanonicalEvent(event, attempts);
+            assertString(payload.interaction_id, `event ${event.event_id}.payload.interaction_id`);
+            assertString(payload.principal_ref, `event ${event.event_id}.payload.principal_ref`);
+            assertString(payload.attestation_ref, `event ${event.event_id}.payload.attestation_ref`);
+            if (attempt.executor?.kind !== "human"
+                || attempt.executor.principal_ref !== payload.principal_ref
+                || attempt.executor.attestation_ref !== payload.attestation_ref) {
+                throw new RunStoreError("identity_conflict", `interaction_submitted event ${event.event_id} does not match human executor`);
+            }
+            break;
+        }
+    }
+}
+function validateCanonicalCollections(snapshot) {
+    const runId = snapshot.run.run_id;
+    const activations = new Map();
+    const lastActivationRoundByStep = new Map();
+    for (const activation of snapshot.activations) {
+        assertExactFields(activation, "activation", [
+            "run_id",
+            "step_id",
+            "activation_id",
+            "workflow_round",
+            "state",
+            "attempt_count",
+            "current_attempt_id",
+            "committed_result_id",
+            "created_at",
+            "updated_at",
+        ]);
+        assertCorrelatedRunId(activation.run_id, runId, "activation");
+        assertString(activation.step_id, "activation.step_id");
+        assertString(activation.activation_id, "activation.activation_id");
+        assertPositiveSafeInteger(activation.workflow_round, `activation ${activation.activation_id}.workflow_round`);
+        const previousRound = lastActivationRoundByStep.get(activation.step_id);
+        if (previousRound !== undefined && activation.workflow_round <= previousRound) {
+            throw new RunStoreError("identity_conflict", `step ${activation.step_id} has non-monotonic workflow round ${activation.workflow_round}`);
+        }
+        lastActivationRoundByStep.set(activation.step_id, activation.workflow_round);
+        if (!CANONICAL_ACTIVATION_STATE_VALUES.includes(activation.state)) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} has unsupported state ${String(activation.state)}`);
+        }
+        assertNonNegativeSafeInteger(activation.attempt_count, `activation ${activation.activation_id}.attempt_count`);
+        const activationCreatedAt = assertTimestamp(activation.created_at, `activation ${activation.activation_id}.created_at`);
+        const activationUpdatedAt = assertTimestamp(activation.updated_at, `activation ${activation.activation_id}.updated_at`);
+        if (activationUpdatedAt < activationCreatedAt) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} updated_at precedes created_at`);
+        }
+        if (activations.has(activation.activation_id)) {
+            throw new RunStoreError("identity_conflict", `duplicate activation ${activation.activation_id}`);
+        }
+        activations.set(activation.activation_id, activation);
+    }
+    const attempts = new Map();
+    const attemptNumbers = new Set();
+    const workerSessions = new Set();
+    for (const attempt of snapshot.attempts) {
+        assertExactFields(attempt, "attempt", [
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "attempt_number",
+            "phase",
+            "executor",
+            "started_at",
+            "completed_at",
+            "terminal_outcome",
+        ]);
+        assertCorrelatedRunId(attempt.run_id, runId, "attempt");
+        assertString(attempt.step_id, "attempt.step_id");
+        assertString(attempt.activation_id, "attempt.activation_id");
+        assertString(attempt.attempt_id, "attempt.attempt_id");
+        assertPositiveSafeInteger(attempt.attempt_number, `attempt ${attempt.attempt_id}.attempt_number`);
+        const activation = activations.get(attempt.activation_id);
+        if (!activation || activation.step_id !== attempt.step_id) {
+            throw new RunStoreError("identity_conflict", `attempt ${attempt.attempt_id} does not match activation ${attempt.activation_id}`);
+        }
+        if (!["claimed", "running", "terminal"].includes(attempt.phase)) {
+            throw new RunStoreError("invalid_record", `attempt ${attempt.attempt_id} has unsupported phase ${String(attempt.phase)}`);
+        }
+        if (attempt.phase === "claimed") {
+            if (attempt.started_at !== null
+                || attempt.completed_at !== null
+                || attempt.terminal_outcome !== null) {
+                throw new RunStoreError("invalid_record", `claimed attempt ${attempt.attempt_id} cannot have execution timestamps or outcome`);
+            }
+        }
+        else {
+            if (attempt.executor === null) {
+                throw new RunStoreError("invalid_record", `${attempt.phase} attempt ${attempt.attempt_id} requires an executor`);
+            }
+            const startedAt = assertTimestamp(attempt.started_at, `attempt ${attempt.attempt_id}.started_at`);
+            if (attempt.phase === "running" && (attempt.completed_at !== null
+                || attempt.terminal_outcome !== null)) {
+                throw new RunStoreError("invalid_record", `running attempt ${attempt.attempt_id} cannot have completion data`);
+            }
+            if (attempt.phase === "terminal" && (attempt.completed_at === null
+                || attempt.terminal_outcome === null)) {
+                throw new RunStoreError("invalid_record", `terminal attempt ${attempt.attempt_id} requires completion data`);
+            }
+            if (attempt.phase === "terminal") {
+                const completedAt = assertTimestamp(attempt.completed_at, `attempt ${attempt.attempt_id}.completed_at`);
+                if (completedAt < startedAt) {
+                    throw new RunStoreError("invalid_record", `attempt ${attempt.attempt_id} completed_at precedes started_at`);
+                }
+            }
+        }
+        if (attempt.executor !== null) {
+            if (attempt.phase === "terminal") {
+                try {
+                    validateCanonicalAttemptOutcome(attempt.executor, attempt.terminal_outcome);
+                }
+                catch (error) {
+                    throw new RunStoreError("invalid_record", `attempt ${attempt.attempt_id} has an invalid canonical outcome`, { cause: error });
+                }
+            }
+            else {
+                assertAttemptExecutor(attempt.executor, `attempt ${attempt.attempt_id}.executor`);
+            }
+            if (attempt.executor.kind === "worker") {
+                if (workerSessions.has(attempt.executor.worker_session_id)) {
+                    throw new RunStoreError("identity_conflict", `worker session ${attempt.executor.worker_session_id} is bound to multiple attempts`);
+                }
+                workerSessions.add(attempt.executor.worker_session_id);
+            }
+        }
+        if (attempts.has(attempt.attempt_id)) {
+            throw new RunStoreError("identity_conflict", `duplicate attempt ${attempt.attempt_id}`);
+        }
+        const attemptNumberKey = `${attempt.activation_id}\0${attempt.attempt_number}`;
+        if (attemptNumbers.has(attemptNumberKey)) {
+            throw new RunStoreError("identity_conflict", `activation ${attempt.activation_id} has duplicate attempt number ${attempt.attempt_number}`);
+        }
+        attemptNumbers.add(attemptNumberKey);
+        attempts.set(attempt.attempt_id, attempt);
+    }
+    const claimTokens = new Set();
+    const claimEpochs = new Set();
+    const claimsByAttempt = new Map();
+    for (const claim of snapshot.claims) {
+        assertExactFields(claim, "claim", [
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "claim_token",
+            "claim_epoch",
+            "owner_id",
+            "claimed_record_version",
+            "driver_claim_lease",
+            "execution_deadline_at",
+        ]);
+        assertCorrelatedRunId(claim.run_id, runId, "claim");
+        assertString(claim.claim_token, "claim.claim_token");
+        assertString(claim.owner_id, "claim.owner_id");
+        assertPositiveSafeInteger(claim.claim_epoch, "claim.claim_epoch");
+        assertPositiveSafeInteger(claim.claimed_record_version, "claim.claimed_record_version");
+        if (claim.claimed_record_version >= snapshot.record_version) {
+            throw new RunStoreError("invalid_record", `claim ${claim.claim_token} must reference an earlier observed record version`);
+        }
+        const executionDeadlineAt = assertTimestamp(claim.execution_deadline_at, "claim.execution_deadline_at");
+        assertExactFields(claim.driver_claim_lease, "claim.driver_claim_lease", [
+            "acquired_at",
+            "expires_at",
+            "heartbeat_at",
+        ]);
+        const acquiredAt = assertTimestamp(claim.driver_claim_lease.acquired_at, "claim.driver_claim_lease.acquired_at");
+        const expiresAt = assertTimestamp(claim.driver_claim_lease.expires_at, "claim.driver_claim_lease.expires_at");
+        const heartbeatAt = assertTimestamp(claim.driver_claim_lease.heartbeat_at, "claim.driver_claim_lease.heartbeat_at");
+        if (acquiredAt > heartbeatAt
+            || heartbeatAt > expiresAt
+            || expiresAt > executionDeadlineAt) {
+            throw new RunStoreError("invalid_record", `claim ${claim.claim_token} has inconsistent lease timestamps`);
+        }
+        const attempt = attempts.get(claim.attempt_id);
+        if (!attempt
+            || attempt.activation_id !== claim.activation_id
+            || attempt.step_id !== claim.step_id) {
+            throw new RunStoreError("invalid_record", `claim ${claim.claim_token} does not match its attempt`);
+        }
+        if (claimTokens.has(claim.claim_token)) {
+            throw new RunStoreError("identity_conflict", `duplicate claim token ${claim.claim_token}`);
+        }
+        const epochKey = `${claim.attempt_id}\0${claim.claim_epoch}`;
+        if (claimEpochs.has(epochKey)) {
+            throw new RunStoreError("identity_conflict", `attempt ${claim.attempt_id} has duplicate claim epoch ${claim.claim_epoch}`);
+        }
+        claimTokens.add(claim.claim_token);
+        claimEpochs.add(epochKey);
+        const attemptClaims = claimsByAttempt.get(claim.attempt_id) ?? [];
+        attemptClaims.push(claim);
+        claimsByAttempt.set(claim.attempt_id, attemptClaims);
+    }
+    for (const attempt of snapshot.attempts) {
+        if (attempt.phase !== "terminal"
+            && (claimsByAttempt.get(attempt.attempt_id)?.length ?? 0) === 0) {
+            throw new RunStoreError("invalid_record", `active attempt ${attempt.attempt_id} requires a durable claim`);
+        }
+    }
+    for (const [attemptId, attemptClaims] of claimsByAttempt) {
+        const ordered = [...attemptClaims].sort((left, right) => left.claim_epoch - right.claim_epoch);
+        const executionDeadline = ordered[0]?.execution_deadline_at;
