"""Fenced SQLite queue for deferred memory-pipeline work."""

from __future__ import annotations

import argparse
import email.utils
import hashlib
import json
import math
import multiprocessing
import os
import random
import re
import shutil
import signal
import sqlite3
import stat
import subprocess
import sys
import threading
import time
import uuid
from collections.abc import Callable, Iterator, Mapping
from contextlib import ExitStack, closing, contextmanager
from dataclasses import dataclass, replace
from datetime import date, datetime, timedelta, timezone
from pathlib import Path
from typing import TYPE_CHECKING, Any, Literal

if TYPE_CHECKING:
    from markdown_transaction import IntentFence
    from operational_ownership import OwnerLease

from reliable_memory import (
    DEFAULTS,
    MigrationStatement,
    OperationalDatabaseContract,
    OperationalDatabaseContractError,
    _set_owner_only,
    begin_immediate,
    canonical_json_bytes,
    fsync_directory,
    fsync_file,
    open_operational_db,
    open_readonly_operational_db,
    read_runtime_bytes,
    restricted_relative_path,
    run_resumable_migration,
    sha256_bytes,
    validate_schema,
)
from secret_redact import redact_secrets

_STATES = ("ready", "leased", "blocked", "succeeded", "dead", "cancelled")
_TERMINAL_STATES = ("succeeded", "dead", "cancelled")
_PERMANENT_CODES = {"invalid_input", "unsupported_version"}
_MAX_RETRY_AFTER_SECONDS = 7 * 24 * 60 * 60
_MAX_RESULT_BYTES = 16 * 1024 * 1024
_MAX_EXPORT_METADATA_BYTES = 64 * 1024 * 1024
_MAX_LEGACY_RECORD_BYTES = 16 * 1024 * 1024
_MAX_RUNTIME_ATTEMPTS = 100
_MAX_MARKER_BYTES = 64
_MAX_QUEUE_PAYLOAD_BYTES = 1024 * 1024
_MAX_QUEUE_DEPTH = 32
_MAX_QUEUE_STRING_BYTES = 256 * 1024
_MAX_QUEUE_CONTAINER_MEMBERS = 1024
_QUEUE_V3_CONTRACT = OperationalDatabaseContract(application_id=0x4C575133)
_SECRET_KEYS = {
    "api_key",
    "apikey",
    "authorization",
    "cookie",
    "credential",
    "credentials",
    "pass",
    "passwd",
    "passphrase",
    "password",
    "private_key",
    "secret",
    "set_cookie",
    "token",
}
_CAPTURE_TERMINAL_DISPOSITION_FIELDS = {
    "markdown_committed": {
        "kind",
        "transaction_id",
        "operation_id",
        "decision_sha256",
        "outputs",
    },
    "no_durable_content": {"kind", "decision_sha256"},
}

_QUEUE_V3_TABLE_SQL = (
    (
        "tasks",
        """CREATE TABLE tasks (
            id TEXT NOT NULL PRIMARY KEY CHECK (length(CAST(id AS BLOB)) BETWEEN 1 AND 256),
            kind TEXT NOT NULL CHECK (length(CAST(kind AS BLOB)) BETWEEN 1 AND 64),
            handler_version INTEGER NOT NULL CHECK (handler_version BETWEEN 1 AND 2147483647),
            payload_blob BLOB NOT NULL CHECK (length(payload_blob) <= 1048576),
            input_hash TEXT NOT NULL CHECK (
                length(input_hash) = 64 AND input_hash NOT GLOB '*[^0-9a-f]*'
            ),
            dedupe_key TEXT CHECK (
                dedupe_key IS NULL OR length(CAST(dedupe_key AS BLOB)) BETWEEN 1 AND 512
            ),
            state TEXT NOT NULL CHECK (state IN (
                'ready','leased','blocked','succeeded','dead','cancelled',
                'quarantine_pending','quarantined','purge_pending'
            )),
            priority INTEGER NOT NULL DEFAULT 0 CHECK (priority BETWEEN -100 AND 100),
            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL,
            available_at TEXT NOT NULL,
            attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts BETWEEN 0 AND 100),
            last_attempt_at TEXT,
            lease_owner TEXT CHECK (
                lease_owner IS NULL OR length(CAST(lease_owner AS BLOB)) <= 256
            ),
            lease_token TEXT CHECK (
                lease_token IS NULL OR length(CAST(lease_token AS BLOB)) <= 256
            ),
            lease_expires_at TEXT,
            lease_heartbeat_at TEXT,
            attempt_started_at TEXT,
            error_code TEXT CHECK (
                error_code IS NULL OR length(CAST(error_code AS BLOB)) BETWEEN 1 AND 64
            ),
            blocked_capability TEXT CHECK (
                blocked_capability IS NULL OR length(CAST(blocked_capability AS BLOB)) <= 128
            ),
            result_reference TEXT CHECK (
                result_reference IS NULL OR length(CAST(result_reference AS BLOB)) <= 4096
            ),
            result_sha256 TEXT CHECK (
                result_sha256 IS NULL OR (
                    length(result_sha256) = 64 AND result_sha256 NOT GLOB '*[^0-9a-f]*'
                )
            ),
            result_operation_id TEXT CHECK (
                result_operation_id IS NULL OR length(CAST(result_operation_id AS BLOB)) <= 4096
            ),
            redrive_of TEXT REFERENCES tasks(id),
            lineage_generation INTEGER NOT NULL DEFAULT 0 CHECK (lineage_generation >= 0)
        )""",
    ),
    (
        "attempt_history",
        """CREATE TABLE attempt_history (
            sequence INTEGER PRIMARY KEY AUTOINCREMENT,
            task_id TEXT NOT NULL REFERENCES tasks(id),
            attempt INTEGER NOT NULL CHECK (attempt BETWEEN 1 AND 100),
            started_at TEXT NOT NULL,
            finished_at TEXT NOT NULL,
            outcome TEXT NOT NULL CHECK (outcome IN (
                'succeeded','failed','blocked','cancelled','lease_expired'
            )),
            error_code TEXT CHECK (
                error_code IS NULL OR length(CAST(error_code AS BLOB)) BETWEEN 1 AND 64
            )
        )""",
    ),
    (
        "source_fences",
        """CREATE TABLE source_fences (
            logical_path TEXT NOT NULL CHECK (length(CAST(logical_path AS BLOB)) BETWEEN 1 AND 4096),
            source_digest TEXT NOT NULL CHECK (
                length(source_digest) = 64 AND source_digest NOT GLOB '*[^0-9a-f]*'
            ),
            token TEXT NOT NULL UNIQUE CHECK (length(CAST(token AS BLOB)) BETWEEN 1 AND 256),
            owner_pid INTEGER NOT NULL CHECK (owner_pid > 0),
            owner_start_identity TEXT NOT NULL CHECK (
                length(CAST(owner_start_identity AS BLOB)) BETWEEN 1 AND 512
            ),
            acquired_at TEXT NOT NULL,
            heartbeat_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            PRIMARY KEY(logical_path, source_digest)
        )""",
    ),
    (
        "source_failures",
        """CREATE TABLE source_failures (
            logical_path TEXT NOT NULL CHECK (length(CAST(logical_path AS BLOB)) BETWEEN 1 AND 4096),
            source_digest TEXT NOT NULL CHECK (
                length(source_digest) = 64 AND source_digest NOT GLOB '*[^0-9a-f]*'
            ),
            error_code TEXT NOT NULL CHECK (length(CAST(error_code AS BLOB)) BETWEEN 1 AND 64),
            producer TEXT NOT NULL CHECK (producer IN ('compile','queue')),
            updated_at TEXT NOT NULL,
            PRIMARY KEY(logical_path, source_digest)
        )""",
    ),
    (
        "task_source_links",
        """CREATE TABLE task_source_links (
            task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
            logical_path TEXT NOT NULL CHECK (length(CAST(logical_path AS BLOB)) BETWEEN 1 AND 4096),
            source_digest TEXT NOT NULL CHECK (
                length(source_digest) = 64 AND source_digest NOT GLOB '*[^0-9a-f]*'
            ),
            PRIMARY KEY(task_id, logical_path, source_digest)
        )""",
    ),
    (
        "queue_ownership",
        """CREATE TABLE queue_ownership (
            actor_id TEXT NOT NULL PRIMARY KEY CHECK (length(CAST(actor_id AS BLOB)) BETWEEN 1 AND 256),
            domain_role TEXT NOT NULL CHECK (domain_role IN ('worker','operator')),
            canonical_role TEXT NOT NULL CHECK (
                canonical_role IN (
                    'queue-worker','queue-operator','repair','compile','doctor','nightly','weekly'
                )
            ),
            canonical_scope TEXT NOT NULL CHECK (
                length(CAST(canonical_scope AS BLOB)) BETWEEN 1 AND 512
            ),
            owner_token TEXT NOT NULL UNIQUE CHECK (length(CAST(owner_token AS BLOB)) BETWEEN 1 AND 256),
            fencing_epoch INTEGER NOT NULL CHECK (fencing_epoch >= 1),
            process_id INTEGER NOT NULL CHECK (process_id > 0),
            process_start_identity TEXT NOT NULL CHECK (
                length(CAST(process_start_identity AS BLOB)) BETWEEN 1 AND 512
            ),
            acquired_at TEXT NOT NULL,
            heartbeat_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            UNIQUE(canonical_role, canonical_scope),
            CHECK (
                (domain_role = 'worker' AND canonical_role IN (
                    'queue-worker','compile','doctor','nightly','weekly'
                ))
                OR
                (domain_role = 'operator' AND canonical_role IN ('queue-operator','repair'))
            )
        )""",
    ),
    (
        "task_purge_authorizations",
        """CREATE TABLE task_purge_authorizations (
            task_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(CAST(task_id AS BLOB)) BETWEEN 1 AND 256
            ),
            mode TEXT NOT NULL CHECK (mode IN ('ordinary','corrupt-lineage','corrupt-parent')),
            operation_id TEXT NOT NULL CHECK (
                length(CAST(operation_id AS BLOB)) BETWEEN 1 AND 4096
            ),
            authorization_digest TEXT NOT NULL CHECK (
                length(authorization_digest) = 64
                AND authorization_digest NOT GLOB '*[^0-9a-f]*'
            ),
            created_at TEXT NOT NULL
        )""",
    ),
    (
        "capture_intents",
        """CREATE TABLE capture_intents (
            intent_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(intent_id) = 64 AND intent_id NOT GLOB '*[^0-9a-f]*'
            ),
            relative_path TEXT NOT NULL CHECK (length(CAST(relative_path AS BLOB)) BETWEEN 1 AND 4096),
            intent_sha256 TEXT NOT NULL CHECK (
                length(intent_sha256) = 64 AND intent_sha256 NOT GLOB '*[^0-9a-f]*'
            ),
            byte_size INTEGER NOT NULL CHECK (byte_size BETWEEN 1 AND 1048576),
            publication_state TEXT NOT NULL CHECK (publication_state IN ('pending','ready')),
            updated_at TEXT NOT NULL
        )""",
    ),
    (
        "capture_task_links",
        """CREATE TABLE capture_task_links (
            task_id TEXT NOT NULL PRIMARY KEY REFERENCES tasks(id),
            intent_id TEXT NOT NULL REFERENCES capture_intents(intent_id),
            intent_sha256 TEXT NOT NULL CHECK (
                length(intent_sha256) = 64 AND intent_sha256 NOT GLOB '*[^0-9a-f]*'
            ),
            handler_version INTEGER NOT NULL CHECK (handler_version BETWEEN 1 AND 2147483647),
            link_digest TEXT NOT NULL UNIQUE CHECK (
                length(link_digest) = 64 AND link_digest NOT GLOB '*[^0-9a-f]*'
            ),
            created_at TEXT NOT NULL
        )""",
    ),
    (
        "capture_task_link_resolutions",
        """CREATE TABLE capture_task_link_resolutions (
            resolution_digest TEXT NOT NULL PRIMARY KEY CHECK (
                length(resolution_digest) = 64 AND resolution_digest NOT GLOB '*[^0-9a-f]*'
            ),
            task_id TEXT NOT NULL REFERENCES tasks(id),
            supersedes_digest TEXT UNIQUE CHECK (
                supersedes_digest IS NULL OR (
                    length(supersedes_digest) = 64
                    AND supersedes_digest NOT GLOB '*[^0-9a-f]*'
                )
            ),
            observed_json BLOB NOT NULL CHECK (length(observed_json) <= 65536),
            selected_intent_id TEXT REFERENCES capture_intents(intent_id),
            actor_identity TEXT NOT NULL CHECK (length(CAST(actor_identity AS BLOB)) BETWEEN 1 AND 512),
            reason TEXT NOT NULL CHECK (length(CAST(reason AS BLOB)) BETWEEN 1 AND 4096),
            created_at TEXT NOT NULL
        )""",
    ),
    (
        "capture_task_link_seals",
        """CREATE TABLE capture_task_link_seals (
            task_id TEXT NOT NULL PRIMARY KEY REFERENCES tasks(id),
            active_digest TEXT NOT NULL CHECK (
                length(active_digest) = 64 AND active_digest NOT GLOB '*[^0-9a-f]*'
            ),
            consumer_kind TEXT NOT NULL CHECK (consumer_kind IN (
                'semantic-decision','transaction','terminal','corrupt-disposition'
            )),
            consumer_id TEXT NOT NULL CHECK (length(CAST(consumer_id AS BLOB)) BETWEEN 1 AND 4096),
            seal_digest TEXT NOT NULL UNIQUE CHECK (
                length(seal_digest) = 64 AND seal_digest NOT GLOB '*[^0-9a-f]*'
            ),
            sealed_at TEXT NOT NULL
        )""",
    ),
    (
        "semantic_decisions",
        """CREATE TABLE semantic_decisions (
            intent_id TEXT NOT NULL REFERENCES capture_intents(intent_id),
            stage TEXT NOT NULL CHECK (stage IN ('flush','feedback','feedback-verify')),
            decision_path TEXT NOT NULL CHECK (length(CAST(decision_path AS BLOB)) BETWEEN 1 AND 4096),
            decision_sha256 TEXT NOT NULL CHECK (
                length(decision_sha256) = 64 AND decision_sha256 NOT GLOB '*[^0-9a-f]*'
            ),
            active_link_digest TEXT NOT NULL CHECK (
                length(active_link_digest) = 64 AND active_link_digest NOT GLOB '*[^0-9a-f]*'
            ),
            publication_state TEXT NOT NULL CHECK (publication_state = 'published'),
            published_at TEXT NOT NULL,
            PRIMARY KEY(intent_id, stage)
        )""",
    ),
    (
        "task_fence_epochs",
        """CREATE TABLE task_fence_epochs (
            task_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(CAST(task_id AS BLOB)) BETWEEN 1 AND 256
            ),
            last_epoch INTEGER NOT NULL CHECK (last_epoch >= 0)
        )""",
    ),
    (
        "task_fences",
        """CREATE TABLE task_fences (
            task_id TEXT NOT NULL PRIMARY KEY REFERENCES tasks(id),
            mode TEXT NOT NULL CHECK (mode IN ('worker','queue-operator')),
            token TEXT NOT NULL UNIQUE CHECK (length(CAST(token AS BLOB)) BETWEEN 1 AND 256),
            fencing_epoch INTEGER NOT NULL CHECK (fencing_epoch >= 1),
            canonical_role TEXT NOT NULL CHECK (canonical_role IN (
                'queue-worker','compile','doctor','nightly','weekly','queue-operator','repair'
            )),
            canonical_scope TEXT NOT NULL CHECK (length(CAST(canonical_scope AS BLOB)) BETWEEN 1 AND 512),
            canonical_actor_id TEXT NOT NULL CHECK (length(CAST(canonical_actor_id AS BLOB)) BETWEEN 1 AND 256),
            canonical_owner_token TEXT NOT NULL CHECK (length(CAST(canonical_owner_token AS BLOB)) BETWEEN 1 AND 256),
            canonical_fencing_epoch INTEGER NOT NULL CHECK (canonical_fencing_epoch >= 1),
            process_id INTEGER NOT NULL CHECK (process_id > 0),
            process_start_identity TEXT NOT NULL CHECK (
                length(CAST(process_start_identity AS BLOB)) BETWEEN 1 AND 512
            ),
            heartbeat_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            CHECK (
                (mode = 'worker' AND canonical_role IN (
                    'queue-worker','compile','doctor','nightly','weekly'
                ))
                OR
                (mode = 'queue-operator' AND canonical_role IN ('queue-operator','repair'))
            )
        )""",
    ),
    (
        "corrupt_export_operations",
        """CREATE TABLE corrupt_export_operations (
            operation_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(CAST(operation_id AS BLOB)) BETWEEN 1 AND 4096
            ),
            task_id TEXT NOT NULL UNIQUE CHECK (length(CAST(task_id AS BLOB)) BETWEEN 1 AND 256),
            disposition_key TEXT NOT NULL UNIQUE CHECK (
                length(disposition_key) = 64 AND disposition_key NOT GLOB '*[^0-9a-f]*'
            ),
            task_fence_token_digest TEXT NOT NULL CHECK (
                length(task_fence_token_digest) = 64
                AND task_fence_token_digest NOT GLOB '*[^0-9a-f]*'
            ),
            task_fence_epoch INTEGER NOT NULL CHECK (task_fence_epoch >= 1),
            intent_fence_digest TEXT CHECK (
                intent_fence_digest IS NULL OR (
                    length(intent_fence_digest) = 64
                    AND intent_fence_digest NOT GLOB '*[^0-9a-f]*'
                )
            ),
            raw_sha256 TEXT NOT NULL CHECK (length(raw_sha256) = 64 AND raw_sha256 NOT GLOB '*[^0-9a-f]*'),
            history_sha256 TEXT NOT NULL CHECK (length(history_sha256) = 64 AND history_sha256 NOT GLOB '*[^0-9a-f]*'),
            metadata_sha256 TEXT NOT NULL CHECK (length(metadata_sha256) = 64 AND metadata_sha256 NOT GLOB '*[^0-9a-f]*'),
            lineage_generation INTEGER NOT NULL CHECK (lineage_generation >= 0),
            cursor_task_id TEXT NOT NULL DEFAULT '' CHECK (length(CAST(cursor_task_id AS BLOB)) <= 256),
            link_count INTEGER NOT NULL DEFAULT 0 CHECK (link_count >= 0),
            page_count INTEGER NOT NULL DEFAULT 0 CHECK (page_count >= 0),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            state TEXT NOT NULL CHECK (state IN ('exporting','manifested','disposed')),
            actor_identity TEXT NOT NULL CHECK (length(CAST(actor_identity AS BLOB)) BETWEEN 1 AND 512),
            reason TEXT NOT NULL CHECK (length(CAST(reason AS BLOB)) BETWEEN 1 AND 4096),
            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )""",
    ),
    (
        "corrupt_export_pages",
        """CREATE TABLE corrupt_export_pages (
            operation_id TEXT NOT NULL REFERENCES corrupt_export_operations(operation_id),
            page_number INTEGER NOT NULL CHECK (page_number >= 1),
            first_task_id TEXT NOT NULL CHECK (length(CAST(first_task_id AS BLOB)) BETWEEN 1 AND 256),
            last_task_id TEXT NOT NULL CHECK (length(CAST(last_task_id AS BLOB)) BETWEEN 1 AND 256),
            link_count INTEGER NOT NULL CHECK (link_count BETWEEN 1 AND 1000),
            page_sha256 TEXT NOT NULL CHECK (length(page_sha256) = 64 AND page_sha256 NOT GLOB '*[^0-9a-f]*'),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            PRIMARY KEY(operation_id, page_number)
        )""",
    ),
    (
        "corrupt_dispositions",
        """CREATE TABLE corrupt_dispositions (
            task_id TEXT NOT NULL PRIMARY KEY CHECK (length(CAST(task_id AS BLOB)) BETWEEN 1 AND 256),
            operation_id TEXT NOT NULL UNIQUE REFERENCES corrupt_export_operations(operation_id),
            package_path TEXT NOT NULL CHECK (length(CAST(package_path AS BLOB)) BETWEEN 1 AND 4096),
            manifest_sha256 TEXT NOT NULL CHECK (length(manifest_sha256) = 64 AND manifest_sha256 NOT GLOB '*[^0-9a-f]*'),
            disposition_sha256 TEXT NOT NULL CHECK (length(disposition_sha256) = 64 AND disposition_sha256 NOT GLOB '*[^0-9a-f]*'),
            active_link_digest TEXT CHECK (
                active_link_digest IS NULL OR (
                    length(active_link_digest) = 64
                    AND active_link_digest NOT GLOB '*[^0-9a-f]*'
                )
            ),
            disposed_at TEXT NOT NULL
        )""",
    ),
    (
        "corrupt_package_supersession_operations",
        """CREATE TABLE corrupt_package_supersession_operations (
            operation_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(CAST(operation_id AS BLOB)) BETWEEN 1 AND 4096
            ),
            package_key TEXT NOT NULL UNIQUE CHECK (
                length(package_key) = 64 AND package_key NOT GLOB '*[^0-9a-f]*'
            ),
            package_path TEXT NOT NULL CHECK (length(CAST(package_path AS BLOB)) BETWEEN 1 AND 4096),
            cursor_name TEXT NOT NULL DEFAULT '' CHECK (
                length(CAST(cursor_name AS BLOB)) <= 256
            ),
            file_count INTEGER NOT NULL DEFAULT 0 CHECK (file_count >= 0),
            page_count INTEGER NOT NULL DEFAULT 0 CHECK (page_count >= 0),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            state TEXT NOT NULL CHECK (state IN ('scanning','disposed')),
            actor_identity TEXT NOT NULL CHECK (length(CAST(actor_identity AS BLOB)) BETWEEN 1 AND 512),
            reason TEXT NOT NULL CHECK (length(CAST(reason AS BLOB)) BETWEEN 1 AND 4096),
            chosen_at TEXT NOT NULL,
            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )""",
    ),
    (
        "corrupt_package_supersession_pages",
        """CREATE TABLE corrupt_package_supersession_pages (
            operation_id TEXT NOT NULL REFERENCES corrupt_package_supersession_operations(operation_id),
            page_number INTEGER NOT NULL CHECK (page_number >= 1),
            first_name TEXT NOT NULL CHECK (
                length(CAST(first_name AS BLOB)) BETWEEN 1 AND 256
            ),
            last_name TEXT NOT NULL CHECK (
                length(CAST(last_name AS BLOB)) BETWEEN 1 AND 256
            ),
            file_count INTEGER NOT NULL CHECK (file_count BETWEEN 1 AND 1000),
            page_sha256 TEXT NOT NULL CHECK (length(page_sha256) = 64 AND page_sha256 NOT GLOB '*[^0-9a-f]*'),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            PRIMARY KEY(operation_id, page_number)
        )""",
    ),
    (
        "corrupt_package_supersessions",
        """CREATE TABLE corrupt_package_supersessions (
            package_key TEXT NOT NULL PRIMARY KEY CHECK (
                length(package_key) = 64 AND package_key NOT GLOB '*[^0-9a-f]*'
            ),
            operation_id TEXT NOT NULL UNIQUE REFERENCES corrupt_package_supersession_operations(operation_id),
            observed_file_count INTEGER NOT NULL CHECK (observed_file_count >= 0),
            observed_root TEXT NOT NULL CHECK (length(observed_root) = 64 AND observed_root NOT GLOB '*[^0-9a-f]*'),
            record_path TEXT NOT NULL CHECK (length(CAST(record_path AS BLOB)) BETWEEN 1 AND 4096),
            record_sha256 TEXT NOT NULL CHECK (length(record_sha256) = 64 AND record_sha256 NOT GLOB '*[^0-9a-f]*'),
            disposed_at TEXT NOT NULL
        )""",
    ),
    (
        "corrupt_purge_operations",
        """CREATE TABLE corrupt_purge_operations (
            operation_id TEXT NOT NULL PRIMARY KEY CHECK (
                length(CAST(operation_id AS BLOB)) BETWEEN 1 AND 4096
            ),
            task_id TEXT NOT NULL UNIQUE CHECK (length(CAST(task_id AS BLOB)) BETWEEN 1 AND 256),
            purge_token TEXT NOT NULL UNIQUE CHECK (length(CAST(purge_token AS BLOB)) BETWEEN 1 AND 256),
            expected_generation INTEGER NOT NULL CHECK (expected_generation >= 0),
            cursor_task_id TEXT NOT NULL DEFAULT '' CHECK (length(CAST(cursor_task_id AS BLOB)) <= 256),
            page_count INTEGER NOT NULL DEFAULT 0 CHECK (page_count >= 0),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            state TEXT NOT NULL CHECK (state IN ('purging','receipt-published')),
            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )""",
    ),
    (
        "corrupt_purge_pages",
        """CREATE TABLE corrupt_purge_pages (
            operation_id TEXT NOT NULL REFERENCES corrupt_purge_operations(operation_id),
            page_number INTEGER NOT NULL CHECK (page_number >= 1),
            first_task_id TEXT NOT NULL CHECK (length(CAST(first_task_id AS BLOB)) BETWEEN 1 AND 256),
            last_task_id TEXT NOT NULL CHECK (length(CAST(last_task_id AS BLOB)) BETWEEN 1 AND 256),
            deleted_link_count INTEGER NOT NULL CHECK (deleted_link_count BETWEEN 1 AND 1000),
            page_sha256 TEXT NOT NULL CHECK (length(page_sha256) = 64 AND page_sha256 NOT GLOB '*[^0-9a-f]*'),
            rolling_root TEXT NOT NULL CHECK (length(rolling_root) = 64 AND rolling_root NOT GLOB '*[^0-9a-f]*'),
            expected_generation INTEGER NOT NULL CHECK (expected_generation >= 0),
            PRIMARY KEY(operation_id, page_number)
        )""",
    ),
)

_QUEUE_V3_INDEX_SQL = (
    (
        "queue_dedupe_identity",
        "CREATE UNIQUE INDEX queue_dedupe_identity ON tasks(dedupe_key) WHERE dedupe_key IS NOT NULL",
    ),
    (
        "queue_claim_order",
        "CREATE INDEX queue_claim_order ON tasks(state, priority DESC, available_at, created_at, id)",
    ),
    (
        "queue_redrive_parent",
        "CREATE INDEX queue_redrive_parent ON tasks(redrive_of, id)",
    ),
    (
        "queue_attempt_history",
        "CREATE INDEX queue_attempt_history ON attempt_history(task_id, sequence)",
    ),
    (
        "queue_source_tasks",
        "CREATE INDEX queue_source_tasks ON task_source_links(logical_path, source_digest, task_id)",
    ),
)

_QUEUE_V3_TRIGGER_SQL = (
    (
        "attempt_history_immutable_update",
        """CREATE TRIGGER attempt_history_immutable_update
        BEFORE UPDATE ON attempt_history
        BEGIN SELECT RAISE(ABORT, 'attempt history is immutable'); END""",
    ),
    (
        "attempt_history_authorized_delete",
        """CREATE TRIGGER attempt_history_authorized_delete
        BEFORE DELETE ON attempt_history
        WHEN NOT EXISTS (
            SELECT 1
            FROM task_purge_authorizations AS authorization
            LEFT JOIN corrupt_purge_operations AS operation
              ON operation.operation_id=authorization.operation_id
            LEFT JOIN tasks AS authorized_task
              ON authorized_task.id=authorization.task_id
            WHERE authorization.task_id=OLD.task_id AND (
                authorization.mode='ordinary'
                OR (
                    authorization.mode='corrupt-lineage'
                    AND operation.state='purging'
                    AND authorized_task.redrive_of=operation.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
                OR (
                    authorization.mode='corrupt-parent'
                    AND operation.state='receipt-published'
                    AND operation.task_id=authorization.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'attempt history delete is unauthorized'); END""",
    ),
    (
        "tasks_authorized_delete",
        """CREATE TRIGGER tasks_authorized_delete
        BEFORE DELETE ON tasks
        WHEN NOT EXISTS (
            SELECT 1
            FROM task_purge_authorizations AS authorization
            LEFT JOIN corrupt_purge_operations AS operation
              ON operation.operation_id=authorization.operation_id
            WHERE authorization.task_id=OLD.id AND (
                authorization.mode='ordinary'
                OR (
                    authorization.mode='corrupt-lineage'
                    AND operation.state='purging'
                    AND OLD.redrive_of=operation.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
                OR (
                    authorization.mode='corrupt-parent'
                    AND operation.state='receipt-published'
                    AND operation.task_id=OLD.id
                    AND authorization.authorization_digest=operation.purge_token
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'task delete is unauthorized'); END""",
    ),
    (
        "attempt_history_bounded_insert",
        """CREATE TRIGGER attempt_history_bounded_insert
        BEFORE INSERT ON attempt_history
        WHEN (SELECT COUNT(*) FROM attempt_history WHERE task_id=NEW.task_id) >= 100
        BEGIN SELECT RAISE(ABORT, 'attempt history limit exceeded'); END""",
    ),
    (
        "capture_task_links_immutable_update",
        """CREATE TRIGGER capture_task_links_immutable_update
        BEFORE UPDATE ON capture_task_links
        BEGIN SELECT RAISE(ABORT, 'capture task links are immutable'); END""",
    ),
    (
        "capture_task_links_authorized_delete",
        """CREATE TRIGGER capture_task_links_authorized_delete
        BEFORE DELETE ON capture_task_links
        WHEN NOT EXISTS (
            SELECT 1
            FROM task_purge_authorizations AS authorization
            LEFT JOIN corrupt_purge_operations AS operation
              ON operation.operation_id=authorization.operation_id
            LEFT JOIN tasks AS authorized_task
              ON authorized_task.id=authorization.task_id
            WHERE authorization.task_id=OLD.task_id AND (
                authorization.mode='ordinary'
                OR (
                    authorization.mode='corrupt-lineage'
                    AND operation.state='purging'
                    AND authorized_task.redrive_of=operation.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
                OR (
                    authorization.mode='corrupt-parent'
                    AND operation.state='receipt-published'
                    AND operation.task_id=authorization.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'capture task link delete is unauthorized'); END""",
    ),
    (
        "capture_task_link_resolutions_immutable_update",
        """CREATE TRIGGER capture_task_link_resolutions_immutable_update
        BEFORE UPDATE ON capture_task_link_resolutions
        BEGIN SELECT RAISE(ABORT, 'capture task link resolutions are immutable'); END""",
    ),
    (
        "capture_task_link_resolutions_authorized_delete",
        """CREATE TRIGGER capture_task_link_resolutions_authorized_delete
        BEFORE DELETE ON capture_task_link_resolutions
        WHEN NOT EXISTS (
            SELECT 1
            FROM task_purge_authorizations AS authorization
            LEFT JOIN corrupt_purge_operations AS operation
              ON operation.operation_id=authorization.operation_id
            LEFT JOIN tasks AS authorized_task
              ON authorized_task.id=authorization.task_id
            WHERE authorization.task_id=OLD.task_id AND (
                authorization.mode='ordinary'
                OR (
                    authorization.mode='corrupt-lineage'
                    AND operation.state='purging'
                    AND authorized_task.redrive_of=operation.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
                OR (
                    authorization.mode='corrupt-parent'
                    AND operation.state='receipt-published'
                    AND operation.task_id=authorization.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'capture task link resolution delete is unauthorized'); END""",
    ),
    (
        "capture_task_link_seals_immutable_update",
        """CREATE TRIGGER capture_task_link_seals_immutable_update
        BEFORE UPDATE ON capture_task_link_seals
        BEGIN SELECT RAISE(ABORT, 'capture task link seals are immutable'); END""",
    ),
    (
        "capture_task_link_seals_authorized_delete",
        """CREATE TRIGGER capture_task_link_seals_authorized_delete
        BEFORE DELETE ON capture_task_link_seals
        WHEN NOT EXISTS (
            SELECT 1
            FROM task_purge_authorizations AS authorization
            LEFT JOIN corrupt_purge_operations AS operation
              ON operation.operation_id=authorization.operation_id
            LEFT JOIN tasks AS authorized_task
              ON authorized_task.id=authorization.task_id
            WHERE authorization.task_id=OLD.task_id AND (
                authorization.mode='ordinary'
                OR (
                    authorization.mode='corrupt-lineage'
                    AND operation.state='purging'
                    AND authorized_task.redrive_of=operation.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
                OR (
                    authorization.mode='corrupt-parent'
                    AND operation.state='receipt-published'
                    AND operation.task_id=authorization.task_id
                    AND authorization.authorization_digest=operation.purge_token
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'capture task link seal delete is unauthorized'); END""",
    ),
    (
        "semantic_decisions_immutable_update",
        """CREATE TRIGGER semantic_decisions_immutable_update
        BEFORE UPDATE ON semantic_decisions
        BEGIN SELECT RAISE(ABORT, 'semantic decisions are immutable'); END""",
    ),
    (
        "semantic_decisions_authorized_delete",
        """CREATE TRIGGER semantic_decisions_authorized_delete
        BEFORE DELETE ON semantic_decisions
        WHEN NOT EXISTS (
            SELECT 1
            FROM capture_task_links AS link
            JOIN task_purge_authorizations AS authorization
              ON authorization.task_id=link.task_id
            WHERE authorization.mode='ordinary' AND (
                (
                    link.intent_id=OLD.intent_id
                    AND link.link_digest=OLD.active_link_digest
                )
                OR EXISTS (
                    SELECT 1 FROM capture_task_link_resolutions AS resolution
                    WHERE resolution.task_id=link.task_id
                      AND resolution.selected_intent_id=OLD.intent_id
                      AND resolution.resolution_digest=OLD.active_link_digest
                )
            )
        )
        BEGIN SELECT RAISE(ABORT, 'semantic decision delete is unauthorized'); END""",
    ),
    (
        "queue_lineage_guard_insert",
        """CREATE TRIGGER queue_lineage_guard_insert
        BEFORE INSERT ON tasks
        WHEN NEW.redrive_of IS NOT NULL AND EXISTS (
            SELECT 1 FROM tasks parent
            WHERE parent.id=NEW.redrive_of
              AND parent.state IN ('quarantine_pending','quarantined','purge_pending')
        )
        BEGIN SELECT RAISE(ABORT, 'redrive lineage is frozen'); END""",
    ),
    (
        "queue_lineage_insert",
        """CREATE TRIGGER queue_lineage_insert
        AFTER INSERT ON tasks
        WHEN NEW.redrive_of IS NOT NULL
        BEGIN
            UPDATE tasks SET lineage_generation=lineage_generation+1
            WHERE id=NEW.redrive_of;
        END""",
    ),
    (
        "queue_lineage_guard_update",
        """CREATE TRIGGER queue_lineage_guard_update
        BEFORE UPDATE OF redrive_of ON tasks
        WHEN OLD.redrive_of IS NOT NEW.redrive_of AND (
            EXISTS (
                SELECT 1 FROM tasks parent
                WHERE parent.id=OLD.redrive_of
                  AND parent.state IN ('quarantine_pending','quarantined','purge_pending')
            ) OR EXISTS (
                SELECT 1 FROM tasks parent
                WHERE parent.id=NEW.redrive_of
                  AND parent.state IN ('quarantine_pending','quarantined','purge_pending')
            )
        )
        BEGIN SELECT RAISE(ABORT, 'redrive lineage is frozen'); END""",
    ),
    (
        "queue_lineage_update_old",
        """CREATE TRIGGER queue_lineage_update_old
        AFTER UPDATE OF redrive_of ON tasks
        WHEN OLD.redrive_of IS NOT NEW.redrive_of AND OLD.redrive_of IS NOT NULL
        BEGIN
            UPDATE tasks SET lineage_generation=lineage_generation+1
            WHERE id=OLD.redrive_of;
        END""",
    ),
    (
        "queue_lineage_update_new",
        """CREATE TRIGGER queue_lineage_update_new
        AFTER UPDATE OF redrive_of ON tasks
        WHEN OLD.redrive_of IS NOT NEW.redrive_of AND NEW.redrive_of IS NOT NULL
        BEGIN
            UPDATE tasks SET lineage_generation=lineage_generation+1
            WHERE id=NEW.redrive_of;
        END""",
    ),
    (
        "queue_lineage_guard_delete",
        """CREATE TRIGGER queue_lineage_guard_delete
        BEFORE DELETE ON tasks
        WHEN OLD.redrive_of IS NOT NULL
          AND EXISTS (
              SELECT 1 FROM tasks parent
              WHERE parent.id=OLD.redrive_of
                AND parent.state IN ('quarantine_pending','quarantined','purge_pending')
          )
          AND NOT EXISTS (
              SELECT 1 FROM task_purge_authorizations
              JOIN corrupt_purge_operations
                ON corrupt_purge_operations.operation_id=task_purge_authorizations.operation_id
               AND corrupt_purge_operations.task_id=task_purge_authorizations.task_id
              WHERE task_purge_authorizations.task_id=OLD.redrive_of
                AND task_purge_authorizations.mode='corrupt-lineage'
                AND corrupt_purge_operations.state='purging'
                AND task_purge_authorizations.authorization_digest=
                    corrupt_purge_operations.purge_token
          )
        BEGIN SELECT RAISE(ABORT, 'redrive lineage is frozen'); END""",
    ),
    (
        "queue_lineage_delete",
        """CREATE TRIGGER queue_lineage_delete
        AFTER DELETE ON tasks
        WHEN OLD.redrive_of IS NOT NULL
        BEGIN
            UPDATE tasks SET lineage_generation=lineage_generation+1
            WHERE id=OLD.redrive_of;
        END""",
    ),
)

_QUEUE_V3_TRIGGER_SQL += tuple(
    (
        f"{table}_immutable_{operation}",
        f"""CREATE TRIGGER {table}_immutable_{operation}
        BEFORE {operation.upper()} ON {table}
        BEGIN SELECT RAISE(ABORT, '{table} rows are immutable'); END""",
    )
    for table in (
        "corrupt_export_pages",
        "corrupt_dispositions",
        "corrupt_package_supersession_pages",
        "corrupt_package_supersessions",
        "corrupt_purge_pages",
    )
    for operation in ("update", "delete")
)

_QUEUE_V3_TRIGGER_SQL += (
    (
        "corrupt_export_operations_immutable_delete",
        """CREATE TRIGGER corrupt_export_operations_immutable_delete
        BEFORE DELETE ON corrupt_export_operations
        BEGIN SELECT RAISE(ABORT, 'corrupt export operations cannot be deleted'); END""",
    ),
    (
        "corrupt_export_operations_monotonic_update",
        """CREATE TRIGGER corrupt_export_operations_monotonic_update
        BEFORE UPDATE ON corrupt_export_operations
        WHEN NOT (
            NEW.operation_id IS OLD.operation_id
            AND NEW.task_id IS OLD.task_id
            AND NEW.disposition_key IS OLD.disposition_key
            AND NEW.task_fence_token_digest IS OLD.task_fence_token_digest
            AND NEW.task_fence_epoch IS OLD.task_fence_epoch
            AND NEW.intent_fence_digest IS OLD.intent_fence_digest
            AND NEW.raw_sha256 IS OLD.raw_sha256
            AND NEW.history_sha256 IS OLD.history_sha256
            AND NEW.metadata_sha256 IS OLD.metadata_sha256
            AND NEW.lineage_generation IS OLD.lineage_generation
            AND NEW.actor_identity IS OLD.actor_identity
            AND NEW.reason IS OLD.reason
            AND NEW.created_at IS OLD.created_at
            AND NEW.cursor_task_id >= OLD.cursor_task_id
            AND NEW.link_count >= OLD.link_count
            AND NEW.page_count >= OLD.page_count
            AND NEW.updated_at >= OLD.updated_at
            AND (
                NEW.state = OLD.state
                OR (OLD.state='exporting' AND NEW.state='manifested')
                OR (OLD.state='manifested' AND NEW.state='disposed')
            )
            AND (
                NEW.rolling_root IS OLD.rolling_root
                OR NEW.cursor_task_id > OLD.cursor_task_id
                OR NEW.link_count > OLD.link_count
                OR NEW.page_count > OLD.page_count
            )
        )
        BEGIN SELECT RAISE(ABORT, 'corrupt export operation update is not monotonic'); END""",
    ),
    (
        "corrupt_package_supersession_operations_immutable_delete",
        """CREATE TRIGGER corrupt_package_supersession_operations_immutable_delete
        BEFORE DELETE ON corrupt_package_supersession_operations
        BEGIN SELECT RAISE(ABORT, 'package supersession operations cannot be deleted'); END""",
    ),
    (
        "corrupt_package_supersession_operations_monotonic_update",
        """CREATE TRIGGER corrupt_package_supersession_operations_monotonic_update
        BEFORE UPDATE ON corrupt_package_supersession_operations
        WHEN NOT (
            NEW.operation_id IS OLD.operation_id
            AND NEW.package_key IS OLD.package_key
            AND NEW.package_path IS OLD.package_path
            AND NEW.actor_identity IS OLD.actor_identity
            AND NEW.reason IS OLD.reason
            AND NEW.chosen_at IS OLD.chosen_at
            AND NEW.created_at IS OLD.created_at
            AND NEW.cursor_name >= OLD.cursor_name
            AND NEW.file_count >= OLD.file_count
            AND NEW.page_count >= OLD.page_count
            AND NEW.updated_at >= OLD.updated_at
            AND (
                NEW.state = OLD.state
                OR (OLD.state='scanning' AND NEW.state='disposed')
            )
            AND (
                NEW.rolling_root IS OLD.rolling_root
                OR NEW.cursor_name > OLD.cursor_name
                OR NEW.file_count > OLD.file_count
                OR NEW.page_count > OLD.page_count
            )
        )
        BEGIN SELECT RAISE(ABORT, 'package supersession update is not monotonic'); END""",
    ),
    (
        "corrupt_purge_operations_immutable_delete",
        """CREATE TRIGGER corrupt_purge_operations_immutable_delete
        BEFORE DELETE ON corrupt_purge_operations
        BEGIN SELECT RAISE(ABORT, 'corrupt purge operations cannot be deleted'); END""",
    ),
    (
        "corrupt_purge_operations_monotonic_update",
        """CREATE TRIGGER corrupt_purge_operations_monotonic_update
        BEFORE UPDATE ON corrupt_purge_operations
        WHEN NOT (
            NEW.operation_id IS OLD.operation_id
            AND NEW.task_id IS OLD.task_id
            AND NEW.purge_token IS OLD.purge_token
            AND NEW.expected_generation >= OLD.expected_generation
            AND NEW.created_at IS OLD.created_at
            AND NEW.cursor_task_id >= OLD.cursor_task_id
            AND NEW.page_count >= OLD.page_count
            AND NEW.updated_at >= OLD.updated_at
            AND (
                NEW.state = OLD.state
                OR (OLD.state='purging' AND NEW.state='receipt-published')
            )
            AND (
                NEW.rolling_root IS OLD.rolling_root
                OR NEW.cursor_task_id > OLD.cursor_task_id
                OR NEW.page_count > OLD.page_count
                OR NEW.expected_generation > OLD.expected_generation
                OR NEW.state != OLD.state
            )
        )
        BEGIN SELECT RAISE(ABORT, 'corrupt purge operation update is not monotonic'); END""",
    ),
)

