[zy95-12]

Written-by: Codex

Latest composition at cca28b2 (merge9d3ab4e40): updated Task/execution/context/governance integrated;31 selected SQL/persistence/authority/policy tests and core lint pass. Actual DSH canonical Chief admission and native Task-role return/continuation pass against independently read committed SQLite snapshots, including persisted activation intent, exit/release proofs and single-resource serialization. Model deterministic, actual code/host tests; no provider/production migration claim. Sixth runtime regression added; current composed full verify NOT rerun. Initial probe exposed an insertion-order assumption, not lost Attempts; predecessor references now establish chronology. Full mandatory policy cap stays384k; historical upstream inventory archived verbatim, active governing/automation rules unchanged. Prior full counts below belong to older named heads. Still Draft, no independent Review/main merge/deployment.

Refs #2182. Stacked on #2226, base feat/2179-task-lifecycle/4826723ccf02b159ccdd7ca0cbbb27ebffe631d0. Head8f7dffab7c341467aa381c92436f95751ac453b2.

The original Store can opt into stateStorage: sqlite without introducing another domain model, queue, identity or dispatcher. One SQL transaction commits changed domain records, normalized history and Effects; the existing save chain acknowledges Effects only after COMMIT. Global commit-revision compare-and-set supplements the exclusive home lock. WAL/FULL/foreign-key settings are configured and verified. Routine state/query APIs do not add model calls, change goal/scope or rewrite Project documents.

Migration validates original JSON ownership/schema, retains working Task/claim/Handoff/SDK Session/Effect IDs and publishes a newer-version JSON guard before SQL initialization. Prepared imports recover from a hashed immutable source; a missing active database refuses to silently revive an old import. SQL remains authoritative when the option is later omitted; JSON is not another writable mirror. Foreign/future schema, guard mismatch, invalid source and stale takeover fail closed.

Histories become separate rows; payloads above64KiB use private immutable hashed files with individual16MiB bounds. Existing artifacts/logs/workspaces stay in their original filesystem locations. Compatibility still hydrates/scans full runtime state; this is not constant-time persistence, memory eviction or a replacement for #2177 context budgets. Unreferenced payload collection and retention are not automatic.

Private offline inspect/export/rollback tools preserve the latest committed state and paired DB/WAL/SHM archives. A prepared rollback fences runtime startup/writes and resumes only its exact migration/export/revision. Remove explicit SQLite configuration before restarting on JSON. No live migration was performed.

Validation on the committed content: full TZ=UTC npm run verify 4610 passed,0 failures,0 skips, including4 actual DSH runtime checks with deterministic inference on their existing JSON configuration. New SQL tests include actual SIGKILL before/after COMMIT, injected transaction failure, Store+Effects restart, stale writer/readonly fencing, guard/import recovery, latest-state rollback and CLI/API checks. Selected41 passed; storage modules95.49–100%lines and81.82–87.50%branches. Original Project APIs against actual SQL persist Task/intake together with zero model calls; this is not real-provider full Task development acceptance. Parent-baseline missing-SQL/Store-integration reds retained. Main986399246 versus delivery741bf1ef scope is documented.

Included: architecture/subsystem/API configuration and recovery notes, PROJECT/ROADMAP/LESSONS, changelog and generated patches. README deployment overhaul remains last in #2189. Public scoped receipts/events/history #2185 and legacy cutover #2186 remain pending; SQL alone does not repair every pre-existing domain-level acknowledgement/replay contract. Original #2171 role governance and #2184 native Session/inflight acceptance also remain open. No merge/deploy/restart, control-plane/UI edit, new worker/timer or interruption of Task40/PR48. Draft; no independent Reviewer PASS.

[zy95-12]

Written-by: Codex

原PR推进到cca28b2a6，合成当前执行/上下文/Task。31项SQL/持久化/授权/规则检查及core lint通过；新增真实DSH+SQLite链路：Chief接纳、native角色打回后恢复同一Session/cwd、真实代码/宿主测试、持久化native.activate及退出证明、单资源无重叠。观察侧独立读取已提交数据库，模型明确为确定性替身。已加第6项运行时回归，当前组合全量尚未运行。

首次SQL探针发现旧断言误用UUID对象迭代顺序，实际两个Attempt和不同candidate均完好；现按feedback.previousAttemptId核对，不移除两次代码版本断言。规则预算失败后仅将显式历史上游mission/旧人名角色/资源清单4808字节全文归档并链接，当前治理/自动化约束原文保留，384k上限不变。

继续原接口PR组合，保持Draft，无主仓合并、部署、生产迁移或前端改动。

[zy95-12]

Owner 授权阶段合入 delivery，剩余范围转 #2292。当前 f08b8e9 基于已通过 tests-ok 的原源码 cca28b2，同步集成祖先并提前带入最终版本已有的 M7 历史原文归档；仅文档归档，不改变运行代码、规则来源、容量上限或测试断言。最终组合源码 d720f8c 已完整验证 4726 pass / 0 fail / 0 skip。正式签名 Reviewer 门禁留待正式合入，不伪造 PASS、不修改仓库规则、不声称 enqueue-guard 通过；新 SHA CI 状态另计。#2182 按 Owner 要求阶段归档，余项保留 #2292。不发布、不部署。