+        const invalidEpoch = ordered.find((claim, index) => claim.claim_epoch !== index + 1);
+        if (invalidEpoch) {
+            throw new RunStoreError("invalid_record", `attempt ${attemptId} claim epochs must be contiguous from 1`);
+        }
+        if (ordered.some((claim) => claim.execution_deadline_at !== executionDeadline)) {
+            throw new RunStoreError("identity_conflict", `attempt ${attemptId} cannot change execution deadline across claim epochs`);
+        }
+    }
+    const resultRefs = new Map();
+    const resultByAttempt = new Map();
+    for (const reference of snapshot.result_refs) {
+        assertExactFields(reference, "result_ref", [
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "result_id",
+            "result_digest",
+        ]);
+        assertCorrelatedRunId(reference.run_id, runId, "result_ref");
+        assertString(reference.step_id, "result_ref.step_id");
+        assertString(reference.activation_id, "result_ref.activation_id");
+        assertString(reference.attempt_id, "result_ref.attempt_id");
+        assertString(reference.result_id, "result_ref.result_id");
+        assertDigest(reference.result_digest, "result_ref.result_digest");
+        const attempt = attempts.get(reference.attempt_id);
+        if (!attempt
+            || attempt.phase !== "terminal"
+            || attempt.activation_id !== reference.activation_id
+            || attempt.step_id !== reference.step_id) {
+            throw new RunStoreError("invalid_record", `result ${reference.result_id} does not match a terminal attempt`);
+        }
+        if (resultRefs.has(reference.result_id)) {
+            throw new RunStoreError("result_conflict", `duplicate canonical result ${reference.result_id}`);
+        }
+        if (resultByAttempt.has(reference.attempt_id)) {
+            throw new RunStoreError("result_conflict", `attempt ${reference.attempt_id} has multiple canonical results`);
+        }
+        resultRefs.set(reference.result_id, reference);
+        resultByAttempt.set(reference.attempt_id, reference);
+    }
+    for (const activation of snapshot.activations) {
+        const activationAttempts = snapshot.attempts
+            .filter((attempt) => attempt.activation_id === activation.activation_id)
+            .sort((left, right) => left.attempt_number - right.attempt_number);
+        if (activation.attempt_count !== activationAttempts.length) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} attempt_count does not match stored attempts`);
+        }
+        const nonContiguousAttempt = activationAttempts.find((attempt, index) => attempt.attempt_number !== index + 1);
+        if (nonContiguousAttempt) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} attempt numbers must be contiguous from 1`);
+        }
+        if (activation.current_attempt_id !== null
+            && attempts.get(activation.current_attempt_id)?.activation_id
+                !== activation.activation_id) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} references an unknown current attempt`);
+        }
+        const latestAttempt = activationAttempts.at(-1) ?? null;
+        if ((latestAttempt === null && activation.current_attempt_id !== null)
+            || (latestAttempt !== null
+                && activation.current_attempt_id !== latestAttempt.attempt_id)) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} current_attempt_id is not its latest attempt`);
+        }
+        const activeAttempts = activationAttempts.filter((attempt) => attempt.phase !== "terminal");
+        if (activeAttempts.length > 1) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} has multiple active attempts`);
+        }
+        if (activeAttempts.length === 1
+            && activeAttempts[0].attempt_id !== activation.current_attempt_id) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} active attempt is not current`);
+        }
+        const currentAttempt = activation.current_attempt_id === null
+            ? null
+            : attempts.get(activation.current_attempt_id) ?? null;
+        if (activation.state === "claimed"
+            && currentAttempt?.phase !== "claimed") {
+            throw new RunStoreError("invalid_record", `claimed activation ${activation.activation_id} requires a claimed current attempt`);
+        }
+        if (activation.state === "running"
+            && currentAttempt?.phase !== "running") {
+            throw new RunStoreError("invalid_record", `running activation ${activation.activation_id} requires a running current attempt`);
+        }
+        if (activation.state === "waiting_for_human"
+            && (currentAttempt === null
+                || !["claimed", "running"].includes(currentAttempt.phase)
+                || (currentAttempt.phase === "running"
+                    && currentAttempt.executor?.kind !== "human"))) {
+            throw new RunStoreError("invalid_record", `waiting_for_human activation ${activation.activation_id} requires a claimed or human-running attempt`);
+        }
+        if (["dormant", "dependency_blocked", "ready", "skipped"].includes(activation.state)
+            && activeAttempts.length !== 0) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} state ${activation.state} cannot retain an active attempt`);
+        }
+        if (["succeeded", "failed"].includes(activation.state)
+            && currentAttempt?.phase !== "terminal") {
+            throw new RunStoreError("invalid_record", `${activation.state} activation ${activation.activation_id} requires a terminal current attempt`);
+        }
+        if (currentAttempt?.phase === "terminal"
+            && ["succeeded", "failed", "cancelled"].includes(activation.state)
+            && canonicalAttemptOutcomeStatus(currentAttempt.terminal_outcome)
+                !== activation.state) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} state ${activation.state} disagrees with attempt ${currentAttempt.attempt_id} outcome`);
+        }
+        if (activation.state === "cancelled"
+            && activeAttempts.length !== 0) {
+            throw new RunStoreError("invalid_record", `cancelled activation ${activation.activation_id} cannot retain an active attempt`);
+        }
+        if (activation.committed_result_id !== null
+            && (resultRefs.get(activation.committed_result_id)?.activation_id
+                !== activation.activation_id
+                || resultRefs.get(activation.committed_result_id)?.attempt_id
+                    !== activation.current_attempt_id)) {
+            throw new RunStoreError("invalid_record", `activation ${activation.activation_id} references an unknown committed result`);
+        }
+        if (activation.state === "succeeded"
+            && activation.committed_result_id === null) {
+            throw new RunStoreError("invalid_record", `succeeded activation ${activation.activation_id} requires a committed result`);
+        }
+    }
+    if (snapshot.run.terminal !== null) {
+        const nonterminalActivation = snapshot.activations.find((activation) => (!["succeeded", "failed", "skipped", "cancelled"].includes(activation.state)));
+        const nonterminalAttempt = snapshot.attempts.find((attempt) => attempt.phase !== "terminal");
+        if (nonterminalActivation || nonterminalAttempt) {
+            throw new RunStoreError("invalid_record", `terminal run ${runId} cannot retain active activations or attempts`);
+        }
+    }
+    const eventIds = new Set();
+    const eventKeys = new Set();
+    const workspacePlans = new Map();
+    const workspaceAttempts = new Set();
+    let previousSequence = 0;
+    for (const event of snapshot.events) {
+        assertExactFields(event, "event", [
+            "event_id",
+            "run_id",
+            "step_id",
+            "activation_id",
+            "attempt_id",
+            "result_id",
+            "sequence",
+            "idempotency_key",
+            "type",
+            "occurred_at",
+            "payload",
+        ]);
+        assertCorrelatedRunId(event.run_id, runId, "event");
+        assertString(event.event_id, "event.event_id");
+        assertString(event.idempotency_key, "event.idempotency_key");
+        assertTimestamp(event.occurred_at, "event.occurred_at");
+        if (!CANONICAL_RUNTIME_EVENT_TYPE_VALUES.includes(event.type)) {
+            throw new RunStoreError("invalid_record", `event ${event.event_id} has unsupported type ${String(event.type)}`);
+        }
+        if (!Number.isSafeInteger(event.sequence)
+            || event.sequence !== previousSequence + 1) {
+            throw new RunStoreError("invalid_record", `event ${event.event_id} has non-contiguous sequence ${event.sequence}`);
+        }
+        if (eventIds.has(event.event_id) || eventKeys.has(event.idempotency_key)) {
+            throw new RunStoreError("event_conflict", `duplicate stored event ${event.event_id}`);
+        }
+        if (event.activation_id === null) {
+            if (event.step_id !== null || event.attempt_id !== null) {
+                throw new RunStoreError("invalid_record", `event ${event.event_id} has partial activation identity`);
+            }
+        }
+        else {
+            const activation = activations.get(event.activation_id);
+            if (!activation || activation.step_id !== event.step_id) {
+                throw new RunStoreError("invalid_record", `event ${event.event_id} does not match its activation`);
+            }
+        }
+        if (event.attempt_id !== null
+            && attempts.get(event.attempt_id)?.activation_id !== event.activation_id) {
+            throw new RunStoreError("invalid_record", `event ${event.event_id} does not match its attempt`);
+        }
+        if (event.result_id !== null) {
+            const eventResult = resultRefs.get(event.result_id);
+            if (eventResult?.activation_id !== event.activation_id
+                || (event.attempt_id !== null
+                    && eventResult.attempt_id !== event.attempt_id)) {
+                throw new RunStoreError("invalid_record", `event ${event.event_id} does not match its result`);
+            }
+        }
+        if (event.type === "result_committed" && event.result_id === null) {
+            throw new RunStoreError("invalid_record", `result_committed event ${event.event_id} requires result_id`);
+        }
+        assertCanonicalEventPayload(event, snapshot, activations, attempts, resultRefs);
+        if (event.type === "workspace_planned") {
+            const attemptId = event.attempt_id;
+            if (workspacePlans.has(attemptId)) {
+                throw new RunStoreError("invalid_record", `attempt ${attemptId} has more than one workspace plan`);
+            }
+            workspacePlans.set(attemptId, event);
+        }
+        if (event.type === "workspace_allocated") {
+            const attemptId = event.attempt_id;
+            const planned = workspacePlans.get(attemptId);
+            if (!planned) {
+                throw new RunStoreError("invalid_record", `attempt ${attemptId} allocation has no prior workspace plan`);