QUEUE_V3_SCHEMA_SHA256 = sha256_bytes(
    canonical_json_bytes(
        {
            "tables": [list(item) for item in _QUEUE_V3_TABLE_SQL],
            "indexes": [list(item) for item in _QUEUE_V3_INDEX_SQL],
            "triggers": [list(item) for item in _QUEUE_V3_TRIGGER_SQL],
            "application_id": _QUEUE_V3_CONTRACT.application_id,
            "user_version": _QUEUE_V3_CONTRACT.user_version,
        }
    )
)


def _normalized_sql(value: str | None) -> str:
    return " ".join((value or "").split()).casefold()


def _queue_v3_object_matches(
    database: sqlite3.Connection, kind: str, name: str, sql: str
) -> bool:
    row = database.execute(
        "SELECT sql FROM sqlite_schema WHERE type=? AND name=?", (kind, name)
    ).fetchone()
    return row is not None and _normalized_sql(row[0]) == _normalized_sql(sql)


def _queue_v3_statements(
    *, include_triggers: bool = True
) -> tuple[MigrationStatement, ...]:
    statements: list[MigrationStatement] = []
    definitions_by_kind = [
        ("table", _QUEUE_V3_TABLE_SQL),
        ("index", _QUEUE_V3_INDEX_SQL),
    ]
    if include_triggers:
        definitions_by_kind.append(("trigger", _QUEUE_V3_TRIGGER_SQL))
    for kind, definitions in definitions_by_kind:
        for name, sql in definitions:
            statements.append(
                MigrationStatement(
                    name=f"create_{name}",
                    sql=sql,
                    completed=lambda database, expected_kind=kind, expected_name=name, expected_sql=sql: (
                        _queue_v3_object_matches(
                            database, expected_kind, expected_name, expected_sql
                        )
                    ),
                )
            )
    return tuple(statements)


def _queue_v3_schema_complete(
    database: sqlite3.Connection, *, include_triggers: bool = True
) -> bool:
    definitions_by_kind = [
        ("table", _QUEUE_V3_TABLE_SQL),
        ("index", _QUEUE_V3_INDEX_SQL),
    ]
    if include_triggers:
        definitions_by_kind.append(("trigger", _QUEUE_V3_TRIGGER_SQL))
    return all(
        _queue_v3_object_matches(database, kind, name, sql)
        for kind, definitions in definitions_by_kind
        for name, sql in definitions
    )


def _migration_error(code: str, message: str) -> OperationalDatabaseContractError:
    error = OperationalDatabaseContractError(message)
    error.code = code
    return error


def _ordinary_purge_operation_id(manifest_sha256: str) -> str:
    return f"ordinary-purge:{manifest_sha256}"


def _capture_purge_archive_path(task_id: str, source_path: str) -> str:
    key = sha256_bytes(
        canonical_json_bytes({"source_path": source_path, "task_id": task_id})
    )
    return f"capture-artifacts/{key}.artifact"


def _ordinary_purge_result_archive_path(task_id: str) -> str:
    value = f"results/{task_id}.result"
    try:
        restricted_relative_path(value, ("results",))
    except ValueError as exc:
        raise QueueOperationError("export_verification_failed") from exc
    return value


def _ordinary_purge_authorization_digest(
    task_id: str, operation_id: str, manifest_sha256: str
) -> str:
    return sha256_bytes(
        canonical_json_bytes(
            {
                "manifest_sha256": manifest_sha256,
                "operation_id": operation_id,
                "task_id": task_id,
            }
        )
    )


def _ordinary_purge_manifest_digest(operation_id: object) -> str | None:
    prefix = "ordinary-purge:"
    if not isinstance(operation_id, str) or not operation_id.startswith(prefix):
        return None
    digest = operation_id.removeprefix(prefix)
    if re.fullmatch(r"[0-9a-f]{64}", digest) is None:
        return None
    return digest


def _queue_v3_purge_authorization_valid(row: sqlite3.Row) -> bool:
    manifest_sha256 = _ordinary_purge_manifest_digest(row["operation_id"])
    if row["mode"] != "ordinary" or row["task_present"]:
        return False
    if manifest_sha256 is None:
        return False
    expected = _ordinary_purge_authorization_digest(
        str(row["task_id"]), str(row["operation_id"]), manifest_sha256
    )
    return row["authorization_digest"] == expected


def _queue_v3_purge_authorizations_valid(database: sqlite3.Connection) -> bool:
    rows = database.execute(
        """SELECT authorization.*,
                  EXISTS(SELECT 1 FROM tasks WHERE id=authorization.task_id)
                    AS task_present
           FROM task_purge_authorizations AS authorization"""
    ).fetchall()
    return all(_queue_v3_purge_authorization_valid(row) for row in rows)


def _repair_partial_queue_v3_schema(
    database: sqlite3.Connection, *, allow_populated_rebuild: bool
) -> None:
    expected = {
        (kind, name): sql
        for kind, definitions in (
            ("table", _QUEUE_V3_TABLE_SQL),
            ("index", _QUEUE_V3_INDEX_SQL),
            ("trigger", _QUEUE_V3_TRIGGER_SQL),
        )
        for name, sql in definitions
    }
    existing = database.execute(
        """SELECT type, name, sql FROM sqlite_schema
           WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name"""
    ).fetchall()
    unexpected = [
        (str(row["type"]), str(row["name"]))
        for row in existing
        if (str(row["type"]), str(row["name"])) not in expected
    ]
    if unexpected:
        if not allow_populated_rebuild:
            raise _migration_error(
                "queue_v3_schema_conflict",
                "queue v3 candidate has unexpected schema objects",
            )
        for kind, name in sorted(
            unexpected,
            key=lambda item: ({"trigger": 0, "index": 1, "table": 2}.get(item[0], 3), item[1]),
        ):
            keyword = {"index": "INDEX", "table": "TABLE", "trigger": "TRIGGER"}.get(
                kind
            )
            if keyword is None:
                raise _migration_error(
                    "queue_v3_schema_conflict",
                    "queue v3 candidate has an unsupported schema object",
                )
            with begin_immediate(database):
                database.execute(f'DROP {keyword} "{name}"')
        existing = database.execute(
            """SELECT type, name, sql FROM sqlite_schema
               WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name"""
        ).fetchall()
    malformed = [
        (str(row["type"]), str(row["name"]))
        for row in existing
        if not _queue_v3_object_matches(
            database,
            str(row["type"]),
            str(row["name"]),
            expected[(str(row["type"]), str(row["name"]))],
        )
    ]
    for kind, name in malformed:
        if kind == "table":
            try:
                populated = database.execute(
                    f'SELECT 1 FROM "{name}" LIMIT 1'
                ).fetchone()
            except sqlite3.DatabaseError:
                populated = True
            if populated is not None and not allow_populated_rebuild:
                raise _migration_error(
                    "queue_v3_schema_conflict",
                    "queue v3 candidate has a populated partial table",
                )
    for kind, name in sorted(
        malformed,
        key=lambda item: ({"trigger": 0, "index": 1, "table": 2}[item[0]], item[1]),
    ):
        keyword = {"index": "INDEX", "table": "TABLE", "trigger": "TRIGGER"}[kind]
        with begin_immediate(database):
            database.execute(f'DROP {keyword} "{name}"')


def _queue_v2_tables(database: sqlite3.Connection) -> set[str]:
    return {
        str(row[0])
        for row in database.execute(
            "SELECT name FROM sqlite_schema WHERE type='table'"
        ).fetchall()
    }


_QUEUE_V2_SCHEMA_OBJECTS = {
    ("index", "queue_claim_order"),
    ("table", "attempt_history"),
    ("table", "queue_ownership"),
    ("table", "source_failures"),
    ("table", "source_fences"),
    ("table", "tasks"),
    ("trigger", "attempt_history_immutable_delete"),
    ("trigger", "attempt_history_immutable_update"),
}


def _validate_queue_v2_schema_objects(database: sqlite3.Connection) -> None:
    objects = {
        (str(row[0]), str(row[1]))
        for row in database.execute(
            """SELECT type, name FROM sqlite_schema
               WHERE name NOT LIKE 'sqlite_%'"""
        )
    }
    if not objects <= _QUEUE_V2_SCHEMA_OBJECTS:
        raise _migration_error(
            "queue_v2_schema_unknown",
            "queue v2 source has unknown schema objects",
        )


def _queue_v2_columns(database: sqlite3.Connection, table: str) -> set[str]:
    return {str(row["name"]) for row in database.execute(f'PRAGMA table_info("{table}")')}


def _queue_v3_source_links(payload_bytes: bytes) -> tuple[tuple[str, str], ...]:
    try:
        payload = json.loads(payload_bytes)
    except (UnicodeDecodeError, json.JSONDecodeError):
        return ()
    paths: set[str] = set()
    digests: set[str] = set()
    daily_ids: set[str] = set()

    def visit(value: object) -> None:
        if isinstance(value, dict):
            for key, item in value.items():
                normalized = str(key).casefold()
                if isinstance(item, str):
                    if normalized in {"source_path", "logical_path"}:
                        paths.add(item)
                    elif normalized in {"source_digest", "digest", "hash"}:
                        digests.add(item)
                    elif normalized == "daily_id":
                        daily_ids.add(item)
                visit(item)
        elif isinstance(value, list):
            for item in value:
                visit(item)

    visit(payload)
    if not paths and len(daily_ids) == 1:
        paths.add(f"knowledge/daily/{next(iter(daily_ids))}.md")
    if not paths and not digests:
        return ()
    if len(paths) != 1 or len(digests) != 1:
        raise _migration_error(
            "queue_v2_source_identity_ambiguous",
            "queue v2 payload has an ambiguous source identity",
        )
    logical_path = next(iter(paths))
    source_digest = next(iter(digests))
    try:
        MemoryQueue._validate_failure_identity(logical_path, source_digest)
    except ValueError as exc:
        raise _migration_error(
            "queue_v2_source_identity_ambiguous",
            "queue v2 payload has an invalid source identity",
        ) from exc
    return ((logical_path, source_digest),)


def _queue_v3_row_matches(
    database: sqlite3.Connection,
    table: str,
    key_column: str,
    key: object,
    columns: tuple[str, ...],
    values: tuple[object, ...],
) -> bool:
    selected = ", ".join(f'"{column}"' for column in columns)
    row = database.execute(
        f'SELECT {selected} FROM "{table}" WHERE "{key_column}"=?', (key,)
    ).fetchone()
    return row is not None and tuple(row) == values


def _queue_v3_insert_statement(
    *,
    name: str,
    table: str,
    columns: tuple[str, ...],
    values: tuple[object, ...],
    key_column: str,
    key: object,
) -> MigrationStatement:
    quoted = ", ".join(f'"{column}"' for column in columns)
    placeholders = ", ".join("?" for _ in columns)
    return MigrationStatement(
        name=name,
        sql=f'INSERT OR IGNORE INTO "{table}" ({quoted}) VALUES ({placeholders})',
        parameters=values,
        completed=lambda database: _queue_v3_row_matches(
            database, table, key_column, key, columns, values
        ),
    )


def _queue_v2_migration_statements(
    source: sqlite3.Connection,
) -> tuple[tuple[MigrationStatement, ...], dict[str, int]]:
    _validate_queue_v2_schema_objects(source)
    tables = _queue_v2_tables(source)
    if "tasks" not in tables:
        raise _migration_error(
            "queue_v2_schema_incomplete", "queue v2 source has no tasks table"
        )
    required_task_columns = {
        "id",
        "kind",
        "handler_version",
        "payload_json",
        "input_hash",
        "dedupe_key",
        "state",
        "priority",
        "created_at",
        "updated_at",
        "available_at",
        "attempts",
        "last_attempt_at",
        "lease_owner",
        "lease_token",
        "lease_expires_at",
        "lease_heartbeat_at",
        "attempt_started_at",
        "error_code",
        "blocked_capability",
        "result_reference",
        "result_sha256",
        "result_operation_id",
        "redrive_of",
    }
    if not required_task_columns <= _queue_v2_columns(source, "tasks"):
        raise _migration_error(
            "queue_v2_schema_incomplete", "queue v2 tasks schema is incomplete"
        )
    if "source_fences" in tables and source.execute(
        "SELECT 1 FROM source_fences LIMIT 1"
    ).fetchone() is not None:
        raise _migration_error(
            "queue_v2_source_fence_ambiguous",
            "queue v2 source fences lack process-start identity",
        )
    if "queue_ownership" in tables and source.execute(
        "SELECT 1 FROM queue_ownership WHERE token IS NOT NULL LIMIT 1"
    ).fetchone() is not None:
        raise _migration_error(
            "queue_v2_owner_ambiguous",
            "queue v2 ownership lacks canonical process identity",
        )

    statements: list[MigrationStatement] = []
    summary = {
        "attempt_history": 0,
        "payload_hash_mismatches": 0,
        "source_failures": 0,
        "source_fences": 0,
        "task_source_links": 0,
        "tasks": 0,
    }
    task_columns = (
        "id",
        "kind",
        "handler_version",
        "payload_blob",
        "input_hash",
        "dedupe_key",
        "state",
        "priority",
        "created_at",
        "updated_at",
        "available_at",
        "attempts",
        "last_attempt_at",
        "lease_owner",
        "lease_token",
        "lease_expires_at",
        "lease_heartbeat_at",
        "attempt_started_at",
        "error_code",
        "blocked_capability",
        "result_reference",
        "result_sha256",
        "result_operation_id",
        "redrive_of",
        "lineage_generation",
    )
    task_links: list[tuple[str, str, str]] = []
    task_rows = list(source.execute("SELECT * FROM tasks ORDER BY id"))
    rows_by_id = {str(row["id"]): row for row in task_rows}
    if len(rows_by_id) != len(task_rows):
        raise _migration_error(
            "queue_v2_task_identity_conflict", "queue v2 task IDs are not unique"
        )
    child_counts = {task_id: 0 for task_id in rows_by_id}
    for row in task_rows:
        parent = row["redrive_of"]
        if parent is not None:
            if str(parent) not in rows_by_id:
                raise _migration_error(
                    "queue_v2_lineage_ambiguous",
                    "queue v2 redrive parent is missing",
                )
            child_counts[str(parent)] += 1
    ordered_rows: list[sqlite3.Row] = []
    visited: set[str] = set()
    visiting: set[str] = set()

    def visit_task(task_id: str) -> None:
        if task_id in visited:
            return
        if task_id in visiting:
            raise _migration_error(
                "queue_v2_lineage_ambiguous", "queue v2 redrive lineage is cyclic"
            )
        visiting.add(task_id)
        row = rows_by_id[task_id]
        parent = row["redrive_of"]
        if parent is not None:
            visit_task(str(parent))
        visiting.remove(task_id)
        visited.add(task_id)
        ordered_rows.append(row)

    for task_id in sorted(rows_by_id):
        visit_task(task_id)

    for row in ordered_rows:
        payload_text = row["payload_json"]
        if not isinstance(payload_text, str):
            raise _migration_error(
                "queue_v2_payload_not_text", "queue v2 payload is not TEXT"
            )
        try:
            payload_bytes = payload_text.encode("utf-8")
        except UnicodeEncodeError as exc:
            raise _migration_error(
                "queue_v2_payload_not_utf8", "queue v2 payload is not UTF-8"
            ) from exc
        if len(payload_bytes) > _MAX_QUEUE_PAYLOAD_BYTES:
            raise _migration_error(
                "queue_v2_payload_too_large", "queue v2 payload exceeds 1 MiB"
            )
        attempts = row["attempts"]
        if not isinstance(attempts, int) or isinstance(attempts, bool) or not 0 <= attempts <= 100:
            raise _migration_error(
                "queue_v2_attempts_out_of_range", "queue v2 attempts exceed v3 bounds"
            )
        payload_validation = validate_payload_blob(
            payload_bytes, row["input_hash"], parse=True
        )
        mismatch = payload_validation.code is not None
        state = "dead" if mismatch else row["state"]
        error_code = "payload_hash_mismatch" if mismatch else row["error_code"]
        values = (
            row["id"],
            row["kind"],
            row["handler_version"],
            payload_bytes,
            row["input_hash"],
            row["dedupe_key"],
            state,
            row["priority"],
            row["created_at"],
            row["updated_at"],
            row["available_at"],
            attempts,
            row["last_attempt_at"],
            row["lease_owner"],
            row["lease_token"],
            row["lease_expires_at"],
            row["lease_heartbeat_at"],
            row["attempt_started_at"],
            error_code,
            row["blocked_capability"],
            row["result_reference"],
            row["result_sha256"],
            row["result_operation_id"],
            row["redrive_of"],
            child_counts[str(row["id"])],
        )
        task_id = str(row["id"])
        statements.append(
            _queue_v3_insert_statement(
                name=f"migrate_task_{sha256_bytes(task_id.encode('utf-8'))[:16]}",
                table="tasks",
                columns=task_columns,
                values=values,
                key_column="id",
                key=row["id"],
            )
        )
        summary["tasks"] += 1
        if mismatch:
            summary["payload_hash_mismatches"] += 1
        else:
            task_links.extend(
                (task_id, logical_path, source_digest)
                for logical_path, source_digest in _queue_v3_source_links(payload_bytes)
            )

    if "attempt_history" in tables:
        history_columns = (
            "sequence",
            "task_id",
            "attempt",
            "started_at",
            "finished_at",
            "outcome",
            "error_code",
        )
        if set(history_columns) != _queue_v2_columns(source, "attempt_history"):
            raise _migration_error(
                "queue_v2_schema_incomplete", "queue v2 attempt history schema is incomplete"
            )
        for row in source.execute("SELECT * FROM attempt_history ORDER BY sequence"):
            values = tuple(row[column] for column in history_columns)
            statements.append(
                _queue_v3_insert_statement(
                    name=f"migrate_attempt_{int(row['sequence'])}",
                    table="attempt_history",
                    columns=history_columns,
                    values=values,
                    key_column="sequence",
                    key=row["sequence"],
                )
            )
            summary["attempt_history"] += 1

    for task_id, logical_path, source_digest in sorted(task_links):
        values = (task_id, logical_path, source_digest)
        identity = sha256_bytes(canonical_json_bytes(list(values)))[:16]
        statements.append(
            MigrationStatement(
                name=f"migrate_task_source_link_{identity}",
                sql="""INSERT OR IGNORE INTO task_source_links(
                    task_id, logical_path, source_digest
                ) VALUES (?, ?, ?)""",
                parameters=values,
                completed=lambda database, expected=values: database.execute(
                    """SELECT 1 FROM task_source_links
                       WHERE task_id=? AND logical_path=? AND source_digest=?""",
                    expected,
                ).fetchone()
                is not None,
            )
        )
        summary["task_source_links"] += 1

    if "source_failures" in tables:
        failure_columns = (
            "logical_path",
            "source_digest",
            "error_code",
            "producer",
            "updated_at",
        )
        if set(failure_columns) != _queue_v2_columns(source, "source_failures"):
            raise _migration_error(
                "queue_v2_schema_incomplete", "queue v2 source failure schema is incomplete"
            )
        for row in source.execute(
            "SELECT * FROM source_failures ORDER BY logical_path, source_digest"
        ):
            values = tuple(row[column] for column in failure_columns)
            identity = sha256_bytes(canonical_json_bytes(list(values[:2])))[:16]
            statements.append(
                MigrationStatement(
                    name=f"migrate_source_failure_{identity}",
                    sql="""INSERT OR IGNORE INTO source_failures(
                        logical_path, source_digest, error_code, producer, updated_at
                    ) VALUES (?, ?, ?, ?, ?)""",
                    parameters=values,
                    completed=lambda database, expected=values: tuple(
                        database.execute(
                            """SELECT error_code, producer, updated_at FROM source_failures
                               WHERE logical_path=? AND source_digest=?""",
                            expected[:2],
                        ).fetchone()
                        or ()
                    )
                    == tuple(expected[2:]),
                )
            )
            summary["source_failures"] += 1
    return tuple(statements), summary


def _queue_v2_reconciliation_complete(
    database: sqlite3.Connection,
    statements: tuple[MigrationStatement, ...],
    summary: Mapping[str, int],
) -> bool:
    if not all(statement.completed(database) for statement in statements):
        return False
    expected = {
        "attempt_history": summary["attempt_history"],
        "source_failures": summary["source_failures"],
        "source_fences": summary["source_fences"],
        "task_source_links": summary["task_source_links"],
        "tasks": summary["tasks"],
    }
    return all(
        database.execute(f'SELECT COUNT(*) FROM "{table}"').fetchone()[0] == count
        for table, count in expected.items()
    ) and all(
        database.execute(f'SELECT COUNT(*) FROM "{table}"').fetchone()[0] == 0
        for table in (
            "capture_intents",
            "capture_task_link_resolutions",
            "capture_task_link_seals",
            "capture_task_links",
            "corrupt_dispositions",
            "corrupt_export_operations",
            "corrupt_export_pages",
            "corrupt_package_supersession_operations",
            "corrupt_package_supersession_pages",
            "corrupt_package_supersessions",
            "corrupt_purge_operations",
            "corrupt_purge_pages",
            "queue_ownership",
            "semantic_decisions",
            "task_fence_epochs",
            "task_fences",
            "task_purge_authorizations",
        )
    )


def _queue_v3_row_counts(database: sqlite3.Connection) -> dict[str, int]:
    return {
        table: int(database.execute(f'SELECT COUNT(*) FROM "{table}"').fetchone()[0])
        for table, _sql in _QUEUE_V3_TABLE_SQL
    }


def _reject_queue_source_alias(candidate: Path, source: Path) -> None:
    if candidate.absolute() == source.absolute():
        raise ValueError("queue v3 candidate and v2 source are the same file")
    try:
        candidate_present = candidate.exists() or candidate.is_symlink()
        if candidate_present and os.path.samefile(candidate, source):
            raise ValueError("queue v3 candidate and v2 source are the same file")
    except ValueError:
        raise
    except OSError as exc:
        raise PermissionError("queue v3 candidate identity could not be verified") from exc


def _queue_v3_payloads_valid(database: sqlite3.Connection) -> bool:
    for row in database.execute(
        "SELECT payload_blob, input_hash, state, error_code FROM tasks"
    ):
        payload_bytes = bytes(row["payload_blob"])
        validation = validate_payload_blob(
            payload_bytes, row["input_hash"], parse=True
        )
        if validation.code is not None and (
            row["state"] != "dead" or row["error_code"] != "payload_hash_mismatch"
        ):
            return False
    return True


def initialize_queue_v3_candidate(
    path: Path,
    *,
    source_v2: Path | None,
    killpoint: Callable[[str], None] | None = None,
) -> dict[str, int]:
    """Create or resume an unpublished queue v3 candidate database."""
    candidate = Path(path)
    source_path = Path(source_v2) if source_v2 is not None else None
    with ExitStack() as stack:
        migration_statements: tuple[MigrationStatement, ...] = ()
        summary = {
            "attempt_history": 0,
            "payload_hash_mismatches": 0,
            "source_failures": 0,
            "source_fences": 0,
            "task_source_links": 0,
            "tasks": 0,
        }
        if source_path is not None:
            _reject_queue_source_alias(candidate, source_path)
            source = stack.enter_context(
                closing(
                    open_readonly_operational_db(
                        source_path,
                        source_path.parent.parent,
                        max_bytes=1 << 50,
                        owner_only=True,
                    )
                )
            )
            source.row_factory = sqlite3.Row
            source.execute("BEGIN")
            migration_statements, summary = _queue_v2_migration_statements(source)
            _reject_queue_source_alias(candidate, source_path)
        database = stack.enter_context(
            closing(
                open_operational_db(
                    candidate,
                    busy_ms=DEFAULTS.queue_busy_ms,
                )
            )
        )
        if source_path is not None:
            _reject_queue_source_alias(candidate, source_path)
        _repair_partial_queue_v3_schema(
            database, allow_populated_rebuild=source_v2 is not None
        )
        run_resumable_migration(
            database,
            _queue_v3_statements(include_triggers=False),
            final_invariant=lambda current: _queue_v3_schema_complete(
                current, include_triggers=False
            ),
            killpoint=killpoint,
        )
        if source_v2 is None:
            if any(_queue_v3_row_counts(database).values()):
                raise _migration_error(
                    "queue_v3_source_conflict",
                    "fresh queue v3 initialization found existing rows",
                )
        else:
            run_resumable_migration(
                database,
                migration_statements,
                final_invariant=lambda current: _queue_v2_reconciliation_complete(
                    current, migration_statements, summary
                ),
                killpoint=killpoint,
            )
        run_resumable_migration(
            database,
            tuple(
                statement
                for statement in _queue_v3_statements()
                if statement.name.startswith("create_")
                and statement.name.removeprefix("create_")
                in {name for name, _sql in _QUEUE_V3_TRIGGER_SQL}
            ),
            final_invariant=_queue_v3_schema_complete,
            killpoint=killpoint,
        )
        integrity = database.execute("PRAGMA integrity_check").fetchall()
        foreign_keys = database.execute("PRAGMA foreign_key_check").fetchall()
        if (
            len(integrity) != 1
            or integrity[0][0] != "ok"
            or foreign_keys
            or not _queue_v3_payloads_valid(database)
        ):
            raise _migration_error(
                "queue_v3_validation_failed", "queue v3 candidate validation failed"
            )
    with closing(
        open_operational_db(
            candidate,
            busy_ms=DEFAULTS.queue_busy_ms,
            contract=_QUEUE_V3_CONTRACT,
            initialize_contract=True,
        )
    ):
        pass
    _harden_owner_only(candidate, 0o600)
    validate_queue_v3_database(candidate, state_root=candidate.parent.parent)
    return summary


def validate_queue_v3_database(
    path: Path, *, state_root: Path
) -> dict[str, object]:
    """Validate one unpublished or active queue v3 database fail-closed."""
    try:
        Path(path).resolve(strict=True).relative_to(Path(state_root).resolve(strict=True))
    except (OSError, ValueError) as exc:
        raise PermissionError("queue v3 database is outside the state root") from exc
    with closing(
        open_readonly_operational_db(
            Path(path),
            Path(state_root),
            max_bytes=1 << 50,
            owner_only=True,
            busy_ms=DEFAULTS.queue_busy_ms,
            contract=_QUEUE_V3_CONTRACT,
        )
    ) as database:
        if not _queue_v3_schema_complete(database):
            raise _migration_error(
                "queue_v3_schema_incomplete", "queue v3 schema is incomplete"
            )
        integrity = database.execute("PRAGMA integrity_check").fetchall()
        foreign_keys = database.execute("PRAGMA foreign_key_check").fetchall()
        payload_violations = database.execute(
            """SELECT COUNT(*) FROM tasks
               WHERE typeof(payload_blob) != 'blob'
                  OR length(payload_blob) > ?
                  OR attempts NOT BETWEEN 0 AND 100""",
            (_MAX_QUEUE_PAYLOAD_BYTES,),
        ).fetchone()[0]
        if (
            len(integrity) != 1
            or integrity[0][0] != "ok"
            or foreign_keys
            or payload_violations
            or not _queue_v3_purge_authorizations_valid(database)
            or not _queue_v3_payloads_valid(database)
        ):
            raise _migration_error(
                "queue_v3_validation_failed", "queue v3 database invariant failed"
            )
        return {
            "application_id": database.execute("PRAGMA application_id").fetchone()[0],
            "foreign_key_check": [],
            "integrity_check": "ok",
            "journal_mode": database.execute("PRAGMA journal_mode").fetchone()[0],
            "row_counts": _queue_v3_row_counts(database),
            "synchronous": database.execute("PRAGMA synchronous").fetchone()[0],
            "trusted_schema": database.execute("PRAGMA trusted_schema").fetchone()[0],
            "user_version": database.execute("PRAGMA user_version").fetchone()[0],
        }


def _require_active(
    deadline: float, cancelled: Callable[[], bool] | None = None
) -> None:
    if time.monotonic() >= deadline or bool(cancelled and cancelled()):
        raise TimeoutError("queue mutation deadline or cancellation reached")


class LeaseFenceError(RuntimeError):
    """Raised when a lease token no longer owns an unexpired task."""


class ResultConflictError(RuntimeError):
    """Raised when an operation ID already names different result bytes."""


class QueueOperationError(RuntimeError):
    """Operator-visible queue failure with a stable, non-sensitive code."""

    def __init__(self, code: str) -> None:
        super().__init__(code)
        self.code = code


@dataclass(frozen=True)
class PayloadValidation:
    raw: bytes
    input_hash: str
    payload: dict[str, object] | None
    code: str | None


def _reject_duplicate_payload_keys(
    pairs: list[tuple[str, object]],
) -> dict[str, object]:
    payload: dict[str, object] = {}
    for key, value in pairs:
        if key in payload:
            raise ValueError("duplicate payload key")
        payload[key] = value
    return payload


def _reject_payload_constant(_value: str) -> object:
    raise ValueError("non-finite payload number")


def _parse_payload_integer(value: str) -> int:
    if len(value.encode("ascii")) > _MAX_QUEUE_STRING_BYTES:
        raise ValueError("payload integer token exceeds its bound")
    return int(value)


def _validate_payload_value(value: object, *, depth: int) -> None:
    if depth > _MAX_QUEUE_DEPTH:
        raise ValueError("payload exceeds its depth bound")
    if value is None or isinstance(value, bool):
        return
    if isinstance(value, int):
        return
    if isinstance(value, float):
        raise ValueError("payload floats are not permitted")
    if isinstance(value, str):
        if len(value.encode("utf-8", errors="strict")) > _MAX_QUEUE_STRING_BYTES:
            raise ValueError("payload string exceeds its byte bound")
        return
    if isinstance(value, list):
        if len(value) > _MAX_QUEUE_CONTAINER_MEMBERS:
            raise ValueError("payload array exceeds its member bound")
        for item in value:
            _validate_payload_value(item, depth=depth + 1)
        return
    if isinstance(value, dict):
        if len(value) > _MAX_QUEUE_CONTAINER_MEMBERS:
            raise ValueError("payload object exceeds its member bound")
        for key, item in value.items():
            if not isinstance(key, str):
                raise ValueError("payload keys must be strings")
            if len(key.encode("utf-8", errors="strict")) > _MAX_QUEUE_STRING_BYTES:
                raise ValueError("payload key exceeds its byte bound")
            _validate_payload_value(item, depth=depth + 1)
        return
    raise ValueError("payload contains an unsupported value")


def validate_payload_blob(
    raw: bytes, stored_hash: str, *, parse: bool
) -> PayloadValidation:
    if not isinstance(raw, bytes):
        raise TypeError("queue payload must be bytes")
    if not isinstance(parse, bool):
        raise TypeError("parse must be a boolean")
    digest = hashlib.sha256()
    view = memoryview(raw)
    for offset in range(0, len(view), 64 * 1024):
        digest.update(view[offset : offset + 64 * 1024])
    input_hash = digest.hexdigest()
    if (
        len(raw) > _MAX_QUEUE_PAYLOAD_BYTES
        or not isinstance(stored_hash, str)
        or re.fullmatch(r"[0-9a-f]{64}", stored_hash) is None
        or input_hash != stored_hash
    ):
        return PayloadValidation(raw, input_hash, None, "payload_hash_mismatch")
    if not parse:
        return PayloadValidation(raw, input_hash, None, None)
    try:
        payload = json.loads(
            raw.decode("utf-8", errors="strict"),
            object_pairs_hook=_reject_duplicate_payload_keys,
            parse_constant=_reject_payload_constant,
            parse_int=_parse_payload_integer,
        )
        _validate_payload_value(payload, depth=1)
        if not isinstance(payload, dict) or canonical_json_bytes(payload) != raw:
            raise ValueError("payload is not a canonical object")
    except (
        json.JSONDecodeError,
        OverflowError,
        RecursionError,
        TypeError,
        UnicodeError,
        ValueError,
    ):
        return PayloadValidation(raw, input_hash, None, "payload_hash_mismatch")
    return PayloadValidation(raw, input_hash, payload, None)


class MigrationBusy(QueueOperationError):
    """Raised when migration cannot prove exclusive legacy ownership."""


class LegacyBackendDisabled(QueueOperationError):
    """Raised when a legacy writer is used after migration started."""


class _InvalidArguments(Exception):
    pass


class _RedactedArgumentParser(argparse.ArgumentParser):
    def error(self, message: str) -> None:
        del message
        raise _InvalidArguments

    def exit(self, status: int = 0, message: str | None = None) -> None:
        if status:
            del message
            raise _InvalidArguments
        super().exit(status, message)


@dataclass(frozen=True)
class QueueFailure:
    error_code: str
    permanent: bool = False
    blocked_capability: str | None = None
    retry_after: float | datetime | str | None = None


@dataclass(frozen=True)
class DeferredResult:
    data: bytes


@dataclass(frozen=True)
class AttemptRecord:
    attempt: int
    started_at: datetime
    finished_at: datetime
    outcome: str
    error_code: str | None


@dataclass(frozen=True)
class QueueTask:
    id: str
    kind: str
    handler_version: int
    payload: dict[str, object]
    input_hash: str
    dedupe_key: str | None
    state: str
    priority: int
    created_at: datetime
    updated_at: datetime
    available_at: datetime
    attempts: int
    last_attempt_at: datetime | None
    lease_owner: str | None
    lease_token: str | None
    lease_expires_at: datetime | None
    lease_heartbeat_at: datetime | None
    error_code: str | None
    blocked_capability: str | None
    result_reference: str | None
    result_sha256: str | None
    redrive_of: str | None
    attempt_history: tuple[AttemptRecord, ...]


@dataclass(frozen=True)
class QueueLease:
    id: str
    kind: str
    handler_version: int
    payload: dict[str, object]
    input_hash: str
    owner: str
    token: str
    expires_at: datetime
    attempt: int
    created_at: datetime
    last_attempt_at: datetime | None
    prior_attempts: int


@dataclass(frozen=True)
class MigrationReceipt:
    imported: int
    quarantined: int
    task_ids: tuple[str, ...]
    codes: tuple[str, ...]


@dataclass(frozen=True)
class QueueOwnerLease:
    state_root: Path
    role: str
    token: str
    pid: int
    epoch: int
    expires_at: datetime
    ttl_seconds: int


@dataclass(frozen=True)
class CaptureTaskBinding:
    task_id: str
    intent_id: str | None
    intent_sha256: str | None
    handler_version: int
    active_digest: str
    seal_digest: str | None


def _require_capture_intent_path(value: str, state: Literal["pending", "ready"]) -> None:
    restricted_relative_path(value, ("run/capture-intents",))
    if len(value.encode("utf-8")) > 4096:
        raise ValueError(f"{state} capture intent path is invalid")
    pattern = rf"run/capture-intents/{state}/[0-9a-f]{{2}}/[0-9a-f]{{64}}\.json"
    if re.fullmatch(pattern, value) is None:
        raise ValueError(f"{state} capture intent path is invalid")


def _require_lower_sha256(value: str, label: str) -> None:
    if re.fullmatch(r"[0-9a-f]{64}", value) is None:
        raise ValueError(f"{label} must be lowercase 64-hex")


def _require_capture_intent_size(value: int) -> None:
    if type(value) is not int:
        raise ValueError("capture intent byte size is invalid")
    if not 1 <= value <= _MAX_QUEUE_PAYLOAD_BYTES:
        raise ValueError("capture intent byte size is invalid")


def _require_capture_intent_descriptor(
    intent_id: str,
    pending_path: str,
    intent_sha256: str,
    byte_size: int,
) -> None:
    _require_lower_sha256(intent_id, "intent_id")
    _require_lower_sha256(intent_sha256, "intent_sha256")
    _require_capture_intent_size(byte_size)
    _require_capture_intent_path(pending_path, "pending")
    expected = f"run/capture-intents/pending/{intent_id[:2]}/{intent_id}.json"
    if pending_path != expected:
        raise ValueError("capture intent descriptor is invalid")


def _require_capture_decision_path(value: str, intent_id: str, stage: str) -> None:
    restricted_relative_path(value, ("run/queue-results",))
    expected = _capture_decision_relative_path(intent_id, stage)
    if value != expected:
        raise ValueError("decision path is invalid")


def _capture_decision_relative_path(intent_id: str, stage: str) -> str:
    key = sha256_bytes(canonical_json_bytes({"intent_id": intent_id, "stage": stage}))
    return f"run/queue-results/capture-decision-{key}.json"


def _capture_semantic_seal_digest(
    task_id: str, intent_id: str, stage: str, active_link_digest: str
) -> str:
    return sha256_bytes(
        canonical_json_bytes(
            {
                "active_digest": active_link_digest,
                "consumer_id": f"{intent_id}:{stage}",
                "consumer_kind": "semantic-decision",
                "task_id": task_id,
            }
        )
    )


def _require_indexed_capture_decision(
    row: sqlite3.Row,
    active: CaptureTaskBinding,
    *,
    intent_id: str,
    stage: str,
    active_link_digest: str,
) -> None:
    decision_path = _capture_decision_relative_path(intent_id, stage)
    seal_digest = _capture_semantic_seal_digest(
        active.task_id, intent_id, stage, active_link_digest
    )
    actual = (
        active.intent_id,
        active.active_digest,
        active.seal_digest,
        row["decision_path"],
        row["active_link_digest"],
        row["publication_state"],
    )
    expected = (
        intent_id,
        active_link_digest,
        seal_digest,
        decision_path,
        active_link_digest,
        "published",
    )
    if actual != expected:
        raise QueueOperationError("semantic_decision_conflict")


def _indexed_capture_decision_published_at(row: sqlite3.Row) -> datetime:
    published_at = _parse_timestamp(str(row["published_at"]))
    if published_at is None:
        raise QueueOperationError("semantic_decision_conflict")
    return published_at


def _read_indexed_capture_decision(
    state_root: Path, row: sqlite3.Row
) -> tuple[str, str]:
    decision_path = str(row["decision_path"])
    decision_sha256 = str(row["decision_sha256"])
    _require_lower_sha256(decision_sha256, "decision_sha256")
    data = read_runtime_bytes(
        state_root / decision_path,
        state_root,
        max_bytes=1024 * 1024,
        owner_only=True,
    )
    if sha256_bytes(data) != decision_sha256:
        raise QueueOperationError("semantic_decision_conflict")
    return decision_path, decision_sha256


def _require_capture_terminal_path(value: str, intent_id: str) -> None:
    restricted_relative_path(value, ("run/queue-results",))
    expected = f"run/queue-results/capture-{intent_id}.json"
    if value != expected:
        raise ValueError("capture terminal path is invalid")


def _capture_terminal_disposition_fields(kind: object) -> set[str] | None:
    if not isinstance(kind, str):
        return None
    return _CAPTURE_TERMINAL_DISPOSITION_FIELDS.get(kind)


def _existing_capture_publication_state(
    row: sqlite3.Row | None,
    *,
    pending_path: str,
    ready_path: str,
    intent_sha256: str,
    byte_size: int,
) -> str:
    if row is None:
        raise QueueOperationError("capture_intent_conflict")
    state = str(row["publication_state"])
    expected_paths = {"pending": pending_path, "ready": ready_path}
    matches = (
        expected_paths.get(state) == row["relative_path"]
        and row["intent_sha256"] == intent_sha256
        and row["byte_size"] == byte_size
    )
    if not matches:
        raise QueueOperationError("capture_intent_conflict")
    return state


def _require_capture_replay_task(
    row: sqlite3.Row,
    kind: str,
    handler_version: int,
    payload_bytes: bytes,
    dedupe_key: str,
) -> None:
    stored = bytes(row["payload_blob"])
    validation = validate_payload_blob(stored, str(row["input_hash"]), parse=True)
    actual = (
        validation.code,
        row["kind"],
        row["handler_version"],
        row["input_hash"],
        row["dedupe_key"],
        stored,
    )
    expected = (None, kind, handler_version, sha256_bytes(payload_bytes), dedupe_key, payload_bytes)
    if actual != expected:
        raise QueueOperationError("capture_replay_conflict")


@dataclass(frozen=True)
class TaskFence:
    task_id: str
    mode: Literal["worker", "queue-operator"]
    token: str
    epoch: int
    owner: OwnerLease
    expires_at: datetime


@dataclass(frozen=True)
class SemanticDecision:
    task_id: str
    intent_id: str
    stage: Literal["flush", "feedback", "feedback-verify"]
    decision_path: str
    decision_sha256: str
    active_link_digest: str
    seal_digest: str
    published_at: datetime


@dataclass(frozen=True)
class CorruptExportProgress:
    task_id: str
    operation_id: str
    state: Literal["quarantine_pending", "quarantined", "blocked"]
    pages_written: int
    links_exported: int
    complete: bool
    code: str | None


@dataclass(frozen=True)
class CorruptPurgeProgress:
    task_id: str
    operation_id: str
    state: Literal["purge_pending", "purged", "blocked"]
    pages_written: int
    links_deleted: int
    complete: bool
    code: str | None


@dataclass(frozen=True)
class SourceFence:
    daily_id: str
    source_digest: str
    token: str
    owner_pid: int
    acquired_at: datetime
    heartbeat_at: datetime
    expires_at: datetime


@dataclass(frozen=True)
class WorkerSummary:
    processed: int
    succeeded: int
    failed: int
    dead: int
    skipped: int
    remaining_eligible: int = 0


@dataclass(frozen=True)
class PurgeReceipt:
    purged: int
    task_ids: tuple[str, ...]


@dataclass(frozen=True)
class _CapturePurgeArtifact:
    source_path: str
    archive_path: str
    sha256: str


@dataclass(frozen=True)
class _CapturePurgeEvidence:
    task_id: str
    intent_id: str
    intent: _CapturePurgeArtifact
    decisions: tuple[_CapturePurgeArtifact, ...]
    terminal_path: str


@dataclass(frozen=True)
class _OrdinaryPurgePlan:
    cutoff: str
    export: Path
    task_ids: tuple[str, ...]
    records: tuple[dict[str, object], ...]
    records_bytes: bytes
    capture_evidence: tuple[_CapturePurgeEvidence, ...]
    manifest_bytes: bytes | None


def _utc_now() -> datetime:
    return datetime.now(timezone.utc)


def _as_utc(value: datetime) -> datetime:
    if value.tzinfo is None:
        value = value.replace(tzinfo=timezone.utc)
    return value.astimezone(timezone.utc)


def _timestamp(value: datetime) -> str:
    return _as_utc(value).isoformat(timespec="microseconds")


def _parse_timestamp(value: str | None) -> datetime | None:
    return _as_utc(datetime.fromisoformat(value)) if value is not None else None


def _is_secret_key(key: str) -> bool:
    normalized = re.sub(r"[^a-z0-9]+", "_", key.casefold()).strip("_")
    return normalized in _SECRET_KEYS or normalized.endswith(
        ("_api_key", "_authorization", "_cookie", "_credential", "_password", "_secret", "_token")
    )


def _redact_payload(value: object) -> object:
    if isinstance(value, str):
        return redact_secrets(value)
    if isinstance(value, (list, tuple)):
        return [_redact_payload(item) for item in value]
    if isinstance(value, dict):
        return {
            key: "[REDACTED]" if _is_secret_key(key) else _redact_payload(item)
            for key, item in value.items()
        }
    return value


def _harden_owner_only(path: Path, mode: int) -> None:
    if os.name == "nt":
        from markdown_transaction import _harden_windows_acl

        _harden_windows_acl(path)
        return
    if not _set_owner_only(path, mode):
        raise PermissionError(f"could not apply owner-only permissions to {path}")


def _is_owner_only(path: Path) -> bool:
    if os.name == "nt":
        from markdown_transaction import (
            _acl_output_text,
            _run_acl_command,
            _windows_acl_identity,
        )

        try:
            verified = _run_acl_command(["icacls", str(path)])
        except Exception:  # noqa: BLE001 - validation is fail-closed
            return False
        if verified.returncode != 0:
            return False
        identity = _windows_acl_identity()
        acl_lines = [
            line.strip()
            for line in _acl_output_text(verified.stdout).splitlines()
            if ":(" in line
        ]
        owner_lines = [
            line for line in acl_lines if identity.casefold() in line.casefold()
        ]
        return (
            len(owner_lines) == 1
            and "(F)" in owner_lines[0]
            and all(identity.casefold() in line.casefold() for line in acl_lines)
        )
    try:
        mode = stat.S_IMODE(path.stat().st_mode)
    except OSError:
        return False
    return mode & 0o077 == 0 and mode & 0o600 == 0o600


def _validate_retry_policy(
    max_attempts: int, retry_base_seconds: int, retry_cap_seconds: int
) -> None:
    for name, value in (
        ("max_attempts", max_attempts),
        ("retry_base_seconds", retry_base_seconds),
        ("retry_cap_seconds", retry_cap_seconds),
    ):
        if not isinstance(value, int) or isinstance(value, bool):
            raise ValueError(f"{name} must be an integer")
    if not 1 <= max_attempts <= _MAX_RUNTIME_ATTEMPTS:
        raise ValueError(
            f"max_attempts must be between 1 and {_MAX_RUNTIME_ATTEMPTS}"
        )
    if retry_base_seconds <= 0:
        raise ValueError("retry_base_seconds must be positive")
    if retry_cap_seconds <= 0:
        raise ValueError("retry_cap_seconds must be positive")
    if retry_base_seconds > retry_cap_seconds:
        raise ValueError("retry_base_seconds must not exceed retry_cap_seconds")


def _validate_worker_policy(
    lease_seconds: int,
    heartbeat_seconds: int,
    max_attempts: int,
    retry_base_seconds: int,
    retry_cap_seconds: int,
) -> None:
    _validate_retry_policy(max_attempts, retry_base_seconds, retry_cap_seconds)
    for name, value in (
        ("lease_seconds", lease_seconds),
        ("heartbeat_seconds", heartbeat_seconds),
    ):
        if not isinstance(value, int) or isinstance(value, bool) or value <= 0:
            raise ValueError(f"{name} must be a positive integer")
    if heartbeat_seconds >= lease_seconds:
        raise ValueError("heartbeat_seconds must be less than lease_seconds")


class MemoryQueue:
    """Durable priority queue with lease-token fencing and at-least-once delivery."""

    @classmethod
    def _from_v3_candidate(
        cls, path: Path, *, state_root: Path
    ) -> _QueueV3CandidateReader:
        validate_queue_v3_database(path, state_root=state_root)
        return _QueueV3CandidateReader(Path(path))

    def __init__(
        self,
        state_root: Path,
        *,
        clock: Callable[[], datetime] | None = None,
        rng: random.Random | random.SystemRandom | None = None,
        heartbeat_wait: Callable[[threading.Event, float], bool] | None = None,
        max_attempts: int = DEFAULTS.queue_max_attempts,
        retry_base_seconds: int = DEFAULTS.retry_base_seconds,
        retry_cap_seconds: int = DEFAULTS.retry_cap_seconds,
    ) -> None:
        _validate_retry_policy(max_attempts, retry_base_seconds, retry_cap_seconds)
        self.state_root = Path(state_root).resolve()
        self.run_dir = self.state_root / "run"
        self.db_path = self.run_dir / "queue.sqlite3"
        self.results_dir = self.run_dir / "queue-results"
        self._clock = clock or _utc_now
        self._rng = rng or random.SystemRandom()
        self._heartbeat_wait = heartbeat_wait or (
            lambda stop, interval: stop.wait(interval)
        )
        self._max_attempts = max_attempts
        self._retry_base_seconds = retry_base_seconds
        self._retry_cap_seconds = retry_cap_seconds
        self._db_hardened = False
        self.run_dir.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(self.run_dir, 0o700)
        self.results_dir.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(self.results_dir, 0o700)
        with self._connect() as connection:
            self._create_schema(connection)
            with begin_immediate(connection):
                self._retire_exhausted_ready(
                    connection, _as_utc(self._clock()), self._max_attempts
                )

    @contextmanager
    def _connect(self) -> Iterator[sqlite3.Connection]:
        connection = open_operational_db(self.db_path, busy_ms=DEFAULTS.queue_busy_ms)
        try:
            # Preserve this legacy context manager's implicit commit/rollback API.
            connection.isolation_level = "DEFERRED"
            if not self._db_hardened:
                _harden_owner_only(self.db_path, 0o600)
                self._db_hardened = True
            with connection:
                yield connection
        finally:
            connection.close()

    @staticmethod
    def _create_schema(connection: sqlite3.Connection) -> None:
        MemoryQueue._upgrade_legacy_attempt_constraint(connection)
        connection.executescript(
            """
            CREATE TABLE IF NOT EXISTS tasks (
                id TEXT PRIMARY KEY,
                kind TEXT NOT NULL,
                handler_version INTEGER NOT NULL CHECK (handler_version >= 1),
                payload_json TEXT NOT NULL,
                input_hash TEXT NOT NULL CHECK (length(input_hash) = 64),
                dedupe_key TEXT UNIQUE,
                state TEXT NOT NULL CHECK (state IN ('ready','leased','blocked','succeeded','dead','cancelled')),
                priority INTEGER NOT NULL DEFAULT 0 CHECK (priority BETWEEN -100 AND 100),
                created_at TEXT NOT NULL,
                updated_at TEXT NOT NULL,
                available_at TEXT NOT NULL,
                attempts INTEGER NOT NULL DEFAULT 0 CHECK (attempts >= 0),
                last_attempt_at TEXT,
                lease_owner TEXT,
                lease_token TEXT,
                lease_expires_at TEXT,
                lease_heartbeat_at TEXT,
                attempt_started_at TEXT,
                error_code TEXT,
                blocked_capability TEXT,
                result_reference TEXT,
                result_sha256 TEXT,
                result_operation_id TEXT,
                redrive_of TEXT REFERENCES tasks(id)
            );
            CREATE INDEX IF NOT EXISTS queue_claim_order
                ON tasks(state, priority DESC, available_at, created_at);
            CREATE TABLE IF NOT EXISTS source_fences (
                daily_id TEXT PRIMARY KEY,
                source_digest TEXT NOT NULL UNIQUE,
                token TEXT NOT NULL UNIQUE,
                owner_pid INTEGER NOT NULL,
                acquired_at TEXT NOT NULL,
                heartbeat_at TEXT NOT NULL,
                expires_at TEXT NOT NULL
            );
            CREATE TABLE IF NOT EXISTS source_failures (
                logical_path TEXT NOT NULL,
                source_digest TEXT NOT NULL,
                error_code TEXT NOT NULL,
                producer TEXT NOT NULL CHECK (producer IN ('compile','queue')),
                updated_at TEXT NOT NULL,
                PRIMARY KEY (logical_path, source_digest)
            );
            CREATE TABLE IF NOT EXISTS attempt_history (
                sequence INTEGER PRIMARY KEY AUTOINCREMENT,
                task_id TEXT NOT NULL REFERENCES tasks(id),
                attempt INTEGER NOT NULL,
                started_at TEXT NOT NULL,
                finished_at TEXT NOT NULL,
                outcome TEXT NOT NULL CHECK (outcome IN ('succeeded','failed','blocked','cancelled','lease_expired')),
                error_code TEXT
            );
            CREATE TRIGGER IF NOT EXISTS attempt_history_immutable_update
                BEFORE UPDATE ON attempt_history BEGIN SELECT RAISE(ABORT, 'attempt history is immutable'); END;
            CREATE TRIGGER IF NOT EXISTS attempt_history_immutable_delete
                BEFORE DELETE ON attempt_history BEGIN SELECT RAISE(ABORT, 'attempt history is immutable'); END;
            """
        )
        columns = {
            str(row["name"])
            for row in connection.execute("PRAGMA table_info(tasks)").fetchall()
        }
        if "last_attempt_at" not in columns:
            connection.execute("ALTER TABLE tasks ADD COLUMN last_attempt_at TEXT")
        if "result_sha256" not in columns:
            connection.execute("ALTER TABLE tasks ADD COLUMN result_sha256 TEXT")
        if "redrive_of" not in columns:
            connection.execute(
                "ALTER TABLE tasks ADD COLUMN redrive_of TEXT REFERENCES tasks(id)"
            )
        source_fence_columns = {
            str(row["name"])
            for row in connection.execute("PRAGMA table_info(source_fences)").fetchall()
        }
        if "heartbeat_at" not in source_fence_columns:
            connection.execute("ALTER TABLE source_fences ADD COLUMN heartbeat_at TEXT")
            connection.execute(
                "UPDATE source_fences SET heartbeat_at=acquired_at WHERE heartbeat_at IS NULL"
            )
        if "expires_at" not in source_fence_columns:
            connection.execute("ALTER TABLE source_fences ADD COLUMN expires_at TEXT")
            connection.execute(
                "UPDATE source_fences SET expires_at=acquired_at WHERE expires_at IS NULL"
            )

    @staticmethod
    def _upgrade_legacy_attempt_constraint(connection: sqlite3.Connection) -> None:
        row = connection.execute(
            "SELECT sql FROM sqlite_master WHERE type='table' AND name='tasks'"
        ).fetchone()
        if row is None or "attempts BETWEEN 0 AND 8" not in str(row["sql"]):
            return
        old_sql = str(row["sql"])
        new_sql = re.sub(
            r"^CREATE TABLE\s+tasks\b",
            "CREATE TABLE tasks_unbounded",
            old_sql,
            count=1,
            flags=re.IGNORECASE,
        ).replace("attempts BETWEEN 0 AND 8", "attempts >= 0")
        connection.commit()
        connection.execute("PRAGMA foreign_keys=OFF")
        try:
            with begin_immediate(connection):
                connection.execute(new_sql)
                connection.execute("INSERT INTO tasks_unbounded SELECT * FROM tasks")
                connection.execute("DROP TABLE tasks")
                connection.execute("ALTER TABLE tasks_unbounded RENAME TO tasks")
        finally:
            connection.execute("PRAGMA foreign_keys=ON")

    def _retire_exhausted_ready(
        self,
        connection: sqlite3.Connection, now: datetime, max_attempts: int
    ) -> None:
        rows = connection.execute(
            "SELECT * FROM tasks WHERE state='ready' AND attempts >= ?",
            (max_attempts,),
        ).fetchall()
        for row in rows:
            connection.execute(
                """UPDATE tasks SET state='dead', error_code='attempts_exhausted',
                       updated_at=?, last_attempt_at=COALESCE(last_attempt_at, ?)
                   WHERE id=? AND state='ready' AND attempts >= ?""",
                (
                    _timestamp(now),
                    _timestamp(now),
                    row["id"],
                    max_attempts,
                ),
            )
            self._record_payload_failure(
                connection,
                str(row["payload_json"]),
                "attempts_exhausted",
                "queue",
                now,
            )

    def enqueue(
        self,
        kind: str,
        handler_version: int,
        payload: Mapping[str, object],
        *,
        priority: int = 0,
        available_at: datetime | None = None,
        dedupe_key: str | None = None,
    ) -> str:
        if not isinstance(kind, str) or not kind:
            raise ValueError("kind must be a non-empty string")
        if not isinstance(handler_version, int) or isinstance(handler_version, bool) or handler_version < 1:
            raise ValueError("handler_version must be a positive integer")
        if not isinstance(priority, int) or isinstance(priority, bool) or not -100 <= priority <= 100:
            raise ValueError("priority must be an integer from -100 to 100")
        if dedupe_key is not None and (not isinstance(dedupe_key, str) or not dedupe_key):
            raise ValueError("dedupe_key must be a non-empty string")
        redacted = _redact_payload(dict(payload))
        payload_bytes = canonical_json_bytes(redacted)
        payload_json = payload_bytes.decode("utf-8")
        input_hash = sha256_bytes(payload_bytes)
        now = _as_utc(self._clock())
        ready_at = _as_utc(available_at or now)
        task_id = uuid.UUID(int=self._rng.getrandbits(128)).hex
        with self._connect() as connection, begin_immediate(connection):
            self._delete_stale_source_fences(connection)
            self._assert_payload_not_fenced(connection, payload_json)
            if dedupe_key is not None:
                existing = connection.execute(
                    """SELECT id, kind, handler_version, payload_json, input_hash
                       FROM tasks WHERE dedupe_key=?""",
                    (dedupe_key,),
                ).fetchone()
                if existing is not None:
                    try:
                        existing_bytes = str(existing["payload_json"]).encode(
                            "utf-8", errors="strict"
                        )
                    except UnicodeError:
                        existing_bytes = b""
                    validation = validate_payload_blob(
                        existing_bytes, existing["input_hash"], parse=True
                    )
                    if (
                        validation.code is None
                        and existing["kind"] == kind
                        and existing["handler_version"] == handler_version
                        and existing["input_hash"] == input_hash
                        and existing_bytes == payload_bytes
                    ):
                        return str(existing["id"])
                    raise QueueOperationError("dedupe_conflict")
            inserted = connection.execute(
                """INSERT INTO tasks(
                       id, kind, handler_version, payload_json, input_hash, dedupe_key,
                       state, priority, created_at, updated_at, available_at
                   ) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?)""",
                (
                    task_id,
                    kind,
                    handler_version,
                    payload_json,
                    input_hash,
                    dedupe_key,
                    priority,
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(ready_at),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("enqueue_failed")
        return task_id

    def claim(
        self,
        owner: str,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
        max_attempts: int | None = None,
    ) -> QueueLease | None:
        if not owner:
            raise ValueError("owner must be non-empty")
        if lease_seconds <= 0:
            raise ValueError("lease must be positive")
        attempt_limit = self._max_attempts if max_attempts is None else max_attempts
        _validate_retry_policy(
            attempt_limit, self._retry_base_seconds, self._retry_cap_seconds
        )
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            self._expire_leases(connection, now, attempt_limit)
            self._delete_stale_source_fences(connection)
            row = connection.execute(
                """SELECT * FROM tasks
                   WHERE state = 'ready' AND attempts < ? AND available_at <= ?
                     AND NOT EXISTS (
                         SELECT 1 FROM source_fences f
                         WHERE instr(tasks.payload_json, f.daily_id) > 0
                            OR instr(tasks.payload_json, f.source_digest) > 0
                     )
                   ORDER BY priority DESC, available_at, created_at, rowid LIMIT 1""",
                (attempt_limit, _timestamp(now)),
            ).fetchone()
            if row is None:
                return None
            token = f"{self._rng.getrandbits(256):064x}"
            expires = now + timedelta(seconds=lease_seconds)
            changed = connection.execute(
                """UPDATE tasks SET state='leased', attempts=attempts+1,
                       lease_owner=?, lease_token=?, lease_expires_at=?, lease_heartbeat_at=?,
                       attempt_started_at=?, updated_at=?, error_code=NULL, blocked_capability=NULL
                   WHERE id=? AND state='ready' AND attempts < ?""",
                (
                    owner,
                    token,
                    _timestamp(expires),
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(now),
                    row["id"],
                    attempt_limit,
                ),
            ).rowcount
            if changed != 1:
                return None
            attempt = int(row["attempts"]) + 1
        return QueueLease(
            id=str(row["id"]),
            kind=str(row["kind"]),
            handler_version=int(row["handler_version"]),
            payload=json.loads(row["payload_json"]),
            input_hash=str(row["input_hash"]),
            owner=owner,
            token=token,
            expires_at=expires,
            attempt=attempt,
            created_at=_parse_timestamp(row["created_at"]),  # type: ignore[arg-type]
            last_attempt_at=_parse_timestamp(row["last_attempt_at"]),
            prior_attempts=int(row["attempts"]),
        )

    def _claim_task(self, task_id: str, owner: str) -> QueueLease | None:
        """Claim one known task for the legacy mark_attempt facade."""
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            self._delete_stale_source_fences(connection)
            row = connection.execute(
                "SELECT * FROM tasks WHERE id=? AND state='ready'", (task_id,)
            ).fetchone()
            if row is None:
                return None
            try:
                self._assert_payload_not_fenced(connection, str(row["payload_json"]))
            except QueueOperationError:
                return None
            token = f"{self._rng.getrandbits(256):064x}"
            expires = now + timedelta(seconds=DEFAULTS.queue_lease_seconds)
            connection.execute(
                """UPDATE tasks SET state='leased', attempts=attempts+1, lease_owner=?,
                       lease_token=?, lease_expires_at=?, lease_heartbeat_at=?,
                       attempt_started_at=?, updated_at=? WHERE id=?""",
                (
                    owner,
                    token,
                    _timestamp(expires),
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(now),
                    task_id,
                ),
            )
        return QueueLease(
            task_id,
            row["kind"],
            row["handler_version"],
            json.loads(row["payload_json"]),
            row["input_hash"],
            owner,
            token,
            expires,
            int(row["attempts"]) + 1,
            _parse_timestamp(row["created_at"]),
            _parse_timestamp(row["last_attempt_at"]),
            int(row["attempts"]),
        )

    def _expire_leases(
        self, connection: sqlite3.Connection, now: datetime, max_attempts: int
    ) -> int:
        rows = connection.execute(
            "SELECT * FROM tasks WHERE state='leased' AND lease_expires_at <= ?",
            (_timestamp(now),),
        ).fetchall()
        for row in rows:
            if row["result_reference"] is not None or row["result_sha256"] is not None:
                valid = self._stored_result_is_valid(row)
                error_code = None if valid else "result_corrupt"
                self._record_attempt(
                    connection,
                    row,
                    now,
                    "succeeded" if valid else "failed",
                    error_code,
                )
                self._finish_lease(
                    connection,
                    row["id"],
                    now,
                    "succeeded" if valid else "dead",
                    error_code,
                    None,
                    last_attempt_at=now,
                )
                continue
            exhausted = int(row["attempts"]) >= max_attempts
            error_code = "attempts_exhausted" if exhausted else "lease_expired"
            state = "dead" if exhausted else "ready"
            self._record_attempt(connection, row, now, "lease_expired", error_code)
            connection.execute(
                """UPDATE tasks SET state=?, available_at=?, updated_at=?, last_attempt_at=?,
                       lease_owner=NULL, lease_token=NULL, lease_expires_at=NULL,
                       lease_heartbeat_at=NULL, attempt_started_at=NULL, error_code=?
                   WHERE id=? AND state='leased' AND lease_token=?""",
                (
                    state,
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(now),
                    error_code,
                    row["id"],
                    row["lease_token"],
                ),
            )
        return len(rows)

    def _stored_result_is_valid(self, row: sqlite3.Row) -> bool:
        reference = row["result_reference"]
        digest = row["result_sha256"]
        if not isinstance(reference, str) or not isinstance(digest, str):
            return False
        if re.fullmatch(r"[0-9a-f]{64}", digest) is None:
            return False
        return self._validated_result_digest(reference) == digest

    def _validated_result_digest(self, reference: str) -> str | None:
        try:
            path = self.state_root / reference
            resolved = path.resolve(strict=True)
            resolved.relative_to(self.results_dir.resolve())
            if path.parent.resolve() != self.results_dir.resolve() or path.is_symlink():
                return None
            metadata = path.lstat()
            if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > _MAX_RESULT_BYTES:
                return None
            if not _is_owner_only(path):
                return None
            flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
            descriptor = os.open(path, flags)
            try:
                opened = os.fstat(descriptor)
                if not stat.S_ISREG(opened.st_mode) or opened.st_size > _MAX_RESULT_BYTES:
                    return None
                with os.fdopen(descriptor, "rb", closefd=False) as handle:
                    data = handle.read(_MAX_RESULT_BYTES + 1)
                if len(data) > _MAX_RESULT_BYTES:
                    return None
                after = os.fstat(descriptor)
                if (
                    opened.st_dev,
                    opened.st_ino,
                    opened.st_size,
                    opened.st_mtime_ns,
                ) != (
                    after.st_dev,
                    after.st_ino,
                    after.st_size,
                    after.st_mtime_ns,
                ):
                    return None
                return sha256_bytes(data)
            finally:
                os.close(descriptor)
        except (OSError, ValueError):
            return None

    def _read_result_for_export(self, reference: str, digest: str) -> bytes:
        try:
            path = self.state_root / reference
            resolved = path.resolve(strict=True)
            resolved.relative_to(self.results_dir.resolve())
            if path.parent.resolve() != self.results_dir.resolve():
                raise QueueOperationError("result_verification_failed")
            data = _read_stable_owner_file(path, _MAX_RESULT_BYTES)
            if sha256_bytes(data) != digest:
                raise QueueOperationError("result_verification_failed")
            return data
        except QueueOperationError:
            raise
        except (OSError, ValueError):
            raise QueueOperationError("result_verification_failed") from None

    def adopt_published_result(
        self, lease: QueueLease, *, operation_id: str
    ) -> str | None:
        """Adopt an owner-only stable result left before its DB reference committed."""
        result_name = f"{sha256_bytes(operation_id.encode('utf-8'))}.result"
        relative = f"run/queue-results/{result_name}"
        target = self.results_dir / result_name
        if not target.exists() and not target.is_symlink():
            return None
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            row = self._require_lease(connection, lease, now)
            digest = self._validated_result_digest(relative)
            if digest is None:
                self._record_attempt(
                    connection, row, now, "failed", "result_corrupt"
                )
                self._finish_lease(
                    connection,
                    lease.id,
                    now,
                    "dead",
                    "result_corrupt",
                    None,
                    last_attempt_at=now,
                )
                return "corrupt"
            connection.execute(
                """UPDATE tasks SET result_reference=?, result_sha256=?,
                       result_operation_id=?, updated_at=? WHERE id=?""",
                (relative, digest, operation_id, _timestamp(now), lease.id),
            )
            return "adopted"

    def heartbeat(
        self,
        lease: QueueLease,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ) -> QueueLease:
        if lease_seconds <= 0:
            raise ValueError("lease must be positive")
        now = _as_utc(self._clock())
        expires = now + timedelta(seconds=lease_seconds)
        with self._connect() as connection, begin_immediate(connection):
            self._require_lease(connection, lease, now)
            connection.execute(
                "UPDATE tasks SET lease_expires_at=?, lease_heartbeat_at=?, updated_at=? WHERE id=?",
                (_timestamp(expires), _timestamp(now), _timestamp(now), lease.id),
            )
        return replace(lease, expires_at=expires)

    def publish_result(
        self, lease: QueueLease, *, operation_id: str, result: bytes
    ) -> str:
        if not operation_id:
            raise ValueError("operation_id must be non-empty")
        if not isinstance(result, bytes):
            raise TypeError("result must be bytes")
        if len(result) > _MAX_RESULT_BYTES:
            raise ValueError("result exceeds maximum queue result size")
        digest = sha256_bytes(result)
        result_name = f"{sha256_bytes(operation_id.encode('utf-8'))}.result"
        relative = f"run/queue-results/{result_name}"
        target = self.results_dir / result_name
        temporary = self.results_dir / f".{result_name}.{uuid.uuid4().hex}.tmp"
        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
        descriptor = os.open(temporary, flags, 0o600)
        descriptor_open = True
        try:
            _harden_owner_only(temporary, 0o600)
            with os.fdopen(descriptor, "wb") as handle:
                descriptor_open = False
                handle.write(result)
                handle.flush()
                os.fsync(handle.fileno())
            now = _as_utc(self._clock())
            publication_error: ResultConflictError | None = None
            with self._connect() as connection, begin_immediate(connection):
                row = self._require_lease(connection, lease, now)
                existing_operation = row["result_operation_id"]
                if existing_operation is not None and existing_operation != operation_id:
                    raise ResultConflictError("lease already published a different operation")
                existing = target.exists() or target.is_symlink()
                linked = False
                if not existing:
                    try:
                        os.link(temporary, target)
                    except FileExistsError:
                        existing = True
                    else:
                        linked = True
                if existing:
                    existing_digest = self._validated_result_digest(relative)
                    if existing_digest is None:
                        self._record_attempt(
                            connection, row, now, "failed", "result_corrupt"
                        )
                        self._finish_lease(
                            connection,
                            lease.id,
                            now,
                            "dead",
                            "result_corrupt",
                            None,
                            last_attempt_at=now,
                        )
                        publication_error = ResultConflictError("result_corrupt")
                    elif existing_digest != digest:
                        publication_error = ResultConflictError(
                            "operation ID already has different result bytes"
                        )
                if publication_error is None:
                    if linked:
                        _harden_owner_only(target, 0o600)
                        fsync_file(target)
                    fsync_directory(self.results_dir)
                    connection.execute(
                        """UPDATE tasks SET result_reference=?, result_sha256=?,
                               result_operation_id=?, updated_at=?
                           WHERE id=?""",
                        (relative, digest, operation_id, _timestamp(now), lease.id),
                    )
            if publication_error is not None:
                raise publication_error
            return relative
        finally:
            if descriptor_open:
                os.close(descriptor)
            try:
                temporary.unlink()
            except OSError:
                pass

    def acknowledge(self, lease: QueueLease) -> QueueTask:
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            row = self._require_lease(connection, lease, now)
            if not self._stored_result_is_valid(row):
                self._record_attempt(
                    connection, row, now, "failed", "result_corrupt"
                )
                self._finish_lease(
                    connection,
                    lease.id,
                    now,
                    "dead",
                    "result_corrupt",
                    None,
                    last_attempt_at=now,
                )
            else:
                self._record_attempt(connection, row, now, "succeeded", None)
                self._finish_lease(
                    connection, lease.id, now, "succeeded", None, None
                )
        return self.get(lease.id)

    def fail(
        self,
        lease: QueueLease,
        failure: QueueFailure,
        *,
        max_attempts: int | None = None,
        retry_base_seconds: int | None = None,
        retry_cap_seconds: int | None = None,
    ) -> None:
        if not failure.error_code:
            raise ValueError("error_code must be non-empty")
        attempt_limit = self._max_attempts if max_attempts is None else max_attempts
        retry_base = (
            self._retry_base_seconds
            if retry_base_seconds is None
            else retry_base_seconds
        )
        retry_cap = (
            self._retry_cap_seconds if retry_cap_seconds is None else retry_cap_seconds
        )
        _validate_retry_policy(attempt_limit, retry_base, retry_cap)
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            row = self._require_lease(connection, lease, now)
            if failure.blocked_capability:
                self._record_attempt(connection, row, now, "blocked", failure.error_code)
                self._record_payload_failure(
                    connection,
                    str(row["payload_json"]),
                    failure.error_code,
                    "queue",
                    now,
                )
                connection.execute(
                    """UPDATE tasks SET state='blocked', attempts=attempts-1, updated_at=?,
                           lease_owner=NULL, lease_token=NULL, lease_expires_at=NULL,
                           lease_heartbeat_at=NULL, attempt_started_at=NULL, error_code=?,
                           blocked_capability=? WHERE id=?""",
                    (
                        _timestamp(now),
                        failure.error_code,
                        failure.blocked_capability,
                        lease.id,
                    ),
                )
                return
            dead = (
                failure.permanent
                or failure.error_code in _PERMANENT_CODES
                or int(row["attempts"]) >= attempt_limit
            )
            self._record_attempt(connection, row, now, "failed", failure.error_code)
            if dead:
                self._finish_lease(
                    connection,
                    lease.id,
                    now,
                    "dead",
                    failure.error_code,
                    None,
                    last_attempt_at=now,
                )
                return
            delay = self._retry_delay(
                int(row["attempts"]),
                retry_base_seconds=retry_base,
                retry_cap_seconds=retry_cap,
            )
            retry_after = self._retry_after_seconds(failure.retry_after, now)
            if retry_after is not None:
                delay = max(delay, retry_after)
            self._finish_lease(
                connection,
                lease.id,
                now,
                "ready",
                failure.error_code,
                now + timedelta(seconds=delay),
                last_attempt_at=now,
            )

    def _retry_delay(
        self,
        attempts: int,
        *,
        retry_base_seconds: int | None = None,
        retry_cap_seconds: int | None = None,
    ) -> float:
        retry_base = (
            self._retry_base_seconds
            if retry_base_seconds is None
            else retry_base_seconds
        )
        retry_cap = (
            self._retry_cap_seconds if retry_cap_seconds is None else retry_cap_seconds
        )
        jitter_cap = min(
            retry_cap,
            retry_base * (2 ** (attempts - 1)),
        )
        return self._rng.uniform(0, jitter_cap)

    @staticmethod
    def _retry_after_seconds(
        value: float | datetime | str | None, now: datetime
    ) -> float | None:
        if isinstance(value, int) and not isinstance(value, bool):
            if value < 0:
                return None
            return float(min(value, _MAX_RETRY_AFTER_SECONDS))
        if isinstance(value, float):
            if not math.isfinite(value) or value < 0:
                return None
            return min(value, float(_MAX_RETRY_AFTER_SECONDS))
        if isinstance(value, datetime):
            seconds = max(0.0, (_as_utc(value) - now).total_seconds())
            return min(seconds, float(_MAX_RETRY_AFTER_SECONDS))
        if isinstance(value, str):
            stripped = value.strip()
            if stripped.isdigit():
                try:
                    seconds = int(stripped)
                except ValueError:
                    return None
                return float(min(seconds, _MAX_RETRY_AFTER_SECONDS))
            try:
                parsed = email.utils.parsedate_to_datetime(stripped)
            except (TypeError, ValueError, OverflowError):
                return None
            seconds = max(0.0, (_as_utc(parsed) - now).total_seconds())
            return min(seconds, float(_MAX_RETRY_AFTER_SECONDS))
        return None

    @staticmethod
    def _record_attempt(
        connection: sqlite3.Connection,
        row: sqlite3.Row,
        now: datetime,
        outcome: str,
        error_code: str | None,
    ) -> None:
        connection.execute(
            """INSERT INTO attempt_history(
                   task_id, attempt, started_at, finished_at, outcome, error_code
               ) VALUES (?, ?, ?, ?, ?, ?)""",
            (
                row["id"],
                row["attempts"],
                row["attempt_started_at"] or _timestamp(now),
                _timestamp(now),
                outcome,
                error_code,
            ),
        )

    def _finish_lease(
        self,
        connection: sqlite3.Connection,
        task_id: str,
        now: datetime,
        state: str,
        error_code: str | None,
        available_at: datetime | None,
        *,
        last_attempt_at: datetime | None = None,
    ) -> None:
        row = connection.execute(
            "SELECT payload_json FROM tasks WHERE id=?", (task_id,)
        ).fetchone()
        if row is not None:
            payload_json = str(row["payload_json"])
            if error_code is not None and state in {"ready", "dead"}:
                self._record_payload_failure(
                    connection, payload_json, error_code, "queue", now
                )
            elif state in {"succeeded", "cancelled"}:
                self._clear_payload_failure(connection, payload_json)
        connection.execute(
            """UPDATE tasks SET state=?, updated_at=?, available_at=COALESCE(?, available_at),
                   last_attempt_at=COALESCE(?, last_attempt_at),
                   lease_owner=NULL, lease_token=NULL, lease_expires_at=NULL,
                   lease_heartbeat_at=NULL, attempt_started_at=NULL, error_code=?,
                   blocked_capability=NULL WHERE id=?""",
            (
                state,
                _timestamp(now),
                _timestamp(available_at) if available_at else None,
                _timestamp(last_attempt_at) if last_attempt_at else None,
                error_code,
                task_id,
            ),
        )

    @staticmethod
    def _require_lease(
        connection: sqlite3.Connection, lease: QueueLease, now: datetime
    ) -> sqlite3.Row:
        row = connection.execute("SELECT * FROM tasks WHERE id=?", (lease.id,)).fetchone()
        if (
            row is None
            or row["state"] != "leased"
            or row["lease_owner"] != lease.owner
            or row["lease_token"] != lease.token
            or row["lease_expires_at"] <= _timestamp(now)
        ):
            raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        return row

    def cancel(
        self,
        task_id: str,
        *,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> bool:
        _require_active(deadline, cancelled)
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(
            connection,
            before_commit=lambda: _require_active(deadline, cancelled),
        ):
            row = connection.execute("SELECT * FROM tasks WHERE id=?", (task_id,)).fetchone()
            if row is None or row["state"] in _TERMINAL_STATES:
                return False
            if row["state"] == "leased":
                self._record_attempt(connection, row, now, "cancelled", "cancelled")
            self._clear_payload_failure(connection, str(row["payload_json"]))
            _require_active(deadline, cancelled)
            connection.execute(
                """UPDATE tasks SET state='cancelled', updated_at=?, lease_owner=NULL,
                       lease_token=NULL, lease_expires_at=NULL, lease_heartbeat_at=NULL,
                       attempt_started_at=NULL, error_code='cancelled' WHERE id=?""",
                (_timestamp(now), task_id),
            )
            return True

    def redrive(
        self,
        task_id: str,
        *,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> str:
        _require_active(deadline, cancelled)
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(
            connection,
            before_commit=lambda: _require_active(deadline, cancelled),
        ):
            row = connection.execute(
                "SELECT * FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            if row is None:
                raise KeyError(task_id)
            if row["state"] != "dead":
                raise QueueOperationError("redrive_requires_dead")
            self._delete_stale_source_fences(connection)
            self._assert_payload_not_fenced(connection, str(row["payload_json"]))
            payload_bytes = str(row["payload_json"]).encode("utf-8")
            replacement = uuid.UUID(int=self._rng.getrandbits(128)).hex
            _require_active(deadline, cancelled)
            connection.execute(
                """INSERT INTO tasks(
                       id, kind, handler_version, payload_json, input_hash, state,
                       priority, created_at, updated_at, available_at, redrive_of
                   ) VALUES (?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?)""",
                (
                    replacement,
                    row["kind"],
                    row["handler_version"],
                    payload_bytes.decode("utf-8"),
                    sha256_bytes(payload_bytes),
                    row["priority"],
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(now),
                    task_id,
                ),
            )
        return replacement

    @staticmethod
    def _validate_source_identity(daily_id: str, source_digest: str) -> None:
        if not isinstance(daily_id, str) or re.fullmatch(r"\d{4}-\d{2}-\d{2}", daily_id) is None:
            raise ValueError("daily_id must be a canonical date")
        try:
            if date.fromisoformat(daily_id).isoformat() != daily_id:
                raise ValueError
        except ValueError as exc:
            raise ValueError("daily_id must be a canonical date") from exc
        if not isinstance(source_digest, str) or re.fullmatch(r"[0-9a-f]{64}", source_digest) is None:
            raise ValueError("source_digest must be a lowercase SHA-256")

    @staticmethod
    def _validate_failure_identity(logical_path: str, source_digest: str) -> None:
        if (
            not isinstance(logical_path, str)
            or re.fullmatch(r"knowledge/daily/\d{4}-\d{2}-\d{2}\.md", logical_path)
            is None
        ):
            raise ValueError("logical_path must name a canonical daily source")
        MemoryQueue._validate_source_identity(
            Path(logical_path).stem, source_digest
        )

    @staticmethod
    def _source_identity_from_payload(payload_json: str) -> tuple[str, str] | None:
        try:
            payload = json.loads(payload_json)
        except json.JSONDecodeError:
            return None
        paths: list[str] = []
        digests: list[str] = []
        daily_ids: list[str] = []

        def visit(value: object) -> None:
            if isinstance(value, dict):
                for key, item in value.items():
                    normalized = str(key).casefold()
                    if isinstance(item, str):
                        if normalized in {"source_path", "logical_path"}:
                            paths.append(item)
                        elif normalized in {"source_digest", "digest", "hash"}:
                            digests.append(item)
                        elif normalized == "daily_id":
                            daily_ids.append(item)
                    visit(item)
            elif isinstance(value, list):
                for item in value:
                    visit(item)

        visit(payload)
        if not paths and daily_ids:
            paths.append(f"knowledge/daily/{daily_ids[0]}.md")
        if not paths or not digests:
            return None
        try:
            MemoryQueue._validate_failure_identity(paths[0], digests[0])
        except ValueError:
            return None
        return paths[0], digests[0]

    @staticmethod
    def _record_source_failure_row(
        connection: sqlite3.Connection,
        logical_path: str,
        source_digest: str,
        error_code: str,
        producer: str,
        now: datetime,
    ) -> None:
        connection.execute(
            """INSERT INTO source_failures(
                   logical_path, source_digest, error_code, producer, updated_at
               ) VALUES (?, ?, ?, ?, ?)
               ON CONFLICT(logical_path, source_digest) DO UPDATE SET
                   error_code=excluded.error_code,
                   producer=excluded.producer,
                   updated_at=excluded.updated_at""",
            (logical_path, source_digest, error_code, producer, _timestamp(now)),
        )

    def _record_payload_failure(
        self,
        connection: sqlite3.Connection,
        payload_json: str,
        error_code: str,
        producer: str,
        now: datetime,
    ) -> None:
        identity = self._source_identity_from_payload(payload_json)
        if identity is not None:
            self._record_source_failure_row(
                connection, *identity, error_code, producer, now
            )

    def _clear_payload_failure(
        self, connection: sqlite3.Connection, payload_json: str
    ) -> None:
        identity = self._source_identity_from_payload(payload_json)
        if identity is not None:
            connection.execute(
                "DELETE FROM source_failures WHERE logical_path=? AND source_digest=?",
                identity,
            )

    def record_source_failure(
        self,
        logical_path: str,
        source_digest: str,
        *,
        error_code: str,
        producer: str,
    ) -> None:
        self._validate_failure_identity(logical_path, source_digest)
        if (
            not isinstance(error_code, str)
            or not 1 <= len(error_code) <= 200
            or any(char in error_code for char in "\r\n")
            or producer not in {"compile", "queue"}
        ):
            raise ValueError("source failure fields are invalid")
        with self._connect() as connection, begin_immediate(connection):
            self._record_source_failure_row(
                connection,
                logical_path,
                source_digest,
                error_code,
                producer,
                _as_utc(self._clock()),
            )

    def clear_source_failure(self, logical_path: str, source_digest: str) -> None:
        self._validate_failure_identity(logical_path, source_digest)
        with self._connect() as connection, begin_immediate(connection):
            connection.execute(
                "DELETE FROM source_failures WHERE logical_path=? AND source_digest=?",
                (logical_path, source_digest),
            )

    def source_failure(
        self, logical_path: str, source_digest: str
    ) -> dict[str, str] | None:
        self._validate_failure_identity(logical_path, source_digest)
        with self._connect() as connection:
            row = connection.execute(
                "SELECT logical_path, source_digest, error_code, producer "
                "FROM source_failures WHERE logical_path=? AND source_digest=?",
                (logical_path, source_digest),
            ).fetchone()
        return None if row is None else {key: str(row[key]) for key in row.keys()}

    @staticmethod
    def _payload_references_source(
        payload_json: str, daily_id: str, source_digest: str
    ) -> bool:
        return daily_id in payload_json or source_digest in payload_json

    def _delete_stale_source_fences(self, connection: sqlite3.Connection) -> None:
        now = _as_utc(self._clock())
        rows = connection.execute(
            "SELECT token, owner_pid, expires_at FROM source_fences"
        ).fetchall()
        for row in rows:
            expires_at = _parse_timestamp(str(row["expires_at"]))
            expired = expires_at is None or expires_at <= now
            if expired or not _pid_is_alive(int(row["owner_pid"])):
                connection.execute(
                    "DELETE FROM source_fences WHERE token=?", (row["token"],)
                )

    def _assert_payload_not_fenced(
        self, connection: sqlite3.Connection, payload_json: str
    ) -> None:
        for row in connection.execute(
            "SELECT daily_id, source_digest FROM source_fences"
        ):
            if self._payload_references_source(
                payload_json, str(row["daily_id"]), str(row["source_digest"])
            ):
                raise QueueOperationError("source_fenced")

    def referencing_source_tasks(
        self,
        daily_id: str,
        source_digest: str,
        *,
        states: tuple[str, ...] = ("ready", "leased", "blocked", "dead"),
    ) -> tuple[str, ...]:
        self._validate_source_identity(daily_id, source_digest)
        if not states or any(state not in _STATES for state in states):
            raise ValueError("invalid queue state")
        placeholders = ",".join("?" for _ in states)
        with self._connect() as connection:
            cursor = connection.execute(
                f"SELECT id, payload_json FROM tasks WHERE state IN ({placeholders}) "
                "ORDER BY created_at, rowid",  # noqa: S608 - generated placeholders
                states,
            )
            matches = []
            for row in cursor:
                if self._payload_references_source(
                    str(row["payload_json"]), daily_id, source_digest
                ):
                    matches.append(str(row["id"]))
            return tuple(matches)

    def acquire_source_fence(
        self,
        daily_id: str,
        source_digest: str,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ) -> SourceFence:
        self._validate_source_identity(daily_id, source_digest)
        if not isinstance(lease_seconds, int) or isinstance(lease_seconds, bool) or lease_seconds <= 0:
            raise ValueError("source fence lease must be a positive integer")
        token = f"{self._rng.getrandbits(256):064x}"
        acquired = _as_utc(self._clock())
        expires = acquired + timedelta(seconds=lease_seconds)
        with self._connect() as connection, begin_immediate(connection):
            self._delete_stale_source_fences(connection)
            for row in connection.execute(
                "SELECT id, payload_json FROM tasks "
                "WHERE state IN ('ready','leased','blocked','dead')"
            ):
                if self._payload_references_source(
                    str(row["payload_json"]), daily_id, source_digest
                ):
                    raise QueueOperationError("source_referenced")
            try:
                connection.execute(
                    "INSERT INTO source_fences "
                    "(daily_id, source_digest, token, owner_pid, acquired_at, "
                    "heartbeat_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)",
                    (
                        daily_id,
                        source_digest,
                        token,
                        os.getpid(),
                        _timestamp(acquired),
                        _timestamp(acquired),
                        _timestamp(expires),
                    ),
                )
            except sqlite3.IntegrityError as exc:
                raise QueueOperationError("source_fenced") from exc
        return SourceFence(
            daily_id,
            source_digest,
            token,
            os.getpid(),
            acquired,
            acquired,
            expires,
        )

    def heartbeat_source_fence(
        self,
        fence: SourceFence,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ) -> SourceFence:
        if not isinstance(fence, SourceFence):
            raise TypeError("source heartbeat requires a SourceFence")
        if not isinstance(lease_seconds, int) or isinstance(lease_seconds, bool) or lease_seconds <= 0:
            raise ValueError("source fence lease must be a positive integer")
        now = _as_utc(self._clock())
        expires = now + timedelta(seconds=lease_seconds)
        with self._connect() as connection, begin_immediate(connection):
            self._delete_stale_source_fences(connection)
            changed = connection.execute(
                """UPDATE source_fences SET heartbeat_at=?, expires_at=?
                   WHERE daily_id=? AND source_digest=? AND token=? AND owner_pid=?
                     AND acquired_at=? AND heartbeat_at=? AND expires_at=?""",
                (
                    _timestamp(now),
                    _timestamp(expires),
                    fence.daily_id,
                    fence.source_digest,
                    fence.token,
                    fence.owner_pid,
                    _timestamp(fence.acquired_at),
                    _timestamp(fence.heartbeat_at),
                    _timestamp(fence.expires_at),
                ),
            ).rowcount
            if changed != 1 or now >= fence.expires_at:
                raise QueueOperationError("source_fence_lost")
        return replace(fence, heartbeat_at=now, expires_at=expires)

    @contextmanager
    def source_fence_heartbeat(
        self,
        fence: SourceFence,
        *,
        heartbeat_seconds: int = DEFAULTS.queue_heartbeat_seconds,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ):
        if (
            not isinstance(heartbeat_seconds, int)
            or isinstance(heartbeat_seconds, bool)
            or heartbeat_seconds <= 0
            or not isinstance(lease_seconds, int)
            or isinstance(lease_seconds, bool)
            or lease_seconds <= heartbeat_seconds
        ):
            raise ValueError("source heartbeat interval must be shorter than its lease")
        heartbeat = _SourceFenceHeartbeat(
            self,
            fence,
            heartbeat_seconds=heartbeat_seconds,
            lease_seconds=lease_seconds,
        )
        heartbeat.start()
        try:
            yield heartbeat
        finally:
            heartbeat.stop()