+            }
+            const expected = {
+                ...planned.payload.plan.payload,
+                workspace_plan_id: planned.payload.workspace_plan_id,
+            };
+            const actual = { ...event.payload.allocation };
+            delete actual.observed_head;
+            delete actual.observed_branch_ref;
+            if (event.payload.workspace_plan_id !== planned.payload.workspace_plan_id
+                || !recordsEqual(actual, expected)) {
+                throw new RunStoreError("identity_conflict", `attempt ${attemptId} allocation does not exactly match its committed workspace plan`);
+            }
+            if (workspaceAttempts.has(event.attempt_id)) {
+                throw new RunStoreError("invalid_record", `attempt ${event.attempt_id} has more than one workspace allocation`);
+            }
+            workspaceAttempts.add(attemptId);
+        }
+        try {
+            canonicalizeJson(event.payload);
+        }
+        catch (error) {
+            throw new RunStoreError("invalid_record", `event ${event.event_id} payload must be canonical JSON`, { cause: error });
+        }
+        eventIds.add(event.event_id);
+        eventKeys.add(event.idempotency_key);
+        previousSequence = event.sequence;
+    }
+}
+function assertCanonicalSnapshot(value, expectedRunId) {
+    assertExactFields(value, "run ledger", [
+        "schema_version",
+        "record_version",
+        "run",
+        "activations",
+        "attempts",
+        "claims",
+        "events",
+        "result_refs",
+        "created_at",
+        "updated_at",
+    ]);
+    const candidate = value;
+    if (candidate.schema_version !== CANONICAL_RUN_STORE_SCHEMA_VERSION) {
+        throw new RunStoreError("unsupported_schema", `unsupported run-store schema version: ${String(candidate.schema_version)}`);
+    }
+    assertPositiveSafeInteger(candidate.record_version, "record_version");
+    if (!candidate.run
+        || !Array.isArray(candidate.activations)
+        || !Array.isArray(candidate.attempts)
+        || !Array.isArray(candidate.claims)
+        || !Array.isArray(candidate.events)
+        || !Array.isArray(candidate.result_refs)) {
+        throw new RunStoreError("invalid_record", "canonical run ledger is missing a required record collection");
+    }
+    const createdAt = assertTimestamp(candidate.created_at, "ledger.created_at");
+    const updatedAt = assertTimestamp(candidate.updated_at, "ledger.updated_at");
+    if (updatedAt < createdAt) {
+        throw new RunStoreError("invalid_record", "ledger.updated_at cannot precede ledger.created_at");
+    }
+    assertCanonicalRunRecord(candidate.run, expectedRunId);
+    validateCanonicalCollections(candidate);
+    return candidate;
+}
+function assertAnySnapshot(value, expectedRunId) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new RunStoreError("invalid_record", "run ledger must be a JSON object");
+    }
+    const version = value.schema_version;
+    if (version === LEGACY_RUN_STORE_SCHEMA_VERSION) {
+        return assertLegacySnapshot(value, expectedRunId);
+    }
+    if (version === CANONICAL_RUN_STORE_SCHEMA_VERSION) {
+        return assertCanonicalSnapshot(value, expectedRunId);
+    }
+    throw new RunStoreError("unsupported_schema", `unsupported run-store schema version: ${String(version)}`);
+}
 function eventReplayEquivalent(existing, incoming) {
     return recordsEqual({
         run_id: existing.run_id,
@@ -339,66 +1884,519 @@ function applyUpdate(current, update) {
     const eventByKey = new Map(events.map((event) => [event.idempotency_key, event]));
     const duplicateEventIds = [];
     for (const event of update.events ?? []) {
-        assertCorrelatedRunId(event.run_id, runId, "event");
+        assertCorrelatedRunId(event.run_id, runId, "event");
+        const byId = eventById.get(event.event_id);
+        const byKey = eventByKey.get(event.idempotency_key);
+        const existing = byId ?? byKey;
+        if (existing) {
+            if ((byId && byKey && byId.event_id !== byKey.event_id) ||
+                !eventReplayEquivalent(existing, event)) {
+                throw new RunStoreError("event_conflict", `event ${event.event_id} conflicts with a stored event identity`);
+            }
+            duplicateEventIds.push(existing.event_id);
+            continue;
+        }
+        const expectedSequence = events.length + 1;
+        if (event.sequence !== expectedSequence) {
+            throw new RunStoreError("event_conflict", `event ${event.event_id} sequence ${event.sequence} must be ${expectedSequence}`);
+        }
+        events.push(event);
+        eventById.set(event.event_id, event);
+        eventByKey.set(event.idempotency_key, event);
+        changed = true;
+    }
+    const results = [...current.results];
+    const resultById = new Map(results.map((result) => [result.result_id, result]));
+    const resultByAttempt = new Map(results.map((result) => [result.attempt_id, result]));
+    const duplicateResultIds = [];
+    for (const result of update.results ?? []) {
+        assertCorrelatedRunId(result.run_id, runId, "result");
+        const existing = resultById.get(result.result_id);
+        if (existing) {
+            if (!recordsEqual(existing, result)) {
+                throw new RunStoreError("result_conflict", `committed result ${result.result_id} is immutable`);
+            }
+            duplicateResultIds.push(existing.result_id);
+            continue;
+        }
+        const attemptResult = resultByAttempt.get(result.attempt_id);
+        if (attemptResult) {
+            throw new RunStoreError("result_conflict", `attempt ${result.attempt_id} already committed result ${attemptResult.result_id}`);
+        }
+        results.push(result);
+        resultById.set(result.result_id, result);
+        resultByAttempt.set(result.attempt_id, result);
+        changed = true;
+    }
+    const now = new Date().toISOString();
+    const candidate = {
+        schema_version: LEGACY_RUN_STORE_SCHEMA_VERSION,
+        record_version: changed
+            ? current.record_version + 1
+            : current.record_version,
+        run,
+        tasks: tasks.records,
+        attempts: attempts.records,
+        claims: claims.records,
+        events,
+        results,
+        created_at: current.created_at,
+        updated_at: changed ? now : current.updated_at,
+    };
+    validateCollections(candidate);
+    return {
+        snapshot: candidate,
+        changed,
+        duplicate_event_ids: duplicateEventIds,
+        duplicate_result_ids: duplicateResultIds,
+    };
+}
+function canonicalEventReplayEquivalent(existing, incoming) {
+    return recordsEqual({
+        run_id: existing.run_id,
+        step_id: existing.step_id,
+        activation_id: existing.activation_id,
+        attempt_id: existing.attempt_id,
+        result_id: existing.result_id,
+        idempotency_key: existing.idempotency_key,
+        type: existing.type,
+        payload: existing.payload,
+    }, {
+        run_id: incoming.run_id,
+        step_id: incoming.step_id,
+        activation_id: incoming.activation_id,
+        attempt_id: incoming.attempt_id,
+        result_id: incoming.result_id,
+        idempotency_key: incoming.idempotency_key,
+        type: incoming.type,
+        payload: incoming.payload,
+    });
+}
+function canonicalEventsOfType(events, type) {
+    return events.filter((event) => event.type === type);
+}
+function assertOneToOneCanonicalEventCoupling(mutations, events, type, matches, describeMutation) {
+    const typedEvents = canonicalEventsOfType(events, type);
+    for (const mutation of mutations) {
+        if (typedEvents.filter((event) => matches(mutation, event)).length !== 1) {
+            throw new RunStoreError("invalid_record", `${describeMutation(mutation)} must commit exactly one ${type} event`);
+        }
+    }
+    for (const event of typedEvents) {
+        if (mutations.filter((mutation) => matches(mutation, event)).length !== 1) {
+            throw new RunStoreError("invalid_record", `${type} event ${event.event_id} does not match exactly one transaction mutation`);
+        }
+    }
+}
+function applyCanonicalUpdate(current, update) {
+    const runId = current.run.run_id;
+    assertCorrelatedRunId(update.run_id, runId, "update");
+    let changed = false;
+    let run = current.run;
+    if (update.run) {
+        assertCanonicalRunRecord(update.run, runId);
+        if (!recordsEqual(run, update.run)) {
+            if (run.terminal !== null) {
+                throw new RunStoreError("immutable_record", `terminal canonical run ${runId} cannot be changed`);
+            }
+            if (!recordsEqual(run.target, update.run.target)
+                || run.plan_id !== update.run.plan_id
+                || run.plan_digest !== update.run.plan_digest
+                || !recordsEqual(run.run_binding, update.run.run_binding)
+                || run.created_at !== update.run.created_at) {
+                throw new RunStoreError("identity_conflict", `canonical run ${runId} cannot change target, plan, binding, or creation identity`);
+            }
+            const allowedStatuses = {
+                active: ["active", "cancelling", "succeeded", "failed", "cancelled"],
+                cancelling: ["cancelling", "cancelled"],
+                succeeded: ["succeeded"],
+                failed: ["failed"],
+                cancelled: ["cancelled"],
+            };
+            if (!allowedStatuses[run.status].includes(update.run.status)) {
+                throw new RunStoreError("immutable_record", `canonical run ${runId} cannot transition from ${run.status} to ${update.run.status}`);
+            }
+            if (run.cancellation !== null
+                && !recordsEqual(run.cancellation, update.run.cancellation)) {
+                throw new RunStoreError("immutable_record", `canonical run ${runId} cannot change cancellation intent`);
+            }
+            if (Date.parse(update.run.updated_at) < Date.parse(run.updated_at)) {
+                throw new RunStoreError("immutable_record", `canonical run ${runId} cannot move updated_at backward`);
+            }
+            run = update.run;
+            changed = true;
+        }
+    }
+    const activations = upsertRecords(current.activations, update.activations ?? [], (activation) => activation.activation_id, (existing, incoming) => {
+        if (existing.run_id !== incoming.run_id
+            || existing.step_id !== incoming.step_id
+            || existing.workflow_round !== incoming.workflow_round
+            || existing.created_at !== incoming.created_at) {
+            throw new RunStoreError("identity_conflict", `activation ${existing.activation_id} cannot change its identity`);
+        }
+        if (["succeeded", "failed", "skipped", "cancelled"].includes(existing.state)) {
+            throw new RunStoreError("immutable_record", `terminal activation ${existing.activation_id} cannot be changed`);