    @contextmanager
    def source_finalization(self, fence: SourceFence):
        if not isinstance(fence, SourceFence):
            raise TypeError("source finalization requires a SourceFence")
        with self._connect() as connection, begin_immediate(connection):
            self._delete_stale_source_fences(connection)
            row = connection.execute(
                "SELECT daily_id, source_digest, token, owner_pid, acquired_at, expires_at "
                "FROM source_fences WHERE token=?",
                (fence.token,),
            ).fetchone()
            now = _as_utc(self._clock())
            row_expires_at = (
                None if row is None else _parse_timestamp(str(row["expires_at"]))
            )
            if (
                row is None
                or str(row["daily_id"]) != fence.daily_id
                or str(row["source_digest"]) != fence.source_digest
                or str(row["token"]) != fence.token
                or int(row["owner_pid"]) != os.getpid()
                or fence.owner_pid != os.getpid()
                or str(row["acquired_at"]) != _timestamp(fence.acquired_at)
                or row_expires_at is None
                or now >= row_expires_at
            ):
                raise QueueOperationError("source_fence_lost")
            logical_path = f"knowledge/daily/{fence.daily_id}.md"
            if connection.execute(
                "SELECT 1 FROM source_failures "
                "WHERE logical_path=? AND source_digest=?",
                (logical_path, fence.source_digest),
            ).fetchone() is not None:
                raise QueueOperationError("source_failure")
            for task in connection.execute(
                "SELECT payload_json FROM tasks "
                "WHERE state IN ('ready','leased','blocked','dead')"
            ):
                if self._payload_references_source(
                    str(task["payload_json"]), fence.daily_id, fence.source_digest
                ):
                    raise QueueOperationError("source_referenced")
            yield

    def release_source_fence(self, token: str) -> None:
        if not isinstance(token, str) or re.fullmatch(r"[0-9a-f]{64}", token) is None:
            raise ValueError("source fence token is invalid")
        with self._connect() as connection, begin_immediate(connection):
            changed = connection.execute(
                "DELETE FROM source_fences WHERE token=? AND owner_pid=?",
                (token, os.getpid()),
            ).rowcount
            if changed != 1:
                raise QueueOperationError("source_fence_lost")

    def retains_run_directory(self) -> bool:
        with self._connect() as connection:
            task = connection.execute("SELECT 1 FROM tasks LIMIT 1").fetchone()
            source_fence = connection.execute(
                "SELECT 1 FROM source_fences LIMIT 1"
            ).fetchone()
            source_failure = connection.execute(
                "SELECT 1 FROM source_failures LIMIT 1"
            ).fetchone()
        if task is not None or source_fence is not None or source_failure is not None:
            return True
        quarantine = self.run_dir / "queue-quarantine"
        try:
            if quarantine.exists() and any(quarantine.iterdir()):
                return True
        except OSError:
            return True
        try:
            return any(self.results_dir.iterdir())
        except OSError:
            return True

    def purge(
        self,
        *,
        terminal_before: datetime,
        export_path: Path,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> PurgeReceipt:
        _require_active(deadline, cancelled)
        requested_cutoff = _as_utc(terminal_before)
        retention_cutoff = _as_utc(self._clock()) - timedelta(
            days=DEFAULTS.queue_result_retention_days
        )
        cutoff = min(requested_cutoff, retention_cutoff)
        export = Path(export_path).absolute()
        if export.exists():
            raise QueueOperationError("export_exists")
        with self._connect() as connection:
            rows = connection.execute(
                """SELECT * FROM tasks
                   WHERE state IN ('succeeded','cancelled') AND updated_at < ?
                   ORDER BY created_at, rowid""",
                (_timestamp(cutoff),),
            ).fetchall()
            histories = {
                str(row["id"]): connection.execute(
                    "SELECT * FROM attempt_history WHERE task_id=? ORDER BY sequence",
                    (row["id"],),
                ).fetchall()
                for row in rows
            }
        task_ids = tuple(str(row["id"]) for row in rows)
        records = [
            _export_task_record(self._task_from_row(row, histories[str(row["id"])]))
            for row in rows
        ]
        records_bytes = canonical_json_bytes(records)
        parent = export.parent
        if not parent.exists():
            parent.mkdir(parents=True)
            _harden_owner_only(parent, 0o700)
        if (
            parent.is_symlink()
            or not parent.is_dir()
            or not _is_owner_only(parent)
        ):
            raise QueueOperationError("export_parent_permissions_invalid")
        _cleanup_export_staging(parent, export.name)
        staging = parent / f".{export.name}.staging-{uuid.uuid4().hex}"
        staging.mkdir()
        _harden_owner_only(staging, 0o700)
        try:
            results_export = staging / "results"
            results_export.mkdir()
            _harden_owner_only(results_export, 0o700)
            result_manifest: list[dict[str, str]] = []
            for row in rows:
                _require_active(deadline, cancelled)
                reference = row["result_reference"]
                digest = row["result_sha256"]
                if reference is None:
                    continue
                if not isinstance(digest, str):
                    raise QueueOperationError("result_verification_failed")
                result = self._read_result_for_export(str(reference), digest)
                target = results_export / f"{row['id']}.result"
                _write_durable_file(target, result)
                result_manifest.append({"id": str(row["id"]), "sha256": digest})
            records_path = staging / "records.json"
            _write_durable_file(records_path, records_bytes)
            manifest = {
                "records_sha256": sha256_bytes(records_bytes),
                "results": result_manifest,
                "task_ids": list(task_ids),
            }
            manifest_path = staging / "manifest.json"
            manifest_bytes = canonical_json_bytes(manifest)
            _write_durable_file(manifest_path, manifest_bytes)
            fsync_directory(results_export)
            fsync_directory(staging)
            if (
                _read_stable_owner_file(records_path, _MAX_EXPORT_METADATA_BYTES)
                != records_bytes
            ):
                raise QueueOperationError("export_verification_failed")
            for item in result_manifest:
                exported = results_export / f"{item['id']}.result"
                data = _read_stable_owner_file(exported, _MAX_RESULT_BYTES)
                if sha256_bytes(data) != item["sha256"]:
                    raise QueueOperationError("export_verification_failed")
            if (
                _read_stable_owner_file(manifest_path, _MAX_EXPORT_METADATA_BYTES)
                != manifest_bytes
            ):
                raise QueueOperationError("export_verification_failed")
            _require_active(deadline, cancelled)
            staging.replace(export)
            fsync_directory(parent)
        except Exception:
            _remove_export_staging(staging)
            raise
        if task_ids:
            try:
                _require_active(deadline, cancelled)
                placeholders = ",".join("?" for _ in task_ids)
                with self._connect() as connection, begin_immediate(
                    connection,
                    before_commit=lambda: _require_active(deadline, cancelled),
                ):
                    current = connection.execute(
                        f"""SELECT id, state, updated_at FROM tasks
                            WHERE id IN ({placeholders})""",  # noqa: S608
                        task_ids,
                    ).fetchall()
                    if len(current) != len(task_ids) or any(
                        row["state"] not in ("succeeded", "cancelled")
                        or row["updated_at"] >= _timestamp(cutoff)
                        for row in current
                    ):
                        raise QueueOperationError("purge_selection_changed")
                    _require_active(deadline, cancelled)
                    connection.execute("DROP TRIGGER attempt_history_immutable_delete")
                    connection.execute(
                        f"DELETE FROM attempt_history WHERE task_id IN ({placeholders})",  # noqa: S608
                        task_ids,
                    )
                    connection.execute(
                        f"DELETE FROM tasks WHERE id IN ({placeholders})",  # noqa: S608
                        task_ids,
                    )
                    connection.execute(
                        """CREATE TRIGGER attempt_history_immutable_delete
                           BEFORE DELETE ON attempt_history BEGIN
                           SELECT RAISE(ABORT, 'attempt history is immutable'); END"""
                    )
            except BaseException:
                _remove_export_staging(export)
                raise
            for row in rows:
                _require_active(deadline, cancelled)
                reference = row["result_reference"]
                if reference is None:
                    continue
                with self._connect() as connection:
                    retained = connection.execute(
                        "SELECT 1 FROM tasks WHERE result_reference=? LIMIT 1",
                        (reference,),
                    ).fetchone()
                if retained is None:
                    (self.state_root / str(reference)).unlink(missing_ok=True)
            fsync_directory(self.results_dir)
        return PurgeReceipt(len(task_ids), task_ids)

    def recover_expired_leases(self) -> int:
        now = _as_utc(self._clock())
        with self._connect() as connection, begin_immediate(connection):
            return self._expire_leases(connection, now, self._max_attempts)

    def get(self, task_id: str) -> QueueTask:
        with self._connect() as connection:
            row = connection.execute("SELECT * FROM tasks WHERE id=?", (task_id,)).fetchone()
            if row is None:
                raise KeyError(task_id)
            history = connection.execute(
                "SELECT * FROM attempt_history WHERE task_id=? ORDER BY sequence", (task_id,)
            ).fetchall()
        return self._task_from_row(row, history)

    def list_tasks(
        self, *, states: tuple[str, ...] | None = None, max_age_days: int | None = None
    ) -> list[QueueTask]:
        states = states or _STATES
        if not states or any(state not in _STATES for state in states):
            raise ValueError("invalid queue state")
        placeholders = ",".join("?" for _ in states)
        parameters: list[object] = list(states)
        age_clause = ""
        if max_age_days is not None:
            cutoff = _as_utc(self._clock()) - timedelta(days=max_age_days)
            age_clause = " AND created_at >= ?"
            parameters.append(_timestamp(cutoff))
        with self._connect() as connection:
            rows = connection.execute(
                f"""SELECT * FROM tasks WHERE state IN ({placeholders}){age_clause}
                    ORDER BY created_at, rowid""",  # noqa: S608 - generated placeholders
                parameters,
            ).fetchall()
            histories: dict[str, list[sqlite3.Row]] = {}
            if rows:
                ids = [row["id"] for row in rows]
                id_placeholders = ",".join("?" for _ in ids)
                for history in connection.execute(
                    f"""SELECT * FROM attempt_history WHERE task_id IN ({id_placeholders})
                        ORDER BY sequence""",  # noqa: S608
                    ids,
                ):
                    histories.setdefault(str(history["task_id"]), []).append(history)
        return [self._task_from_row(row, histories.get(str(row["id"]), [])) for row in rows]

    def count_eligible(self, *, max_attempts: int = DEFAULTS.queue_max_attempts) -> int:
        _validate_retry_policy(
            max_attempts, self._retry_base_seconds, self._retry_cap_seconds
        )
        now = _as_utc(self._clock())
        with self._connect() as connection:
            row = connection.execute(
                """SELECT COUNT(*) FROM tasks
                   WHERE state='ready' AND attempts < ? AND available_at <= ?""",
                (max_attempts, _timestamp(now)),
            ).fetchone()
        return int(row[0])

    @staticmethod
    def _task_from_row(row: sqlite3.Row, history: list[sqlite3.Row]) -> QueueTask:
        return QueueTask(
            id=str(row["id"]),
            kind=str(row["kind"]),
            handler_version=int(row["handler_version"]),
            payload=json.loads(row["payload_json"]),
            input_hash=str(row["input_hash"]),
            dedupe_key=row["dedupe_key"],
            state=str(row["state"]),
            priority=int(row["priority"]),
            created_at=_parse_timestamp(row["created_at"]),  # type: ignore[arg-type]
            updated_at=_parse_timestamp(row["updated_at"]),  # type: ignore[arg-type]
            available_at=_parse_timestamp(row["available_at"]),  # type: ignore[arg-type]
            attempts=int(row["attempts"]),
            last_attempt_at=_parse_timestamp(row["last_attempt_at"]),
            lease_owner=row["lease_owner"],
            lease_token=row["lease_token"],
            lease_expires_at=_parse_timestamp(row["lease_expires_at"]),
            lease_heartbeat_at=_parse_timestamp(row["lease_heartbeat_at"]),
            error_code=row["error_code"],
            blocked_capability=row["blocked_capability"],
            result_reference=row["result_reference"],
            result_sha256=row["result_sha256"],
            redrive_of=row["redrive_of"],
            attempt_history=tuple(
                AttemptRecord(
                    attempt=int(item["attempt"]),
                    started_at=_parse_timestamp(item["started_at"]),  # type: ignore[arg-type]
                    finished_at=_parse_timestamp(item["finished_at"]),  # type: ignore[arg-type]
                    outcome=str(item["outcome"]),
                    error_code=item["error_code"],
                )
                for item in history
            ),
        )


class _QueueV3CandidateReader:
    """Minimal claim seam for tests against an unpublished v3 candidate."""

    def __init__(self, path: Path, *, coordinator_path: Path | None = None) -> None:
        self.db_path = Path(path)
        self.state_root = self.db_path.parent.parent
        self.results_dir = self.state_root / "run" / "queue-results"
        self.coordinator_path = coordinator_path

    def ownership_registry(self):
        from operational_ownership import OwnershipRegistry

        if self.coordinator_path is None:
            return OwnershipRegistry(self.state_root)
        return OwnershipRegistry._from_adopted_database(
            self.state_root, self.coordinator_path
        )

    def _connect(self) -> sqlite3.Connection:
        return open_operational_db(
            self.db_path,
            busy_ms=DEFAULTS.queue_busy_ms,
            contract=_QUEUE_V3_CONTRACT,
        )

    @staticmethod
    def _demote_payload_mismatch(
        database: sqlite3.Connection, row: sqlite3.Row, *, now: datetime
    ) -> None:
        changed = database.execute(
            """UPDATE tasks SET state='dead', error_code='payload_hash_mismatch',
                   updated_at=?, lease_owner=NULL, lease_token=NULL,
                   lease_expires_at=NULL, lease_heartbeat_at=NULL,
                   attempt_started_at=NULL, blocked_capability=NULL
               WHERE id=? AND state=?""",
            (_timestamp(now), row["id"], row["state"]),
        ).rowcount
        if changed != 1:
            raise QueueOperationError("payload_demotion_failed")

    @staticmethod
    def _require_valid_task_payload(
        database: sqlite3.Connection,
        row: sqlite3.Row,
        *,
        now: datetime,
        parse: bool,
    ) -> PayloadValidation | None:
        validation = validate_payload_blob(
            bytes(row["payload_blob"]), row["input_hash"], parse=parse
        )
        if validation.code is not None:
            _QueueV3CandidateReader._demote_payload_mismatch(database, row, now=now)
            return None
        return validation

    @staticmethod
    def _require_lease_row(
        database: sqlite3.Connection, lease: QueueLease, now: datetime
    ) -> sqlite3.Row:
        row = database.execute("SELECT * FROM tasks WHERE id=?", (lease.id,)).fetchone()
        if (
            row is None
            or row["state"] != "leased"
            or row["lease_owner"] != lease.owner
            or row["lease_token"] != lease.token
            or row["lease_expires_at"] <= _timestamp(now)
        ):
            raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        return row

    @staticmethod
    def _raise_payload_mismatch() -> None:
        raise QueueOperationError("payload_hash_mismatch")

    def enqueue(
        self,
        kind: str,
        handler_version: int,
        payload: Mapping[str, object],
        *,
        priority: int = 0,
        available_at: datetime | None = None,
        dedupe_key: str | None = None,
        source_links: tuple[tuple[str, str], ...] | list[tuple[str, str]] = (),
    ) -> str:
        if not isinstance(kind, str) or not kind or len(kind.encode("utf-8")) > 64:
            raise ValueError("kind must be a non-empty bounded string")
        if (
            not isinstance(handler_version, int)
            or isinstance(handler_version, bool)
            or not 1 <= handler_version <= 2_147_483_647
        ):
            raise ValueError("handler_version must be a positive bounded integer")
        if (
            not isinstance(priority, int)
            or isinstance(priority, bool)
            or not -100 <= priority <= 100
        ):
            raise ValueError("priority must be an integer from -100 to 100")
        if dedupe_key is not None and (
            not isinstance(dedupe_key, str)
            or not dedupe_key
            or len(dedupe_key.encode("utf-8")) > 512
        ):
            raise ValueError("dedupe_key must be a non-empty bounded string")
        normalized_links: list[tuple[str, str]] = []
        for item in source_links:
            if not isinstance(item, tuple) or len(item) != 2:
                raise ValueError("source links must be path and digest pairs")
            logical_path, source_digest = item
            if (
                not isinstance(logical_path, str)
                or not logical_path
                or len(logical_path.encode("utf-8")) > 4096
                or logical_path.startswith(("/", "\\"))
                or "\\" in logical_path
                or any(part in {"", ".", ".."} for part in logical_path.split("/"))
            ):
                raise ValueError("source link path is invalid")
            if (
                not isinstance(source_digest, str)
                or re.fullmatch(r"[0-9a-f]{64}", source_digest) is None
            ):
                raise ValueError("source link digest is invalid")
            normalized_links.append((logical_path, source_digest))
        if len(normalized_links) != len(set(normalized_links)):
            raise ValueError("source links must be unique")
        payload_bytes = canonical_json_bytes(_redact_payload(dict(payload)))
        input_hash = sha256_bytes(payload_bytes)
        validation = validate_payload_blob(payload_bytes, input_hash, parse=True)
        if validation.code is not None:
            raise ValueError(validation.code)
        now = _utc_now()
        ready_at = _as_utc(available_at or now)
        task_id = uuid.uuid4().hex
        with closing(self._connect()) as database, begin_immediate(database):
            if dedupe_key is not None:
                existing = database.execute(
                    """SELECT id, kind, handler_version, payload_blob, input_hash
                       FROM tasks WHERE dedupe_key=?""",
                    (dedupe_key,),
                ).fetchone()
                if existing is not None:
                    existing_bytes = bytes(existing["payload_blob"])
                    current = validate_payload_blob(
                        existing_bytes, existing["input_hash"], parse=True
                    )
                    if (
                        current.code is None
                        and existing["kind"] == kind
                        and existing["handler_version"] == handler_version
                        and existing["input_hash"] == input_hash
                        and existing_bytes == payload_bytes
                    ):
                        return str(existing["id"])
                    raise QueueOperationError("dedupe_conflict")
            inserted = database.execute(
                """INSERT INTO tasks(
                       id,kind,handler_version,payload_blob,input_hash,dedupe_key,
                       state,priority,created_at,updated_at,available_at
                   ) VALUES (?,?,?,?,?,?,'ready',?,?,?,?)""",
                (
                    task_id,
                    kind,
                    handler_version,
                    payload_bytes,
                    input_hash,
                    dedupe_key,
                    priority,
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(ready_at),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("enqueue_failed")
            for logical_path, source_digest in sorted(normalized_links):
                linked = database.execute(
                    """INSERT INTO task_source_links(
                           task_id,logical_path,source_digest
                       ) VALUES (?,?,?)""",
                    (task_id, logical_path, source_digest),
                ).rowcount
                if linked != 1:
                    raise QueueOperationError("source_link_insert_failed")
        return task_id

    def publish_capture_intent(
        self,
        *,
        intent_id: str,
        intent_path: str,
        intent_sha256: str,
        byte_size: int,
    ) -> None:
        if re.fullmatch(r"[0-9a-f]{64}", intent_id) is None:
            raise ValueError("intent_id must be lowercase 64-hex")
        if re.fullmatch(r"[0-9a-f]{64}", intent_sha256) is None:
            raise ValueError("intent_sha256 must be lowercase 64-hex")
        if (
            not isinstance(intent_path, str)
            or not intent_path.startswith("run/capture-intents/")
            or "\\" in intent_path
            or len(intent_path.encode("utf-8")) > 4096
        ):
            raise ValueError("intent_path is invalid")
        if (
            isinstance(byte_size, bool)
            or not isinstance(byte_size, int)
            or not 1 <= byte_size <= _MAX_QUEUE_PAYLOAD_BYTES
        ):
            raise ValueError("intent byte size is invalid")
        now = _timestamp(_utc_now())
        with closing(self._connect()) as database, begin_immediate(database):
            existing = database.execute(
                "SELECT * FROM capture_intents WHERE intent_id=?", (intent_id,)
            ).fetchone()
            if existing is not None:
                if (
                    existing["relative_path"] != intent_path
                    or existing["intent_sha256"] != intent_sha256
                    or existing["byte_size"] != byte_size
                    or existing["publication_state"] != "ready"
                ):
                    raise QueueOperationError("capture_intent_conflict")
                return
            inserted = database.execute(
                """INSERT INTO capture_intents(
                       intent_id,relative_path,intent_sha256,byte_size,
                       publication_state,updated_at
                   ) VALUES (?,?,?,?,'ready',?)""",
                (intent_id, intent_path, intent_sha256, byte_size, now),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("capture_intent_insert_failed")

    def index_capture_intent_pending(
        self,
        *,
        intent_id: str,
        pending_path: str,
        ready_path: str,
        intent_sha256: str,
        byte_size: int,
    ) -> str:
        _require_capture_intent_descriptor(
            intent_id, pending_path, intent_sha256, byte_size
        )
        _require_capture_intent_path(ready_path, "ready")
        now = _timestamp(_utc_now())
        with closing(self._connect()) as database, begin_immediate(database):
            existing = database.execute(
                "SELECT * FROM capture_intents WHERE intent_id=?", (intent_id,)
            ).fetchone()
            if existing is not None:
                return _existing_capture_publication_state(
                    existing,
                    pending_path=pending_path,
                    ready_path=ready_path,
                    intent_sha256=intent_sha256,
                    byte_size=byte_size,
                )
            inserted = database.execute(
                """INSERT INTO capture_intents(
                       intent_id,relative_path,intent_sha256,byte_size,
                       publication_state,updated_at
                   ) VALUES (?,?,?,?,'pending',?)""",
                (intent_id, pending_path, intent_sha256, byte_size, now),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("capture_intent_insert_failed")
        return "pending"

    def mark_capture_intent_ready(
        self,
        *,
        intent_id: str,
        pending_path: str,
        ready_path: str,
        intent_sha256: str,
        byte_size: int,
    ) -> None:
        _require_capture_intent_descriptor(
            intent_id, pending_path, intent_sha256, byte_size
        )
        _require_capture_intent_path(ready_path, "ready")
        with closing(self._connect()) as database, begin_immediate(database):
            row = database.execute(
                "SELECT * FROM capture_intents WHERE intent_id=?", (intent_id,)
            ).fetchone()
            state = _existing_capture_publication_state(
                row,
                pending_path=pending_path,
                ready_path=ready_path,
                intent_sha256=intent_sha256,
                byte_size=byte_size,
            )
            if state == "ready":
                return
            updated = database.execute(
                """UPDATE capture_intents
                   SET relative_path=?,publication_state='ready',updated_at=?
                   WHERE intent_id=? AND relative_path=?
                     AND publication_state='pending'""",
                (ready_path, _timestamp(_utc_now()), intent_id, pending_path),
            ).rowcount
            if updated != 1:
                raise QueueOperationError("capture_intent_conflict")

    def enqueue_capture_task_replay_safe(
        self,
        kind: str,
        handler_version: int,
        payload: Mapping[str, object],
        *,
        intent_id: str,
        intent_path: str,
        intent_sha256: str,
        capture_fence: object,
        owner: OwnerLease,
    ) -> CaptureTaskBinding:
        payload_bytes = canonical_json_bytes(_redact_payload(dict(payload)))
        dedupe_key = f"capture:{intent_id}:{handler_version}"
        existing = self._capture_replay_binding(
            intent_id=intent_id,
            kind=kind,
            handler_version=handler_version,
            payload_bytes=payload_bytes,
            dedupe_key=dedupe_key,
        )
        if existing is not None:
            return existing
        return self.enqueue_capture_task(
            kind,
            handler_version,
            payload,
            intent_id=intent_id,
            intent_path=intent_path,
            intent_sha256=intent_sha256,
            capture_fence=capture_fence,
            owner=owner,
            dedupe_key=dedupe_key,
        )

    def _capture_replay_binding(
        self,
        *,
        intent_id: str,
        kind: str,
        handler_version: int,
        payload_bytes: bytes,
        dedupe_key: str,
    ) -> CaptureTaskBinding | None:
        with closing(self._connect()) as database:
            rows = database.execute(
                """SELECT task.*,link.intent_sha256
                   FROM capture_task_links AS link
                   JOIN tasks AS task ON task.id=link.task_id
                   WHERE link.intent_id=?""",
                (intent_id,),
            ).fetchall()
            if not rows:
                return None
            if len(rows) != 1:
                raise QueueOperationError("capture_link_conflicted")
            _require_capture_replay_task(
                rows[0], kind, handler_version, payload_bytes, dedupe_key
            )
            return self.active_capture_binding(database, str(rows[0]["id"]))

    @staticmethod
    def _insert_capture_link(
        database: sqlite3.Connection,
        *,
        task_id: str,
        intent_id: str,
        intent_sha256: str,
        handler_version: int,
        link_digest: str,
        created_at: str,
    ) -> None:
        inserted = database.execute(
            """INSERT INTO capture_task_links(
                   task_id,intent_id,intent_sha256,handler_version,
                   link_digest,created_at
               ) VALUES (?,?,?,?,?,?)""",
            (
                task_id,
                intent_id,
                intent_sha256,
                handler_version,
                link_digest,
                created_at,
            ),
        ).rowcount
        if inserted != 1:
            raise QueueOperationError("capture_link_insert_failed")

    def enqueue_capture_task(
        self,
        kind: str,
        handler_version: int,
        payload: Mapping[str, object],
        *,
        intent_id: str,
        intent_path: str,
        intent_sha256: str,
        capture_fence: object,
        owner: OwnerLease,
        priority: int = 0,
        available_at: datetime | None = None,
        dedupe_key: str | None = None,
    ) -> CaptureTaskBinding:
        if re.fullmatch(r"[0-9a-f]{64}", intent_id) is None:
            raise ValueError("intent_id must be lowercase 64-hex")
        if re.fullmatch(r"[0-9a-f]{64}", intent_sha256) is None:
            raise ValueError("intent_sha256 must be lowercase 64-hex")
        if not isinstance(intent_path, str) or len(intent_path.encode("utf-8")) > 4096:
            raise ValueError("intent_path is invalid")
        from markdown_transaction import IntentFence
        from operational_ownership import OwnerLease

        if not isinstance(owner, OwnerLease) or owner.role != "capture":
            raise ValueError("capture enqueue requires a capture owner")
        if (
            not isinstance(capture_fence, IntentFence)
            or capture_fence.intent_id != intent_id
            or capture_fence.mode != "capture"
            or capture_fence.owner != owner
        ):
            raise ValueError("capture fence does not match the intent and owner")
        registry = self.ownership_registry()
        with closing(registry._connect()) as coordinator_database:
            try:
                registry.require(coordinator_database, owner)
            except Exception as exc:
                raise QueueOperationError("intent_fence_lost") from exc
            fence_row = coordinator_database.execute(
                """SELECT 1 FROM intent_fences
                   WHERE intent_id=? AND mode='capture' AND token=?
                     AND fencing_epoch=? AND canonical_role=?
                     AND canonical_scope=? AND canonical_actor_id=?
                     AND canonical_owner_token=? AND canonical_fencing_epoch=?
                     AND process_id=? AND process_start_identity=? AND expires_at>?""",
                (
                    intent_id,
                    capture_fence.token,
                    capture_fence.epoch,
                    owner.role,
                    owner.scope,
                    owner.actor_id,
                    owner.token,
                    owner.epoch,
                    owner.process.pid,
                    owner.process.start_identity,
                    _timestamp(_utc_now()),
                ),
            ).fetchone()
            if fence_row is None:
                raise QueueOperationError("intent_fence_lost")
        if not isinstance(kind, str) or not kind or len(kind.encode("utf-8")) > 64:
            raise ValueError("kind must be a non-empty bounded string")
        if (
            not isinstance(handler_version, int)
            or isinstance(handler_version, bool)
            or not 1 <= handler_version <= 2_147_483_647
        ):
            raise ValueError("handler_version must be a positive bounded integer")
        if (
            not isinstance(priority, int)
            or isinstance(priority, bool)
            or not -100 <= priority <= 100
        ):
            raise ValueError("priority must be an integer from -100 to 100")
        payload_bytes = canonical_json_bytes(_redact_payload(dict(payload)))
        input_hash = sha256_bytes(payload_bytes)
        if validate_payload_blob(payload_bytes, input_hash, parse=True).code is not None:
            raise ValueError("payload_hash_mismatch")
        now = _utc_now()
        ready_at = _as_utc(available_at or now)
        task_id = uuid.uuid4().hex
        link_record = {
            "schema_version": "capture-task-link/v1",
            "task_id": task_id,
            "intent_id": intent_id,
            "intent_sha256": intent_sha256,
            "handler_version": handler_version,
        }
        link_digest = sha256_bytes(canonical_json_bytes(link_record))
        with closing(self._connect()) as database, begin_immediate(database):
            intent = database.execute(
                "SELECT * FROM capture_intents WHERE intent_id=?", (intent_id,)
            ).fetchone()
            if (
                intent is None
                or intent["relative_path"] != intent_path
                or intent["intent_sha256"] != intent_sha256
                or intent["publication_state"] != "ready"
            ):
                raise QueueOperationError("capture_intent_conflict")
            if dedupe_key is not None and database.execute(
                "SELECT 1 FROM tasks WHERE dedupe_key=?", (dedupe_key,)
            ).fetchone() is not None:
                raise QueueOperationError("dedupe_conflict")
            inserted = database.execute(
                """INSERT INTO tasks(
                       id,kind,handler_version,payload_blob,input_hash,dedupe_key,
                       state,priority,created_at,updated_at,available_at
                   ) VALUES (?,?,?,?,?,?,'ready',?,?,?,?)""",
                (
                    task_id,
                    kind,
                    handler_version,
                    payload_bytes,
                    input_hash,
                    dedupe_key,
                    priority,
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(ready_at),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("enqueue_failed")
            self._insert_capture_link(
                database,
                task_id=task_id,
                intent_id=intent_id,
                intent_sha256=intent_sha256,
                handler_version=handler_version,
                link_digest=link_digest,
                created_at=_timestamp(now),
            )
        return CaptureTaskBinding(
            task_id=task_id,
            intent_id=intent_id,
            intent_sha256=intent_sha256,
            handler_version=handler_version,
            active_digest=link_digest,
            seal_digest=None,
        )

    @staticmethod
    def _validate_task_fence_owner(
        owner: OwnerLease, mode: Literal["worker", "queue-operator"]
    ) -> None:
        from operational_ownership import OwnerLease

        if not isinstance(owner, OwnerLease):
            raise TypeError("owner must be an OwnerLease")
        allowed = {
            "worker": {"queue-worker", "compile", "doctor", "nightly", "weekly"},
            "queue-operator": {"queue-operator", "repair"},
        }
        if mode not in allowed or owner.role not in allowed[mode]:
            raise ValueError("owner cannot acquire the requested task fence")

    def acquire_task_fence(
        self,
        task_id: str,
        *,
        mode: Literal["worker", "queue-operator"],
        owner: OwnerLease,
    ) -> TaskFence:
        self._validate_task_fence_owner(owner, mode)
        if not isinstance(task_id, str) or not task_id:
            raise ValueError("task_id must be non-empty")
        registry = self.ownership_registry()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
        now = _utc_now()
        expires_at = min(owner.expires_at, now + timedelta(seconds=120))
        token = uuid.uuid4().hex
        with closing(self._connect()) as database, begin_immediate(database):
            projection = database.execute(
                """SELECT 1 FROM queue_ownership
                   WHERE actor_id=? AND canonical_role=? AND canonical_scope=?
                     AND owner_token=? AND fencing_epoch=? AND process_id=?
                     AND process_start_identity=? AND expires_at>?""",
                (
                    owner.actor_id,
                    owner.role,
                    owner.scope,
                    owner.token,
                    owner.epoch,
                    owner.process.pid,
                    owner.process.start_identity,
                    _timestamp(now),
                ),
            ).fetchone()
            if projection is None:
                raise QueueOperationError("queue_owner_fence_lost")
            if database.execute(
                "SELECT 1 FROM tasks WHERE id=?", (task_id,)
            ).fetchone() is None:
                raise KeyError(task_id)
            existing = database.execute(
                "SELECT * FROM task_fences WHERE task_id=?", (task_id,)
            ).fetchone()
            if existing is not None:
                raise QueueOperationError("task_fenced")
            epoch = int(
                database.execute(
                    """INSERT INTO task_fence_epochs(task_id,last_epoch) VALUES (?,1)
                       ON CONFLICT(task_id) DO UPDATE
                       SET last_epoch=task_fence_epochs.last_epoch+1
                       RETURNING last_epoch""",
                    (task_id,),
                ).fetchone()[0]
            )
            inserted = database.execute(
                """INSERT INTO task_fences(
                       task_id,mode,token,fencing_epoch,canonical_role,
                       canonical_scope,canonical_actor_id,canonical_owner_token,
                       canonical_fencing_epoch,process_id,process_start_identity,
                       heartbeat_at,expires_at
                   ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)""",
                (
                    task_id,
                    mode,
                    token,
                    epoch,
                    owner.role,
                    owner.scope,
                    owner.actor_id,
                    owner.token,
                    owner.epoch,
                    owner.process.pid,
                    owner.process.start_identity,
                    _timestamp(now),
                    _timestamp(expires_at),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("task_fence_failed")
        return TaskFence(task_id, mode, token, epoch, owner, expires_at)

    def release_task_fence(self, fence: TaskFence) -> None:
        if not isinstance(fence, TaskFence):
            raise TypeError("fence must be a TaskFence")
        with closing(self._connect()) as database, begin_immediate(database):
            deleted = database.execute(
                """DELETE FROM task_fences
                   WHERE task_id=? AND mode=? AND token=? AND fencing_epoch=?
                     AND canonical_role=? AND canonical_scope=?
                     AND canonical_actor_id=? AND canonical_owner_token=?
                     AND canonical_fencing_epoch=? AND process_id=?
                     AND process_start_identity=?""",
                (
                    fence.task_id,
                    fence.mode,
                    fence.token,
                    fence.epoch,
                    fence.owner.role,
                    fence.owner.scope,
                    fence.owner.actor_id,
                    fence.owner.token,
                    fence.owner.epoch,
                    fence.owner.process.pid,
                    fence.owner.process.start_identity,
                ),
            ).rowcount
            if deleted != 1:
                raise QueueOperationError("task_fence_lost")

    @contextmanager
    def task_fence(
        self,
        task_id: str,
        *,
        mode: Literal["worker", "queue-operator"],
        owner: OwnerLease,
    ) -> Iterator[TaskFence]:
        fence = self.acquire_task_fence(task_id, mode=mode, owner=owner)
        try:
            yield fence
        finally:
            self.release_task_fence(fence)

    @contextmanager
    def _corrupt_intent_fence(
        self, task_id: str, *, owner: OwnerLease
    ) -> Iterator[tuple[CaptureTaskBinding | None, object | None]]:
        try:
            binding = self.active_capture_binding(None, task_id)
        except QueueOperationError:
            yield None, None
            return
        if binding.intent_id is None:
            yield binding, None
            return
        from markdown_transaction import MarkdownCoordinator

        coordinator = MarkdownCoordinator._from_v3_candidate(
            self.state_root / "run" / "markdown-transactions-v3.candidate.sqlite3",
            state_root=self.state_root,
        )
        fence = coordinator.acquire_intent_fence(
            binding.intent_id, mode="operator", owner=owner
        )
        try:
            yield binding, fence
        finally:
            coordinator.release_intent_fence(fence)

    def active_capture_binding(
        self, connection: sqlite3.Connection | None, task_id: str
    ) -> CaptureTaskBinding:
        owned = connection is None
        database = self._connect() if owned else connection
        try:
            link = database.execute(
                "SELECT * FROM capture_task_links WHERE task_id=?", (task_id,)
            ).fetchone()
            if link is None:
                raise QueueOperationError("capture_link_conflicted")
            resolutions = database.execute(
                """SELECT * FROM capture_task_link_resolutions
                   WHERE task_id=? ORDER BY created_at,resolution_digest""",
                (task_id,),
            ).fetchall()
            superseded = {
                str(row["supersedes_digest"])
                for row in resolutions
                if row["supersedes_digest"] is not None
            }
            leaves: list[tuple[str, str | None, str | None, int]] = []
            if str(link["link_digest"]) not in superseded:
                leaves.append(
                    (
                        str(link["link_digest"]),
                        str(link["intent_id"]),
                        str(link["intent_sha256"]),
                        int(link["handler_version"]),
                    )
                )
            for resolution in resolutions:
                digest = str(resolution["resolution_digest"])
                if digest in superseded:
                    continue
                selected = resolution["selected_intent_id"]
                if selected is None:
                    leaves.append((digest, None, None, int(link["handler_version"])))
                    continue
                intent = database.execute(
                    "SELECT * FROM capture_intents WHERE intent_id=?", (selected,)
                ).fetchone()
                if intent is None:
                    raise QueueOperationError("capture_link_conflicted")
                leaves.append(
                    (
                        digest,
                        str(intent["intent_id"]),
                        str(intent["intent_sha256"]),
                        int(link["handler_version"]),
                    )
                )
            if len(leaves) != 1:
                raise QueueOperationError("capture_link_conflicted")
            active_digest, intent_id, intent_sha256, handler_version = leaves[0]
            seal = database.execute(
                "SELECT * FROM capture_task_link_seals WHERE task_id=?", (task_id,)
            ).fetchone()
            return CaptureTaskBinding(
                task_id=task_id,
                intent_id=intent_id,
                intent_sha256=intent_sha256,
                handler_version=handler_version,
                active_digest=active_digest,
                seal_digest=None if seal is None else str(seal["seal_digest"]),
            )
        finally:
            if owned:
                database.close()

    def append_capture_link_resolution(
        self,
        task_id: str,
        *,
        supersedes_digest: str | None,
        observed: Mapping[str, object],
        selected_intent: Mapping[str, object] | None,
        owner: OwnerLease,
        reason: str,
    ) -> CaptureTaskBinding:
        from operational_ownership import OwnerLease, current_actor_identity

        if not isinstance(owner, OwnerLease) or owner.role != "repair":
            raise ValueError("capture link resolution requires a repair owner")
        if not isinstance(reason, str) or not 1 <= len(reason.encode("utf-8")) <= 4096:
            raise ValueError("resolution reason is invalid")
        actor = current_actor_identity()
        now = _utc_now()
        record = {
            "schema_version": "capture-task-link-resolution/v1",
            "task_id": task_id,
            "supersedes_digest": supersedes_digest,
            "observed": dict(observed),
            "selected_intent": None if selected_intent is None else dict(selected_intent),
            "actor_identity": actor,
            "reason": reason,
            "created_at": _timestamp(now),
        }
        validate_schema(
            record,
            Path(__file__).with_name("schemas")
            / "capture-task-link-resolution-v1.json",
        )
        resolution_digest = sha256_bytes(canonical_json_bytes(record))
        observed_json = canonical_json_bytes(record["observed"])
        registry = self.ownership_registry()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
        with closing(self._connect()) as database, begin_immediate(database):
            projection = database.execute(
                """SELECT 1 FROM queue_ownership WHERE owner_token=?
                   AND fencing_epoch=? AND canonical_role='repair' AND expires_at>?""",
                (owner.token, owner.epoch, _timestamp(now)),
            ).fetchone()
            if projection is None:
                raise QueueOperationError("queue_owner_fence_lost")
            if database.execute(
                "SELECT 1 FROM task_fences WHERE task_id=?", (task_id,)
            ).fetchone() is not None:
                raise QueueOperationError("task_fenced")
            if database.execute(
                "SELECT 1 FROM capture_task_link_seals WHERE task_id=?", (task_id,)
            ).fetchone() is not None:
                raise QueueOperationError("capture_link_sealed")
            active = self.active_capture_binding(database, task_id)
            if supersedes_digest != active.active_digest:
                raise QueueOperationError("capture_link_conflicted")
            selected_id = None
            if selected_intent is not None:
                selected_id = selected_intent["intent_id"]
                intent = database.execute(
                    "SELECT * FROM capture_intents WHERE intent_id=?", (selected_id,)
                ).fetchone()
                if (
                    intent is None
                    or intent["intent_sha256"] != selected_intent["intent_sha256"]
                ):
                    raise QueueOperationError("capture_link_conflicted")
            inserted = database.execute(
                """INSERT INTO capture_task_link_resolutions(
                       resolution_digest,task_id,supersedes_digest,observed_json,
                       selected_intent_id,actor_identity,reason,created_at
                   ) VALUES (?,?,?,?,?,?,?,?)""",
                (
                    resolution_digest,
                    task_id,
                    supersedes_digest,
                    observed_json,
                    selected_id,
                    actor,
                    reason,
                    _timestamp(now),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("capture_link_resolution_failed")
            return self.active_capture_binding(database, task_id)

    def seal_capture_binding(
        self,
        task_id: str,
        *,
        consumer_kind: Literal["transaction", "terminal", "corrupt-disposition"],
        consumer_id: str,
        active_link_digest: str,
        before_side_effect: Callable[[], None] | None = None,
    ) -> CaptureTaskBinding:
        if consumer_kind not in {"transaction", "terminal", "corrupt-disposition"}:
            raise ValueError("consumer kind is invalid")
        if not isinstance(consumer_id, str) or not 1 <= len(consumer_id.encode("utf-8")) <= 4096:
            raise ValueError("consumer ID is invalid")
        now = _utc_now()
        seal_digest = sha256_bytes(
            canonical_json_bytes(
                {
                    "active_digest": active_link_digest,
                    "consumer_id": consumer_id,
                    "consumer_kind": consumer_kind,
                    "task_id": task_id,
                }
            )
        )
        with closing(self._connect()) as database, begin_immediate(database):
            active = self.active_capture_binding(database, task_id)
            if active.active_digest != active_link_digest:
                raise QueueOperationError("capture_link_conflicted")
            existing = database.execute(
                "SELECT * FROM capture_task_link_seals WHERE task_id=?", (task_id,)
            ).fetchone()
            if existing is not None:
                if (
                    existing["active_digest"] != active_link_digest
                    or existing["consumer_kind"] != consumer_kind
                    or existing["consumer_id"] != consumer_id
                    or existing["seal_digest"] != seal_digest
                ):
                    raise QueueOperationError("capture_link_sealed")
            else:
                inserted = database.execute(
                    """INSERT INTO capture_task_link_seals(
                           task_id,active_digest,consumer_kind,consumer_id,
                           seal_digest,sealed_at
                       ) VALUES (?,?,?,?,?,?)""",
                    (
                        task_id,
                        active_link_digest,
                        consumer_kind,
                        consumer_id,
                        seal_digest,
                        _timestamp(now),
                    ),
                ).rowcount
                if inserted != 1:
                    raise QueueOperationError("capture_link_seal_failed")
        if before_side_effect is not None:
            before_side_effect()
        return CaptureTaskBinding(
            task_id=active.task_id,
            intent_id=active.intent_id,
            intent_sha256=active.intent_sha256,
            handler_version=active.handler_version,
            active_digest=active.active_digest,
            seal_digest=seal_digest,
        )

    @staticmethod
    def _insert_semantic_decision(
        database: sqlite3.Connection,
        *,
        intent_id: str,
        stage: str,
        decision_path: str,
        decision_sha256: str,
        active_link_digest: str,
        published_at: str,
    ) -> None:
        inserted = database.execute(
            """INSERT INTO semantic_decisions(
                   intent_id,stage,decision_path,decision_sha256,
                   active_link_digest,publication_state,published_at
               ) VALUES (?,?,?,?,?,'published',?)""",
            (
                intent_id,
                stage,
                decision_path,
                decision_sha256,
                active_link_digest,
                published_at,
            ),
        ).rowcount
        if inserted != 1:
            raise QueueOperationError("semantic_decision_insert_failed")

    def indexed_capture_decision(
        self,
        *,
        task_id: str,
        intent_id: str,
        stage: Literal["flush", "feedback", "feedback-verify"],
        active_link_digest: str,
    ) -> SemanticDecision | None:
        _require_capture_decision_path(
            _capture_decision_relative_path(intent_id, stage), intent_id, stage
        )
        with closing(self._connect()) as database:
            row = database.execute(
                "SELECT * FROM semantic_decisions WHERE intent_id=? AND stage=?",
                (intent_id, stage),
            ).fetchone()
            if row is None:
                return None
            active = self.active_capture_binding(database, task_id)
            _require_indexed_capture_decision(
                row,
                active,
                intent_id=intent_id,
                stage=stage,
                active_link_digest=active_link_digest,
            )
            published_at = _indexed_capture_decision_published_at(row)
        decision_path, decision_sha256 = _read_indexed_capture_decision(
            self.state_root, row
        )
        return SemanticDecision(
            task_id=task_id,
            intent_id=intent_id,
            stage=stage,
            decision_path=decision_path,
            decision_sha256=decision_sha256,
            active_link_digest=active_link_digest,
            seal_digest=active.seal_digest or "",
            published_at=published_at,
        )

    def publish_semantic_decision(
        self,
        coordinator: object,
        *,
        task_id: str,
        intent_id: str,
        stage: Literal["flush", "feedback", "feedback-verify"],
        decision_path: str,
        decision_sha256: str,
        active_link_digest: str,
        task_fence: TaskFence,
        intent_fence: object,
        owner: OwnerLease,
    ) -> SemanticDecision:
        from markdown_transaction import IntentFence
        from operational_ownership import OwnerLease

        if stage not in {"flush", "feedback", "feedback-verify"}:
            raise ValueError("semantic decision stage is invalid")
        if re.fullmatch(r"[0-9a-f]{64}", decision_sha256) is None:
            raise ValueError("decision_sha256 must be lowercase 64-hex")
        if not isinstance(task_fence, TaskFence) or task_fence.task_id != task_id:
            raise ValueError("task fence does not match")
        if (
            not isinstance(intent_fence, IntentFence)
            or intent_fence.intent_id != intent_id
            or intent_fence.mode != "worker"
        ):
            raise ValueError("intent fence does not match")
        if (
            not isinstance(owner, OwnerLease)
            or task_fence.owner != owner
            or intent_fence.owner != owner
        ):
            raise ValueError("semantic decision owner does not match fences")
        _require_capture_decision_path(decision_path, intent_id, stage)
        candidate = self.state_root / decision_path
        data = read_runtime_bytes(
            candidate,
            self.state_root,
            max_bytes=64 * 1024,
            owner_only=True,
        )
        if sha256_bytes(data) != decision_sha256:
            raise QueueOperationError("semantic_decision_conflict")
        registry = self.ownership_registry()
        now = _utc_now()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
            intent_row = coordinator_database.execute(
                """SELECT 1 FROM intent_fences WHERE intent_id=? AND mode='worker'
                   AND token=? AND fencing_epoch=? AND canonical_owner_token=?
                   AND canonical_fencing_epoch=? AND expires_at>?""",
                (
                    intent_id,
                    intent_fence.token,
                    intent_fence.epoch,
                    owner.token,
                    owner.epoch,
                    _timestamp(now),
                ),
            ).fetchone()
            if intent_row is None:
                raise QueueOperationError("intent_fence_lost")
        seal_digest = sha256_bytes(
            canonical_json_bytes(
                {
                    "active_digest": active_link_digest,
                    "consumer_id": f"{intent_id}:{stage}",
                    "consumer_kind": "semantic-decision",
                    "task_id": task_id,
                }
            )
        )
        with closing(self._connect()) as database, begin_immediate(database):
            projection = database.execute(
                """SELECT 1 FROM queue_ownership WHERE owner_token=?
                   AND fencing_epoch=? AND expires_at>?""",
                (owner.token, owner.epoch, _timestamp(now)),
            ).fetchone()
            fence_row = database.execute(
                """SELECT 1 FROM task_fences WHERE task_id=? AND token=?
                   AND fencing_epoch=? AND canonical_owner_token=?
                   AND canonical_fencing_epoch=? AND expires_at>?""",
                (
                    task_id,
                    task_fence.token,
                    task_fence.epoch,
                    owner.token,
                    owner.epoch,
                    _timestamp(now),
                ),
            ).fetchone()
            if projection is None or fence_row is None:
                raise QueueOperationError("task_fence_lost")
            active = self.active_capture_binding(database, task_id)
            if (
                active.intent_id != intent_id
                or active.active_digest != active_link_digest
                or active.seal_digest is not None
            ):
                raise QueueOperationError("capture_link_conflicted")
            existing = database.execute(
                """SELECT seal.*, decision.decision_path,
                          decision.decision_sha256,decision.active_link_digest
                   FROM capture_task_link_seals AS seal
                   LEFT JOIN semantic_decisions AS decision
                     ON decision.intent_id=? AND decision.stage=?
                   WHERE seal.task_id=?""",
                (intent_id, stage, task_id),
            ).fetchone()
            if existing is None:
                inserted = database.execute(
                    """INSERT INTO capture_task_link_seals(
                           task_id,active_digest,consumer_kind,consumer_id,
                           seal_digest,sealed_at
                       ) VALUES (?,?,'semantic-decision',?,?,?)""",
                    (
                        task_id,
                        active_link_digest,
                        f"{intent_id}:{stage}",
                        seal_digest,
                        _timestamp(now),
                    ),
                ).rowcount
                if inserted != 1:
                    raise QueueOperationError("capture_link_seal_failed")
                self._insert_semantic_decision(
                    database,
                    intent_id=intent_id,
                    stage=stage,
                    decision_path=decision_path,
                    decision_sha256=decision_sha256,
                    active_link_digest=active_link_digest,
                    published_at=_timestamp(now),
                )
            elif (
                existing["consumer_kind"] != "semantic-decision"
                or existing["consumer_id"] != f"{intent_id}:{stage}"
                or existing["seal_digest"] != seal_digest
                or existing["decision_path"] != decision_path
                or existing["decision_sha256"] != decision_sha256
                or existing["active_link_digest"] != active_link_digest
            ):
                raise QueueOperationError("semantic_decision_conflict")
            published = database.execute(
                """SELECT published_at FROM semantic_decisions
                   WHERE intent_id=? AND stage=?""",
                (intent_id, stage),
            ).fetchone()
            if published is None:
                raise QueueOperationError("semantic_decision_conflict")
            published_at = _parse_timestamp(str(published["published_at"]))
            if published_at is None:
                raise QueueOperationError("semantic_decision_conflict")
        return SemanticDecision(
            task_id=task_id,
            intent_id=intent_id,
            stage=stage,
            decision_path=decision_path,
            decision_sha256=decision_sha256,
            active_link_digest=active_link_digest,
            seal_digest=seal_digest,
            published_at=published_at,
        )

    def _read_capture_terminal(
        self, terminal_path: str, terminal_sha256: str
    ) -> tuple[dict[str, object], bytes]:
        data = read_runtime_bytes(
            self.state_root / terminal_path,
            self.state_root,
            max_bytes=64 * 1024,
            owner_only=True,
        )
        if sha256_bytes(data) != terminal_sha256:
            raise QueueOperationError("capture_terminal_conflict")
        value = json.loads(data.decode("utf-8", errors="strict"))
        if not isinstance(value, dict):
            raise QueueOperationError("capture_terminal_invalid")
        return value, data

    def _capture_terminal_decisions(
        self, database: sqlite3.Connection, intent_id: str
    ) -> list[dict[str, str]]:
        rows = database.execute(
            """SELECT stage,decision_path,decision_sha256 FROM semantic_decisions
               WHERE intent_id=? ORDER BY stage""",
            (intent_id,),
        ).fetchall()
        result = []
        for row in rows:
            data = read_runtime_bytes(
                self.state_root / str(row["decision_path"]),
                self.state_root,
                max_bytes=1024 * 1024,
                owner_only=True,
            )
            if sha256_bytes(data) != row["decision_sha256"]:
                raise QueueOperationError("semantic_decision_conflict")
            result.append(
                {
                    "stage": str(row["stage"]),
                    "decision_path": str(row["decision_path"]),
                    "decision_sha256": str(row["decision_sha256"]),
                }
            )
        return result

    @staticmethod
    def _require_capture_terminal_disposition(
        record: Mapping[str, object], decisions: list[dict[str, str]]
    ) -> None:
        disposition = record.get("disposition")
        if not isinstance(disposition, dict):
            raise QueueOperationError("capture_terminal_invalid")
        required = _capture_terminal_disposition_fields(disposition.get("kind"))
        decision_digests = {item["decision_sha256"] for item in decisions}
        actual = (set(disposition), disposition.get("decision_sha256") in decision_digests)
        expected = (required, True)
        if actual != expected:
            raise QueueOperationError("capture_terminal_invalid")

    def _require_capture_terminal_record(
        self,
        record: Mapping[str, object],
        *,
        binding: CaptureTaskBinding,
        decisions: list[dict[str, str]],
    ) -> None:
        expected_keys = {
            "schema_version",
            "intent_id",
            "intent_sha256",
            "semantic_decisions",
            "processing_binding",
            "disposition",
        }
        processing = record.get("processing_binding")
        identity = (
            set(record),
            record.get("schema_version"),
            record.get("intent_id"),
            record.get("intent_sha256"),
            record.get("semantic_decisions"),
        )
        expected_identity = (
            expected_keys,
            "capture-terminal/v1",
            binding.intent_id,
            binding.intent_sha256,
            decisions,
        )
        if identity != expected_identity or not isinstance(processing, dict):
            raise QueueOperationError("capture_terminal_invalid")
        expected_processing = {
            "kind": "task",
            "task_id": binding.task_id,
            "active_link_digest": binding.active_digest,
        }
        if processing != expected_processing:
            raise QueueOperationError("capture_terminal_invalid")
        self._require_capture_terminal_disposition(record, decisions)

    def _require_capture_terminal_owner(
        self,
        *,
        lease: QueueLease,
        intent_id: str,
        task_fence: TaskFence,
        intent_fence: object,
        owner: OwnerLease,
    ) -> None:
        from markdown_transaction import IntentFence
        from operational_ownership import OwnerLease

        actual = (
            isinstance(owner, OwnerLease),
            task_fence.task_id,
            task_fence.mode,
            task_fence.owner,
            isinstance(intent_fence, IntentFence),
            getattr(intent_fence, "intent_id", None),
            getattr(intent_fence, "mode", None),
            getattr(intent_fence, "owner", None),
        )
        expected = (True, lease.id, "worker", owner, True, intent_id, "worker", owner)
        if actual != expected:
            raise ValueError("capture terminal fences do not match")

    @staticmethod
    def _require_capture_terminal_task_fence(
        database: sqlite3.Connection,
        task_fence: TaskFence,
        owner: OwnerLease,
        now: datetime,
    ) -> None:
        row = database.execute(
            """SELECT 1 FROM task_fences WHERE task_id=? AND mode='worker'
               AND token=? AND fencing_epoch=? AND canonical_owner_token=?
               AND canonical_fencing_epoch=? AND expires_at>?""",
            (
                task_fence.task_id,
                task_fence.token,
                task_fence.epoch,
                owner.token,
                owner.epoch,
                _timestamp(now),
            ),
        ).fetchone()
        if row is None:
            raise QueueOperationError("task_fence_lost")

    @staticmethod
    def _require_capture_terminal_intent_fence(
        database: sqlite3.Connection,
        intent_fence: IntentFence,
        owner: OwnerLease,
        now: datetime,
    ) -> None:
        row = database.execute(
            """SELECT 1 FROM intent_fences WHERE intent_id=? AND mode='worker'
               AND token=? AND fencing_epoch=? AND canonical_owner_token=?
               AND canonical_fencing_epoch=? AND expires_at>?""",
            (
                intent_fence.intent_id,
                intent_fence.token,
                intent_fence.epoch,
                owner.token,
                owner.epoch,
                _timestamp(now),
            ),
        ).fetchone()
        if row is None:
            raise QueueOperationError("intent_fence_lost")

    @staticmethod
    def _commit_capture_terminal_row(
        database: sqlite3.Connection,
        row: sqlite3.Row,
        lease: QueueLease,
        *,
        terminal_path: str,
        terminal_sha256: str,
        intent_id: str,
        now: datetime,
    ) -> None:
        database.execute(
            """INSERT INTO attempt_history(
                   task_id,attempt,started_at,finished_at,outcome,error_code
               ) VALUES (?,?,?,?, 'succeeded',NULL)""",
            (
                lease.id,
                row["attempts"],
                row["attempt_started_at"] or _timestamp(now),
                _timestamp(now),
            ),
        )
        changed = database.execute(
            """UPDATE tasks SET state='succeeded',result_reference=?,result_sha256=?,
                   result_operation_id=?,error_code=NULL,updated_at=?,last_attempt_at=?,
                   lease_owner=NULL,lease_token=NULL,lease_expires_at=NULL,
                   lease_heartbeat_at=NULL,attempt_started_at=NULL
               WHERE id=? AND lease_token=? AND state='leased'""",
            (
                terminal_path,
                terminal_sha256,
                f"capture-terminal:{intent_id}",
                _timestamp(now),
                _timestamp(now),
                lease.id,
                lease.token,
            ),
        ).rowcount
        if changed != 1:
            raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")

    def complete_existing_capture_terminal(
        self,
        lease: QueueLease,
        *,
        intent_id: str,
        active_link_digest: str,
        task_fence: TaskFence,
        intent_fence: object,
        owner: OwnerLease,
    ) -> str | None:
        relative = f"run/queue-results/capture-{intent_id}.json"
        candidate = self.state_root / relative
        try:
            candidate.lstat()
        except FileNotFoundError:
            return None
        data = read_runtime_bytes(
            candidate,
            self.state_root,
            max_bytes=64 * 1024,
            owner_only=True,
        )
        return self.complete_capture_terminal(
            lease,
            intent_id=intent_id,
            terminal_path=relative,
            terminal_sha256=sha256_bytes(data),
            active_link_digest=active_link_digest,
            task_fence=task_fence,
            intent_fence=intent_fence,
            owner=owner,
        )

    def complete_capture_terminal(
        self,
        lease: QueueLease,
        *,
        intent_id: str,
        terminal_path: str,
        terminal_sha256: str,
        active_link_digest: str,
        task_fence: TaskFence,
        intent_fence: object,
        owner: OwnerLease,
    ) -> str:
        _require_lower_sha256(intent_id, "intent_id")
        _require_lower_sha256(terminal_sha256, "terminal_sha256")
        _require_capture_terminal_path(terminal_path, intent_id)
        self._require_capture_terminal_owner(
            lease=lease,
            intent_id=intent_id,
            task_fence=task_fence,
            intent_fence=intent_fence,
            owner=owner,
        )
        record, _data = self._read_capture_terminal(terminal_path, terminal_sha256)
        registry = self.ownership_registry()
        now = _utc_now()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
            self._require_capture_terminal_intent_fence(
                coordinator_database, intent_fence, owner, now
            )
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            self._require_capture_terminal_task_fence(database, task_fence, owner, now)
            binding = self.active_capture_binding(database, lease.id)
            if binding.active_digest != active_link_digest or binding.intent_id != intent_id:
                raise QueueOperationError("capture_link_conflicted")
            decisions = self._capture_terminal_decisions(database, intent_id)
            self._require_capture_terminal_record(record, binding=binding, decisions=decisions)
            self._commit_capture_terminal_row(
                database,
                row,
                lease,
                terminal_path=terminal_path,
                terminal_sha256=terminal_sha256,
                intent_id=intent_id,
                now=now,
            )
        return terminal_path

    @staticmethod
    def _publish_corrupt_fixed_files(
        package: Path,
        *,
        payload: bytes,
        history: bytes,
        metadata: bytes,
    ) -> None:
        package.parent.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(package.parent, 0o700)
        if not package.exists():
            package.mkdir()
            _harden_owner_only(package, 0o700)
        for name, data in (
            ("payload.bin", payload),
            ("attempt-history.json", history),
            ("task-metadata.json", metadata),
        ):
            _write_durable_file(package / name, data)

    @staticmethod
    def _insert_corrupt_disposition(
        database: sqlite3.Connection,
        *,
        task_id: str,
        operation_id: str,
        package_path: str,
        manifest_sha256: str,
        disposition_sha256: str,
        active_link_digest: str | None,
        disposed_at: str,
    ) -> None:
        inserted = database.execute(
            """INSERT INTO corrupt_dispositions(
                   task_id,operation_id,package_path,manifest_sha256,
                   disposition_sha256,active_link_digest,disposed_at
               ) VALUES (?,?,?,?,?,?,?)""",
            (
                task_id,
                operation_id,
                package_path,
                manifest_sha256,
                disposition_sha256,
                active_link_digest,
                disposed_at,
            ),
        ).rowcount
        if inserted != 1:
            raise QueueOperationError("corrupt_disposition_failed")

    def quarantine_corrupt(
        self,
        task_id: str,
        *,
        reason: str,
        owner: OwnerLease,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> CorruptExportProgress:
        from operational_ownership import OwnerLease, current_actor_identity

        _require_active(deadline, cancelled)
        if not isinstance(owner, OwnerLease) or owner.role != "repair":
            raise ValueError("corrupt quarantine requires a repair owner")
        if not isinstance(task_id, str) or not 1 <= len(task_id.encode("utf-8")) <= 256:
            raise ValueError("task ID is invalid")
        if not isinstance(reason, str) or not 1 <= len(reason.encode("utf-8")) <= 4096:
            raise ValueError("quarantine reason is invalid")
        registry = self.ownership_registry()
        actor = current_actor_identity()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
        with self.queue_owner(
            role="queue-operator",
            scope=f"task:{sha256_bytes(task_id.encode('utf-8'))}",
            parent=owner,
        ), self.task_fence(
            task_id, mode="queue-operator", owner=owner
        ) as task_fence, self._corrupt_intent_fence(
            task_id, owner=owner
        ) as (capture_binding, intent_fence):
            now = _utc_now()
            with closing(self._connect()) as database, begin_immediate(database):
                row = database.execute(
                    "SELECT * FROM tasks WHERE id=?", (task_id,)
                ).fetchone()
                if row is None:
                    raise KeyError(task_id)
                if row["state"] not in {"dead", "quarantine_pending"}:
                    raise QueueOperationError("corrupt_quarantine_state_invalid")
                raw = bytes(row["payload_blob"])
                raw_validation = validate_payload_blob(
                    raw, row["input_hash"], parse=False
                )
                raw_sha256 = raw_validation.input_hash
                history_rows = database.execute(
                    """SELECT attempt,started_at,finished_at,outcome,error_code
                       FROM attempt_history WHERE task_id=? ORDER BY sequence""",
                    (task_id,),
                ).fetchall()
                history = canonical_json_bytes(
                    [
                        {
                            "attempt": int(item["attempt"]),
                            "started_at": str(item["started_at"]),
                            "finished_at": str(item["finished_at"]),
                            "outcome": str(item["outcome"]),
                            "error_code": item["error_code"],
                        }
                        for item in history_rows
                    ]
                )
                metadata = canonical_json_bytes(
                    {
                        "task_id": task_id,
                        "kind": str(row["kind"]),
                        "handler_version": int(row["handler_version"]),
                        "input_hash": str(row["input_hash"]),
                        "state": "dead",
                        "error_code": row["error_code"],
                        "lineage_generation": int(row["lineage_generation"]),
                    }
                )
                history_sha256 = sha256_bytes(history)
                metadata_sha256 = sha256_bytes(metadata)
                disposition_key = sha256_bytes(
                    canonical_json_bytes(
                        {
                            "actor_identity": actor,
                            "history_sha256": history_sha256,
                            "metadata_sha256": metadata_sha256,
                            "raw_sha256": raw_sha256,
                            "reason": reason,
                            "task_id": task_id,
                        }
                    )
                )
                operation_id = f"corrupt-export:{disposition_key}"
                existing = database.execute(
                    "SELECT * FROM corrupt_export_operations WHERE task_id=?",
                    (task_id,),
                ).fetchone()
                if existing is None:
                    inserted = database.execute(
                        """INSERT INTO corrupt_export_operations(
                               operation_id,task_id,disposition_key,
                               task_fence_token_digest,task_fence_epoch,
                               intent_fence_digest,raw_sha256,history_sha256,
                               metadata_sha256,lineage_generation,cursor_task_id,
                               link_count,page_count,rolling_root,state,
                               actor_identity,reason,created_at,updated_at
                           ) VALUES (?,?,?,?,?,NULL,?,?,?,?, '',0,0,?,'exporting',?,?,?,?)""",
                        (
                            operation_id,
                            task_id,
                            disposition_key,
                            sha256_bytes(task_fence.token.encode("utf-8")),
                            task_fence.epoch,
                            raw_sha256,
                            history_sha256,
                            metadata_sha256,
                            int(row["lineage_generation"]),
                            sha256_bytes(b""),
                            actor,
                            reason,
                            _timestamp(now),
                            _timestamp(now),
                        ),
                    ).rowcount
                    if inserted != 1:
                        raise QueueOperationError("corrupt_export_start_failed")
                    changed = database.execute(
                        """UPDATE tasks SET state='quarantine_pending',updated_at=?
                           WHERE id=? AND state='dead'""",
                        (_timestamp(now), task_id),
                    ).rowcount
                    if changed != 1:
                        raise QueueOperationError("corrupt_quarantine_start_failed")
                elif (
                    existing["operation_id"] != operation_id
                    or existing["disposition_key"] != disposition_key
                ):
                    if existing["state"] == "disposed":
                        disposition = database.execute(
                            "SELECT * FROM corrupt_dispositions WHERE task_id=?",
                            (task_id,),
                        ).fetchone()
                        if disposition is not None:
                            return CorruptExportProgress(
                                task_id=task_id,
                                operation_id=str(existing["operation_id"]),
                                state="quarantined",
                                pages_written=int(existing["page_count"]),
                                links_exported=int(existing["link_count"]),
                                complete=True,
                                code=None,
                            )
                    raise QueueOperationError("corrupt_export_conflict")
                else:
                    operation_id = str(existing["operation_id"])
                    disposition_key = str(existing["disposition_key"])
            package = self.results_dir / f"corrupt-{disposition_key}"
            self._publish_corrupt_fixed_files(
                package, payload=raw, history=history, metadata=metadata
            )
            with closing(self._connect()) as database, begin_immediate(database):
                operation = database.execute(
                    "SELECT * FROM corrupt_export_operations WHERE task_id=?",
                    (task_id,),
                ).fetchone()
                if operation is None:
                    raise QueueOperationError("corrupt_export_lost")
                if operation["state"] == "exporting":
                    started = time.monotonic()
                    candidates = database.execute(
                        """SELECT id,state,created_at,updated_at,input_hash
                           FROM tasks WHERE redrive_of=? AND id>?
                           ORDER BY id LIMIT 1001""",
                        (task_id, operation["cursor_task_id"]),
                    ).fetchall()
                    links: list[dict[str, object]] = []
                    for child in candidates[:1000]:
                        candidate = {
                            "created_at": str(child["created_at"]),
                            "input_hash": str(child["input_hash"]),
                            "state": str(child["state"]),
                            "task_id": str(child["id"]),
                            "updated_at": str(child["updated_at"]),
                        }
                        prospective = canonical_json_bytes(
                            {
                                "operation_id": operation_id,
                                "page_number": int(operation["page_count"]) + 1,
                                "previous_root": str(operation["rolling_root"]),
                                "links": [*links, candidate],
                            }
                        )
                        if len(prospective) > 1024 * 1024 or time.monotonic() - started >= 5:
                            break
                        links.append(candidate)
                    if links:
                        page_number = int(operation["page_count"]) + 1
                        page = {
                            "operation_id": operation_id,
                            "page_number": page_number,
                            "previous_root": str(operation["rolling_root"]),
                            "links": links,
                        }
                        page_bytes = canonical_json_bytes(page)
                        page_sha256 = sha256_bytes(page_bytes)
                        rolling_root = sha256_bytes(
                            bytes.fromhex(str(operation["rolling_root"]))
                            + bytes.fromhex(page_sha256)
                        )
                        page_path = package / f"lineage-page-{page_number:08d}.json"
                        _write_durable_file(page_path, page_bytes)
                        if _read_stable_owner_file(page_path, 1024 * 1024) != page_bytes:
                            raise QueueOperationError("corrupt_page_verification_failed")
                        inserted = database.execute(
                            """INSERT INTO corrupt_export_pages(
                                   operation_id,page_number,first_task_id,last_task_id,
                                   link_count,page_sha256,rolling_root
                               ) VALUES (?,?,?,?,?,?,?)""",
                            (
                                operation_id,
                                page_number,
                                links[0]["task_id"],
                                links[-1]["task_id"],
                                len(links),
                                page_sha256,
                                rolling_root,
                            ),
                        ).rowcount
                        if inserted != 1:
                            raise QueueOperationError("corrupt_page_insert_failed")
                        stable_end = len(candidates) <= len(links)
                        state = "manifested" if stable_end else "exporting"
                        updated = database.execute(
                            """UPDATE corrupt_export_operations
                               SET cursor_task_id=?,link_count=link_count+?,
                                   page_count=page_count+1,rolling_root=?,state=?,updated_at=?
                               WHERE operation_id=? AND state='exporting'
                                 AND cursor_task_id=? AND page_count=?""",
                            (
                                links[-1]["task_id"],
                                len(links),
                                rolling_root,
                                state,
                                _timestamp(_utc_now()),
                                operation_id,
                                operation["cursor_task_id"],
                                operation["page_count"],
                            ),
                        ).rowcount
                        if updated != 1:
                            raise QueueOperationError("corrupt_page_fence_lost")
                    elif not candidates:
                        updated = database.execute(
                            """UPDATE corrupt_export_operations
                               SET state='manifested',updated_at=?
                               WHERE operation_id=? AND state='exporting'""",
                            (_timestamp(_utc_now()), operation_id),
                        ).rowcount
                        if updated != 1:
                            raise QueueOperationError("corrupt_manifest_fence_lost")
            with closing(self._connect()) as database:
                operation = database.execute(
                    "SELECT * FROM corrupt_export_operations WHERE task_id=?",
                    (task_id,),
                ).fetchone()
            if operation is None:
                raise QueueOperationError("corrupt_export_lost")
            if operation["state"] == "manifested":
                manifest = {
                    "schema_version": "corrupt-task-manifest/v1",
                    "operation_id": operation_id,
                    "task_id": task_id,
                    "package_key": disposition_key,
                    "package_path": f"run/queue-results/corrupt-{disposition_key}",
                    "raw_sha256": str(operation["raw_sha256"]),
                    "history_sha256": str(operation["history_sha256"]),
                    "metadata_sha256": str(operation["metadata_sha256"]),
                    "lineage_generation": int(operation["lineage_generation"]),
                    "link_count": int(operation["link_count"]),
                    "page_count": int(operation["page_count"]),
                    "rolling_root": str(operation["rolling_root"]),
                }
                validate_schema(
                    manifest,
                    Path(__file__).with_name("schemas")
                    / "corrupt-task-manifest-v1.json",
                )
                _write_durable_file(package / "manifest.json", canonical_json_bytes(manifest))
                if capture_binding is None or intent_fence is None:
                    return CorruptExportProgress(
                        task_id=task_id,
                        operation_id=operation_id,
                        state="blocked",
                        pages_written=int(operation["page_count"]),
                        links_exported=int(operation["link_count"]),
                        complete=False,
                        code="capture_link_conflicted",
                    )
                sealed = self.seal_capture_binding(
                    task_id,
                    consumer_kind="corrupt-disposition",
                    consumer_id=operation_id,
                    active_link_digest=capture_binding.active_digest,
                )
                manifest_bytes = _read_stable_owner_file(
                    package / "manifest.json", 64 * 1024
                )
                manifest_sha256 = sha256_bytes(manifest_bytes)
                disposed_at = str(operation["created_at"])
                disposition_record = {
                    "schema_version": "corrupt-task-disposition/v1",
                    "operation_id": operation_id,
                    "task_id": task_id,
                    "package_key": disposition_key,
                    "package_path": f"run/queue-results/corrupt-{disposition_key}",
                    "manifest_path": (
                        f"run/queue-results/corrupt-{disposition_key}/manifest.json"
                    ),
                    "manifest_sha256": manifest_sha256,
                    "active_link_digest": sealed.active_digest,
                    "actor_identity": actor,
                    "reason": reason,
                    "disposed_at": disposed_at,
                }
                validate_schema(
                    disposition_record,
                    Path(__file__).with_name("schemas")
                    / "corrupt-task-disposition-v1.json",
                )
                disposition_bytes = canonical_json_bytes(disposition_record)
                _write_durable_file(package / "disposition.json", disposition_bytes)
                if (
                    _read_stable_owner_file(package / "payload.bin", _MAX_QUEUE_PAYLOAD_BYTES)
                    != raw
                    or _read_stable_owner_file(
                        package / "attempt-history.json", _MAX_EXPORT_METADATA_BYTES
                    )
                    != history
                    or _read_stable_owner_file(
                        package / "task-metadata.json", _MAX_EXPORT_METADATA_BYTES
                    )
                    != metadata
                    or _read_stable_owner_file(
                        package / "disposition.json", 64 * 1024
                    )
                    != disposition_bytes
                ):
                    raise QueueOperationError("corrupt_export_verification_failed")
                disposition_sha256 = sha256_bytes(disposition_bytes)
                with closing(self._connect()) as database, begin_immediate(database):
                    current_task = database.execute(
                        "SELECT * FROM tasks WHERE id=?", (task_id,)
                    ).fetchone()
                    current_operation = database.execute(
                        "SELECT * FROM corrupt_export_operations WHERE operation_id=?",
                        (operation_id,),
                    ).fetchone()
                    current_fence = database.execute(
                        """SELECT 1 FROM task_fences WHERE task_id=? AND token=?
                           AND fencing_epoch=? AND expires_at>?""",
                        (
                            task_id,
                            task_fence.token,
                            task_fence.epoch,
                            _timestamp(_utc_now()),
                        ),
                    ).fetchone()
                    current_seal = database.execute(
                        """SELECT 1 FROM capture_task_link_seals
                           WHERE task_id=? AND active_digest=? AND seal_digest=?
                             AND consumer_kind='corrupt-disposition' AND consumer_id=?""",
                        (
                            task_id,
                            sealed.active_digest,
                            sealed.seal_digest,
                            operation_id,
                        ),
                    ).fetchone()
                    incoming_count = database.execute(
                        "SELECT COUNT(*) FROM tasks WHERE redrive_of=?", (task_id,)
                    ).fetchone()[0]
                    if (
                        current_task is None
                        or current_task["state"] != "quarantine_pending"
                        or current_operation is None
                        or current_operation["state"] != "manifested"
                        or current_operation["lineage_generation"]
                        != current_task["lineage_generation"]
                        or current_operation["link_count"] != incoming_count
                        or current_fence is None
                        or current_seal is None
                    ):
                        raise QueueOperationError("corrupt_export_verification_failed")
                    self._insert_corrupt_disposition(
                        database,
                        task_id=task_id,
                        operation_id=operation_id,
                        package_path=str(disposition_record["package_path"]),
                        manifest_sha256=manifest_sha256,
                        disposition_sha256=disposition_sha256,
                        active_link_digest=sealed.active_digest,
                        disposed_at=disposed_at,
                    )
                    changed = database.execute(
                        """UPDATE tasks SET state='quarantined',updated_at=?
                           WHERE id=? AND state='quarantine_pending'""",
                        (_timestamp(_utc_now()), task_id),
                    ).rowcount
                    advanced = database.execute(
                        """UPDATE corrupt_export_operations
                           SET state='disposed',updated_at=?
                           WHERE operation_id=? AND state='manifested'""",
                        (_timestamp(_utc_now()), operation_id),
                    ).rowcount
                    if (changed, advanced) != (1, 1):
                        raise QueueOperationError("corrupt_disposition_failed")
                return CorruptExportProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="quarantined",
                    pages_written=int(operation["page_count"]),
                    links_exported=int(operation["link_count"]),
                    complete=True,
                    code=None,
                )
            return CorruptExportProgress(
                task_id=task_id,
                operation_id=operation_id,
                state="quarantine_pending",
                pages_written=int(operation["page_count"]),
                links_exported=int(operation["link_count"]),
                complete=False,
                code=None,
            )

    def _purge_corrupt_lineage_page(
        self,
        task_id: str,
        *,
        operation_id: str,
        package: Path,
        owner: OwnerLease,
        task_fence: TaskFence,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> CorruptPurgeProgress:
        del owner
        _require_active(deadline, cancelled)
        started = time.monotonic()
        with closing(self._connect()) as database, begin_immediate(database):
            operation = database.execute(
                "SELECT * FROM corrupt_purge_operations WHERE operation_id=?",
                (operation_id,),
            ).fetchone()
            parent = database.execute(
                "SELECT * FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            if operation is None or parent is None:
                raise QueueOperationError("corrupt_purge_lost")
            prior_links_deleted = int(
                database.execute(
                    """SELECT COALESCE(SUM(deleted_link_count),0)
                       FROM corrupt_purge_pages WHERE operation_id=?""",
                    (operation_id,),
                ).fetchone()[0]
            )
            if operation["state"] != "purging" or parent["state"] != "purge_pending":
                return CorruptPurgeProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="purge_pending",
                    pages_written=int(operation["page_count"]),
                    links_deleted=prior_links_deleted,
                    complete=False,
                    code=None,
                )
            self._require_corrupt_task_fence(database, task_fence)
            if int(parent["lineage_generation"]) != int(
                operation["expected_generation"]
            ):
                return CorruptPurgeProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="blocked",
                    pages_written=int(operation["page_count"]),
                    links_deleted=prior_links_deleted,
                    complete=False,
                    code="corrupt_lineage_generation_changed",
                )
            candidates = database.execute(
                """SELECT * FROM tasks WHERE redrive_of=? AND id>?
                   ORDER BY id LIMIT 1001""",
                (task_id, operation["cursor_task_id"]),
            ).fetchall()
            if not candidates:
                return CorruptPurgeProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="purge_pending",
                    pages_written=int(operation["page_count"]),
                    links_deleted=prior_links_deleted,
                    complete=False,
                    code=None,
                )
            now = _utc_now()
            children: list[dict[str, object]] = []
            blocker_code: str | None = None
            for child in candidates[:1000]:
                blocker = self._corrupt_child_purge_blocker(database, child, now=now)
                if blocker is not None:
                    blocker_code = blocker
                    break
                descriptor = self._corrupt_purge_child_descriptor(database, child)
                prospective = canonical_json_bytes(
                    {
                        "operation_id": operation_id,
                        "page_number": int(operation["page_count"]) + 1,
                        "previous_root": str(operation["rolling_root"]),
                        "before_generation": int(operation["expected_generation"]),
                        "after_generation": int(operation["expected_generation"])
                        + len(children)
                        + 1,
                        "children": [*children, descriptor],
                    }
                )
                if len(prospective) > 1024 * 1024 or time.monotonic() - started >= 5:
                    break
                children.append(descriptor)
            if not children:
                return CorruptPurgeProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="blocked" if blocker_code is not None else "purge_pending",
                    pages_written=int(operation["page_count"]),
                    links_deleted=prior_links_deleted,
                    complete=False,
                    code=blocker_code,
                )
            page_number = int(operation["page_count"]) + 1
            before_generation = int(operation["expected_generation"])
            after_generation = before_generation + len(children)
            page = {
                "operation_id": operation_id,
                "page_number": page_number,
                "previous_root": str(operation["rolling_root"]),
                "before_generation": before_generation,
                "after_generation": after_generation,
                "children": children,
            }
            page_bytes = canonical_json_bytes(page)
            if len(page_bytes) > 1024 * 1024:
                raise QueueOperationError("corrupt_purge_page_too_large")
            page_sha256 = sha256_bytes(page_bytes)
            rolling_root = sha256_bytes(
                bytes.fromhex(str(operation["rolling_root"]))
                + bytes.fromhex(page_sha256)
            )
            page_path = package / f"purge-page-{page_number:08d}.json"
            try:
                _write_durable_file(page_path, page_bytes)
            except QueueOperationError as exc:
                if exc.code != "durable_file_conflict":
                    raise
                return CorruptPurgeProgress(
                    task_id=task_id,
                    operation_id=operation_id,
                    state="blocked",
                    pages_written=int(operation["page_count"]),
                    links_deleted=prior_links_deleted,
                    complete=False,
                    code="orphan_corrupt_purge_page_conflict",
                )
            try:
                observed_page = _read_stable_owner_file(page_path, 1024 * 1024)
            except (OSError, PermissionError, ValueError) as exc:
                raise QueueOperationError("corrupt_purge_page_invalid") from exc
            if observed_page != page_bytes:
                raise QueueOperationError("corrupt_purge_page_invalid")
            self._insert_corrupt_purge_page(
                database,
                operation_id=operation_id,
                page_number=page_number,
                first_task_id=str(children[0]["task_id"]),
                last_task_id=str(children[-1]["task_id"]),
                deleted_link_count=len(children),
                page_sha256=page_sha256,
                rolling_root=rolling_root,
                expected_generation=after_generation,
            )
            inserted = database.execute(
                """INSERT INTO task_purge_authorizations(
                       task_id,mode,operation_id,authorization_digest,created_at
                   ) VALUES (?,'corrupt-lineage',?,?,?)""",
                (
                    task_id,
                    operation_id,
                    operation["purge_token"],
                    _timestamp(now),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("purge_authorization_failed")
            for child in children:
                child_id = str(child["task_id"])
                inserted = database.execute(
                    """INSERT INTO task_purge_authorizations(
                           task_id,mode,operation_id,authorization_digest,created_at
                       ) VALUES (?,'corrupt-lineage',?,?,?)""",
                    (
                        child_id,
                        operation_id,
                        operation["purge_token"],
                        _timestamp(now),
                    ),
                ).rowcount
                if inserted != 1:
                    raise QueueOperationError("purge_authorization_failed")
                self._delete_task_owned_evidence(database, child_id)
                deleted = database.execute(
                    "DELETE FROM tasks WHERE id=? AND redrive_of=?",
                    (child_id, task_id),
                ).rowcount
                if deleted != 1:
                    raise QueueOperationError("corrupt_child_delete_failed")
                cleared = database.execute(
                    "DELETE FROM task_purge_authorizations WHERE task_id=?",
                    (child_id,),
                ).rowcount
                if cleared != 1:
                    raise QueueOperationError("purge_authorization_failed")
            cleared = database.execute(
                "DELETE FROM task_purge_authorizations WHERE task_id=?",
                (task_id,),
            ).rowcount
            if cleared != 1:
                raise QueueOperationError("purge_authorization_failed")
            parent_generation = database.execute(
                "SELECT lineage_generation FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            if parent_generation is None or int(parent_generation[0]) != after_generation:
                raise QueueOperationError("corrupt_lineage_generation_changed")
            updated = database.execute(
                """UPDATE corrupt_purge_operations
                   SET expected_generation=?,cursor_task_id=?,page_count=page_count+1,
                       rolling_root=?,updated_at=?
                   WHERE operation_id=? AND state='purging'
                     AND expected_generation=? AND cursor_task_id=? AND page_count=?""",
                (
                    after_generation,
                    children[-1]["task_id"],
                    rolling_root,
                    _timestamp(_utc_now()),
                    operation_id,
                    before_generation,
                    operation["cursor_task_id"],
                    operation["page_count"],
                ),
            ).rowcount
            if updated != 1:
                raise QueueOperationError("corrupt_purge_page_fence_lost")
            return CorruptPurgeProgress(
                task_id=task_id,
                operation_id=operation_id,
                state="blocked" if blocker_code is not None else "purge_pending",
                pages_written=page_number,
                links_deleted=prior_links_deleted + len(children),
                complete=False,
                code=blocker_code,
            )

    @staticmethod
    def _insert_corrupt_purge_page(
        database: sqlite3.Connection,
        *,
        operation_id: str,
        page_number: int,
        first_task_id: str,
        last_task_id: str,
        deleted_link_count: int,
        page_sha256: str,
        rolling_root: str,
        expected_generation: int,
    ) -> None:
        inserted = database.execute(
            """INSERT INTO corrupt_purge_pages(
                   operation_id,page_number,first_task_id,last_task_id,
                   deleted_link_count,page_sha256,rolling_root,expected_generation
               ) VALUES (?,?,?,?,?,?,?,?)""",
            (
                operation_id,
                page_number,
                first_task_id,
                last_task_id,
                deleted_link_count,
                page_sha256,
                rolling_root,
                expected_generation,
            ),
        ).rowcount
        if inserted != 1:
            raise QueueOperationError("corrupt_purge_page_insert_failed")

    def _corrupt_child_purge_blocker(
        self,
        database: sqlite3.Connection,
        child: sqlite3.Row,
        *,
        now: datetime,
    ) -> str | None:
        child_id = str(child["id"])
        if database.execute(
            "SELECT 1 FROM tasks WHERE redrive_of=? LIMIT 1", (child_id,)
        ).fetchone() is not None:
            return "corrupt_child_not_leaf"
        if child["state"] not in _TERMINAL_STATES:
            return "corrupt_child_nonterminal"
        if child["state"] == "dead" and DEFAULTS.dead_task_retention_days is None:
            return "corrupt_child_retained"
        updated_at = _parse_timestamp(str(child["updated_at"]))
        retention_days = (
            DEFAULTS.dead_task_retention_days
            if child["state"] == "dead"
            else DEFAULTS.queue_result_retention_days
        )
        if (
            updated_at is None
            or retention_days is None
            or updated_at + timedelta(days=retention_days) > now
        ):
            return "corrupt_child_retention_active"
        if database.execute(
            "SELECT 1 FROM task_fences WHERE task_id=? LIMIT 1", (child_id,)
        ).fetchone() is not None:
            return "corrupt_child_fenced"
        link_exists = database.execute(
            "SELECT 1 FROM capture_task_links WHERE task_id=?", (child_id,)
        ).fetchone() is not None
        try:
            binding = self.active_capture_binding(database, child_id)
        except QueueOperationError:
            if link_exists:
                return "corrupt_child_intent_unresolved"
            binding = None
        if binding is not None and binding.intent_id is not None:
            terminal_code = self._capture_terminal_blocker(
                database, child_id, binding
            )
            if terminal_code is not None:
                return "corrupt_child_intent_unresolved"
        if database.execute(
            """SELECT 1 FROM capture_task_link_seals
               WHERE task_id=? AND consumer_kind='semantic-decision' LIMIT 1""",
            (child_id,),
        ).fetchone() is not None:
            return "corrupt_child_decision_retained"
        if any(
            child[field] is not None
            for field in ("result_reference", "result_sha256", "result_operation_id")
        ):
            return "corrupt_child_result_retained"
        return None

    def _corrupt_purge_child_descriptor(
        self, database: sqlite3.Connection, child: sqlite3.Row
    ) -> dict[str, object]:
        task_id = str(child["id"])
        history = canonical_json_bytes(
            [
                {
                    "attempt": int(row["attempt"]),
                    "started_at": str(row["started_at"]),
                    "finished_at": str(row["finished_at"]),
                    "outcome": str(row["outcome"]),
                    "error_code": row["error_code"],
                }
                for row in database.execute(
                    """SELECT attempt,started_at,finished_at,outcome,error_code
                       FROM attempt_history WHERE task_id=? ORDER BY sequence""",
                    (task_id,),
                )
            ]
        )
        task_evidence = canonical_json_bytes(
            {
                "task_id": task_id,
                "state": str(child["state"]),
                "input_hash": str(child["input_hash"]),
                "updated_at": str(child["updated_at"]),
                "lineage_generation": int(child["lineage_generation"]),
            }
        )
        return {
            "task_id": task_id,
            "task_sha256": sha256_bytes(task_evidence),
            "history_sha256": sha256_bytes(history),
        }

    @staticmethod
    def _delete_task_owned_evidence(
        database: sqlite3.Connection, task_id: str
    ) -> None:
        for table in (
            "capture_task_link_seals",
            "capture_task_link_resolutions",
            "capture_task_links",
            "attempt_history",
            "task_source_links",
        ):
            database.execute(f'DELETE FROM "{table}" WHERE task_id=?', (task_id,))