+        }
+        if (incoming.state !== existing.state
+            && !CANONICAL_ACTIVATION_STATE_TRANSITIONS[existing.state]
+                .includes(incoming.state)) {
+            throw new RunStoreError("immutable_record", `activation ${existing.activation_id} cannot transition from ${existing.state} to ${incoming.state}`);
+        }
+        if (incoming.attempt_count < existing.attempt_count) {
+            throw new RunStoreError("immutable_record", `activation ${existing.activation_id} cannot decrease attempt_count`);
+        }
+        if (Date.parse(incoming.updated_at) < Date.parse(existing.updated_at)) {
+            throw new RunStoreError("immutable_record", `activation ${existing.activation_id} cannot move updated_at backward`);
+        }
+        if (existing.committed_result_id !== null
+            && incoming.committed_result_id !== existing.committed_result_id) {
+            throw new RunStoreError("immutable_record", `activation ${existing.activation_id} cannot change its committed result`);
+        }
+    });
+    changed ||= activations.changed;
+    const activationMutations = [];
+    const activationStateById = new Map(current.activations.map((activation) => [activation.activation_id, activation]));
+    for (const incoming of update.activations ?? []) {
+        const before = activationStateById.get(incoming.activation_id) ?? null;
+        if (!before || !recordsEqual(before, incoming)) {
+            activationMutations.push({ before, after: incoming });
+        }
+        activationStateById.set(incoming.activation_id, incoming);
+    }
+    const activationStateChanges = activationMutations.filter((mutation) => mutation.before !== null && mutation.before.state !== mutation.after.state);
+    const conditionalActivationTargetMutations = activationMutations.filter(({ before, after }) => (["ready", "dependency_blocked"].includes(after.state)
+        && (before === null || before.state === "dormant")));
+    const attempts = upsertRecords(current.attempts, update.attempts ?? [], (attempt) => attempt.attempt_id, (existing, incoming) => {
+        if (existing.run_id !== incoming.run_id
+            || existing.step_id !== incoming.step_id
+            || existing.activation_id !== incoming.activation_id
+            || existing.attempt_number !== incoming.attempt_number) {
+            throw new RunStoreError("identity_conflict", `canonical attempt ${existing.attempt_id} cannot change its identity`);
+        }
+        if (existing.executor !== null
+            && !recordsEqual(existing.executor, incoming.executor)) {
+            throw new RunStoreError("identity_conflict", `canonical attempt ${existing.attempt_id} cannot change executor`);
+        }
+        if (existing.started_at !== null
+            && incoming.started_at !== existing.started_at) {
+            throw new RunStoreError("immutable_record", `canonical attempt ${existing.attempt_id} cannot change started_at`);
+        }
+        if (existing.phase === "terminal") {
+            throw new RunStoreError("immutable_record", `terminal canonical attempt ${existing.attempt_id} cannot be changed`);
+        }
+        if ((existing.phase === "running" && incoming.phase !== "terminal")
+            || (existing.phase === "claimed" && !["claimed", "running", "terminal"].includes(incoming.phase))) {
+            throw new RunStoreError("immutable_record", `canonical attempt ${existing.attempt_id} has an invalid phase transition`);
+        }
+    });
+    changed ||= attempts.changed;
+    const attemptMutations = [];
+    const attemptStateById = new Map(current.attempts.map((attempt) => [attempt.attempt_id, attempt]));
+    for (const incoming of update.attempts ?? []) {
+        const before = attemptStateById.get(incoming.attempt_id) ?? null;
+        if (!before || !recordsEqual(before, incoming)) {
+            attemptMutations.push({ before, after: incoming });
+        }
+        attemptStateById.set(incoming.attempt_id, incoming);
+    }
+    const newlyTerminalAttempts = attemptMutations.filter(({ before, after }) => (before?.phase !== "terminal" && after.phase === "terminal"));
+    const newlyStartedAttempts = attemptMutations.filter(({ before, after }) => (before?.started_at == null && after.started_at !== null));
+    const executorIntroductions = attemptMutations.filter(({ before, after }) => (before?.executor == null && after.executor !== null));
+    const highestClaimEpoch = new Map();
+    for (const claim of current.claims) {
+        highestClaimEpoch.set(claim.attempt_id, Math.max(highestClaimEpoch.get(claim.attempt_id) ?? 0, claim.claim_epoch));
+    }
+    const storedClaimTokens = new Set(current.claims.map((claim) => claim.claim_token));
+    const stopFencedAttemptIds = new Set(current.events.flatMap((event) => (event.type === "attempt_stop_requested" && event.attempt_id !== null
+        ? [event.attempt_id]
+        : [])));
+    const attemptsWithNewClaims = new Set();
+    const newClaims = [];
+    const renewedClaims = [];
+    for (const claim of update.claims ?? []) {
+        const existing = current.claims.find((candidate) => candidate.claim_token === claim.claim_token);
+        if (stopFencedAttemptIds.has(claim.attempt_id)
+            && (existing === undefined || !recordsEqual(existing, claim))) {
+            throw new RunStoreError("immutable_record", `attempt ${claim.attempt_id} cannot change claims after a durable stop intent`);
+        }
+        if (storedClaimTokens.has(claim.claim_token)) {
+            if (existing && !recordsEqual(existing, claim))
+                renewedClaims.push(claim);
+            continue;
+        }
+        const currentAttempt = current.attempts.find((attempt) => attempt.attempt_id === claim.attempt_id);
+        const incomingAttempt = update.attempts?.find((attempt) => attempt.attempt_id === claim.attempt_id);
+        if (currentAttempt?.phase === "terminal"
+            || incomingAttempt?.phase === "terminal") {
+            throw new RunStoreError("immutable_record", `terminal attempt ${claim.attempt_id} cannot receive a new claim`);
+        }
+        const existingDeadline = current.claims.find((candidate) => candidate.attempt_id === claim.attempt_id)?.execution_deadline_at;
+        if (existingDeadline !== undefined
+            && claim.execution_deadline_at !== existingDeadline) {
+            throw new RunStoreError("identity_conflict", `attempt ${claim.attempt_id} cannot change execution deadline across claim epochs`);
+        }
+        const highest = highestClaimEpoch.get(claim.attempt_id) ?? 0;
+        if (attemptsWithNewClaims.has(claim.attempt_id)) {
+            throw new RunStoreError("invalid_record", `canonical update cannot create multiple claim epochs for attempt ${claim.attempt_id}`);
+        }
+        if (claim.claim_epoch !== highest + 1) {
+            throw new RunStoreError("immutable_record", `canonical claim epoch ${claim.claim_epoch} must follow epoch ${highest} for attempt ${claim.attempt_id}`);
+        }
+        if (claim.claimed_record_version !== current.record_version) {
+            throw new RunStoreError("version_conflict", `canonical claim ${claim.claim_token} observed record version ${claim.claimed_record_version}, expected ${current.record_version}`);
+        }
+        highestClaimEpoch.set(claim.attempt_id, claim.claim_epoch);
+        attemptsWithNewClaims.add(claim.attempt_id);
+        newClaims.push(claim);
+    }
+    const claims = upsertRecords(current.claims, update.claims ?? [], (claim) => claim.claim_token, (existing, incoming) => {
+        if (existing.run_id !== incoming.run_id
+            || existing.step_id !== incoming.step_id
+            || existing.activation_id !== incoming.activation_id
+            || existing.attempt_id !== incoming.attempt_id
+            || existing.claim_epoch !== incoming.claim_epoch
+            || existing.owner_id !== incoming.owner_id
+            || existing.claimed_record_version !== incoming.claimed_record_version
+            || existing.driver_claim_lease.acquired_at
+                !== incoming.driver_claim_lease.acquired_at
+            || existing.execution_deadline_at !== incoming.execution_deadline_at) {
+            throw new RunStoreError("identity_conflict", `canonical claim ${existing.claim_token} cannot change ownership identity`);
+        }
+        if (Date.parse(incoming.driver_claim_lease.heartbeat_at)
+            < Date.parse(existing.driver_claim_lease.heartbeat_at)
+            || Date.parse(incoming.driver_claim_lease.expires_at)
+                < Date.parse(existing.driver_claim_lease.expires_at)) {
+            throw new RunStoreError("immutable_record", `canonical claim ${existing.claim_token} cannot move its lease clocks backward`);
+        }
+    });
+    changed ||= claims.changed;
+    const events = [...current.events];
+    const eventById = new Map(events.map((event) => [event.event_id, event]));
+    const eventByKey = new Map(events.map((event) => [event.idempotency_key, event]));
+    const duplicateEventIds = [];
+    const newEvents = [];
+    for (const event of update.events ?? []) {
+        assertCorrelatedRunId(event.run_id, runId, "canonical event");
         const byId = eventById.get(event.event_id);
         const byKey = eventByKey.get(event.idempotency_key);
         const existing = byId ?? byKey;
         if (existing) {
-            if ((byId && byKey && byId.event_id !== byKey.event_id) ||
-                !eventReplayEquivalent(existing, event)) {
-                throw new RunStoreError("event_conflict", `event ${event.event_id} conflicts with a stored event identity`);
+            if ((byId && byKey && byId.event_id !== byKey.event_id)
+                || !canonicalEventReplayEquivalent(existing, event)) {
+                throw new RunStoreError("event_conflict", `canonical event ${event.event_id} conflicts with stored identity`);
             }
             duplicateEventIds.push(existing.event_id);
             continue;
         }
         const expectedSequence = events.length + 1;
         if (event.sequence !== expectedSequence) {
-            throw new RunStoreError("event_conflict", `event ${event.event_id} sequence ${event.sequence} must be ${expectedSequence}`);
+            throw new RunStoreError("event_conflict", `canonical event ${event.event_id} sequence ${event.sequence} must be ${expectedSequence}`);
         }
         events.push(event);
+        newEvents.push(event);
         eventById.set(event.event_id, event);
         eventByKey.set(event.idempotency_key, event);
         changed = true;
     }
-    const results = [...current.results];
-    const resultById = new Map(results.map((result) => [result.result_id, result]));
-    const resultByAttempt = new Map(results.map((result) => [result.attempt_id, result]));
+    const resultRefs = [...current.result_refs];
+    const resultById = new Map(resultRefs.map((reference) => [reference.result_id, reference]));