    @contextmanager
    def _corrupt_purge_task_fence(
        self, task_id: str, *, owner: OwnerLease
    ) -> Iterator[TaskFence]:
        fence = self.acquire_task_fence(task_id, mode="queue-operator", owner=owner)
        try:
            yield fence
        finally:
            with closing(self._connect()) as database:
                task = database.execute(
                    "SELECT 1 FROM tasks WHERE id=?", (task_id,)
                ).fetchone()
                current = database.execute(
                    """SELECT 1 FROM task_fences WHERE task_id=? AND token=?
                       AND fencing_epoch=?""",
                    (task_id, fence.token, fence.epoch),
                ).fetchone()
            if current is not None:
                self.release_task_fence(fence)
            elif task is not None:
                raise QueueOperationError("task_fence_lost")

    def _capture_terminal_file(
        self, intent_id: str
    ) -> tuple[dict[str, object], bytes]:
        path = self.results_dir / f"capture-{intent_id}.json"
        try:
            raw = _read_stable_owner_file(path, 64 * 1024)
            value = json.loads(raw.decode("utf-8", errors="strict"))
        except (OSError, PermissionError, ValueError, json.JSONDecodeError) as exc:
            raise QueueOperationError("capture_intent_unresolved") from exc
        if not isinstance(value, dict):
            raise QueueOperationError("capture_terminal_invalid")
        return value, raw

    @staticmethod
    def _require_capture_terminal_identity(
        record: Mapping[str, object], task_id: str, binding: CaptureTaskBinding
    ) -> None:
        processing = record.get("processing_binding")
        disposition = record.get("disposition")
        actual = (
            set(record),
            record.get("schema_version"),
            record.get("intent_id"),
            record.get("intent_sha256"),
            isinstance(record.get("semantic_decisions"), list),
        )
        expected = (
            {
                "schema_version",
                "intent_id",
                "intent_sha256",
                "semantic_decisions",
                "processing_binding",
                "disposition",
            },
            "capture-terminal/v1",
            binding.intent_id,
            binding.intent_sha256,
            True,
        )
        if actual != expected:
            raise QueueOperationError("capture_terminal_invalid")
        expected_processing = {
            "kind": "task",
            "task_id": task_id,
            "active_link_digest": binding.active_digest,
        }
        if processing != expected_processing:
            raise QueueOperationError("capture_terminal_invalid")
        if not isinstance(disposition, dict):
            raise QueueOperationError("capture_terminal_invalid")
        allowed = {"markdown_committed", "no_durable_content", "operator_discard"}
        if disposition.get("kind") not in allowed:
            raise QueueOperationError("capture_terminal_invalid")

    @staticmethod
    def _require_capture_terminal_database_binding(
        database: sqlite3.Connection,
        task_id: str,
        binding: CaptureTaskBinding,
        raw: bytes,
    ) -> None:
        intent = database.execute(
            "SELECT intent_sha256 FROM capture_intents WHERE intent_id=?",
            (binding.intent_id,),
        ).fetchone()
        if intent is None or intent["intent_sha256"] != binding.intent_sha256:
            raise QueueOperationError("capture_terminal_invalid")
        task = database.execute(
            """SELECT result_reference,result_sha256,result_operation_id
               FROM tasks WHERE id=?""",
            (task_id,),
        ).fetchone()
        expected = (
            f"run/queue-results/capture-{binding.intent_id}.json",
            sha256_bytes(raw),
            f"capture-terminal:{binding.intent_id}",
        )
        if task is None or tuple(task) != expected:
            raise QueueOperationError("capture_terminal_unbound")

    def _require_capture_terminal_proof(
        self,
        database: sqlite3.Connection,
        task_id: str,
        binding: CaptureTaskBinding,
    ) -> dict[str, object]:
        if binding.intent_id is None or binding.intent_sha256 is None:
            raise QueueOperationError("capture_intent_unresolved")
        record, raw = self._capture_terminal_file(binding.intent_id)
        self._require_capture_terminal_identity(record, task_id, binding)
        self._require_capture_terminal_database_binding(
            database, task_id, binding, raw
        )
        return record

    def _capture_terminal_blocker(
        self,
        database: sqlite3.Connection,
        task_id: str,
        binding: CaptureTaskBinding,
    ) -> str | None:
        try:
            self._require_capture_terminal_proof(database, task_id, binding)
        except QueueOperationError as exc:
            return exc.code
        return None

    @staticmethod
    def _require_capture_purge_unshared(
        database: sqlite3.Connection, task_id: str, intent_id: str
    ) -> None:
        other = database.execute(
            """SELECT task_id FROM capture_task_links
               WHERE intent_id=? AND task_id<>?
               UNION ALL
               SELECT task_id FROM capture_task_link_resolutions
               WHERE selected_intent_id=? AND task_id<>?
               LIMIT 1""",
            (intent_id, task_id, intent_id, task_id),
        ).fetchone()
        if other is not None:
            raise QueueOperationError("capture_link_conflicted")

    def _capture_purge_artifact(
        self,
        task_id: str,
        source_path: str,
        expected_sha256: str,
        *,
        max_bytes: int,
        error_code: str,
    ) -> _CapturePurgeArtifact:
        try:
            data = read_runtime_bytes(
                self.state_root / source_path,
                self.state_root,
                max_bytes=max_bytes,
                owner_only=True,
            )
        except (OSError, PermissionError, ValueError) as exc:
            raise QueueOperationError(error_code) from exc
        if sha256_bytes(data) != expected_sha256:
            raise QueueOperationError(error_code)
        archive_path = _capture_purge_archive_path(task_id, source_path)
        return _CapturePurgeArtifact(source_path, archive_path, expected_sha256)

    def _capture_purge_intent_path(
        self, database: sqlite3.Connection, binding: CaptureTaskBinding
    ) -> _CapturePurgeArtifact:
        row = database.execute(
            "SELECT * FROM capture_intents WHERE intent_id=?", (binding.intent_id,)
        ).fetchone()
        if row is None:
            raise QueueOperationError("capture_intent_conflict")
        relative = str(row["relative_path"])
        artifact = self._capture_purge_artifact(
            binding.task_id,
            relative,
            str(binding.intent_sha256),
            max_bytes=_MAX_QUEUE_PAYLOAD_BYTES,
            error_code="capture_intent_conflict",
        )
        size = (self.state_root / relative).stat().st_size
        if (size, row["publication_state"]) != (row["byte_size"], "ready"):
            raise QueueOperationError("capture_intent_conflict")
        return artifact

    def _require_capture_purge_decision_file(
        self, task_id: str, row: sqlite3.Row
    ) -> _CapturePurgeArtifact:
        return self._capture_purge_artifact(
            task_id,
            str(row["decision_path"]),
            str(row["decision_sha256"]),
            max_bytes=1024 * 1024,
            error_code="semantic_decision_conflict",
        )

    @staticmethod
    def _capture_purge_decisions_match(
        rows: list[sqlite3.Row],
        binding: CaptureTaskBinding,
        record: Mapping[str, object],
    ) -> bool:
        indexed = [
            {
                "stage": str(row["stage"]),
                "decision_path": str(row["decision_path"]),
                "decision_sha256": str(row["decision_sha256"]),
            }
            for row in rows
        ]
        digests_match = all(
            row["active_link_digest"] == binding.active_digest for row in rows
        )
        return indexed == record.get("semantic_decisions") and digests_match

    def _capture_purge_decision_paths(
        self,
        database: sqlite3.Connection,
        binding: CaptureTaskBinding,
        record: Mapping[str, object],
    ) -> tuple[_CapturePurgeArtifact, ...]:
        rows = database.execute(
            """SELECT stage,decision_path,decision_sha256,active_link_digest
               FROM semantic_decisions WHERE intent_id=? ORDER BY stage""",
            (binding.intent_id,),
        ).fetchall()
        if not self._capture_purge_decisions_match(rows, binding, record):
            raise QueueOperationError("capture_terminal_invalid")
        return tuple(
            self._require_capture_purge_decision_file(binding.task_id, row)
            for row in rows
        )

    def _capture_purge_evidence(
        self,
        database: sqlite3.Connection,
        task_id: str,
        binding: CaptureTaskBinding,
    ) -> _CapturePurgeEvidence:
        record = self._require_capture_terminal_proof(database, task_id, binding)
        intent_id = str(binding.intent_id)
        self._require_capture_purge_unshared(database, task_id, intent_id)
        intent = self._capture_purge_intent_path(database, binding)
        decisions = self._capture_purge_decision_paths(
            database, binding, record
        )
        return _CapturePurgeEvidence(
            task_id,
            intent_id,
            intent,
            decisions,
            f"run/queue-results/capture-{intent_id}.json",
        )

    @staticmethod
    def _require_corrupt_task_fence(
        database: sqlite3.Connection, task_fence: TaskFence
    ) -> None:
        row = database.execute(
            """SELECT 1 FROM task_fences WHERE task_id=? AND token=?
               AND fencing_epoch=? AND canonical_owner_token=?
               AND canonical_fencing_epoch=? AND expires_at>?""",
            (
                task_fence.task_id,
                task_fence.token,
                task_fence.epoch,
                task_fence.owner.token,
                task_fence.owner.epoch,
                _timestamp(_utc_now()),
            ),
        ).fetchone()
        if row is None:
            raise QueueOperationError("task_fence_lost")

    def _publish_corrupt_purge_receipt(
        self,
        task_id: str,
        *,
        operation_id: str,
        package: Path,
        task_fence: TaskFence,
    ) -> bytes:
        with closing(self._connect()) as database, begin_immediate(database):
            operation = database.execute(
                "SELECT * FROM corrupt_purge_operations WHERE operation_id=?",
                (operation_id,),
            ).fetchone()
            task = database.execute(
                "SELECT * FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            disposition = database.execute(
                """SELECT disposition.*,export.disposition_key,
                          export.rolling_root AS original_frozen_root
                   FROM corrupt_dispositions AS disposition
                   JOIN corrupt_export_operations AS export
                     ON export.operation_id=disposition.operation_id
                   WHERE disposition.task_id=?""",
                (task_id,),
            ).fetchone()
            if operation is None or task is None or disposition is None:
                raise QueueOperationError("corrupt_purge_lost")
            self._require_corrupt_task_fence(database, task_fence)
            incoming_count = int(
                database.execute(
                    "SELECT COUNT(*) FROM tasks WHERE redrive_of=?", (task_id,)
                ).fetchone()[0]
            )
            if (
                task["state"] != "purge_pending"
                or int(task["lineage_generation"])
                != int(operation["expected_generation"])
                or incoming_count != 0
            ):
                raise QueueOperationError("corrupt_purge_receipt_precondition_failed")
            manifest_bytes = _read_stable_owner_file(package / "manifest.json", 64 * 1024)
            disposition_bytes = _read_stable_owner_file(
                package / "disposition.json", 64 * 1024
            )
            if (
                sha256_bytes(manifest_bytes) != disposition["manifest_sha256"]
                or sha256_bytes(disposition_bytes) != disposition["disposition_sha256"]
            ):
                raise QueueOperationError("corrupt_package_invalid")
            receipt = {
                "schema_version": "corrupt-purge/v1",
                "operation_id": operation_id,
                "task_id": task_id,
                "package_key": str(disposition["disposition_key"]),
                "package_path": str(disposition["package_path"]),
                "manifest_sha256": str(disposition["manifest_sha256"]),
                "disposition_sha256": str(disposition["disposition_sha256"]),
                "original_frozen_root": str(disposition["original_frozen_root"]),
                "purge_page_count": int(operation["page_count"]),
                "final_rolling_root": str(operation["rolling_root"]),
                "final_generation": int(operation["expected_generation"]),
                "observed_incoming_link_count": 0,
            }
            validate_schema(
                receipt,
                Path(__file__).with_name("schemas") / "corrupt-purge-v1.json",
            )
            receipt_bytes = canonical_json_bytes(receipt)
            if len(receipt_bytes) > 64 * 1024:
                raise QueueOperationError("corrupt_purge_receipt_too_large")
            _write_durable_file(package / "purge-receipt.json", receipt_bytes)
            if (
                _read_stable_owner_file(package / "purge-receipt.json", 64 * 1024)
                != receipt_bytes
            ):
                raise QueueOperationError("corrupt_purge_receipt_invalid")
            if operation["state"] == "purging":
                updated = database.execute(
                    """UPDATE corrupt_purge_operations
                       SET state='receipt-published',updated_at=?
                       WHERE operation_id=? AND state='purging'
                         AND expected_generation=? AND page_count=? AND rolling_root=?""",
                    (
                        _timestamp(_utc_now()),
                        operation_id,
                        operation["expected_generation"],
                        operation["page_count"],
                        operation["rolling_root"],
                    ),
                ).rowcount
                if updated != 1:
                    raise QueueOperationError("corrupt_purge_receipt_fence_lost")
            return receipt_bytes

    def _delete_corrupt_parent(
        self,
        task_id: str,
        *,
        operation_id: str,
        package: Path,
        task_fence: TaskFence,
    ) -> None:
        with closing(self._connect()) as database, begin_immediate(database):
            operation = database.execute(
                "SELECT * FROM corrupt_purge_operations WHERE operation_id=?",
                (operation_id,),
            ).fetchone()
            task = database.execute(
                "SELECT * FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            disposition = database.execute(
                """SELECT disposition.*,export.raw_sha256,export.history_sha256,
                          export.metadata_sha256,export.disposition_key,
                          export.rolling_root AS original_frozen_root
                   FROM corrupt_dispositions AS disposition
                   JOIN corrupt_export_operations AS export
                     ON export.operation_id=disposition.operation_id
                   WHERE disposition.task_id=?""",
                (task_id,),
            ).fetchone()
            if operation is None or task is None or disposition is None:
                raise QueueOperationError("corrupt_purge_lost")
            self._require_corrupt_task_fence(database, task_fence)
            receipt_bytes = _read_stable_owner_file(
                package / "purge-receipt.json", 64 * 1024
            )
            receipt = json.loads(receipt_bytes.decode("utf-8", errors="strict"))
            validate_schema(
                receipt,
                Path(__file__).with_name("schemas") / "corrupt-purge-v1.json",
            )
            raw = _read_stable_owner_file(
                package / "payload.bin", _MAX_QUEUE_PAYLOAD_BYTES
            )
            history = _read_stable_owner_file(
                package / "attempt-history.json", _MAX_EXPORT_METADATA_BYTES
            )
            current_history = canonical_json_bytes(
                [
                    {
                        "attempt": int(row["attempt"]),
                        "started_at": str(row["started_at"]),
                        "finished_at": str(row["finished_at"]),
                        "outcome": str(row["outcome"]),
                        "error_code": row["error_code"],
                    }
                    for row in database.execute(
                        """SELECT attempt,started_at,finished_at,outcome,error_code
                           FROM attempt_history WHERE task_id=? ORDER BY sequence""",
                        (task_id,),
                    )
                ]
            )
            if (
                operation["state"] != "receipt-published"
                or task["state"] != "purge_pending"
                or int(task["lineage_generation"])
                != int(operation["expected_generation"])
                or database.execute(
                    "SELECT 1 FROM tasks WHERE redrive_of=? LIMIT 1", (task_id,)
                ).fetchone()
                is not None
                or sha256_bytes(raw) != disposition["raw_sha256"]
                or sha256_bytes(bytes(task["payload_blob"]))
                != disposition["raw_sha256"]
                or sha256_bytes(history) != disposition["history_sha256"]
                or sha256_bytes(current_history) != disposition["history_sha256"]
                or receipt["operation_id"] != operation_id
                or receipt["task_id"] != task_id
                or receipt["package_key"] != disposition["disposition_key"]
                or receipt["manifest_sha256"] != disposition["manifest_sha256"]
                or receipt["disposition_sha256"]
                != disposition["disposition_sha256"]
                or receipt["original_frozen_root"]
                != disposition["original_frozen_root"]
                or receipt["purge_page_count"] != operation["page_count"]
                or receipt["final_rolling_root"] != operation["rolling_root"]
                or receipt["final_generation"] != operation["expected_generation"]
            ):
                raise QueueOperationError("corrupt_parent_delete_precondition_failed")
            inserted = database.execute(
                """INSERT INTO task_purge_authorizations(
                       task_id,mode,operation_id,authorization_digest,created_at
                   ) VALUES (?,'corrupt-parent',?,?,?)""",
                (
                    task_id,
                    operation_id,
                    operation["purge_token"],
                    _timestamp(_utc_now()),
                ),
            ).rowcount
            if inserted != 1:
                raise QueueOperationError("purge_authorization_failed")
            deleted_fence = database.execute(
                """DELETE FROM task_fences WHERE task_id=? AND token=?
                   AND fencing_epoch=?""",
                (task_id, task_fence.token, task_fence.epoch),
            ).rowcount
            if deleted_fence != 1:
                raise QueueOperationError("task_fence_lost")
            self._delete_task_owned_evidence(database, task_id)
            deleted_task = database.execute(
                "DELETE FROM tasks WHERE id=?", (task_id,)
            ).rowcount
            if deleted_task != 1:
                raise QueueOperationError("corrupt_parent_delete_failed")
            cleared = database.execute(
                "DELETE FROM task_purge_authorizations WHERE task_id=?", (task_id,)
            ).rowcount
            if cleared != 1:
                raise QueueOperationError("purge_authorization_failed")

    def purge_quarantined(
        self,
        task_id: str,
        *,
        owner: OwnerLease,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> CorruptPurgeProgress:
        from operational_ownership import OwnerLease

        _require_active(deadline, cancelled)
        if not isinstance(owner, OwnerLease) or owner.role != "repair":
            raise ValueError("corrupt purge requires a repair owner")
        if not isinstance(task_id, str) or not 1 <= len(task_id.encode("utf-8")) <= 256:
            raise ValueError("task ID is invalid")
        registry = self.ownership_registry()
        with closing(registry._connect()) as coordinator_database:
            registry.require(coordinator_database, owner)
        completed = self._completed_corrupt_purge_progress(task_id)
        if completed is not None:
            return completed
        with self.queue_owner(
            role="queue-operator",
            scope=f"task:{sha256_bytes(task_id.encode('utf-8'))}",
            parent=owner,
        ), self._corrupt_purge_task_fence(task_id, owner=owner) as task_fence:
            now = _utc_now()
            with closing(self._connect()) as database, begin_immediate(database):
                task = database.execute(
                    "SELECT * FROM tasks WHERE id=?", (task_id,)
                ).fetchone()
                disposition = database.execute(
                    """SELECT disposition.*, operation.disposition_key,
                              operation.rolling_root AS original_frozen_root,
                              operation.lineage_generation
                       FROM corrupt_dispositions AS disposition
                       JOIN corrupt_export_operations AS operation
                         ON operation.operation_id=disposition.operation_id
                       WHERE disposition.task_id=?""",
                    (task_id,),
                ).fetchone()
                if task is None or disposition is None or task["state"] not in {
                    "quarantined",
                    "purge_pending",
                }:
                    raise QueueOperationError("corrupt_purge_state_invalid")
                existing_operation = database.execute(
                    "SELECT * FROM corrupt_purge_operations WHERE task_id=?",
                    (task_id,),
                ).fetchone()
                disposed_at = _parse_timestamp(str(disposition["disposed_at"]))
                if disposed_at is None:
                    raise QueueOperationError("corrupt_disposition_invalid")
                if (
                    existing_operation is None
                    and disposed_at + timedelta(days=30) > now
                ):
                    return CorruptPurgeProgress(
                        task_id=task_id,
                        operation_id="",
                        state="blocked",
                        pages_written=0,
                        links_deleted=0,
                        complete=False,
                        code="corrupt_retention_active",
                    )
                package_key = str(disposition["disposition_key"])
                package = self.results_dir / f"corrupt-{package_key}"
                package_code = self._corrupt_package_purge_blocker(
                    package, disposition
                )
                if package_code is not None:
                    return CorruptPurgeProgress(
                        task_id=task_id,
                        operation_id="",
                        state="blocked",
                        pages_written=0,
                        links_deleted=0,
                        complete=False,
                        code=package_code,
                    )
                operation_key = sha256_bytes(
                    canonical_json_bytes(
                        {
                            "disposition_sha256": disposition["disposition_sha256"],
                            "package_key": package_key,
                            "task_id": task_id,
                        }
                    )
                )
                operation_id = f"corrupt-purge:{operation_key}"
                if existing_operation is None:
                    try:
                        binding = self.active_capture_binding(database, task_id)
                    except QueueOperationError:
                        return CorruptPurgeProgress(
                            task_id=task_id,
                            operation_id="",
                            state="blocked",
                            pages_written=0,
                            links_deleted=0,
                            complete=False,
                            code="capture_intent_unresolved",
                        )
                    terminal_code = self._capture_terminal_blocker(
                        database, task_id, binding
                    )
                    if terminal_code is not None:
                        return CorruptPurgeProgress(
                            task_id=task_id,
                            operation_id="",
                            state="blocked",
                            pages_written=0,
                            links_deleted=0,
                            complete=False,
                            code=terminal_code,
                        )
                    purge_token = sha256_bytes(
                        canonical_json_bytes(
                            {
                                "operation_id": operation_id,
                                "task_id": task_id,
                                "task_fence_epoch": task_fence.epoch,
                            }
                        )
                    )
                    inserted = database.execute(
                        """INSERT INTO corrupt_purge_operations(
                               operation_id,task_id,purge_token,expected_generation,
                               cursor_task_id,page_count,rolling_root,state,created_at,updated_at
                           ) VALUES (?,?,?,?,'',0,?,'purging',?,?)""",
                        (
                            operation_id,
                            task_id,
                            purge_token,
                            int(task["lineage_generation"]),
                            sha256_bytes(b""),
                            _timestamp(now),
                            _timestamp(now),
                        ),
                    ).rowcount
                    changed = database.execute(
                        """UPDATE tasks SET state='purge_pending',updated_at=?
                           WHERE id=? AND state='quarantined'""",
                        (_timestamp(now), task_id),
                    ).rowcount
                    if (inserted, changed) != (1, 1):
                        raise QueueOperationError("corrupt_purge_start_failed")
                elif (
                    existing_operation["operation_id"] != operation_id
                    or task["state"] != "purge_pending"
                ):
                    raise QueueOperationError("corrupt_purge_conflict")
            page_progress = self._purge_corrupt_lineage_page(
                task_id,
                operation_id=operation_id,
                package=package,
                owner=owner,
                task_fence=task_fence,
                deadline=deadline,
                cancelled=cancelled,
            )
            if page_progress.state == "blocked":
                return page_progress
            with closing(self._connect()) as database:
                incoming = database.execute(
                    "SELECT 1 FROM tasks WHERE redrive_of=? LIMIT 1", (task_id,)
                ).fetchone()
            if incoming is not None:
                return page_progress
            self._publish_corrupt_purge_receipt(
                task_id,
                operation_id=operation_id,
                package=package,
                task_fence=task_fence,
            )
            self._delete_corrupt_parent(
                task_id,
                operation_id=operation_id,
                package=package,
                task_fence=task_fence,
            )
            return CorruptPurgeProgress(
                task_id=task_id,
                operation_id=operation_id,
                state="purged",
                pages_written=page_progress.pages_written,
                links_deleted=page_progress.links_deleted,
                complete=True,
                code=None,
            )

    def _completed_corrupt_purge_progress(
        self, task_id: str
    ) -> CorruptPurgeProgress | None:
        with closing(self._connect()) as database:
            task_exists = database.execute(
                "SELECT 1 FROM tasks WHERE id=?", (task_id,)
            ).fetchone()
            operation = database.execute(
                "SELECT * FROM corrupt_purge_operations WHERE task_id=?",
                (task_id,),
            ).fetchone()
            if task_exists is not None or operation is None:
                return None
            if operation["state"] != "receipt-published":
                raise QueueOperationError("corrupt_purge_completion_invalid")
            disposition = database.execute(
                """SELECT disposition.*,export.disposition_key
                   FROM corrupt_dispositions AS disposition
                   JOIN corrupt_export_operations AS export
                     ON export.operation_id=disposition.operation_id
                   WHERE disposition.task_id=?""",
                (task_id,),
            ).fetchone()
            links_deleted = int(
                database.execute(
                    """SELECT COALESCE(SUM(deleted_link_count),0)
                       FROM corrupt_purge_pages WHERE operation_id=?""",
                    (operation["operation_id"],),
                ).fetchone()[0]
            )
        if disposition is None:
            raise QueueOperationError("corrupt_purge_completion_invalid")
        package = self.results_dir / f"corrupt-{disposition['disposition_key']}"
        try:
            receipt_bytes = _read_stable_owner_file(
                package / "purge-receipt.json", 64 * 1024
            )
            receipt = json.loads(receipt_bytes.decode("utf-8", errors="strict"))
            validate_schema(
                receipt,
                Path(__file__).with_name("schemas") / "corrupt-purge-v1.json",
            )
        except (OSError, PermissionError, ValueError, json.JSONDecodeError) as exc:
            raise QueueOperationError("corrupt_purge_completion_invalid") from exc
        if (
            receipt["operation_id"] != operation["operation_id"]
            or receipt["task_id"] != task_id
            or receipt["package_key"] != disposition["disposition_key"]
            or receipt["manifest_sha256"] != disposition["manifest_sha256"]
            or receipt["disposition_sha256"] != disposition["disposition_sha256"]
            or receipt["purge_page_count"] != operation["page_count"]
            or receipt["final_rolling_root"] != operation["rolling_root"]
            or receipt["final_generation"] != operation["expected_generation"]
        ):
            raise QueueOperationError("corrupt_purge_completion_invalid")
        return CorruptPurgeProgress(
            task_id=task_id,
            operation_id=str(operation["operation_id"]),
            state="purged",
            pages_written=int(operation["page_count"]),
            links_deleted=links_deleted,
            complete=True,
            code=None,
        )

    def _corrupt_package_purge_blocker(
        self, package: Path, disposition: sqlite3.Row
    ) -> str | None:
        try:
            metadata = package.lstat()
            reparse_flag = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
            if (
                stat.S_ISLNK(metadata.st_mode)
                or getattr(metadata, "st_file_attributes", 0) & reparse_flag
                or not stat.S_ISDIR(metadata.st_mode)
                or not _is_owner_only(package)
            ):
                return "corrupt_package_invalid"
            manifest_bytes = _read_stable_owner_file(
                package / "manifest.json", 64 * 1024
            )
            disposition_bytes = _read_stable_owner_file(
                package / "disposition.json", 64 * 1024
            )
            manifest = json.loads(manifest_bytes.decode("utf-8", errors="strict"))
            disposition_record = json.loads(
                disposition_bytes.decode("utf-8", errors="strict")
            )
            validate_schema(
                manifest,
                Path(__file__).with_name("schemas") / "corrupt-task-manifest-v1.json",
            )
            validate_schema(
                disposition_record,
                Path(__file__).with_name("schemas")
                / "corrupt-task-disposition-v1.json",
            )
        except (OSError, PermissionError, ValueError, json.JSONDecodeError):
            return "corrupt_package_invalid"
        if (
            sha256_bytes(manifest_bytes) != disposition["manifest_sha256"]
            or sha256_bytes(disposition_bytes) != disposition["disposition_sha256"]
            or manifest["task_id"] != disposition["task_id"]
            or disposition_record["task_id"] != disposition["task_id"]
            or manifest["package_path"] != disposition["package_path"]
            or disposition_record["package_path"] != disposition["package_path"]
        ):
            return "corrupt_package_invalid"
        try:
            raw = _read_stable_owner_file(
                package / "payload.bin", _MAX_QUEUE_PAYLOAD_BYTES
            )
            history = _read_stable_owner_file(
                package / "attempt-history.json", _MAX_EXPORT_METADATA_BYTES
            )
            metadata = _read_stable_owner_file(
                package / "task-metadata.json", _MAX_EXPORT_METADATA_BYTES
            )
        except (OSError, PermissionError, ValueError):
            return "corrupt_package_invalid"
        if (
            sha256_bytes(raw) != manifest["raw_sha256"]
            or sha256_bytes(history) != manifest["history_sha256"]
            or sha256_bytes(metadata) != manifest["metadata_sha256"]
            or manifest["rolling_root"] != disposition["original_frozen_root"]
        ):
            return "corrupt_package_invalid"
        return None

    @contextmanager
    def queue_owner(
        self,
        *,
        role: Literal["queue-worker", "queue-operator"],
        scope: str,
        parent: OwnerLease | None = None,
    ) -> Iterator[OwnerLease]:
        from operational_ownership import OwnerLease

        allowed = {
            "queue-worker": {"queue-worker", "compile", "doctor", "nightly", "weekly"},
            "queue-operator": {"queue-operator", "repair"},
        }
        if role not in allowed:
            raise ValueError("queue owner role must be queue-worker or queue-operator")
        registry = self.ownership_registry()
        nested = parent is not None
        if nested:
            if not isinstance(parent, OwnerLease):
                raise TypeError("parent must be an OwnerLease")
            if parent.role not in allowed[role]:
                raise ValueError("parent role cannot project the requested queue role")
            with closing(registry._connect()) as database:
                registry.require(database, parent)
            lease = parent
        else:
            lease = registry.acquire(role, scope=scope)
        try:
            self._insert_queue_projection(lease, role=role, scope=scope)
        except BaseException:
            if not nested:
                registry.release(lease)
            raise
        try:
            yield lease
        finally:
            self._remove_queue_projection(lease)
            if not nested:
                registry.release(lease)

    def _insert_queue_projection(
        self,
        lease: OwnerLease,
        *,
        role: Literal["queue-worker", "queue-operator"],
        scope: str,
    ) -> None:
        from operational_ownership import OwnerLease

        if not isinstance(lease, OwnerLease):
            raise TypeError("lease must be an OwnerLease")
        domain_role = "worker" if role == "queue-worker" else "operator"
        with closing(
            open_operational_db(
                self.db_path,
                busy_ms=DEFAULTS.queue_busy_ms,
                contract=_QUEUE_V3_CONTRACT,
            )
        ) as database, begin_immediate(database):
            database.execute(
                """INSERT INTO queue_ownership(
                       actor_id,domain_role,canonical_role,canonical_scope,
                       owner_token,fencing_epoch,process_id,process_start_identity,
                       acquired_at,heartbeat_at,expires_at
                   ) VALUES (?,?,?,?,?,?,?,?,?,?,?)""",
                (
                    lease.actor_id,
                    domain_role,
                    lease.role,
                    lease.scope,
                    lease.token,
                    lease.epoch,
                    lease.process.pid,
                    lease.process.start_identity,
                    _timestamp(lease.acquired_at),
                    _timestamp(lease.heartbeat_at),
                    _timestamp(lease.expires_at),
                ),
            )

    def heartbeat_queue_owner(self, lease: OwnerLease) -> None:
        registry = self.ownership_registry()
        current = registry.heartbeat(lease)
        with closing(
            open_operational_db(
                self.db_path,
                busy_ms=DEFAULTS.queue_busy_ms,
                contract=_QUEUE_V3_CONTRACT,
            )
        ) as database, begin_immediate(database):
            updated = database.execute(
                """UPDATE queue_ownership SET heartbeat_at=?,expires_at=?
                   WHERE actor_id=? AND canonical_role=? AND canonical_scope=?
                     AND owner_token=? AND fencing_epoch=? AND process_id=?
                     AND process_start_identity=?""",
                (
                    _timestamp(current.heartbeat_at),
                    _timestamp(current.expires_at),
                    current.actor_id,
                    current.role,
                    current.scope,
                    current.token,
                    current.epoch,
                    current.process.pid,
                    current.process.start_identity,
                ),
            ).rowcount
            if updated != 1:
                raise QueueOperationError("queue_owner_fence_lost")

    def _remove_queue_projection(self, lease: OwnerLease) -> None:
        from operational_ownership import OwnerLease

        if not isinstance(lease, OwnerLease):
            raise TypeError("lease must be an OwnerLease")
        with closing(
            open_operational_db(
                self.db_path,
                busy_ms=DEFAULTS.queue_busy_ms,
                contract=_QUEUE_V3_CONTRACT,
            )
        ) as database, begin_immediate(database):
            deleted = database.execute(
                """DELETE FROM queue_ownership
                   WHERE actor_id=? AND canonical_role=? AND canonical_scope=?
                     AND owner_token=? AND fencing_epoch=? AND process_id=?
                     AND process_start_identity=?""",
                (
                    lease.actor_id,
                    lease.role,
                    lease.scope,
                    lease.token,
                    lease.epoch,
                    lease.process.pid,
                    lease.process.start_identity,
                ),
            ).rowcount
            if deleted != 1:
                raise QueueOperationError("queue_owner_fence_lost")

    def claim(
        self,
        owner: str,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
        max_attempts: int = DEFAULTS.queue_max_attempts,
    ) -> QueueLease | None:
        if not owner:
            raise ValueError("owner must be non-empty")
        if lease_seconds <= 0:
            raise ValueError("lease must be positive")
        _validate_retry_policy(
            max_attempts, DEFAULTS.retry_base_seconds, DEFAULTS.retry_cap_seconds
        )
        now = _utc_now()
        with closing(
            self._connect()
        ) as database, begin_immediate(database):
            while True:
                row = database.execute(
                    """SELECT * FROM tasks
                       WHERE state='ready' AND attempts < ? AND available_at <= ?
                       ORDER BY priority DESC, available_at, created_at, id LIMIT 1""",
                    (max_attempts, _timestamp(now)),
                ).fetchone()
                if row is None:
                    return None
                validation = self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                if validation is None:
                    continue
                history_count = database.execute(
                    "SELECT COUNT(*) FROM attempt_history WHERE task_id=?",
                    (row["id"],),
                ).fetchone()[0]
                if int(history_count) >= _MAX_RUNTIME_ATTEMPTS:
                    changed = database.execute(
                        """UPDATE tasks SET state='dead',
                               error_code='attempt_history_exhausted',updated_at=?
                           WHERE id=? AND state='ready'""",
                        (_timestamp(now), row["id"]),
                    ).rowcount
                    if changed != 1:
                        raise QueueOperationError("attempt_history_demotion_failed")
                    continue
                break
            token = sha256_bytes(os.urandom(32))
            expires_at = now + timedelta(seconds=lease_seconds)
            changed = database.execute(
                """UPDATE tasks SET state='leased', attempts=attempts+1,
                       lease_owner=?, lease_token=?, lease_expires_at=?,
                       lease_heartbeat_at=?, attempt_started_at=?, updated_at=?
                   WHERE id=? AND state='ready' AND attempts < ?""",
                (
                    owner,
                    token,
                    _timestamp(expires_at),
                    _timestamp(now),
                    _timestamp(now),
                    _timestamp(now),
                    row["id"],
                    max_attempts,
                ),
            ).rowcount
            if changed != 1:
                return None
        return QueueLease(
            id=str(row["id"]),
            kind=str(row["kind"]),
            handler_version=int(row["handler_version"]),
            payload=validation.payload or {},
            input_hash=str(row["input_hash"]),
            owner=owner,
            token=token,
            expires_at=expires_at,
            attempt=int(row["attempts"]) + 1,
            created_at=_parse_timestamp(row["created_at"]),  # type: ignore[arg-type]
            last_attempt_at=_parse_timestamp(row["last_attempt_at"]),
            prior_attempts=int(row["attempts"]),
        )

    @staticmethod
    def _validate_capture_claim(
        owner: str, lease_seconds: int, max_attempts: int
    ) -> None:
        if not owner:
            raise ValueError("owner must be non-empty")
        if lease_seconds <= 0:
            raise ValueError("lease must be positive")
        _validate_retry_policy(
            max_attempts, DEFAULTS.retry_base_seconds, DEFAULTS.retry_cap_seconds
        )

    @staticmethod
    def _capture_claim_row(
        database: sqlite3.Connection, max_attempts: int, now: datetime
    ) -> sqlite3.Row | None:
        return database.execute(
            """SELECT task.* FROM tasks AS task
               JOIN capture_task_links AS link ON link.task_id=task.id
               WHERE task.state='ready' AND task.kind='flush'
                 AND task.handler_version=1 AND task.attempts<?
                 AND task.available_at<=?
                 AND (SELECT COUNT(*) FROM attempt_history AS history
                      WHERE history.task_id=task.id)<?
               ORDER BY task.priority DESC,task.available_at,task.created_at,task.id
               LIMIT 1""",
            (max_attempts, _timestamp(now), _MAX_RUNTIME_ATTEMPTS),
        ).fetchone()

    def _lease_capture_row(
        self,
        database: sqlite3.Connection,
        row: sqlite3.Row,
        *,
        owner: str,
        lease_seconds: int,
        max_attempts: int,
        now: datetime,
    ) -> QueueLease | None:
        validation = self._require_valid_task_payload(database, row, now=now, parse=True)
        if validation is None:
            return None
        token = sha256_bytes(os.urandom(32))
        expires_at = now + timedelta(seconds=lease_seconds)
        changed = database.execute(
            """UPDATE tasks SET state='leased',attempts=attempts+1,
                   lease_owner=?,lease_token=?,lease_expires_at=?,
                   lease_heartbeat_at=?,attempt_started_at=?,updated_at=?
               WHERE id=? AND state='ready' AND attempts<?""",
            (
                owner,
                token,
                _timestamp(expires_at),
                _timestamp(now),
                _timestamp(now),
                _timestamp(now),
                row["id"],
                max_attempts,
            ),
        ).rowcount
        if changed != 1:
            return None
        return QueueLease(
            id=str(row["id"]),
            kind=str(row["kind"]),
            handler_version=int(row["handler_version"]),
            payload=validation.payload or {},
            input_hash=str(row["input_hash"]),
            owner=owner,
            token=token,
            expires_at=expires_at,
            attempt=int(row["attempts"]) + 1,
            created_at=_parse_timestamp(row["created_at"]),  # type: ignore[arg-type]
            last_attempt_at=_parse_timestamp(row["last_attempt_at"]),
            prior_attempts=int(row["attempts"]),
        )

    def claim_capture(
        self,
        owner: str,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
        max_attempts: int = DEFAULTS.queue_max_attempts,
    ) -> QueueLease | None:
        self._validate_capture_claim(owner, lease_seconds, max_attempts)
        now = _utc_now()
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._capture_claim_row(database, max_attempts, now)
            if row is None:
                return None
            return self._lease_capture_row(
                database,
                row,
                owner=owner,
                lease_seconds=lease_seconds,
                max_attempts=max_attempts,
                now=now,
            )

    def heartbeat(
        self,
        lease: QueueLease,
        *,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ) -> QueueLease:
        if lease_seconds <= 0:
            raise ValueError("lease must be positive")
        now = _utc_now()
        expires_at = now + timedelta(seconds=lease_seconds)
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            validation = self._require_valid_task_payload(
                database, row, now=now, parse=True
            )
            mismatch = validation is None
            if not mismatch:
                changed = database.execute(
                    """UPDATE tasks SET lease_expires_at=?, lease_heartbeat_at=?,
                           updated_at=? WHERE id=? AND lease_token=? AND state='leased'""",
                    (
                        _timestamp(expires_at),
                        _timestamp(now),
                        _timestamp(now),
                        lease.id,
                        lease.token,
                    ),
                ).rowcount
                if changed != 1:
                    raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        if mismatch:
            self._raise_payload_mismatch()
        return replace(lease, expires_at=expires_at)

    def payload_for_execution(self, lease: QueueLease) -> dict[str, object]:
        now = _utc_now()
        payload: dict[str, object] | None = None
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            validation = self._require_valid_task_payload(
                database, row, now=now, parse=True
            )
            mismatch = validation is None
            if validation is not None:
                payload = validation.payload
        if mismatch:
            self._raise_payload_mismatch()
        return payload or {}

    def _validated_result_digest(self, relative: str) -> str | None:
        try:
            path = self.state_root / relative
            if path.parent.resolve(strict=True) != self.results_dir.resolve(strict=True):
                return None
            data = _read_stable_owner_file(path, _MAX_RESULT_BYTES)
            return sha256_bytes(data)
        except (OSError, PermissionError, ValueError):
            return None

    def adopt_published_result(
        self, lease: QueueLease, *, operation_id: str
    ) -> str | None:
        if not operation_id:
            raise ValueError("operation_id must be non-empty")
        result_name = f"{sha256_bytes(operation_id.encode('utf-8'))}.result"
        relative = f"run/queue-results/{result_name}"
        if not (self.state_root / relative).exists():
            return None
        now = _utc_now()
        mismatch = False
        outcome: str | None = None
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            validation = self._require_valid_task_payload(
                database, row, now=now, parse=True
            )
            mismatch = validation is None
            if not mismatch:
                digest = self._validated_result_digest(relative)
                if digest is None:
                    outcome = "corrupt"
                    database.execute(
                        """UPDATE tasks SET state='dead',error_code='result_corrupt',
                               updated_at=?,lease_owner=NULL,lease_token=NULL,
                               lease_expires_at=NULL,lease_heartbeat_at=NULL,
                               attempt_started_at=NULL WHERE id=?""",
                        (_timestamp(now), lease.id),
                    )
                else:
                    changed = database.execute(
                        """UPDATE tasks SET result_reference=?,result_sha256=?,
                               result_operation_id=?,updated_at=?
                           WHERE id=? AND lease_token=? AND state='leased'""",
                        (
                            relative,
                            digest,
                            operation_id,
                            _timestamp(now),
                            lease.id,
                            lease.token,
                        ),
                    ).rowcount
                    if changed != 1:
                        raise LeaseFenceError(
                            f"lease is stale or not owned: {lease.id}"
                        )
                    outcome = "adopted"
        if mismatch:
            self._raise_payload_mismatch()
        return outcome

    def publish_result(
        self, lease: QueueLease, *, operation_id: str, result: bytes
    ) -> str:
        if not operation_id:
            raise ValueError("operation_id must be non-empty")
        if not isinstance(result, bytes):
            raise TypeError("result must be bytes")
        if len(result) > _MAX_RESULT_BYTES:
            raise ValueError("result exceeds maximum queue result size")
        now = _utc_now()
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            mismatch = (
                self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                is None
            )
        if mismatch:
            self._raise_payload_mismatch()
        self.results_dir.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(self.results_dir, 0o700)
        result_name = f"{sha256_bytes(operation_id.encode('utf-8'))}.result"
        target = self.results_dir / result_name
        _write_durable_file(target, result)
        relative = f"run/queue-results/{result_name}"
        digest = sha256_bytes(result)
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, _utc_now())
            mismatch = (
                self._require_valid_task_payload(
                    database, row, now=_utc_now(), parse=True
                )
                is None
            )
            if not mismatch:
                existing_operation = row["result_operation_id"]
                if existing_operation not in {None, operation_id}:
                    raise ResultConflictError(
                        "lease already published a different operation"
                    )
                existing_digest = self._validated_result_digest(relative)
                if existing_digest != digest:
                    raise ResultConflictError(
                        "operation ID already has different result bytes"
                    )
                changed = database.execute(
                    """UPDATE tasks SET result_reference=?,result_sha256=?,
                           result_operation_id=?,updated_at=?
                       WHERE id=? AND lease_token=? AND state='leased'""",
                    (
                        relative,
                        digest,
                        operation_id,
                        _timestamp(_utc_now()),
                        lease.id,
                        lease.token,
                    ),
                ).rowcount
                if changed != 1:
                    raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        if mismatch:
            self._raise_payload_mismatch()
        return relative

    def acknowledge(self, lease: QueueLease) -> None:
        now = _utc_now()
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            mismatch = (
                self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                is None
            )
            if not mismatch:
                digest = row["result_sha256"]
                reference = row["result_reference"]
                valid_result = (
                    isinstance(digest, str)
                    and isinstance(reference, str)
                    and self._validated_result_digest(reference) == digest
                )
                state = "succeeded" if valid_result else "dead"
                error_code = None if valid_result else "result_corrupt"
                database.execute(
                    """INSERT INTO attempt_history(
                           task_id,attempt,started_at,finished_at,outcome,error_code
                       ) VALUES (?,?,?,?,?,?)""",
                    (
                        lease.id,
                        row["attempts"],
                        row["attempt_started_at"] or _timestamp(now),
                        _timestamp(now),
                        "succeeded" if valid_result else "failed",
                        error_code,
                    ),
                )
                changed = database.execute(
                    """UPDATE tasks SET state=?,error_code=?,updated_at=?,
                           lease_owner=NULL,lease_token=NULL,lease_expires_at=NULL,
                           lease_heartbeat_at=NULL,attempt_started_at=NULL
                       WHERE id=? AND lease_token=? AND state='leased'""",
                    (state, error_code, _timestamp(now), lease.id, lease.token),
                ).rowcount
                if changed != 1:
                    raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        if mismatch:
            self._raise_payload_mismatch()

    def fail(self, lease: QueueLease, failure: QueueFailure) -> None:
        if not isinstance(failure, QueueFailure) or not failure.error_code:
            raise ValueError("failure must have a non-empty error code")
        now = _utc_now()
        mismatch = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = self._require_lease_row(database, lease, now)
            mismatch = (
                self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                is None
            )
            if not mismatch:
                outcome = "blocked" if failure.blocked_capability else "failed"
                database.execute(
                    """INSERT INTO attempt_history(
                           task_id,attempt,started_at,finished_at,outcome,error_code
                       ) VALUES (?,?,?,?,?,?)""",
                    (
                        lease.id,
                        row["attempts"],
                        row["attempt_started_at"] or _timestamp(now),
                        _timestamp(now),
                        outcome,
                        failure.error_code,
                    ),
                )
                if failure.blocked_capability:
                    state = "blocked"
                    attempts = int(row["attempts"]) - 1
                elif failure.permanent or failure.error_code in _PERMANENT_CODES:
                    state = "dead"
                    attempts = int(row["attempts"])
                else:
                    state = "ready"
                    attempts = int(row["attempts"])
                changed = database.execute(
                    """UPDATE tasks SET state=?,attempts=?,error_code=?,
                           blocked_capability=?,updated_at=?,available_at=?,
                           lease_owner=NULL,lease_token=NULL,lease_expires_at=NULL,
                           lease_heartbeat_at=NULL,attempt_started_at=NULL
                       WHERE id=? AND lease_token=? AND state='leased'""",
                    (
                        state,
                        attempts,
                        failure.error_code,
                        failure.blocked_capability,
                        _timestamp(now),
                        _timestamp(now),
                        lease.id,
                        lease.token,
                    ),
                ).rowcount
                if changed != 1:
                    raise LeaseFenceError(f"lease is stale or not owned: {lease.id}")
        if mismatch:
            self._raise_payload_mismatch()

    def recover_expired_leases(self) -> int:
        now = _utc_now()
        with closing(self._connect()) as database, begin_immediate(database):
            rows = database.execute(
                "SELECT * FROM tasks WHERE state='leased' AND lease_expires_at<=?",
                (_timestamp(now),),
            ).fetchall()
            for row in rows:
                validation = self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                if validation is None:
                    continue
                database.execute(
                    """INSERT INTO attempt_history(
                           task_id,attempt,started_at,finished_at,outcome,error_code
                       ) VALUES (?,?,?,?,?,?)""",
                    (
                        row["id"],
                        row["attempts"],
                        row["attempt_started_at"] or _timestamp(now),
                        _timestamp(now),
                        "lease_expired",
                        "lease_expired",
                    ),
                )
                changed = database.execute(
                    """UPDATE tasks SET state='ready',error_code='lease_expired',
                           updated_at=?,available_at=?,lease_owner=NULL,lease_token=NULL,
                           lease_expires_at=NULL,lease_heartbeat_at=NULL,
                           attempt_started_at=NULL WHERE id=? AND state='leased'""",
                    (_timestamp(now), _timestamp(now), row["id"]),
                ).rowcount
                if changed != 1:
                    raise QueueOperationError("lease_expiry_failed")
        return len(rows)

    def cancel(self, task_id: str) -> bool:
        now = _utc_now()
        mismatch = False
        changed = False
        with closing(self._connect()) as database, begin_immediate(database):
            row = database.execute("SELECT * FROM tasks WHERE id=?", (task_id,)).fetchone()
            if row is None or row["state"] in _TERMINAL_STATES:
                return False
            mismatch = (
                self._require_valid_task_payload(
                    database, row, now=now, parse=True
                )
                is None
            )
            if not mismatch:
                changed = database.execute(
                    """UPDATE tasks SET state='cancelled',error_code='cancelled',
                           updated_at=?,lease_owner=NULL,lease_token=NULL,
                           lease_expires_at=NULL,lease_heartbeat_at=NULL,
                           attempt_started_at=NULL WHERE id=? AND state=?""",
                    (_timestamp(now), task_id, row["state"]),
                ).rowcount == 1
        if mismatch:
            self._raise_payload_mismatch()
        return changed

    def redrive(self, task_id: str) -> str:
        now = _utc_now()
        mismatch = False
        replacement = uuid.uuid4().hex
        with closing(self._connect()) as database, begin_immediate(database):
            row = database.execute("SELECT * FROM tasks WHERE id=?", (task_id,)).fetchone()
            if row is None:
                raise KeyError(task_id)
            if row["state"] != "dead":
                raise QueueOperationError("redrive_requires_dead")
            validation = self._require_valid_task_payload(
                database, row, now=now, parse=True
            )
            mismatch = validation is None
            if not mismatch:
                inserted = database.execute(
                    """INSERT INTO tasks(
                           id,kind,handler_version,payload_blob,input_hash,state,
                           priority,created_at,updated_at,available_at,redrive_of
                       ) VALUES (?,?,?,?,?,'ready',?,?,?,?,?)""",
                    (
                        replacement,
                        row["kind"],
                        row["handler_version"],
                        validation.raw,
                        validation.input_hash,
                        row["priority"],
                        _timestamp(now),
                        _timestamp(now),
                        _timestamp(now),
                        task_id,
                    ),
                ).rowcount
                if inserted != 1:
                    raise QueueOperationError("redrive_failed")
        if mismatch:
            self._raise_payload_mismatch()
        return replacement

    def export_task(self, task_id: str) -> dict[str, object]:
        with closing(self._connect()) as database:
            row = database.execute("SELECT * FROM tasks WHERE id=?", (task_id,)).fetchone()
            if row is None:
                raise KeyError(task_id)
            validation = validate_payload_blob(
                bytes(row["payload_blob"]), row["input_hash"], parse=True
            )
            if validation.code is not None:
                raise QueueOperationError("payload_hash_mismatch")
            history = database.execute(
                """SELECT attempt,started_at,finished_at,outcome,error_code
                   FROM attempt_history WHERE task_id=? ORDER BY sequence""",
                (task_id,),
            ).fetchall()
            source_links = database.execute(
                """SELECT logical_path,source_digest FROM task_source_links
                   WHERE task_id=? ORDER BY logical_path,source_digest""",
                (task_id,),
            ).fetchall()
            link = database.execute(
                "SELECT * FROM capture_task_links WHERE task_id=?", (task_id,)
            ).fetchone()
            seal = database.execute(
                "SELECT * FROM capture_task_link_seals WHERE task_id=?", (task_id,)
            ).fetchone()
        lease_values = (
            row["lease_owner"],
            row["lease_token"],
            row["lease_expires_at"],
            row["lease_heartbeat_at"],
        )
        lease = (
            None
            if lease_values == (None, None, None, None)
            else {
                "owner": lease_values[0],
                "token": lease_values[1],
                "expires_at": lease_values[2],
                "heartbeat_at": lease_values[3],
            }
        )
        result_values = (
            row["result_reference"],
            row["result_sha256"],
            row["result_operation_id"],
        )
        result = (
            None
            if result_values == (None, None, None)
            else {
                "reference": result_values[0],
                "sha256": result_values[1],
                "operation_id": result_values[2],
            }
        )
        capture_binding = None
        if link is not None:
            active_digest = str(link["link_digest"])
            capture_binding = {
                "intent_id": link["intent_id"],
                "intent_sha256": link["intent_sha256"],
                "handler_version": int(link["handler_version"]),
                "active_digest": active_digest,
                "seal_digest": None if seal is None else seal["seal_digest"],
            }
        record: dict[str, object] = {
            "schema_version": "queue-task/v3",
            "task_id": str(row["id"]),
            "kind": str(row["kind"]),
            "handler_version": int(row["handler_version"]),
            "payload": validation.payload,
            "input_hash": str(row["input_hash"]),
            "dedupe_key": row["dedupe_key"],
            "state": str(row["state"]),
            "priority": int(row["priority"]),
            "created_at": str(row["created_at"]),
            "updated_at": str(row["updated_at"]),
            "available_at": str(row["available_at"]),
            "attempts": int(row["attempts"]),
            "last_attempt_at": row["last_attempt_at"],
            "lease": lease,
            "error_code": row["error_code"],
            "blocked_capability": row["blocked_capability"],
            "result": result,
            "redrive_of": row["redrive_of"],
            "lineage_generation": int(row["lineage_generation"]),
            "attempt_history": [
                {
                    "attempt": int(item["attempt"]),
                    "started_at": str(item["started_at"]),
                    "finished_at": str(item["finished_at"]),
                    "outcome": str(item["outcome"]),
                    "error_code": item["error_code"],
                }
                for item in history
            ],
            "source_links": [
                {
                    "logical_path": str(item["logical_path"]),
                    "source_digest": str(item["source_digest"]),
                }
                for item in source_links
            ],
            "capture_binding": capture_binding,
        }
        validate_schema(
            record, Path(__file__).with_name("schemas") / "queue-task-v3.json"
        )
        if len(canonical_json_bytes(record)) > _MAX_EXPORT_METADATA_BYTES:
            raise QueueOperationError("export_metadata_too_large")
        return record

    def purge(
        self,
        *,
        terminal_before: datetime,
        export_path: Path,
        deadline: float = float("inf"),
        cancelled: Callable[[], bool] | None = None,
    ) -> PurgeReceipt:
        _require_active(deadline, cancelled)
        plan = self._ordinary_purge_plan(terminal_before, export_path)
        manifest_bytes = self._publish_ordinary_purge_export(
            plan, deadline=deadline, cancelled=cancelled
        )
        capture_evidence = self._commit_ordinary_purge(
            plan,
            manifest_bytes,
            deadline=deadline,
            cancelled=cancelled,
        )
        self._cleanup_ordinary_purge_artifacts(plan, capture_evidence)
        self._publish_ordinary_purge_receipt(plan, manifest_bytes)
        self._clear_ordinary_purge_authorizations(plan, manifest_bytes)
        return PurgeReceipt(len(plan.task_ids), plan.task_ids)

    def _ordinary_purge_plan(
        self, terminal_before: datetime, export_path: Path
    ) -> _OrdinaryPurgePlan:
        retention_cutoff = _utc_now() - timedelta(
            days=DEFAULTS.queue_result_retention_days
        )
        cutoff = _timestamp(min(_as_utc(terminal_before), retention_cutoff))
        export = Path(export_path).absolute()
        if export.is_symlink():
            raise QueueOperationError("export_verification_failed")
        if export.exists():
            return self._load_ordinary_purge_plan(cutoff, export)
        return self._new_ordinary_purge_plan(cutoff, export)

    def _new_ordinary_purge_plan(
        self, cutoff: str, export: Path
    ) -> _OrdinaryPurgePlan:
        with closing(self._connect()) as database:
            database.execute("BEGIN")
            rows = database.execute(
                """SELECT * FROM tasks
                   WHERE state IN ('succeeded','cancelled') AND updated_at<?
                   ORDER BY created_at,id""",
                (cutoff,),
            ).fetchall()
            records = tuple(
                self._export_task_in_transaction(database, row) for row in rows
            )
            capture_evidence = self._ordinary_capture_evidence_for_rows(
                database, rows
            )
        task_ids = tuple(str(row["id"]) for row in rows)
        records_bytes = canonical_json_bytes(list(records))
        if len(records_bytes) > _MAX_EXPORT_METADATA_BYTES:
            raise QueueOperationError("export_metadata_too_large")
        return _OrdinaryPurgePlan(
            cutoff,
            export,
            task_ids,
            records,
            records_bytes,
            capture_evidence,
            None,
        )

    def _ordinary_capture_evidence_for_rows(
        self, database: sqlite3.Connection, rows: list[sqlite3.Row]
    ) -> tuple[_CapturePurgeEvidence, ...]:
        evidence: list[_CapturePurgeEvidence] = []
        for row in rows:
            evidence.extend(
                self._ordinary_capture_purge_evidence(database, str(row["id"]))
            )
        return tuple(evidence)

    def _load_ordinary_purge_plan(
        self, cutoff: str, export: Path
    ) -> _OrdinaryPurgePlan:
        self._require_ordinary_purge_export_directory(export)
        try:
            records_bytes = _read_stable_owner_file(
                export / "records.json", _MAX_EXPORT_METADATA_BYTES
            )
            manifest_bytes = _read_stable_owner_file(
                export / "manifest.json", _MAX_EXPORT_METADATA_BYTES
            )
            records, manifest = self._decode_ordinary_purge_export(
                records_bytes, manifest_bytes
            )
        except QueueOperationError:
            raise
        except (OSError, PermissionError, UnicodeError, ValueError) as exc:
            raise QueueOperationError("export_verification_failed") from exc
        task_ids = tuple(str(record["task_id"]) for record in records)
        self._require_ordinary_purge_manifest(
            manifest,
            cutoff=cutoff,
            task_ids=task_ids,
            records_bytes=records_bytes,
        )
        capture_evidence = self._capture_purge_evidence_from_manifest(
            manifest["capture_artifacts"], records
        )
        plan = _OrdinaryPurgePlan(
            cutoff,
            export,
            task_ids,
            records,
            records_bytes,
            capture_evidence,
            manifest_bytes,
        )
        self._require_existing_ordinary_purge_files(plan, manifest)
        return plan

    @staticmethod
    def _require_ordinary_purge_export_directory(export: Path) -> None:
        metadata = export.lstat()
        reparse = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
        actual = (
            stat.S_ISDIR(metadata.st_mode),
            stat.S_ISLNK(metadata.st_mode),
            bool(getattr(metadata, "st_file_attributes", 0) & reparse),
            _is_owner_only(export),
        )
        if actual != (True, False, False, True):
            raise QueueOperationError("export_verification_failed")

    @staticmethod
    def _decode_ordinary_purge_export(
        records_bytes: bytes, manifest_bytes: bytes
    ) -> tuple[tuple[dict[str, object], ...], dict[str, object]]:
        records_value, manifest = (
            _QueueV3CandidateReader._decode_ordinary_purge_json(
                records_bytes, manifest_bytes
            )
        )
        records = _QueueV3CandidateReader._ordinary_purge_records(
            records_value, records_bytes
        )
        return records, manifest

    @staticmethod
    def _decode_ordinary_purge_json(
        records_bytes: bytes, manifest_bytes: bytes
    ) -> tuple[list[object], dict[str, object]]:
        try:
            records_value = json.loads(records_bytes.decode("utf-8", errors="strict"))
            manifest = json.loads(manifest_bytes.decode("utf-8", errors="strict"))
        except (UnicodeError, json.JSONDecodeError) as exc:
            raise QueueOperationError("export_verification_failed") from exc
        if (isinstance(records_value, list), isinstance(manifest, dict)) != (True, True):
            raise QueueOperationError("export_verification_failed")
        return records_value, manifest

    @staticmethod
    def _ordinary_purge_records(
        records_value: list[object], records_bytes: bytes
    ) -> tuple[dict[str, object], ...]:
        if not all(isinstance(record, dict) for record in records_value):
            raise QueueOperationError("export_verification_failed")
        records = tuple(records_value)
        if canonical_json_bytes(list(records)) != records_bytes:
            raise QueueOperationError("export_verification_failed")
        for record in records:
            validate_schema(
                record, Path(__file__).with_name("schemas") / "queue-task-v3.json"
            )
        return records

    @staticmethod
    def _require_ordinary_purge_manifest(
        manifest: Mapping[str, object],
        *,
        cutoff: str,
        task_ids: tuple[str, ...],
        records_bytes: bytes,
    ) -> None:
        identity = (
            set(manifest),
            manifest.get("cutoff"),
            manifest.get("records_sha256"),
            manifest.get("task_ids"),
        )
        expected = (
            {"capture_artifacts", "cutoff", "records_sha256", "results", "task_ids"},
            cutoff,
            sha256_bytes(records_bytes),
            list(task_ids),
        )
        if identity != expected:
            raise QueueOperationError("export_verification_failed")
        if len(set(task_ids)) != len(task_ids):
            raise QueueOperationError("export_verification_failed")
        if not isinstance(manifest.get("results"), list):
            raise QueueOperationError("export_verification_failed")
        if not isinstance(manifest.get("capture_artifacts"), list):
            raise QueueOperationError("export_verification_failed")

    @staticmethod
    def _capture_purge_manifest_identity(
        value: object,
    ) -> tuple[str, str, str, str, str, str, str]:
        record = _QueueV3CandidateReader._capture_purge_manifest_mapping(value)
        _QueueV3CandidateReader._require_capture_purge_manifest_hashes(record)
        return (
            str(record["task_id"]),
            str(record["intent_id"]),
            str(record["terminal_path"]),
            str(record["kind"]),
            str(record["source_path"]),
            str(record["archive_path"]),
            str(record["sha256"]),
        )

    @staticmethod
    def _capture_purge_manifest_mapping(value: object) -> dict[str, object]:
        fields = {
            "archive_path",
            "intent_id",
            "kind",
            "sha256",
            "source_path",
            "task_id",
            "terminal_path",
        }
        if not isinstance(value, dict):
            raise QueueOperationError("export_verification_failed")
        actual = (set(value), {type(item) for item in value.values()})
        if actual != (fields, {str}):
            raise QueueOperationError("export_verification_failed")
        return value

    @staticmethod
    def _require_capture_purge_manifest_hashes(
        value: Mapping[str, object],
    ) -> None:
        if value["kind"] not in {"intent", "decision"}:
            raise QueueOperationError("export_verification_failed")
        try:
            _require_lower_sha256(str(value["intent_id"]), "intent_id")
            _require_lower_sha256(str(value["sha256"]), "sha256")
        except ValueError as exc:
            raise QueueOperationError("export_verification_failed") from exc

    @staticmethod
    def _capture_purge_manifest_artifact(
        task_id: str,
        source_path: str,
        archive_path: str,
        digest: str,
    ) -> _CapturePurgeArtifact:
        try:
            restricted_relative_path(
                source_path, ("run/capture-intents", "run/queue-results")
            )
            restricted_relative_path(archive_path, ("capture-artifacts",))
        except ValueError as exc:
            raise QueueOperationError("export_verification_failed") from exc
        if archive_path != _capture_purge_archive_path(task_id, source_path):
            raise QueueOperationError("export_verification_failed")
        return _CapturePurgeArtifact(source_path, archive_path, digest)

    def _capture_purge_evidence_from_manifest(
        self,
        value: object,
        records: tuple[dict[str, object], ...],
    ) -> tuple[_CapturePurgeEvidence, ...]:
        if not isinstance(value, list):
            raise QueueOperationError("export_verification_failed")
        grouped: dict[
            tuple[str, str, str], list[tuple[str, _CapturePurgeArtifact]]
        ] = {}
        for item in value:
            task_id, intent_id, terminal, kind, source, archive, digest = (
                self._capture_purge_manifest_identity(item)
            )
            artifact = self._capture_purge_manifest_artifact(
                task_id, source, archive, digest
            )
            grouped.setdefault((task_id, intent_id, terminal), []).append(
                (kind, artifact)
            )
        evidence = tuple(
            self._capture_purge_evidence_group(key, grouped[key])
            for key in sorted(grouped)
        )
        self._require_capture_purge_evidence_records(evidence, records)
        return evidence

    @staticmethod
    def _capture_purge_evidence_group(
        key: tuple[str, str, str],
        items: list[tuple[str, _CapturePurgeArtifact]],
    ) -> _CapturePurgeEvidence:
        intents, decisions = _QueueV3CandidateReader._partition_capture_purge_artifacts(
            items
        )
        _QueueV3CandidateReader._require_unique_capture_purge_paths(items, intents)
        task_id, intent_id, terminal_path = key
        return _CapturePurgeEvidence(
            task_id, intent_id, intents[0], decisions, terminal_path
        )

    @staticmethod
    def _partition_capture_purge_artifacts(
        items: list[tuple[str, _CapturePurgeArtifact]],
    ) -> tuple[tuple[_CapturePurgeArtifact, ...], tuple[_CapturePurgeArtifact, ...]]:
        intents: list[_CapturePurgeArtifact] = []
        decisions: list[_CapturePurgeArtifact] = []
        for kind, artifact in items:
            if kind == "intent":
                intents.append(artifact)
                continue
            decisions.append(artifact)
        return tuple(intents), tuple(decisions)

    @staticmethod
    def _require_unique_capture_purge_paths(
        items: list[tuple[str, _CapturePurgeArtifact]],
        intents: tuple[_CapturePurgeArtifact, ...],
    ) -> None:
        paths = {artifact.source_path for _kind, artifact in items}
        if (len(intents), len(paths)) != (1, len(items)):
            raise QueueOperationError("export_verification_failed")

    @staticmethod
    def _ordinary_purge_record_capture_identity(
        record: Mapping[str, object],
    ) -> tuple[str, str, str, str] | None:
        binding = record.get("capture_binding")
        if binding is None:
            return None
        result = record.get("result")
        if (isinstance(binding, dict), isinstance(result, dict)) != (True, True):
            raise QueueOperationError("export_verification_failed")
        return _QueueV3CandidateReader._ordinary_capture_record_values(
            record, binding, result
        )

    @staticmethod
    def _ordinary_capture_record_values(
        record: Mapping[str, object],
        binding: Mapping[str, object],
        result: Mapping[str, object],
    ) -> tuple[str, str, str, str]:
        task_id = record.get("task_id")
        intent_id = binding.get("intent_id")
        intent_sha256 = binding.get("intent_sha256")
        terminal_path = result.get("reference")
        values = (task_id, intent_id, intent_sha256, terminal_path)
        if tuple(isinstance(item, str) for item in values) != (True,) * len(values):
            raise QueueOperationError("export_verification_failed")
        if terminal_path != f"run/queue-results/capture-{intent_id}.json":
            raise QueueOperationError("export_verification_failed")
        return str(task_id), str(intent_id), str(intent_sha256), str(terminal_path)

    def _require_capture_purge_evidence_records(
        self,
        evidence: tuple[_CapturePurgeEvidence, ...],
        records: tuple[dict[str, object], ...],
    ) -> None:
        expected = self._ordinary_purge_expected_capture_records(records)
        observed = {
            item.task_id: (
                item.intent_id,
                item.intent.sha256,
                item.terminal_path,
            )
            for item in evidence
        }
        if (len(observed), observed) != (len(evidence), expected):
            raise QueueOperationError("export_verification_failed")

    def _ordinary_purge_expected_capture_records(
        self, records: tuple[dict[str, object], ...]
    ) -> dict[str, tuple[str, str, str]]:
        expected: dict[str, tuple[str, str, str]] = {}
        for record in records:
            identity = self._ordinary_purge_record_capture_identity(record)
            if identity is not None:
                task_id, intent_id, intent_sha256, terminal = identity
                expected[task_id] = (intent_id, intent_sha256, terminal)
        return expected

    @staticmethod
    def _ordinary_purge_expected_results(
        records: tuple[dict[str, object], ...],
    ) -> list[dict[str, str]]:
        return [
            {"id": str(record["task_id"]), "sha256": str(record["result"]["sha256"])}
            for record in records
            if isinstance(record.get("result"), dict)
        ]

    @staticmethod
    def _capture_purge_artifacts(
        evidence: tuple[_CapturePurgeEvidence, ...],
    ) -> tuple[_CapturePurgeArtifact, ...]:
        return tuple(
            artifact
            for item in evidence
            for artifact in (item.intent, *item.decisions)
        )

    def _require_existing_ordinary_purge_files(
        self, plan: _OrdinaryPurgePlan, manifest: Mapping[str, object]
    ) -> None:
        expected_results = self._ordinary_purge_expected_results(plan.records)
        if manifest["results"] != expected_results:
            raise QueueOperationError("export_verification_failed")
        self._require_existing_ordinary_result_files(plan.export, expected_results)
        self._require_existing_capture_purge_files(plan)

    @staticmethod
    def _require_existing_ordinary_result_files(
        export: Path, expected_results: list[dict[str, str]]
    ) -> None:
        for item in expected_results:
            relative = _ordinary_purge_result_archive_path(item["id"])
            data = _read_stable_owner_file(export / relative, _MAX_RESULT_BYTES)
            if sha256_bytes(data) != item["sha256"]:
                raise QueueOperationError("export_verification_failed")

    def _require_existing_capture_purge_files(
        self, plan: _OrdinaryPurgePlan
    ) -> None:
        for artifact in self._capture_purge_artifacts(plan.capture_evidence):
            data = _read_stable_owner_file(
                plan.export / artifact.archive_path, _MAX_QUEUE_PAYLOAD_BYTES
            )
            if sha256_bytes(data) != artifact.sha256:
                raise QueueOperationError("export_verification_failed")

    def _publish_ordinary_purge_export(
        self,
        plan: _OrdinaryPurgePlan,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> bytes:
        if plan.manifest_bytes is not None:
            return self._existing_ordinary_purge_manifest(plan)
        return self._publish_new_ordinary_purge_export(
            plan, deadline=deadline, cancelled=cancelled
        )

    @staticmethod
    def _existing_ordinary_purge_manifest(plan: _OrdinaryPurgePlan) -> bytes:
        current = _read_stable_owner_file(
            plan.export / "manifest.json", _MAX_EXPORT_METADATA_BYTES
        )
        if current != plan.manifest_bytes:
            raise QueueOperationError("export_verification_failed")
        return current

    def _publish_new_ordinary_purge_export(
        self,
        plan: _OrdinaryPurgePlan,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> bytes:
        parent = plan.export.parent
        parent.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(parent, 0o700)
        actual = (parent.is_symlink(), parent.is_dir(), _is_owner_only(parent))
        if actual != (False, True, True):
            raise QueueOperationError("export_parent_permissions_invalid")
        _cleanup_export_staging(parent, plan.export.name)
        staging = parent / f".{plan.export.name}.staging-{uuid.uuid4().hex}"
        staging.mkdir()
        _harden_owner_only(staging, 0o700)
        try:
            manifest_bytes = self._write_ordinary_purge_export(
                plan, staging, deadline=deadline, cancelled=cancelled
            )
            _require_active(deadline, cancelled)
            staging.replace(plan.export)
            fsync_directory(parent)
            return manifest_bytes
        except BaseException:
            _remove_export_staging(staging)
            raise

    def _write_ordinary_purge_export(
        self,
        plan: _OrdinaryPurgePlan,
        staging: Path,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> bytes:
        results_export = staging / "results"
        results_export.mkdir()
        _harden_owner_only(results_export, 0o700)
        results = self._ordinary_purge_result_manifest(
            plan.records,
            results_export,
            deadline=deadline,
            cancelled=cancelled,
        )
        capture_artifacts = self._ordinary_purge_capture_manifest(
            plan,
            staging,
            deadline=deadline,
            cancelled=cancelled,
        )
        manifest_bytes = canonical_json_bytes(
            {
                "capture_artifacts": capture_artifacts,
                "cutoff": plan.cutoff,
                "records_sha256": sha256_bytes(plan.records_bytes),
                "results": results,
                "task_ids": list(plan.task_ids),
            }
        )
        records_path = staging / "records.json"
        manifest_path = staging / "manifest.json"
        _write_durable_file(records_path, plan.records_bytes)
        _write_durable_file(manifest_path, manifest_bytes)
        self._require_ordinary_purge_export(
            records_path, plan.records_bytes, manifest_path, manifest_bytes
        )
        fsync_directory(results_export)
        fsync_directory(staging)
        return manifest_bytes

    def _ordinary_purge_capture_manifest(
        self,
        plan: _OrdinaryPurgePlan,
        staging: Path,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> list[dict[str, str]]:
        manifest: list[dict[str, str]] = []
        for evidence in plan.capture_evidence:
            _require_active(deadline, cancelled)
            manifest.append(
                self._publish_capture_purge_artifact(
                    staging, evidence, evidence.intent, kind="intent"
                )
            )
            for decision in evidence.decisions:
                manifest.append(
                    self._publish_capture_purge_artifact(
                        staging, evidence, decision, kind="decision"
                    )
                )
        capture_dir = staging / "capture-artifacts"
        if capture_dir.exists():
            fsync_directory(capture_dir)
        return manifest

    def _publish_capture_purge_artifact(
        self,
        staging: Path,
        evidence: _CapturePurgeEvidence,
        artifact: _CapturePurgeArtifact,
        *,
        kind: Literal["intent", "decision"],
    ) -> dict[str, str]:
        data = read_runtime_bytes(
            self.state_root / artifact.source_path,
            self.state_root,
            max_bytes=_MAX_QUEUE_PAYLOAD_BYTES,
            owner_only=True,
        )
        if sha256_bytes(data) != artifact.sha256:
            raise QueueOperationError("capture_purge_changed")
        target = staging / artifact.archive_path
        target.parent.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(target.parent, 0o700)
        _write_durable_file(target, data)
        return {
            "archive_path": artifact.archive_path,
            "intent_id": evidence.intent_id,
            "kind": kind,
            "sha256": artifact.sha256,
            "source_path": artifact.source_path,
            "task_id": evidence.task_id,
            "terminal_path": evidence.terminal_path,
        }

    def _ordinary_purge_result_manifest(
        self,
        records: tuple[dict[str, object], ...],
        results_export: Path,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> list[dict[str, str]]:
        result_manifest: list[dict[str, str]] = []
        for record in records:
            _require_active(deadline, cancelled)
            result = record["result"]
            if not isinstance(result, dict):
                continue
            reference = str(result["reference"])
            digest = str(result["sha256"])
            data = _read_stable_owner_file(
                self.state_root / reference, _MAX_RESULT_BYTES
            )
            if sha256_bytes(data) != digest:
                raise QueueOperationError("result_verification_failed")
            archive = _ordinary_purge_result_archive_path(str(record["task_id"]))
            _write_durable_file(results_export.parent / archive, data)
            result_manifest.append({"id": str(record["task_id"]), "sha256": digest})
        return result_manifest

    @staticmethod
    def _require_ordinary_purge_export(
        records_path: Path,
        records_bytes: bytes,
        manifest_path: Path,
        manifest_bytes: bytes,
    ) -> None:
        actual = (
            _read_stable_owner_file(records_path, _MAX_EXPORT_METADATA_BYTES),
            _read_stable_owner_file(manifest_path, _MAX_EXPORT_METADATA_BYTES),
        )
        if actual != (records_bytes, manifest_bytes):
            raise QueueOperationError("export_verification_failed")

    def _commit_ordinary_purge(
        self,
        plan: _OrdinaryPurgePlan,
        manifest_bytes: bytes,
        *,
        deadline: float,
        cancelled: Callable[[], bool] | None,
    ) -> tuple[_CapturePurgeEvidence, ...]:
        if not plan.task_ids:
            return ()
        manifest_sha256 = sha256_bytes(manifest_bytes)
        operation_id = _ordinary_purge_operation_id(manifest_sha256)
        receipt_published = self._ordinary_purge_receipt_matches(
            plan, manifest_bytes
        )
        expected = {item.task_id: item for item in plan.capture_evidence}
        with closing(self._connect()) as database, begin_immediate(
            database,
            before_commit=lambda: _require_active(deadline, cancelled),
        ):
            state = self._ordinary_purge_commit_state(
                database,
                plan,
                operation_id=operation_id,
                manifest_sha256=manifest_sha256,
                receipt_published=receipt_published,
            )
            if state == "pending":
                for task_id, expected_record in zip(plan.task_ids, plan.records):
                    _require_active(deadline, cancelled)
                    self._purge_ordinary_task(
                        database,
                        task_id,
                        expected_record,
                        expected_capture=expected.get(task_id),
                        cutoff=plan.cutoff,
                        operation_id=operation_id,
                        manifest_sha256=manifest_sha256,
                    )
        return plan.capture_evidence

    def _ordinary_purge_commit_state(
        self,
        database: sqlite3.Connection,
        plan: _OrdinaryPurgePlan,
        *,
        operation_id: str,
        manifest_sha256: str,
        receipt_published: bool,
    ) -> str:
        placeholders = ",".join("?" for _ in plan.task_ids)
        present = database.execute(
            f"SELECT id FROM tasks WHERE id IN ({placeholders})",  # noqa: S608
            plan.task_ids,
        ).fetchall()
        authorizations = database.execute(
            f"""SELECT * FROM task_purge_authorizations
                WHERE task_id IN ({placeholders}) ORDER BY task_id""",  # noqa: S608
            plan.task_ids,
        ).fetchall()
        counts = (len(present), len(authorizations))
        if counts == (len(plan.task_ids), 0):
            return "pending"
        if counts == (0, len(plan.task_ids)):
            self._require_ordinary_purge_authorizations(
                authorizations, plan.task_ids, operation_id, manifest_sha256
            )
            return "cleanup"
        if (counts, receipt_published) == ((0, 0), True):
            return "complete"
        raise QueueOperationError("purge_resume_conflict")

    @staticmethod
    def _require_ordinary_purge_authorizations(
        rows: list[sqlite3.Row],
        task_ids: tuple[str, ...],
        operation_id: str,
        manifest_sha256: str,
    ) -> None:
        expected = sorted(
            (
                task_id,
                "ordinary",
                operation_id,
                _ordinary_purge_authorization_digest(
                    task_id, operation_id, manifest_sha256
                ),
            )
            for task_id in task_ids
        )
        actual = sorted(
            (
                str(row["task_id"]),
                str(row["mode"]),
                str(row["operation_id"]),
                str(row["authorization_digest"]),
            )
            for row in rows
        )
        if actual != expected:
            raise QueueOperationError("purge_authorization_failed")

    def _purge_ordinary_task(
        self,
        database: sqlite3.Connection,
        task_id: str,
        expected_record: Mapping[str, object],
        *,
        expected_capture: _CapturePurgeEvidence | None,
        cutoff: str,
        operation_id: str,
        manifest_sha256: str,
    ) -> None:
        row = database.execute(
            "SELECT * FROM tasks WHERE id=?", (task_id,)
        ).fetchone()
        self._require_ordinary_purge_task(row, cutoff)
        self._require_ordinary_purge_payload(database, row)
        self._require_ordinary_purge_record(database, row, expected_record)
        evidence = self._ordinary_capture_purge_evidence(database, task_id)
        expected_evidence = () if expected_capture is None else (expected_capture,)
        if evidence != expected_evidence:
            raise QueueOperationError("capture_purge_changed")
        self._insert_ordinary_purge_authorization(
            database, task_id, operation_id, manifest_sha256
        )
        self._delete_capture_purge_rows_before_task(database, evidence)
        self._delete_task_owned_evidence(database, task_id)
        self._delete_ordinary_task(database, task_id)
        self._delete_capture_purge_rows_after_task(database, evidence)

    @staticmethod
    def _require_ordinary_purge_task(row: sqlite3.Row | None, cutoff: str) -> None:
        if (
            row is None
            or row["state"] not in {"succeeded", "cancelled"}
            or row["updated_at"] >= cutoff
        ):
            raise QueueOperationError("purge_selection_changed")

    def _require_ordinary_purge_payload(
        self, database: sqlite3.Connection, row: sqlite3.Row
    ) -> None:
        validation = validate_payload_blob(
            bytes(row["payload_blob"]), row["input_hash"], parse=True
        )
        if validation.code is not None:
            self._demote_payload_mismatch(database, row, now=_utc_now())
            raise QueueOperationError("payload_hash_mismatch")

    def _require_ordinary_purge_record(
        self,
        database: sqlite3.Connection,
        row: sqlite3.Row,
        expected_record: Mapping[str, object],
    ) -> None:
        current = self._export_task_in_transaction(database, row)
        if canonical_json_bytes(current) != canonical_json_bytes(expected_record):
            raise QueueOperationError("purge_selection_changed")

    def _ordinary_capture_purge_evidence(
        self, database: sqlite3.Connection, task_id: str
    ) -> tuple[_CapturePurgeEvidence, ...]:
        link = database.execute(
            "SELECT 1 FROM capture_task_links WHERE task_id=?", (task_id,)
        ).fetchone()
        if link is None:
            return ()
        binding = self.active_capture_binding(database, task_id)
        return (self._capture_purge_evidence(database, task_id, binding),)

    @staticmethod
    def _insert_ordinary_purge_authorization(
        database: sqlite3.Connection,
        task_id: str,
        operation_id: str,
        manifest_sha256: str,
    ) -> None:
        authorization_digest = _ordinary_purge_authorization_digest(
            task_id, operation_id, manifest_sha256
        )
        inserted = database.execute(
            """INSERT INTO task_purge_authorizations(
                   task_id,mode,operation_id,authorization_digest,created_at
               ) VALUES (?,'ordinary',?,?,?)""",
            (task_id, operation_id, authorization_digest, _timestamp(_utc_now())),
        ).rowcount
        if inserted != 1:
            raise QueueOperationError("purge_authorization_failed")

    @staticmethod
    def _delete_capture_purge_rows_before_task(
        database: sqlite3.Connection,
        evidence: tuple[_CapturePurgeEvidence, ...],
    ) -> None:
        for item in evidence:
            deleted = database.execute(
                "DELETE FROM semantic_decisions WHERE intent_id=?", (item.intent_id,)
            ).rowcount
            if deleted != len(item.decisions):
                raise QueueOperationError("capture_purge_changed")

    @staticmethod
    def _delete_ordinary_task(
        database: sqlite3.Connection, task_id: str
    ) -> None:
        deleted = database.execute(
            "DELETE FROM tasks WHERE id=?", (task_id,)
        ).rowcount
        if deleted != 1:
            raise QueueOperationError("purge_delete_failed")

    @staticmethod
    def _delete_capture_purge_rows_after_task(
        database: sqlite3.Connection,
        evidence: tuple[_CapturePurgeEvidence, ...],
    ) -> None:
        for item in evidence:
            deleted = database.execute(
                "DELETE FROM capture_intents WHERE intent_id=?", (item.intent_id,)
            ).rowcount
            if deleted != 1:
                raise QueueOperationError("capture_purge_changed")

    def _cleanup_ordinary_purge_artifacts(
        self,
        plan: _OrdinaryPurgePlan,
        evidence: tuple[_CapturePurgeEvidence, ...],
    ) -> None:
        retained_terminals = {item.terminal_path for item in evidence}
        for item in evidence:
            self._unlink_capture_purge_artifacts(plan.export, item)
        for record in plan.records:
            self._cleanup_ordinary_result(record, retained_terminals)

    def _cleanup_ordinary_result(
        self, record: Mapping[str, object], retained_terminals: set[str]
    ) -> None:
        result = record["result"]
        if not isinstance(result, dict):
            return
        reference = str(result["reference"])
        if reference in retained_terminals:
            return
        with closing(self._connect()) as database:
            retained = database.execute(
                "SELECT 1 FROM tasks WHERE result_reference=? LIMIT 1", (reference,)
            ).fetchone()
        if retained is None:
            (self.state_root / reference).unlink(missing_ok=True)

    def _unlink_capture_purge_artifacts(
        self, export: Path, evidence: _CapturePurgeEvidence
    ) -> None:
        for artifact in (evidence.intent, *evidence.decisions):
            self._unlink_capture_purge_artifact(export, evidence.task_id, artifact)

    def _unlink_capture_purge_artifact(
        self,
        export: Path,
        task_id: str,
        artifact: _CapturePurgeArtifact,
    ) -> None:
        self._capture_purge_manifest_artifact(
            task_id, artifact.source_path, artifact.archive_path, artifact.sha256
        )
        archived = _read_stable_owner_file(
            export / artifact.archive_path, _MAX_QUEUE_PAYLOAD_BYTES
        )
        if sha256_bytes(archived) != artifact.sha256:
            raise QueueOperationError("export_verification_failed")
        source = self.state_root / artifact.source_path
        try:
            before = source.lstat()
        except FileNotFoundError:
            return
        current = read_runtime_bytes(
            source,
            self.state_root,
            max_bytes=_MAX_QUEUE_PAYLOAD_BYTES,
            owner_only=True,
        )
        if sha256_bytes(current) != artifact.sha256:
            raise QueueOperationError("capture_purge_changed")
        if not os.path.samestat(before, source.lstat()):
            raise QueueOperationError("capture_purge_changed")
        source.unlink()
        fsync_directory(source.parent)

    @staticmethod
    def _ordinary_purge_receipt_bytes(
        plan: _OrdinaryPurgePlan, manifest_bytes: bytes
    ) -> bytes:
        manifest_sha256 = sha256_bytes(manifest_bytes)
        return canonical_json_bytes(
            {
                "schema_version": "ordinary-purge-receipt/v1",
                "operation_id": _ordinary_purge_operation_id(manifest_sha256),
                "manifest_sha256": manifest_sha256,
                "task_ids": list(plan.task_ids),
            }
        )

    def _ordinary_purge_receipt_matches(
        self, plan: _OrdinaryPurgePlan, manifest_bytes: bytes
    ) -> bool:
        path = plan.export / "purge-receipt.json"
        try:
            current = _read_stable_owner_file(path, 64 * 1024)
        except FileNotFoundError:
            return False
        if current != self._ordinary_purge_receipt_bytes(plan, manifest_bytes):
            raise QueueOperationError("purge_receipt_invalid")
        return True

    def _publish_ordinary_purge_receipt(
        self, plan: _OrdinaryPurgePlan, manifest_bytes: bytes
    ) -> None:
        receipt_bytes = self._ordinary_purge_receipt_bytes(plan, manifest_bytes)
        _write_durable_file(plan.export / "purge-receipt.json", receipt_bytes)
        if not self._ordinary_purge_receipt_matches(plan, manifest_bytes):
            raise QueueOperationError("purge_receipt_invalid")

    def _clear_ordinary_purge_authorizations(
        self, plan: _OrdinaryPurgePlan, manifest_bytes: bytes
    ) -> None:
        if not plan.task_ids:
            return
        manifest_sha256 = sha256_bytes(manifest_bytes)
        operation_id = _ordinary_purge_operation_id(manifest_sha256)
        placeholders = ",".join("?" for _ in plan.task_ids)
        with closing(self._connect()) as database, begin_immediate(database):
            rows = database.execute(
                f"""SELECT * FROM task_purge_authorizations
                    WHERE task_id IN ({placeholders}) ORDER BY task_id""",  # noqa: S608
                plan.task_ids,
            ).fetchall()
            if not rows:
                return
            self._require_ordinary_purge_authorizations(
                rows, plan.task_ids, operation_id, manifest_sha256
            )
            deleted = database.execute(
                f"""DELETE FROM task_purge_authorizations
                    WHERE task_id IN ({placeholders})""",  # noqa: S608
                plan.task_ids,
            ).rowcount
            if deleted != len(plan.task_ids):
                raise QueueOperationError("purge_authorization_failed")

    def _export_task_in_transaction(
        self, database: sqlite3.Connection, row: sqlite3.Row
    ) -> dict[str, object]:
        task_id = str(row["id"])
        validation = validate_payload_blob(
            bytes(row["payload_blob"]), row["input_hash"], parse=True
        )
        if validation.code is not None:
            raise QueueOperationError("payload_hash_mismatch")
        history = database.execute(
            """SELECT attempt,started_at,finished_at,outcome,error_code
               FROM attempt_history WHERE task_id=? ORDER BY sequence""",
            (task_id,),
        ).fetchall()
        sources = database.execute(
            """SELECT logical_path,source_digest FROM task_source_links
               WHERE task_id=? ORDER BY logical_path,source_digest""",
            (task_id,),
        ).fetchall()
        link = database.execute(
            "SELECT * FROM capture_task_links WHERE task_id=?", (task_id,)
        ).fetchone()
        seal = database.execute(
            "SELECT * FROM capture_task_link_seals WHERE task_id=?", (task_id,)
        ).fetchone()
        lease = None
        if row["lease_owner"] is not None:
            lease = {
                "owner": row["lease_owner"],
                "token": row["lease_token"],
                "expires_at": row["lease_expires_at"],
                "heartbeat_at": row["lease_heartbeat_at"],
            }
        result = None
        if row["result_reference"] is not None:
            result = {
                "reference": row["result_reference"],
                "sha256": row["result_sha256"],
                "operation_id": row["result_operation_id"],
            }
        capture_binding = None
        if link is not None:
            capture_binding = {
                "intent_id": link["intent_id"],
                "intent_sha256": link["intent_sha256"],
                "handler_version": int(link["handler_version"]),
                "active_digest": str(link["link_digest"]),
                "seal_digest": None if seal is None else seal["seal_digest"],
            }
        record: dict[str, object] = {
            "schema_version": "queue-task/v3",
            "task_id": task_id,
            "kind": str(row["kind"]),
            "handler_version": int(row["handler_version"]),
            "payload": validation.payload,
            "input_hash": str(row["input_hash"]),
            "dedupe_key": row["dedupe_key"],
            "state": str(row["state"]),
            "priority": int(row["priority"]),
            "created_at": str(row["created_at"]),
            "updated_at": str(row["updated_at"]),
            "available_at": str(row["available_at"]),
            "attempts": int(row["attempts"]),
            "last_attempt_at": row["last_attempt_at"],
            "lease": lease,
            "error_code": row["error_code"],
            "blocked_capability": row["blocked_capability"],
            "result": result,
            "redrive_of": row["redrive_of"],
            "lineage_generation": int(row["lineage_generation"]),
            "attempt_history": [
                {
                    "attempt": int(item["attempt"]),
                    "started_at": str(item["started_at"]),
                    "finished_at": str(item["finished_at"]),
                    "outcome": str(item["outcome"]),
                    "error_code": item["error_code"],
                }
                for item in history
            ],
            "source_links": [
                {
                    "logical_path": str(item["logical_path"]),
                    "source_digest": str(item["source_digest"]),
                }
                for item in sources
            ],
            "capture_binding": capture_binding,
        }
        validate_schema(
            record, Path(__file__).with_name("schemas") / "queue-task-v3.json"
        )
        return record