+    const resultByAttempt = new Map(resultRefs.map((reference) => [reference.attempt_id, reference]));
     const duplicateResultIds = [];
-    for (const result of update.results ?? []) {
-        assertCorrelatedRunId(result.run_id, runId, "result");
-        const existing = resultById.get(result.result_id);
+    const newResultRefs = [];
+    for (const reference of update.result_refs ?? []) {
+        assertCorrelatedRunId(reference.run_id, runId, "canonical result reference");
+        const existing = resultById.get(reference.result_id);
         if (existing) {
-            if (!recordsEqual(existing, result)) {
-                throw new RunStoreError("result_conflict", `committed result ${result.result_id} is immutable`);
+            if (!recordsEqual(existing, reference)) {
+                throw new RunStoreError("result_conflict", `canonical result ${reference.result_id} is immutable`);
             }
             duplicateResultIds.push(existing.result_id);
             continue;
         }
-        const attemptResult = resultByAttempt.get(result.attempt_id);
+        const attemptResult = resultByAttempt.get(reference.attempt_id);
         if (attemptResult) {
-            throw new RunStoreError("result_conflict", `attempt ${result.attempt_id} already committed result ${attemptResult.result_id}`);
+            throw new RunStoreError("result_conflict", `canonical attempt ${reference.attempt_id} already references result ${attemptResult.result_id}`);
         }
-        results.push(result);
-        resultById.set(result.result_id, result);
-        resultByAttempt.set(result.attempt_id, result);
+        resultRefs.push(reference);
+        newResultRefs.push(reference);
+        resultById.set(reference.result_id, reference);
+        resultByAttempt.set(reference.attempt_id, reference);
         changed = true;
     }
+    for (const attemptId of stopFencedAttemptIds) {
+        const storedAttempt = current.attempts.find((attempt) => attempt.attempt_id === attemptId);
+        if (!storedAttempt)
+            continue;
+        const stopPending = storedAttempt.phase !== "terminal";
+        const attemptMutation = attemptMutations.find(({ after }) => after.attempt_id === attemptId);
+        const terminalMutation = attemptMutation?.after.phase === "terminal" ? attemptMutation : null;
+        if (attemptMutation && terminalMutation === null) {
+            throw new RunStoreError("immutable_record", `attempt ${attemptId} can only confirm its durable stop intent`);
+        }
+        if (newResultRefs.some((reference) => reference.attempt_id === attemptId)) {
+            throw new RunStoreError("immutable_record", `attempt ${attemptId} cannot commit a result after a durable stop intent`);
+        }
+        const activationMutation = stopPending
+            ? activationMutations.find(({ after }) => after.activation_id === storedAttempt.activation_id)
+            : undefined;
+        if (activationMutation
+            && (terminalMutation === null
+                || !["ready", "succeeded", "failed", "cancelled", "skipped"].includes(activationMutation.after.state)
+                || activationMutation.after.committed_result_id
+                    !== activationMutation.before?.committed_result_id)) {
+            throw new RunStoreError("immutable_record", `activation ${storedAttempt.activation_id} can only transition with durable stop confirmation`);
+        }
+        for (const event of newEvents) {
+            const scopesAttempt = stopPending && (event.attempt_id === attemptId
+                || event.activation_id === storedAttempt.activation_id);
+            if (!scopesAttempt)
+                continue;
+            const allowedTerminal = terminalMutation !== null
+                && event.type === "attempt_terminal"
+                && event.attempt_id === attemptId;
+            const allowedActivation = terminalMutation !== null
+                && activationMutation !== undefined
+                && event.type === "activation_state_changed"
+                && event.activation_id === storedAttempt.activation_id;
+            if (!allowedTerminal && !allowedActivation) {
+                throw new RunStoreError("immutable_record", `attempt ${attemptId} cannot append ${event.type} after a durable stop intent`);
+            }
+        }
+    }
     const now = new Date().toISOString();
     const candidate = {
-        schema_version: RUN_STORE_SCHEMA_VERSION,
+        schema_version: CANONICAL_RUN_STORE_SCHEMA_VERSION,
         record_version: changed
             ? current.record_version + 1
             : current.record_version,
         run,
-        tasks: tasks.records,
+        activations: activations.records,
         attempts: attempts.records,
         claims: claims.records,
         events,
-        results,
+        result_refs: resultRefs,
         created_at: current.created_at,
         updated_at: changed ? now : current.updated_at,
     };
-    validateCollections(candidate);
+    if (current.run.terminal !== null && changed) {
+        throw new RunStoreError("immutable_record", `terminal canonical run ${runId} cannot be changed`);
+    }
+    validateCanonicalCollections(candidate);
+    const routeEvents = canonicalEventsOfType(newEvents, "route_selected");
+    const retrySegmentEvents = canonicalEventsOfType(newEvents, "retry_segment_scheduled");
+    for (const mutation of conditionalActivationTargetMutations) {
+        const matchingRoutes = routeEvents.filter((event) => (event.payload.successor_activation_ids.includes(mutation.after.activation_id)));
+        const matchingRetries = mutation.before === null
+            ? retrySegmentEvents.filter((event) => (event.payload.replacement_activation_ids.includes(mutation.after.activation_id)))
+            : [];
+        if (matchingRoutes.length + matchingRetries.length !== 1) {
+            throw new RunStoreError("invalid_record", `conditional activation ${mutation.after.activation_id} must be authorized by exactly one route or retry segment event`);
+        }
+    }
+    for (const event of routeEvents) {
+        for (const successorId of event.payload.successor_activation_ids) {
+            const matchingMutations = conditionalActivationTargetMutations.filter(({ after }) => after.activation_id === successorId);
+            if (matchingMutations.length !== 1) {
+                throw new RunStoreError("invalid_record", `route_selected event ${event.event_id} successor ${successorId} does not match exactly one readiness mutation`);
+            }
+        }
+        if (event.payload.successor_activation_ids.length > 0
+            && event.payload.source_result_id !== null
+            && !newResultRefs.some((reference) => reference.result_id === event.payload.source_result_id)) {
+            throw new RunStoreError("invalid_record", `route_selected event ${event.event_id} must commit its source result in the same transaction`);
+        }
+    }
+    for (const event of retrySegmentEvents) {
+        for (let index = 0; index < event.payload.replacement_activation_ids.length; index += 1) {
+            const priorId = event.payload.prior_activation_ids[index];
+            const replacementId = event.payload.replacement_activation_ids[index];
+            const prior = candidate.activations.find((activation) => activation.activation_id === priorId);
+            const matchingMutations = conditionalActivationTargetMutations.filter(({ before, after }) => before === null && after.activation_id === replacementId);
+            if (!prior
+                || !["succeeded", "failed", "skipped", "cancelled"].includes(prior.state)
+                || matchingMutations.length !== 1
+                || matchingMutations[0].after.step_id !== prior.step_id
+                || prior.workflow_round !== event.payload.from_round
+                || matchingMutations[0].after.workflow_round !== event.payload.to_round
+                || matchingMutations[0].after.state !== (replacementId === event.payload.retry_from_activation_id
+                    ? "ready"
+                    : "dependency_blocked")) {
+                throw new RunStoreError("invalid_record", `retry_segment_scheduled event ${event.event_id} does not match one prior and replacement activation pair`);
+            }
+        }
+    }
+    assertOneToOneCanonicalEventCoupling(activationStateChanges, newEvents, "activation_state_changed", ({ before, after }, event) => (event.activation_id === after.activation_id
+        && event.payload.from === before.state
+        && event.payload.to === after.state), ({ after }) => `activation transition ${after.activation_id}`);
+    assertOneToOneCanonicalEventCoupling(newClaims, newEvents, "attempt_claimed", (claim, event) => (event.attempt_id === claim.attempt_id
+        && event.payload.claim_epoch === claim.claim_epoch
+        && event.payload.owner_id === claim.owner_id
+        && event.payload.claim_expires_at === claim.driver_claim_lease.expires_at
+        && event.payload.execution_deadline_at === claim.execution_deadline_at), (claim) => `canonical claim ${claim.claim_token}`);
+    assertOneToOneCanonicalEventCoupling(renewedClaims, newEvents, "attempt_heartbeat", (claim, event) => (event.attempt_id === claim.attempt_id
+        && event.payload.claim_epoch === claim.claim_epoch
+        && event.payload.heartbeat_at === claim.driver_claim_lease.heartbeat_at
+        && event.payload.claim_expires_at === claim.driver_claim_lease.expires_at), (claim) => `canonical claim renewal ${claim.claim_token}`);
+    assertOneToOneCanonicalEventCoupling(newlyStartedAttempts, newEvents, "attempt_started", ({ after }, event) => (event.attempt_id === after.attempt_id
+        && recordsEqual(event.payload.executor, after.executor)), ({ after }) => `started attempt ${after.attempt_id}`);
+    assertOneToOneCanonicalEventCoupling(newlyTerminalAttempts, newEvents, "attempt_terminal", ({ after }, event) => (event.attempt_id === after.attempt_id
+        && recordsEqual(event.payload.executor, after.executor)
+        && recordsEqual(event.payload.outcome, after.terminal_outcome)), ({ after }) => `terminal attempt ${after.attempt_id}`);
+    const attachedEvents = canonicalEventsOfType(newEvents, "attempt_attached");
+    for (const mutation of executorIntroductions) {
+        const matchingAttached = attachedEvents.filter((event) => (event.attempt_id === mutation.after.attempt_id
+            && recordsEqual(event.payload.executor, mutation.after.executor)));
+        if (matchingAttached.length > 1) {
+            throw new RunStoreError("invalid_record", `attempt ${mutation.after.attempt_id} cannot attach its executor more than once per transaction`);
+        }
+        if (mutation.after.executor?.kind === "worker" && matchingAttached.length !== 1) {
+            throw new RunStoreError("invalid_record", `attempt ${mutation.after.attempt_id} must commit exactly one attempt_attached event`);
+        }
+    }
+    for (const event of attachedEvents) {
+        if (executorIntroductions.filter(({ after }) => (event.attempt_id === after.attempt_id
+            && recordsEqual(event.payload.executor, after.executor))).length !== 1) {
+            throw new RunStoreError("invalid_record", `attempt_attached event ${event.event_id} does not introduce an executor in this transaction`);
+        }
+    }
+    const workerExecutorIntroductions = executorIntroductions.filter(({ after }) => after.executor?.kind === "worker");
+    const currentAllocatedAttempts = new Set(current.events
+        .filter((event) => event.type === "workspace_allocated")
+        .map((event) => event.attempt_id));
+    const currentPlannedAttempts = new Set(current.events
+        .filter((event) => event.type === "workspace_planned")
+        .map((event) => event.attempt_id));
+    for (const event of canonicalEventsOfType(newEvents, "workspace_allocated")) {
+        if (!currentPlannedAttempts.has(event.attempt_id)) {
+            throw new RunStoreError("invalid_record", `workspace allocation for attempt ${event.attempt_id} must reference a plan committed in an earlier transaction`);
+        }
+    }
+    for (const { after } of newlyStartedAttempts.filter(({ after }) => after.executor?.kind === "worker")) {
+        if (!currentPlannedAttempts.has(after.attempt_id) || !currentAllocatedAttempts.has(after.attempt_id)) {
+            throw new RunStoreError("invalid_record", `worker attempt ${after.attempt_id} must reference a workspace plan and allocation committed before its start transaction`);
+        }
+    }
+    if (canonicalEventsOfType(newEvents, "workspace_allocated")
+        .some((event) => newlyStartedAttempts.some(({ after }) => after.attempt_id === event.attempt_id))) {
+        throw new RunStoreError("invalid_record", "workspace allocation and attempt start cannot share a transaction");
+    }
+    assertOneToOneCanonicalEventCoupling(newResultRefs, newEvents, "result_committed", (reference, event) => (event.result_id === reference.result_id
+        && event.attempt_id === reference.attempt_id
+        && event.activation_id === reference.activation_id
+        && event.payload.result_digest === reference.result_digest), (reference) => `canonical result ${reference.result_id}`);
+    for (const reference of newResultRefs) {
+        const terminalAttempt = newlyTerminalAttempts.find(({ after }) => after.attempt_id === reference.attempt_id);
+        const activation = activationMutations.find(({ after }) => after.activation_id === reference.activation_id);
+        if (!terminalAttempt || !activation) {
+            throw new RunStoreError("invalid_record", `canonical result ${reference.result_id} must commit attempt and activation state in one update`);
+        }
+    }
+    const cancellationMutations = (current.run.cancellation === null && run.cancellation !== null) ? [run.cancellation] : [];
+    assertOneToOneCanonicalEventCoupling(cancellationMutations, newEvents, "run_cancel_requested", (cancellation, event) => event.payload.reason === cancellation.reason, () => `canonical run ${runId} cancellation intent`);
+    const terminalRunMutations = (current.run.terminal === null && run.terminal !== null) ? [run.terminal] : [];
+    assertOneToOneCanonicalEventCoupling(terminalRunMutations, newEvents, "run_terminal", (terminal, event) => (event.payload.status === terminal.status
+        && event.payload.reason_code === terminal.reason_code
+        && event.payload.reason === terminal.reason), () => `canonical run ${runId} terminal state`);
     return {
         snapshot: candidate,
         changed,
@@ -455,129 +2453,45 @@ async function writeAtomic(filePath, data) {
         throw error;
     }
 }
-async function readLockOwner(ownerPath) {
-    try {
-        return (await readFile(ownerPath, "utf8")).trim();
-    }
-    catch (error) {
-        if (isErrno(error, "ENOENT"))
-            return null;
-        throw error;
-    }
-}
-async function lockIsStale(lockDirectory, staleMs) {
-    try {
-        const lease = await stat(join(lockDirectory, LOCK_LEASE_FILE_NAME));
-        return Date.now() - lease.mtimeMs > staleMs;
-    }
-    catch (error) {
-        if (!isErrno(error, "ENOENT"))
-            return false;
-    }
-    try {
-        const lock = await stat(lockDirectory);
-        return Date.now() - lock.mtimeMs > staleMs;
-    }
-    catch {
-        return false;
+function versionFileName(recordVersion) {
+    if (!Number.isSafeInteger(recordVersion) || recordVersion < 1) {
+        throw new RunStoreError("invalid_record", "record_version must be a positive safe integer");
     }
+    return `${String(recordVersion).padStart(16, "0")}.json`;
 }
-async function recoverStaleLock(lockDirectory, staleMs) {
-    if (!(await lockIsStale(lockDirectory, staleMs)))
-        return false;
-    const quarantine = `${lockDirectory}.reclaimed.${randomUUID()}`;
+/**
+ * Publishes a complete immutable snapshot without replacing an existing
+ * version. The hard link is the compare-and-swap boundary.
+ */
+async function publishVersion(destination, data) {
+    const directory = dirname(destination);
+    await mkdir(directory, { recursive: true, mode: DIRECTORY_MODE });
+    const temporaryPath = join(directory, `.tmp.${process.pid}.${randomUUID()}`);
+    let handle;
     try {
-        await rename(lockDirectory, quarantine);
-    }
-    catch (error) {
-        if (isErrno(error, "ENOENT"))
-            return true;
-        throw error;
-    }
-    await rm(quarantine, { recursive: true, force: true });
-    return true;
-}
-async function withRunLock(lockDirectory, options, operation) {
-    const ownerToken = `${process.pid}.${Date.now()}.${randomUUID()}`;
-    const ownerPath = join(lockDirectory, LOCK_OWNER_FILE_NAME);
-    const leasePath = join(lockDirectory, LOCK_LEASE_FILE_NAME);
-    const deadline = Date.now() + options.lock_wait_ms;
-    await mkdir(dirname(lockDirectory), {
-        recursive: true,
-        mode: DIRECTORY_MODE,
-    });
-    while (true) {
+        handle = await open(temporaryPath, "wx", FILE_MODE);
+        await handle.writeFile(data, "utf8");
+        await handle.chmod(IMMUTABLE_FILE_MODE);
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
         try {
-            await mkdir(lockDirectory, { mode: DIRECTORY_MODE });
-            try {
-                const owner = await open(ownerPath, "wx", FILE_MODE);
-                await owner.writeFile(ownerToken, "utf8");
-                await owner.sync();
-                await owner.close();
-                const lease = await open(leasePath, "wx", FILE_MODE);
-                await lease.writeFile(ownerToken, "utf8");
-                await lease.sync();
-                await lease.close();
-            }
-            catch (error) {
-                await rm(lockDirectory, { recursive: true, force: true });
-                throw error;
-            }
-            break;
+            await link(temporaryPath, destination);
         }
         catch (error) {
-            if (!isErrno(error, "EEXIST"))
-                throw error;
-            if (await recoverStaleLock(lockDirectory, options.lock_stale_ms))
-                continue;
-            if (Date.now() >= deadline) {
-                throw new RunStoreError("lock_timeout", `timed out acquiring run-store lock ${lockDirectory}`);
-            }
-            await sleep(options.lock_retry_ms);
-        }
-    }
-    let heartbeatRunning = false;
-    let lostOwnership = false;
-    const refresh = async () => {
-        if (heartbeatRunning || lostOwnership)
-            return;
-        heartbeatRunning = true;
-        try {
-            if ((await readLockOwner(ownerPath)) !== ownerToken) {
-                lostOwnership = true;
-                return;
-            }
-            const now = new Date();
-            await utimes(leasePath, now, now);
-        }
-        catch {
-            lostOwnership = true;
-        }
-        finally {
-            heartbeatRunning = false;
+            if (isErrno(error, "EEXIST"))
+                return false;
+            throw error;
         }
-    };
-    const timer = setInterval(() => void refresh(), options.lock_heartbeat_ms);
-    timer.unref();
-    const lock = {
-        async assertOwned() {
-            if (lostOwnership ||
-                (await readLockOwner(ownerPath)) !== ownerToken) {
-                lostOwnership = true;
-                throw new RunStoreError("lock_lost", `run-store lock ownership was lost for ${lockDirectory}`);
-            }
-        },
-    };
-    try {
-        return await operation(lock);
+        await syncParentDirectory(destination);
+        return true;
     }
     finally {
-        clearInterval(timer);
-        while (heartbeatRunning)
-            await sleep(1);
-        if ((await readLockOwner(ownerPath).catch(() => null)) === ownerToken) {
-            await rm(lockDirectory, { recursive: true, force: true });
-        }
+        await handle?.close().catch(() => undefined);
+        await unlink(temporaryPath).catch((error) => {
+            if (!isErrno(error, "ENOENT"))
+                throw error;
+        });
     }
 }
 export class DurableRunStore {
@@ -585,54 +2499,198 @@ export class DurableRunStore {
     constructor(options) {
         this.options = resolveOptions(options);
     }
+    serviceOwnedRuntimeDirectory(component) {
+        return join(this.options.root_directory, "runtime", component);
+    }
     runDirectory(runId) {
         return join(this.options.root_directory, "runs", runStorageKey(runId));
     }
     ledgerPath(runId) {
         return join(this.runDirectory(runId), LEDGER_FILE_NAME);
     }
-    lockDirectory(runId) {
-        return join(this.options.root_directory, ".locks", `${runStorageKey(runId)}.lock`);
+    versionsDirectory(runId) {
+        return join(this.runDirectory(runId), VERSION_DIRECTORY_NAME);
     }
-    async readSnapshot(runId) {
+    versionPath(runId, recordVersion) {
+        return join(this.versionsDirectory(runId), versionFileName(recordVersion));
+    }
+    async readLedgerSnapshot(runId) {
         try {
             const raw = await readFile(this.ledgerPath(runId), "utf8");
-            return assertSnapshot(JSON.parse(raw), runId);
+            return assertAnySnapshot(JSON.parse(raw), runId);
+        }
+        catch (error) {
+            if (isErrno(error, "ENOENT"))
+                return null;
+            if (error instanceof SyntaxError) {
+                throw new RunStoreError("invalid_record", `run ${runId} contains invalid JSON`, { cause: error });
+            }
+            throw error;
+        }
+    }
+    async readCommittedHeadFromDirectory(runDirectory, expectedRunId) {
+        const versionsDirectory = join(runDirectory, VERSION_DIRECTORY_NAME);
+        let entries;
+        try {
+            entries = await readdir(versionsDirectory, { withFileTypes: true });
         }
         catch (error) {
             if (isErrno(error, "ENOENT"))
                 return null;
+            throw error;
+        }
+        const versionNames = entries
+            .map((entry) => entry.name)
+            .filter((name) => VERSION_FILE_PATTERN.test(name))
+            .sort();
+        const headName = versionNames.at(-1);
+        if (headName === undefined)
+            return null;
+        const match = headName.match(VERSION_FILE_PATTERN);
+        const recordVersion = Number(match?.[1]);
+        if (!Number.isSafeInteger(recordVersion) || recordVersion < 1) {
+            throw new RunStoreError("invalid_record", `run version filename ${headName} is outside the supported range`);
+        }
+        const headPath = join(versionsDirectory, headName);
+        let value;
+        try {
+            value = JSON.parse(await readFile(headPath, "utf8"));
+        }
+        catch (error) {
             if (error instanceof SyntaxError) {
-                throw new RunStoreError("invalid_record", `run ${runId} contains invalid JSON`);
+                throw new RunStoreError("invalid_record", `run version ${headPath} contains invalid JSON`, { cause: error });
             }
             throw error;
         }
+        const snapshot = assertAnySnapshot(value, expectedRunId);
+        if (snapshot.record_version !== recordVersion) {
+            throw new RunStoreError("invalid_record", `run version ${headPath} contains record version ${snapshot.record_version}`);
+        }
+        return snapshot;
+    }
+    async readCommittedHead(runId) {
+        return this.readCommittedHeadFromDirectory(this.runDirectory(runId), runId);
+    }
+    async readProjectionForRepair(runId) {
+        try {
+            return await this.readLedgerSnapshot(runId);
+        }
+        catch (error) {
+            if (error instanceof RunStoreError)
+                return null;
+            throw error;
+        }
+    }
+    async projectCommittedHead(runId) {
+        while (true) {
+            const head = await this.readCommittedHead(runId);
+            if (head === null)
+                return null;
+            const projection = await this.readProjectionForRepair(runId);
+            if (projection === null || !recordsEqual(projection, head)) {
+                await writeAtomic(this.ledgerPath(runId), `${JSON.stringify(head, null, 2)}\n`);
+            }
+            const latest = await this.readCommittedHead(runId);
+            const latestProjection = await this.readProjectionForRepair(runId);
+            if (latest !== null
+                && recordsEqual(latest, head)
+                && latestProjection !== null
+                && recordsEqual(latestProjection, latest)) {
+                return latest;
+            }
+        }
+    }
+    async beforeLedgerCommit(_snapshot) { }
+    async afterLedgerCommit(_snapshot) { }
+    async commitSnapshot(snapshot) {
+        await this.beforeLedgerCommit(snapshot);
+        const committed = await publishVersion(this.versionPath(snapshot.run.run_id, snapshot.record_version), `${JSON.stringify(snapshot, null, 2)}\n`);
+        if (!committed)
+            return false;
+        await this.afterLedgerCommit(snapshot);
+        await this.projectCommittedHead(snapshot.run.run_id);
+        return true;
+    }
+    async readAnySnapshot(runId) {
+        const committed = await this.readCommittedHead(runId);
+        if (committed !== null) {
+            return (await this.projectCommittedHead(runId)) ?? committed;
+        }
+        return this.readLedgerSnapshot(runId);
+    }
+    async readSnapshot(runId) {
+        const snapshot = await this.readAnySnapshot(runId);
+        if (snapshot !== null
+            && snapshot.schema_version !== LEGACY_RUN_STORE_SCHEMA_VERSION) {
+            throw new RunStoreError("unsupported_schema", `canonical run ${runId} requires the canonical store API`);
+        }
+        return snapshot;
     }
     async createRun(input) {
         assertRunRecord(input.run);
         const runId = input.run.run_id;
-        return withRunLock(this.lockDirectory(runId), this.options, async (lock) => {
-            if (await this.readSnapshot(runId)) {
-                throw new RunStoreError("run_exists", `run ${runId} already exists`);
-            }
-            const now = new Date().toISOString();
-            const snapshot = {
-                schema_version: RUN_STORE_SCHEMA_VERSION,
-                record_version: 1,
-                run: input.run,
-                tasks: [...(input.tasks ?? [])],
-                attempts: [],
-                claims: [],
-                events: [],
-                results: [],
-                created_at: now,
-                updated_at: now,
-            };
-            validateCollections(snapshot);
-            await lock.assertOwned();
-            await writeAtomic(this.ledgerPath(runId), `${JSON.stringify(snapshot, null, 2)}\n`);
-            return snapshot;
-        });
+        if (await this.readAnySnapshot(runId)) {
+            throw new RunStoreError("run_exists", `run ${runId} already exists`);
+        }
+        const now = new Date().toISOString();
+        const snapshot = {
+            schema_version: LEGACY_RUN_STORE_SCHEMA_VERSION,
+            record_version: 1,
+            run: input.run,
+            tasks: [...(input.tasks ?? [])],
+            attempts: [],
+            claims: [],
+            events: [],
+            results: [],
+            created_at: now,
+            updated_at: now,
+        };
+        validateCollections(snapshot);
+        if (!await this.commitSnapshot(snapshot)) {
+            throw new RunStoreError("run_exists", `run ${runId} already exists`);
+        }
+        return snapshot;
+    }
+    async createCanonicalRun(input) {
+        assertCanonicalRunRecord(input.run);
+        const runId = input.run.run_id;
+        if (await this.readAnySnapshot(runId)) {
+            throw new RunStoreError("run_exists", `run ${runId} already exists`);
+        }
+        const now = new Date().toISOString();
+        const createdEvent = {
+            event_id: randomUUID(),
+            run_id: runId,
+            step_id: null,
+            activation_id: null,
+            attempt_id: null,
+            result_id: null,
+            sequence: 1,
+            idempotency_key: `run:${runId}:created`,
+            type: "run_created",
+            occurred_at: input.run.created_at,
+            payload: {
+                plan_id: input.run.plan_id,
+                run_binding_id: input.run.run_binding.binding_id,
+            },
+        };
+        const snapshot = {
+            schema_version: CANONICAL_RUN_STORE_SCHEMA_VERSION,
+            record_version: 1,
+            run: input.run,
+            activations: [...(input.activations ?? [])],
+            attempts: [],
+            claims: [],
+            events: [createdEvent],
+            result_refs: [],
+            created_at: now,
+            updated_at: now,
+        };
+        validateCanonicalCollections(snapshot);
+        if (!await this.commitSnapshot(snapshot)) {
+            throw new RunStoreError("run_exists", `run ${runId} already exists`);
+        }
+        return snapshot;
     }
     async loadRun(runId) {
         assertString(runId, "run_id");
@@ -645,13 +2703,238 @@ export class DurableRunStore {
         }
         return snapshot;
     }
+    async cancelLegacyRun(runId, reason = null) {
+        assertString(runId, "run_id");
+        if (reason !== null && (typeof reason !== "string" || !reason.trim())) {
+            throw new RunStoreError("invalid_record", "legacy cancellation reason must be a non-empty string or null");
+        }
+        while (true) {
+            const snapshot = await this.requireRun(runId);
+            if (snapshot.run.terminal !== null)
+                return snapshot;
+            const now = new Date().toISOString();
+            const cancellation = snapshot.run.cancellation ?? {
+                requested_at: now,
+                reason,
+            };
+            const tasks = snapshot.tasks
+                .filter((task) => [
+                "dependency_blocked",
+                "ready",
+                "round_succeeded",
+            ].includes(task.state))
+                .map((task) => ({
+                ...task,
+                state: "cancelled",
+                updated_at: now,
+            }));
+            const eventInputs = [];
+            if (snapshot.run.status !== "cancelling") {
+                eventInputs.push({
+                    run_id: runId,
+                    step_id: null,
+                    attempt_id: null,
+                    worker_session_id: null,
+                    result_id: null,
+                    idempotency_key: `run:${runId}:cancel-requested`,
+                    type: "run_cancel_requested",
+                    occurred_at: cancellation.requested_at,
+                    payload: { reason: cancellation.reason },
+                });
+            }
+            for (const task of tasks) {
+                const prior = snapshot.tasks.find((item) => item.step_id === task.step_id);
+                eventInputs.push({
+                    run_id: runId,
+                    step_id: task.step_id,
+                    attempt_id: null,
+                    worker_session_id: null,
+                    result_id: null,
+                    idempotency_key: `task:${task.step_id}:cancelled`,
+                    type: "task_state_changed",
+                    occurred_at: now,
+                    payload: { from: prior.state, to: "cancelled" },
+                });
+            }
+            const run = {
+                ...snapshot.run,
+                status: "cancelling",
+                cancellation,
+                updated_at: now,
+            };
+            try {
+                return (await this.updateRun({
+                    run_id: runId,
+                    expected_record_version: snapshot.record_version,
+                    run,
+                    tasks,
+                    events: eventInputs.map((input, index) => (legacyEvent(snapshot, index, input))),
+                })).snapshot;
+            }
+            catch (error) {
+                if (error instanceof RunStoreError && error.code === "version_conflict") {
+                    continue;
+                }
+                throw error;
+            }
+        }
+    }
+    async closeLegacyRun(runId, reason = null) {
+        assertString(runId, "run_id");
+        if (reason !== null && (typeof reason !== "string" || !reason.trim())) {
+            throw new RunStoreError("invalid_record", "legacy close reason must be a non-empty string or null");
+        }
+        while (true) {
+            const snapshot = await this.requireRun(runId);
+            if (snapshot.run.terminal !== null)
+                return snapshot;
+            const now = new Date().toISOString();
+            const terminalReason = reason
+                ?? snapshot.run.cancellation?.reason
+                ?? "legacy run closed";
+            const cancellation = snapshot.run.cancellation ?? {
+                requested_at: now,
+                reason: terminalReason,
+            };
+            const tasks = snapshot.tasks
+                .filter((task) => ![
+                "succeeded",
+                "failed",
+                "skipped",
+                "cancelled",
+            ].includes(task.state))
+                .map((task) => ({
+                ...task,
+                state: "cancelled",
+                updated_at: now,
+            }));
+            const attempts = snapshot.attempts
+                .filter((attempt) => attempt.phase !== "terminal")
+                .map((attempt) => ({
+                ...attempt,
+                phase: "terminal",
+                completed_at: now,
+                terminal_outcome: {
+                    kind: "cancelled",
+                    exit_code: null,
+                    signal: null,
+                    reason: terminalReason,
+                },
+            }));
+            const eventInputs = [];
+            if (snapshot.run.cancellation === null) {
+                eventInputs.push({
+                    run_id: runId,
+                    step_id: null,
+                    attempt_id: null,
+                    worker_session_id: null,
+                    result_id: null,
+                    idempotency_key: `run:${runId}:cancel-requested`,
+                    type: "run_cancel_requested",
+                    occurred_at: cancellation.requested_at,
+                    payload: { reason: cancellation.reason },
+                });
+            }
+            for (const task of tasks) {
+                const prior = snapshot.tasks.find((item) => item.step_id === task.step_id);
+                eventInputs.push({
+                    run_id: runId,
+                    step_id: task.step_id,
+                    attempt_id: null,
+                    worker_session_id: null,
+                    result_id: null,
+                    idempotency_key: `task:${task.step_id}:closed`,
+                    type: "task_state_changed",
+                    occurred_at: now,
+                    payload: { from: prior.state, to: "cancelled", close: true },
+                });
+            }
+            for (const attempt of attempts) {
+                eventInputs.push({
+                    run_id: runId,
+                    step_id: attempt.step_id,
+                    attempt_id: attempt.attempt_id,
+                    worker_session_id: attempt.worker_session_id,
+                    result_id: null,
+                    idempotency_key: `attempt:${attempt.attempt_id}:closed`,
+                    type: "attempt_terminal",
+                    occurred_at: now,
+                    payload: { outcome: "cancelled", reason: terminalReason, close: true },
+                });
+            }
+            eventInputs.push({
+                run_id: runId,
+                step_id: null,
+                attempt_id: null,
+                worker_session_id: null,
+                result_id: null,
+                idempotency_key: `run:${runId}:terminal:cancelled`,
+                type: "run_terminal",
+                occurred_at: now,
+                payload: { status: "cancelled", reason: terminalReason, close: true },
+            });
+            const run = {
+                ...snapshot.run,
+                status: "cancelled",
+                cancellation,
+                terminal: {
+                    status: "cancelled",
+                    reason: terminalReason,
+                    completed_at: now,
+                },
+                updated_at: now,
+            };
+            try {
+                return (await this.updateRun({
+                    run_id: runId,
+                    expected_record_version: snapshot.record_version,
+                    run,
+                    tasks,
+                    attempts,
+                    events: eventInputs.map((input, index) => (legacyEvent(snapshot, index, input))),
+                })).snapshot;
+            }
+            catch (error) {
+                if (error instanceof RunStoreError && error.code === "version_conflict") {
+                    continue;
+                }
+                throw error;
+            }
+        }
+    }
+    async loadAnyRun(runId) {
+        assertString(runId, "run_id");
+        return this.readAnySnapshot(runId);
+    }
+    async requireAnyRun(runId) {
+        const snapshot = await this.loadAnyRun(runId);
+        if (!snapshot) {
+            throw new RunStoreError("run_not_found", `run ${runId} was not found`);
+        }
+        return snapshot;
+    }
+    async loadCanonicalRun(runId) {
+        const snapshot = await this.loadAnyRun(runId);
+        if (snapshot !== null
+            && snapshot.schema_version === LEGACY_RUN_STORE_SCHEMA_VERSION) {
+            throw new RunStoreError("unsupported_legacy_run", `legacy run ${runId} cannot be loaded as a canonical run`);
+        }
+        return snapshot;
+    }
+    async requireCanonicalRun(runId) {
+        const snapshot = await this.loadCanonicalRun(runId);
+        if (!snapshot) {
+            throw new RunStoreError("run_not_found", `run ${runId} was not found`);
+        }
+        return snapshot;
+    }
     async updateRun(update) {
         assertString(update.run_id, "run_id");
         if (!Number.isSafeInteger(update.expected_record_version) ||
             update.expected_record_version < 1) {
             throw new RunStoreError("invalid_record", "expected_record_version must be a positive safe integer");
         }
-        return withRunLock(this.lockDirectory(update.run_id), this.options, async (lock) => {
+        while (true) {
             const current = await this.readSnapshot(update.run_id);
             if (!current) {
                 throw new RunStoreError("run_not_found", `run ${update.run_id} was not found`);
@@ -677,21 +2960,59 @@ export class DurableRunStore {
             if (current.record_version !== update.expected_record_version) {
                 throw new RunStoreError("version_conflict", `run ${update.run_id} is at version ${current.record_version}, expected ${update.expected_record_version}`);
             }
-            await lock.assertOwned();
-            await writeAtomic(this.ledgerPath(update.run_id), `${JSON.stringify(applied.snapshot, null, 2)}\n`);
+            if (!await this.commitSnapshot(applied.snapshot))
+                continue;
             return {
                 snapshot: applied.snapshot,
                 applied: true,
                 duplicate_event_ids: applied.duplicate_event_ids,
                 duplicate_result_ids: applied.duplicate_result_ids,
             };
-        });
+        }
     }
-    /**
-     * Reads every valid run ledger after restart. No worker-session directory is
-     * consulted, and this store intentionally exposes no worker cleanup operation.
-     */
-    async loadAllRuns() {
+    async updateCanonicalRun(update) {
+        assertString(update.run_id, "run_id");
+        assertPositiveSafeInteger(update.expected_record_version, "expected_record_version");
+        while (true) {
+            const anyCurrent = await this.readAnySnapshot(update.run_id);
+            if (!anyCurrent) {
+                throw new RunStoreError("run_not_found", `run ${update.run_id} was not found`);
+            }
+            if (anyCurrent.schema_version === LEGACY_RUN_STORE_SCHEMA_VERSION) {
+                throw new RunStoreError("unsupported_legacy_run", `legacy run ${update.run_id} cannot be updated by the canonical store`);
+            }
+            let applied;
+            try {
+                applied = applyCanonicalUpdate(anyCurrent, update);
+            }
+            catch (error) {
+                if (anyCurrent.record_version !== update.expected_record_version) {
+                    throw new RunStoreError("version_conflict", `run ${update.run_id} is at version ${anyCurrent.record_version}, expected ${update.expected_record_version}`);
+                }
+                throw error;
+            }
+            if (!applied.changed) {
+                return {
+                    snapshot: anyCurrent,
+                    applied: false,
+                    duplicate_event_ids: applied.duplicate_event_ids,
+                    duplicate_result_ids: applied.duplicate_result_ids,
+                };
+            }
+            if (anyCurrent.record_version !== update.expected_record_version) {
+                throw new RunStoreError("version_conflict", `run ${update.run_id} is at version ${anyCurrent.record_version}, expected ${update.expected_record_version}`);
+            }
+            if (!await this.commitSnapshot(applied.snapshot))
+                continue;
+            return {
+                snapshot: applied.snapshot,
+                applied: true,
+                duplicate_event_ids: applied.duplicate_event_ids,
+                duplicate_result_ids: applied.duplicate_result_ids,
+            };
+        }
+    }
+    async loadAllAnyRuns() {
         const runsDirectory = join(this.options.root_directory, "runs");
         let entries;
         try {
@@ -706,10 +3027,21 @@ export class DurableRunStore {
         for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
             if (!entry.isDirectory())
                 continue;
-            const ledgerPath = join(runsDirectory, entry.name, LEDGER_FILE_NAME);
+            const runDirectory = join(runsDirectory, entry.name);
+            const committed = await this.readCommittedHeadFromDirectory(runDirectory);
+            if (committed !== null) {
+                if (runStorageKey(committed.run.run_id) !== entry.name) {
+                    throw new RunStoreError("invalid_record", `run directory ${runDirectory} does not match run ${committed.run.run_id}`);
+                }
+                const projected = await this.projectCommittedHead(committed.run.run_id);
+                if (projected !== null)
+                    snapshots.push(projected);
+                continue;
+            }
+            const ledgerPath = join(runDirectory, LEDGER_FILE_NAME);
             try {
                 const raw = await readFile(ledgerPath, "utf8");
-                snapshots.push(assertSnapshot(JSON.parse(raw)));
+                snapshots.push(assertAnySnapshot(JSON.parse(raw)));
             }
             catch (error) {
                 if (isErrno(error, "ENOENT"))
@@ -722,4 +3054,14 @@ export class DurableRunStore {
         }
         return snapshots;
     }
+    /**
+     * Reads every valid legacy ledger after restart while allowing canonical
+     * ledgers to coexist in the same durable root.
+     */
+    async loadAllRuns() {
+        return (await this.loadAllAnyRuns()).filter((snapshot) => (snapshot.schema_version === LEGACY_RUN_STORE_SCHEMA_VERSION));
+    }
+    async loadAllCanonicalRuns() {
+        return (await this.loadAllAnyRuns()).filter((snapshot) => (snapshot.schema_version === CANONICAL_RUN_STORE_SCHEMA_VERSION));
+    }
 }