@contextmanager
def capture_task_fences(
    queue: _QueueV3CandidateReader,
    coordinator: object,
    task_id: str,
    *,
    intent_id: str | None,
    mode: Literal["worker", "queue-operator"],
    owner: OwnerLease,
) -> Iterator[tuple[TaskFence, object | None]]:
    task_fence = queue.acquire_task_fence(task_id, mode=mode, owner=owner)
    intent_fence = None
    try:
        if intent_id is not None:
            intent_mode = "worker" if mode == "worker" else "operator"
            intent_fence = coordinator.acquire_intent_fence(
                intent_id, mode=intent_mode, owner=owner
            )
        yield task_fence, intent_fence
    finally:
        if intent_fence is not None:
            coordinator.release_intent_fence(intent_fence)
        queue.release_task_fence(task_fence)


def _state_root() -> Path:
    env = os.environ.get("LLM_WIKI_STATE_ROOT")
    if env:
        return Path(env)
    try:
        from memory_state import STATE_ROOT

        return Path(STATE_ROOT)
    except Exception:  # noqa: BLE001
        return Path(os.environ.get("LLM_WIKI_ROOT", Path(__file__).resolve().parent.parent))


def _pid_is_alive(pid: int) -> bool:
    try:
        from memory_state import _is_pid_alive

        return _is_pid_alive(pid)
    except Exception:  # noqa: BLE001 - inability to prove death is treated as live
        return True


def _migration_paths(state_root: Path) -> tuple[Path, Path, Path, Path]:
    run_dir = Path(state_root).resolve() / "run"
    return (
        run_dir,
        run_dir / "queue",
        run_dir / "queue.sqlite3",
        run_dir / "queue-migrated-v2",
    )


def _path_present(path: Path) -> bool:
    return path.exists() or path.is_symlink()


def _legacy_write_allowed(state_root: Path) -> bool:
    _run_dir, legacy_dir, _db_path, marker = _migration_paths(state_root)
    if _path_present(marker):
        _validate_migration_marker(marker)
        if legacy_dir.exists():
            _post_marker_legacy_conflict(state_root)
        raise LegacyBackendDisabled("legacy_backend_disabled")
    if _queue_owner_is_active(state_root, "migration"):
        raise LegacyBackendDisabled("legacy_migration_quiesced")
    return True


def _open_queue_ownership_db(state_root: Path) -> sqlite3.Connection:
    run_dir, _legacy_dir, db_path, _marker = _migration_paths(state_root)
    run_dir.mkdir(parents=True, exist_ok=True)
    _harden_owner_only(run_dir, 0o700)
    connection = open_operational_db(db_path, busy_ms=DEFAULTS.queue_busy_ms)
    try:
        _harden_owner_only(db_path, 0o600)
        connection.execute(
            """CREATE TABLE IF NOT EXISTS queue_ownership (
                   role TEXT PRIMARY KEY,
                   token TEXT,
                   pid INTEGER,
                   heartbeat_at TEXT,
                   expires_at TEXT,
                   epoch INTEGER NOT NULL CHECK (epoch >= 0)
               )"""
        )
        connection.commit()
    except Exception:
        connection.close()
        raise
    return connection


def _acquire_queue_owner(
    state_root: Path,
    role: str,
    busy_code: str,
    *,
    now: datetime | None = None,
    ttl_seconds: int = DEFAULTS.queue_lease_seconds,
) -> QueueOwnerLease:
    if not role or ttl_seconds <= 0:
        raise ValueError("owner role and ttl must be valid")
    acquired_at = _as_utc(now or _utc_now())
    token = uuid.uuid4().hex
    pid = os.getpid()
    expires_at = acquired_at + timedelta(seconds=ttl_seconds)
    with _open_queue_ownership_db(state_root) as connection, begin_immediate(connection):
        row = connection.execute(
            "SELECT * FROM queue_ownership WHERE role=?", (role,)
        ).fetchone()
        epoch = 1
        if row is not None:
            epoch = int(row["epoch"]) + 1
            existing_token = row["token"]
            if existing_token is not None:
                existing_pid = row["pid"]
                dead = not isinstance(existing_pid, int) or not _pid_is_alive(existing_pid)
                if not dead:
                    raise MigrationBusy(busy_code)
            connection.execute(
                """UPDATE queue_ownership
                   SET token=?, pid=?, heartbeat_at=?, expires_at=?, epoch=?
                   WHERE role=?""",
                (
                    token,
                    pid,
                    _timestamp(acquired_at),
                    _timestamp(expires_at),
                    epoch,
                    role,
                ),
            )
        else:
            connection.execute(
                """INSERT INTO queue_ownership(
                       role, token, pid, heartbeat_at, expires_at, epoch
                   ) VALUES (?, ?, ?, ?, ?, ?)""",
                (
                    role,
                    token,
                    pid,
                    _timestamp(acquired_at),
                    _timestamp(expires_at),
                    epoch,
                ),
            )
    return QueueOwnerLease(
        Path(state_root).resolve(), role, token, pid, epoch, expires_at, ttl_seconds
    )


def _require_queue_owner(
    connection: sqlite3.Connection,
    lease: QueueOwnerLease,
    now: datetime,
    *,
    heartbeat: bool,
) -> datetime:
    row = connection.execute(
        "SELECT * FROM queue_ownership WHERE role=?", (lease.role,)
    ).fetchone()
    expiry = _parse_timestamp(row["expires_at"]) if row is not None else None
    if (
        row is None
        or row["token"] != lease.token
        or int(row["epoch"]) != lease.epoch
        or expiry is None
        or row["pid"] != lease.pid
        or not _pid_is_alive(lease.pid)
    ):
        code = "migration_fence_lost" if lease.role == "migration" else "legacy_owner_fence_lost"
        raise QueueOperationError(code)
    if heartbeat:
        expiry = now + timedelta(seconds=lease.ttl_seconds)
        connection.execute(
            """UPDATE queue_ownership SET heartbeat_at=?, expires_at=?
               WHERE role=? AND token=? AND epoch=?""",
            (
                _timestamp(now),
                _timestamp(expiry),
                lease.role,
                lease.token,
                lease.epoch,
            ),
        )
    return expiry


def _heartbeat_queue_owner(
    lease: QueueOwnerLease, *, now: datetime | None = None
) -> QueueOwnerLease:
    heartbeat_at = _as_utc(now or _utc_now())
    with _open_queue_ownership_db(lease.state_root) as connection, begin_immediate(connection):
        expires_at = _require_queue_owner(
            connection, lease, heartbeat_at, heartbeat=True
        )
    return replace(lease, expires_at=expires_at)


def _release_queue_owner(lease: QueueOwnerLease) -> bool:
    with _open_queue_ownership_db(lease.state_root) as connection, begin_immediate(connection):
        changed = connection.execute(
            """UPDATE queue_ownership
               SET token=NULL, pid=NULL, heartbeat_at=NULL, expires_at=NULL
               WHERE role=? AND token=? AND epoch=?""",
            (lease.role, lease.token, lease.epoch),
        ).rowcount
    return changed == 1


def _queue_owner_is_active(state_root: Path, role: str) -> bool:
    with _open_queue_ownership_db(state_root) as connection:
        row = connection.execute(
            "SELECT token, pid, expires_at FROM queue_ownership WHERE role=?", (role,)
        ).fetchone()
    if row is None or row["token"] is None:
        return False
    return (
        isinstance(row["pid"], int)
        and _pid_is_alive(row["pid"])
    )


def _validate_migration_marker(marker: Path) -> None:
    expected = canonical_json_bytes({"version": 2})
    try:
        metadata = marker.lstat()
        if (
            marker.is_symlink()
            or not stat.S_ISREG(metadata.st_mode)
            or metadata.st_size > _MAX_MARKER_BYTES
            or not _is_owner_only(marker)
        ):
            raise QueueOperationError("migration_marker_invalid")
        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
        descriptor = os.open(marker, flags)
        try:
            opened = os.fstat(descriptor)
            if (metadata.st_dev, metadata.st_ino) != (opened.st_dev, opened.st_ino):
                raise QueueOperationError("migration_marker_invalid")
            with os.fdopen(descriptor, "rb", closefd=False) as handle:
                raw = handle.read(_MAX_MARKER_BYTES + 1)
            after = os.fstat(descriptor)
            if (
                opened.st_dev,
                opened.st_ino,
                opened.st_size,
                opened.st_mtime_ns,
            ) != (
                after.st_dev,
                after.st_ino,
                after.st_size,
                after.st_mtime_ns,
            ):
                raise QueueOperationError("migration_marker_invalid")
        finally:
            os.close(descriptor)
        if raw != expected:
            raise QueueOperationError("migration_marker_invalid")
    except QueueOperationError:
        raise
    except (OSError, ValueError):
        raise QueueOperationError("migration_marker_invalid") from None


def _read_bounded_regular_nofollow(path: Path) -> bytes:
    metadata = path.lstat()
    if not stat.S_ISREG(metadata.st_mode) or path.is_symlink():
        raise QueueOperationError("legacy_source_unsafe")
    if metadata.st_size > _MAX_LEGACY_RECORD_BYTES:
        raise QueueOperationError("legacy_record_too_large")
    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
    descriptor = os.open(path, flags)
    try:
        opened = os.fstat(descriptor)
        if not stat.S_ISREG(opened.st_mode) or opened.st_size > _MAX_LEGACY_RECORD_BYTES:
            raise QueueOperationError("legacy_source_unsafe")
        if (metadata.st_dev, metadata.st_ino) != (opened.st_dev, opened.st_ino):
            raise QueueOperationError("legacy_source_changed")
        with os.fdopen(descriptor, "rb", closefd=False) as handle:
            raw = handle.read(_MAX_LEGACY_RECORD_BYTES + 1)
        if len(raw) > _MAX_LEGACY_RECORD_BYTES:
            raise QueueOperationError("legacy_record_too_large")
        after = os.fstat(descriptor)
        if (
            opened.st_dev,
            opened.st_ino,
            opened.st_size,
            opened.st_mtime_ns,
        ) != (
            after.st_dev,
            after.st_ino,
            after.st_size,
            after.st_mtime_ns,
        ):
            raise QueueOperationError("legacy_source_changed")
        return raw
    finally:
        os.close(descriptor)


def _prove_no_live_processing(legacy_dir: Path) -> None:
    if not legacy_dir.exists():
        return
    for path in legacy_dir.glob("*.processing"):
        raw = _read_bounded_regular_nofollow(path)
        try:
            record = json.loads(raw)
        except (UnicodeDecodeError, json.JSONDecodeError):
            raise MigrationBusy("legacy_owner_unverifiable") from None
        pid = record.get("lease_pid") if isinstance(record, dict) else None
        if not isinstance(pid, int) or pid <= 0:
            raise MigrationBusy("legacy_owner_unverifiable")
        if _pid_is_alive(pid):
            raise MigrationBusy("legacy_owner_live")


def _scan_legacy_records(
    legacy_dir: Path,
) -> tuple[list[tuple[Path, dict[str, object]]], list[tuple[Path, bytes]]]:
    valid: list[tuple[Path, dict[str, object]]] = []
    malformed: list[tuple[Path, bytes]] = []
    if not legacy_dir.exists():
        return valid, malformed
    paths = sorted((*legacy_dir.glob("*.json"), *legacy_dir.glob("*.processing")))
    for path in paths:
        try:
            raw = _read_bounded_regular_nofollow(path)
            record = json.loads(raw)
        except (UnicodeDecodeError, json.JSONDecodeError):
            malformed.append((path, raw))
            continue
        if path.suffix == ".processing":
            pid = record.get("lease_pid") if isinstance(record, dict) else None
            if isinstance(pid, int) and pid > 0 and _pid_is_alive(pid):
                raise MigrationBusy("legacy_owner_live")
        if not _valid_legacy_record(record):
            malformed.append((path, raw))
            continue
        valid.append((path, record))
    return valid, malformed


def _valid_legacy_record(record: object) -> bool:
    if not isinstance(record, dict):
        return False
    return (
        isinstance(record.get("id"), str)
        and bool(record["id"])
        and re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}", record["id"])
        is not None
        and isinstance(record.get("type"), str)
        and bool(record["type"])
        and isinstance(record.get("payload"), dict)
        and isinstance(record.get("attempts", 0), int)
        and not isinstance(record.get("attempts", 0), bool)
        and int(record.get("attempts", 0)) >= 0
        and _safe_legacy_timestamp(record.get("enqueued_at")) is not None
    )


def _safe_legacy_timestamp(value: object) -> datetime | None:
    if not isinstance(value, str):
        return None
    try:
        return _as_utc(datetime.fromisoformat(value))
    except ValueError:
        return None


def _import_legacy_record(queue: MemoryQueue, record: dict[str, object], source: Path) -> str:
    created = _safe_legacy_timestamp(record["enqueued_at"])
    if created is None:
        raise QueueOperationError("legacy_invalid")
    last_attempt = _safe_legacy_timestamp(record.get("last_attempt_at"))
    if source.suffix == ".processing":
        last_attempt = _safe_legacy_timestamp(record.get("lease_acquired_at")) or last_attempt
    attempts = int(record.get("attempts", 0))
    payload = _redact_payload(dict(record["payload"]))
    payload_bytes = canonical_json_bytes(payload)
    state = "dead" if attempts >= DEFAULTS.queue_max_attempts else "ready"
    updated = last_attempt or created
    expected = (
        str(record["type"]),
        payload_bytes.decode("utf-8"),
        sha256_bytes(payload_bytes),
        state,
        _timestamp(created),
        _timestamp(updated),
        _timestamp(updated),
        attempts,
        _timestamp(last_attempt) if last_attempt else None,
        "attempts_exhausted" if state == "dead" else None,
    )
    with queue._connect() as connection, begin_immediate(connection):
        connection.execute(
            """INSERT OR IGNORE INTO tasks(
                   id, kind, handler_version, payload_json, input_hash, state, priority,
                   created_at, updated_at, available_at, attempts, last_attempt_at,
                   error_code
               ) VALUES (?, ?, 1, ?, ?, ?, 0, ?, ?, ?, ?, ?, ?)""",
            (
                record["id"],
                *expected,
            ),
        )
        stored = connection.execute(
            """SELECT kind, payload_json, input_hash, state, created_at, updated_at,
                      available_at, attempts, last_attempt_at, error_code
               FROM tasks WHERE id=?""",
            (record["id"],),
        ).fetchone()
        if stored is None or tuple(stored) != expected:
            raise QueueOperationError("legacy_import_conflict")
    return str(record["id"])


def _quarantine_legacy_record(
    run_dir: Path, source: Path, raw: bytes, *, code: str = "legacy_invalid"
) -> None:
    quarantine = run_dir / "queue-quarantine"
    quarantine.mkdir(parents=True, exist_ok=True)
    _harden_owner_only(quarantine, 0o700)
    digest = sha256_bytes(raw)
    raw_name = f"{digest}.raw"
    _write_durable_file(quarantine / raw_name, raw)
    record = {
        "code": code,
        "raw_name": raw_name,
        "source_name": source.name,
        "source_sha256": digest,
    }
    source_digest = sha256_bytes(source.name.encode("utf-8"))[:16]
    _write_durable_file(
        quarantine / f"{digest}-{source_digest}.json", canonical_json_bytes(record)
    )
    fsync_directory(quarantine)


def _quarantine_legacy_directory(run_dir: Path, legacy_dir: Path, *, code: str) -> int:
    quarantined = 0
    for source in sorted(legacy_dir.iterdir()):
        raw = _read_bounded_regular_nofollow(source)
        _quarantine_legacy_record(run_dir, source, raw, code=code)
        source.unlink()
        quarantined += 1
    legacy_dir.rmdir()
    fsync_directory(run_dir)
    return quarantined


def _post_marker_legacy_conflict(state_root: Path) -> None:
    run_dir, legacy_dir, _db_path, marker = _migration_paths(state_root)
    if not _path_present(marker) or not legacy_dir.exists():
        return
    owner = _acquire_queue_owner(state_root, "legacy", "legacy_owner_busy")
    try:
        if legacy_dir.exists():
            _quarantine_legacy_directory(
                run_dir, legacy_dir, code="legacy_backend_conflict"
            )
            raise LegacyBackendDisabled("legacy_backend_conflict")
    finally:
        _release_queue_owner(owner)


def _legacy_enqueue_file(
    task_type: str, payload: dict[str, Any], state_root: Path | None = None
) -> str:
    root = Path(state_root or _state_root()).resolve()
    _legacy_write_allowed(root)
    owner = _acquire_queue_owner(root, "legacy", "legacy_owner_busy")
    target: Path | None = None
    try:
        _legacy_write_allowed(root)
        task_id = f"{datetime.now().strftime('%Y%m%d-%H%M%S')}-{uuid.uuid4().hex[:8]}"
        record = {
            "attempts": 0,
            "enqueued_at": _timestamp(_utc_now()),
            "id": task_id,
            "last_attempt_at": None,
            "payload": payload,
            "type": task_type,
        }
        queue_dir = root / "run" / "queue"
        queue_dir.mkdir(parents=True, exist_ok=True)
        _harden_owner_only(queue_dir, 0o700)
        target = queue_dir / f"{task_id}.json"
        owner = _heartbeat_queue_owner(owner)
        marker = _migration_paths(root)[3]
        if _path_present(marker):
            _validate_migration_marker(marker)
            raise LegacyBackendDisabled("legacy_marker_race")
        _write_durable_file(target, canonical_json_bytes(record))
        try:
            owner = _heartbeat_queue_owner(owner)
            marker = _migration_paths(root)[3]
            if _path_present(marker):
                _validate_migration_marker(marker)
                raise LegacyBackendDisabled("legacy_marker_race")
        except Exception:
            target.unlink(missing_ok=True)
            fsync_directory(queue_dir)
            raise
        return task_id
    finally:
        _release_queue_owner(owner)


def _write_durable_file(path: Path, data: bytes) -> None:
    temporary = path.with_name(f".{path.name}.{uuid.uuid4().hex}.tmp")
    descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    try:
        with os.fdopen(descriptor, "wb") as handle:
            handle.write(data)
            handle.flush()
            os.fsync(handle.fileno())
        _harden_owner_only(temporary, 0o600)
        try:
            os.link(temporary, path)
        except FileExistsError:
            if path.read_bytes() != data or not _is_owner_only(path):
                raise QueueOperationError("durable_file_conflict") from None
        else:
            fsync_file(path)
            fsync_directory(path.parent)
    finally:
        temporary.unlink(missing_ok=True)


def _read_stable_owner_file(path: Path, max_bytes: int) -> bytes:
    metadata = path.lstat()
    if (
        path.is_symlink()
        or not stat.S_ISREG(metadata.st_mode)
        or metadata.st_size > max_bytes
        or not _is_owner_only(path)
    ):
        raise QueueOperationError("export_verification_failed")
    descriptor = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
    try:
        opened = os.fstat(descriptor)
        if (metadata.st_dev, metadata.st_ino) != (opened.st_dev, opened.st_ino):
            raise QueueOperationError("export_verification_failed")
        with os.fdopen(descriptor, "rb", closefd=False) as handle:
            data = handle.read(max_bytes + 1)
        after = os.fstat(descriptor)
        if len(data) > max_bytes or (
            opened.st_dev,
            opened.st_ino,
            opened.st_size,
            opened.st_mtime_ns,
        ) != (
            after.st_dev,
            after.st_ino,
            after.st_size,
            after.st_mtime_ns,
        ):
            raise QueueOperationError("export_verification_failed")
        return data
    finally:
        os.close(descriptor)


def _remove_export_staging(staging: Path) -> None:
    if not staging.exists():
        return
    if staging.is_symlink() or not staging.is_dir() or not _is_owner_only(staging):
        raise QueueOperationError("export_staging_invalid")
    shutil.rmtree(staging)
    fsync_directory(staging.parent)


def _cleanup_export_staging(parent: Path, export_name: str) -> None:
    for staging in parent.glob(f".{export_name}.staging-*"):
        _remove_export_staging(staging)


def _commit_migration_marker(
    lease: QueueOwnerLease, marker: Path, run_dir: Path
) -> QueueOwnerLease:
    now = _utc_now()
    with _open_queue_ownership_db(lease.state_root) as connection, begin_immediate(connection):
        expires_at = _require_queue_owner(connection, lease, now, heartbeat=True)
        try:
            _write_durable_file(marker, canonical_json_bytes({"version": 2}))
        except QueueOperationError:
            if _path_present(marker):
                _validate_migration_marker(marker)
            raise
        _validate_migration_marker(marker)
        fsync_directory(run_dir)
    return replace(lease, expires_at=expires_at)


def migrate_legacy_queue(
    state_root: Path,
    *,
    deadline: float = float("inf"),
    cancelled: Callable[[], bool] | None = None,
) -> MigrationReceipt:
    def require_active() -> None:
        if time.monotonic() >= deadline or bool(cancelled and cancelled()):
            raise TimeoutError("queue migration cancelled or deadline reached")

    require_active()
    run_dir, legacy_dir, _db_path, marker = _migration_paths(state_root)
    if _path_present(marker):
        _validate_migration_marker(marker)
        _post_marker_legacy_conflict(state_root)
        return MigrationReceipt(0, 0, (), ())
    owner = _acquire_queue_owner(state_root, "migration", "migration_busy")
    legacy_owner: QueueOwnerLease | None = None
    try:
        require_active()
        if _path_present(marker):
            _validate_migration_marker(marker)
            _post_marker_legacy_conflict(state_root)
            return MigrationReceipt(0, 0, (), ())
        legacy_owner = _acquire_queue_owner(state_root, "legacy", "legacy_owner_busy")
        owner = _heartbeat_queue_owner(owner)
        require_active()
        _prove_no_live_processing(legacy_dir)
        owner = _heartbeat_queue_owner(owner)
        require_active()
        migration_inputs = sorted(run_dir.glob("queue-migration-*"))
        if migration_inputs and legacy_dir.exists():
            raise MigrationBusy("legacy_migration_conflict")
        if len(migration_inputs) > 1:
            raise MigrationBusy("legacy_migration_conflict")
        if migration_inputs:
            migration_input = migration_inputs[0]
        elif legacy_dir.exists():
            migration_input = run_dir / f"queue-migration-{uuid.uuid4().hex}"
            legacy_dir.replace(migration_input)
            fsync_directory(run_dir)
        else:
            migration_input = None
        owner = _heartbeat_queue_owner(owner)
        require_active()
        valid, malformed = (
            _scan_legacy_records(migration_input)
            if migration_input is not None
            else ([], [])
        )
        owner = _heartbeat_queue_owner(owner)
        queue = MemoryQueue(Path(state_root)) if valid else None
        imported: list[str] = []
        for source, record in valid:
            require_active()
            if queue is None:  # pragma: no cover - guarded by valid
                raise AssertionError
            imported.append(_import_legacy_record(queue, record, source))
            source.unlink()
            owner = _heartbeat_queue_owner(owner)
        for source, raw in malformed:
            require_active()
            _quarantine_legacy_record(run_dir, source, raw)
            source.unlink(missing_ok=True)
            owner = _heartbeat_queue_owner(owner)
        if migration_input is not None:
            fsync_directory(migration_input)
            migration_input.rmdir()
            fsync_directory(run_dir)
        owner = _heartbeat_queue_owner(owner)
        if legacy_dir.exists():
            _quarantine_legacy_directory(
                run_dir, legacy_dir, code="legacy_backend_conflict"
            )
            raise LegacyBackendDisabled("legacy_backend_conflict")
        owner = _commit_migration_marker(owner, marker, run_dir)
        codes = ("legacy_invalid",) if malformed else ()
        return MigrationReceipt(len(imported), len(malformed), tuple(imported), codes)
    finally:
        if legacy_owner is not None:
            _release_queue_owner(legacy_owner)
        _release_queue_owner(owner)


def _ensure_sqlite_enabled() -> None:
    state_root = _state_root()
    marker = _migration_paths(state_root)[3]
    if not _path_present(marker):
        migrate_legacy_queue(state_root)
    else:
        _validate_migration_marker(marker)
        _post_marker_legacy_conflict(state_root)


def _queue_dir() -> Path:
    """Compatibility path: SQLite and results now live directly under run/."""
    path = _state_root() / "run"
    path.mkdir(parents=True, exist_ok=True)
    return path


def _queue(
    *,
    max_attempts: int = DEFAULTS.queue_max_attempts,
    retry_base_seconds: int = DEFAULTS.retry_base_seconds,
    retry_cap_seconds: int = DEFAULTS.retry_cap_seconds,
) -> MemoryQueue:
    _ensure_sqlite_enabled()
    return MemoryQueue(
        _state_root(),
        max_attempts=max_attempts,
        retry_base_seconds=retry_base_seconds,
        retry_cap_seconds=retry_cap_seconds,
    )


def _v3_queue_for_cli() -> _QueueV3CandidateReader:
    state_root = _state_root()
    return MemoryQueue._from_v3_candidate(
        state_root / "run" / "queue-v3.candidate.sqlite3",
        state_root=state_root,
    )


def active_memory_queue(vault: Path, state_root: Path) -> _QueueV3CandidateReader:
    """Open the queue side of one completely validated adopted V3 pair."""
    from installed_memory_repair import require_reliability_v3_adopted

    resolved_vault = Path(vault).resolve(strict=True)
    state = Path(state_root).absolute()
    require_reliability_v3_adopted(root=resolved_vault, state_root=state)
    queue_path = state / "run" / "queue-v3.sqlite3"
    coordinator_path = state / "run" / "markdown-transactions-v3.sqlite3"
    validate_queue_v3_database(queue_path, state_root=state)
    return _QueueV3CandidateReader(
        queue_path, coordinator_path=coordinator_path
    )


@contextmanager
def _repair_owner_for_cli() -> Iterator[OwnerLease]:
    from operational_ownership import OwnershipRegistry

    registry = OwnershipRegistry(_state_root())
    owner = registry.acquire("repair", scope=f"repair:cli:{os.getpid()}")
    try:
        yield owner
    finally:
        registry.release(owner)


def enqueue(task_type: str, payload: dict[str, Any]) -> str:
    """Compatibility facade that enqueues handler version 1."""
    return _queue().enqueue(task_type, 1, payload)


def _compat_task(task: QueueTask | QueueLease) -> dict[str, Any]:
    created = task.created_at
    last_attempt = task.last_attempt_at
    attempts = task.attempts if isinstance(task, QueueTask) else task.prior_attempts
    return {
        "id": task.id,
        "type": task.kind,
        "handler_version": task.handler_version,
        "enqueued_at": created.isoformat(timespec="seconds"),
        "attempts": attempts,
        "last_attempt_at": (
            last_attempt.isoformat(timespec="seconds") if last_attempt else None
        ),
        "payload": task.payload,
    }


def _export_task_record(task: QueueTask) -> dict[str, object]:
    return {
        "attempt_history": [
            {
                "attempt": item.attempt,
                "error_code": item.error_code,
                "finished_at": _timestamp(item.finished_at),
                "outcome": item.outcome,
                "started_at": _timestamp(item.started_at),
            }
            for item in task.attempt_history
        ],
        "attempts": task.attempts,
        "available_at": _timestamp(task.available_at),
        "blocked_capability": task.blocked_capability,
        "created_at": _timestamp(task.created_at),
        "dedupe_key": task.dedupe_key,
        "error_code": task.error_code,
        "handler_version": task.handler_version,
        "id": task.id,
        "input_hash": task.input_hash,
        "kind": task.kind,
        "last_attempt_at": (
            _timestamp(task.last_attempt_at) if task.last_attempt_at else None
        ),
        "payload": task.payload,
        "priority": task.priority,
        "redrive_of": task.redrive_of,
        "result_reference": task.result_reference,
        "result_sha256": task.result_sha256,
        "state": task.state,
        "updated_at": _timestamp(task.updated_at),
    }


def list_pending(max_age_days: int | None = None) -> list[dict[str, Any]]:
    tasks = _queue().list_tasks(
        states=("ready", "leased", "blocked", "dead"), max_age_days=max_age_days
    )
    return [_compat_task(task) for task in tasks]


def mark_attempt(task_id: str, success: bool) -> None:
    """Legacy attempt API retained for callers while storage is SQLite-backed."""
    queue = _queue()
    try:
        task = queue.get(task_id)
    except KeyError:
        return
    if task.state != "ready":
        return
    lease = queue._claim_task(task_id, f"legacy-{os.getpid()}")
    if lease is None:
        return
    if success:
        queue.publish_result(lease, operation_id=task_id, result=b"")
        queue.acknowledge(lease)
    else:
        queue.fail(lease, QueueFailure("processor_failed", retry_after=60))


def recover_stale_leases(max_age_seconds: int = 600) -> int:
    del max_age_seconds
    return _queue().recover_expired_leases()


def cancel(
    task_id: str,
    *,
    deadline: float = float("inf"),
    cancelled: Callable[[], bool] | None = None,
) -> bool:
    return _queue().cancel(task_id, deadline=deadline, cancelled=cancelled)


def redrive(
    task_id: str,
    *,
    deadline: float = float("inf"),
    cancelled: Callable[[], bool] | None = None,
) -> str:
    return _queue().redrive(task_id, deadline=deadline, cancelled=cancelled)


def purge(
    *,
    terminal_before: datetime,
    export_path: Path,
    deadline: float = float("inf"),
    cancelled: Callable[[], bool] | None = None,
) -> PurgeReceipt:
    return _queue().purge(
        terminal_before=terminal_before,
        export_path=export_path,
        deadline=deadline,
        cancelled=cancelled,
    )


def retained_queue_state() -> bool:
    """Return whether queue records or results block deletion of run/."""
    return _queue().retains_run_directory()


class _SourceFenceHeartbeat:
    def __init__(
        self,
        queue: MemoryQueue,
        fence: SourceFence,
        *,
        heartbeat_seconds: int,
        lease_seconds: int,
    ) -> None:
        self._queue = queue
        self._fence = fence
        self._heartbeat_seconds = heartbeat_seconds
        self._lease_seconds = lease_seconds
        self._stop = threading.Event()
        self._lock = threading.Lock()
        self.error: Exception | None = None
        self._thread = threading.Thread(
            target=self._run,
            name=f"memory-source-fence-heartbeat-{fence.daily_id}",
            daemon=True,
        )

    def start(self) -> None:
        self._thread.start()

    def stop(self) -> None:
        self._stop.set()
        self._thread.join()

    def current(self) -> SourceFence:
        with self._lock:
            if self.error is not None:
                raise QueueOperationError("source_fence_lost") from self.error
            return self._fence

    def refresh(self) -> SourceFence:
        with self._lock:
            if self.error is not None:
                raise QueueOperationError("source_fence_lost") from self.error
            try:
                self._fence = self._queue.heartbeat_source_fence(
                    self._fence, lease_seconds=self._lease_seconds
                )
            except Exception as exc:
                self.error = exc
                self._stop.set()
                raise QueueOperationError("source_fence_lost") from exc
            return self._fence

    def _run(self) -> None:
        while not self._queue._heartbeat_wait(  # noqa: SLF001 - injected queue seam
            self._stop, self._heartbeat_seconds
        ):
            try:
                self.refresh()
            except QueueOperationError:
                return


class _LeaseHeartbeat:
    def __init__(
        self,
        queue: MemoryQueue,
        lease: QueueLease,
        *,
        heartbeat_seconds: int = DEFAULTS.queue_heartbeat_seconds,
        lease_seconds: int = DEFAULTS.queue_lease_seconds,
    ) -> None:
        self._queue = queue
        self._lease = lease
        self._heartbeat_seconds = heartbeat_seconds
        self._lease_seconds = lease_seconds
        self._stop = threading.Event()
        self.error: Exception | None = None
        self._thread = threading.Thread(
            target=self._run,
            name=f"memory-queue-heartbeat-{lease.id}",
            daemon=True,
        )

    def start(self) -> None:
        self._thread.start()

    def stop(self) -> None:
        self._stop.set()
        self._thread.join()

    def _run(self) -> None:
        while not self._queue._heartbeat_wait(  # noqa: SLF001 - injected queue seam
            self._stop, self._heartbeat_seconds
        ):
            try:
                self._lease = self._queue.heartbeat(
                    self._lease, lease_seconds=self._lease_seconds
                )
            except Exception as exc:  # noqa: BLE001 - completion must remain fenced
                self.error = exc
                self._stop.set()
                return


def drain_with(
    processor: Callable[[dict], bool | DeferredResult], max_tasks: int = 10
) -> dict[str, int]:
    """Run handlers outside transactions and fence completion with a result marker."""
    counts = {"ok": 0, "failed": 0, "dead": 0, "skipped": 0}
    queue = _queue()
    owner = f"compat-{os.getpid()}-{uuid.uuid4().hex}"
    for _ in range(max_tasks):
        lease = queue.claim(owner)
        if lease is None:
            break
        adopted = queue.adopt_published_result(lease, operation_id=lease.id)
        if adopted == "adopted":
            _count_terminal(counts, queue.acknowledge(lease))
            continue
        if adopted == "corrupt":
            _count_terminal(counts, queue.get(lease.id))
            continue
        heartbeat = _LeaseHeartbeat(queue, lease)
        heartbeat.start()
        try:
            try:
                outcome = processor(_compat_task(lease))
                succeeded = bool(outcome)
            except Exception:  # noqa: BLE001
                print("processor_exception", file=sys.stderr)
                succeeded = False
        finally:
            heartbeat.stop()
        if heartbeat.error is not None:
            counts["failed"] += 1
            continue
        try:
            if succeeded:
                result = outcome.data if isinstance(outcome, DeferredResult) else b""
                queue.publish_result(lease, operation_id=lease.id, result=result)
                _count_terminal(counts, queue.acknowledge(lease))
            else:
                queue.fail(lease, QueueFailure("processor_failed", retry_after=60))
                _count_terminal(counts, queue.get(lease.id))
        except (LeaseFenceError, ResultConflictError):
            counts["failed"] += 1
            task = queue.get(lease.id)
            if task.state == "dead":
                counts["dead"] += 1
    return counts


def _run_processor_inline(
    processor: Callable[[dict], bool | DeferredResult],
    task: dict[str, Any],
    timeout: float,
) -> bool | DeferredResult:
    del timeout
    return processor(task)


def _processor_child_entry(
    sender: Any,
    processor: Callable[[dict], bool | DeferredResult],
    task: dict[str, Any],
) -> None:
    try:
        if os.name != "nt":
            os.setsid()
        try:
            outcome = processor(task)
            if isinstance(outcome, DeferredResult):
                frame = b"D" + outcome.data
            elif isinstance(outcome, bool):
                frame = b"T" if outcome else b"F"
            else:
                frame = b"?"
        except Exception:  # noqa: BLE001 - parent receives a stable code only
            frame = b"E"
        sender.send_bytes(b"R")
        if not sender.poll(5) or sender.recv_bytes(1) != b"A":
            return
        sender.send_bytes(frame)
    except Exception:  # noqa: BLE001 - parent receives a stable code only
        pass
    finally:
        sender.close()


def _kill_process_group(pid: int, sig: int) -> None:
    os.killpg(pid, sig)


def _process_snapshot_posix() -> list[tuple[int, int, int, str]] | None:
    proc = Path("/proc")
    if not proc.is_dir():
        return None
    rows: list[tuple[int, int, int, str]] = []
    for entry in proc.iterdir():
        if not entry.name.isdigit():
            continue
        try:
            raw = (entry / "stat").read_text(encoding="ascii")
            fields = raw[raw.rfind(")") + 2 :].split()
            rows.append((int(entry.name), int(fields[1]), int(fields[2]), fields[0]))
        except (OSError, ValueError, IndexError):
            continue
    return rows


def _tracked_descendant_pids(root_pid: int, platform_name: str) -> set[int] | None:
    if platform_name == "nt":
        try:
            result = subprocess.run(
                ["wmic", "process", "get", "ParentProcessId,ProcessId", "/format:csv"],
                check=False,
                capture_output=True,
                text=True,
                timeout=2,
            )
            if result.returncode != 0:
                raise OSError
            pairs = []
            for line in result.stdout.splitlines():
                fields = [field.strip() for field in line.split(",")]
                if len(fields) >= 3 and fields[-1].isdigit() and fields[-2].isdigit():
                    pairs.append((int(fields[-1]), int(fields[-2])))
        except (OSError, ValueError, subprocess.SubprocessError):
            command = (
                "Get-CimInstance Win32_Process | "
                "Select-Object ProcessId,ParentProcessId | ConvertTo-Json -Compress"
            )
            try:
                result = subprocess.run(
                    ["powershell", "-NoProfile", "-Command", command],
                    check=False,
                    capture_output=True,
                    text=True,
                    timeout=5,
                )
                if result.returncode != 0:
                    return None
                decoded = json.loads(result.stdout or "[]")
                items = decoded if isinstance(decoded, list) else [decoded]
                pairs = [
                    (int(item["ProcessId"]), int(item["ParentProcessId"]))
                    for item in items
                    if isinstance(item, dict)
                ]
            except (
                OSError,
                ValueError,
                KeyError,
                json.JSONDecodeError,
                subprocess.SubprocessError,
            ):
                return None
    else:
        snapshot = _process_snapshot_posix()
        if snapshot is None:
            return set()
        pairs = [(pid, ppid) for pid, ppid, _pgrp, _state in snapshot]
    descendants: set[int] = set()
    frontier = {root_pid}
    while frontier:
        children = {pid for pid, ppid in pairs if ppid in frontier and pid not in descendants}
        descendants.update(children)
        frontier = children
    return descendants


def _process_group_alive(group_id: int) -> bool:
    snapshot = _process_snapshot_posix()
    if snapshot is not None:
        return any(pgrp == group_id and state != "Z" for _pid, _ppid, pgrp, state in snapshot)
    try:
        _kill_process_group(group_id, 0)
        return True
    except ProcessLookupError:
        return False
    except PermissionError:
        return True


def _cleanup_confirmed(
    process: multiprocessing.Process,
    descendants: set[int],
    *,
    platform_name: str,
) -> bool:
    snapshot = _process_snapshot_posix() if platform_name != "nt" else None
    if snapshot is None:
        descendant_alive = any(_pid_is_alive(pid) for pid in descendants)
    else:
        states = {pid: state for pid, _ppid, _pgrp, state in snapshot}
        descendant_alive = any(
            pid in states and states[pid] != "Z" for pid in descendants
        )
    if process.is_alive() or descendant_alive:
        return False
    return platform_name == "nt" or not _process_group_alive(process.pid)


_DISCOVER_DESCENDANTS = object()


def _terminate_processor_child(
    process: multiprocessing.Process,
    *,
    platform_name: str | None = None,
    cleanup_timeout: float = 1.0,
    tracked_descendants: set[int] | None | object = _DISCOVER_DESCENDANTS,
) -> set[int]:
    platform_name = platform_name or os.name
    direct_was_alive = process.is_alive()
    discover_descendants = tracked_descendants is _DISCOVER_DESCENDANTS
    if not direct_was_alive and platform_name == "nt" and discover_descendants:
        raise QueueOperationError("process_cleanup_failed")
    descendants = (
        _tracked_descendant_pids(process.pid, platform_name)
        if discover_descendants
        else tracked_descendants
    )
    if descendants is not None and _cleanup_confirmed(
        process, descendants, platform_name=platform_name
    ):
        return descendants
    tree_verified = False
    if platform_name == "nt":
        try:
            result = subprocess.run(
                ["taskkill", "/PID", str(process.pid), "/T", "/F"],
                check=False,
                stdin=subprocess.DEVNULL,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
                timeout=2,
            )
            tree_verified = result.returncode == 0
        except (OSError, subprocess.SubprocessError):
            tree_verified = False
        if descendants is not None:
            for pid in descendants:
                if not _pid_is_alive(pid):
                    continue
                try:
                    subprocess.run(
                        ["taskkill", "/PID", str(pid), "/T", "/F"],
                        check=False,
                        stdin=subprocess.DEVNULL,
                        stdout=subprocess.DEVNULL,
                        stderr=subprocess.DEVNULL,
                        timeout=2,
                    )
                except (OSError, subprocess.SubprocessError):
                    pass
    else:
        try:
            _kill_process_group(process.pid, signal.SIGTERM)
            tree_verified = True
        except ProcessLookupError:
            tree_verified = os.name != "nt" and descendants == set()
        except OSError:
            tree_verified = False
    process.join(0.2)
    if process.is_alive():
        if platform_name != "nt" and tree_verified:
            try:
                _kill_process_group(process.pid, signal.SIGKILL)
            except OSError:
                tree_verified = False
            process.join(0.2)
    if process.is_alive():
        try:
            process.terminate()
        except (OSError, ValueError):
            pass
        process.join(0.2)
    if process.is_alive():
        try:
            process.kill()
        except (OSError, ValueError):
            pass
        process.join(0.2)
    deadline = time.monotonic() + max(0.0, cleanup_timeout)
    cleanup_verified = descendants is not None and _cleanup_confirmed(
        process, descendants, platform_name=platform_name
    )
    while not cleanup_verified and descendants is not None and time.monotonic() < deadline:
        time.sleep(0.02)
        cleanup_verified = _cleanup_confirmed(
            process, descendants, platform_name=platform_name
        )
    if not cleanup_verified or (platform_name != "nt" and not tree_verified):
        raise QueueOperationError("process_cleanup_failed")
    return descendants


def _decode_processor_frame(frame: bytes) -> bool | DeferredResult:
    if not frame:
        raise QueueOperationError("processor_result_malformed")
    tag = frame[:1]
    if tag == b"D":
        data = frame[1:]
        if len(data) > _MAX_RESULT_BYTES:
            raise QueueOperationError("processor_result_oversize")
        return DeferredResult(data)
    if frame == b"T":
        return True
    if frame == b"F":
        return False
    if frame == b"E":
        raise QueueOperationError("processor_exception")
    raise QueueOperationError("processor_result_malformed")


def _run_processor_child(
    processor: Callable[[dict], bool | DeferredResult],
    task: dict[str, Any],
    timeout: float,
) -> bool | DeferredResult:
    if timeout <= 0:
        raise TimeoutError
    context = multiprocessing.get_context("spawn")
    receiver, sender = context.Pipe(duplex=True)
    process = context.Process(
        target=_processor_child_entry,
        args=(sender, processor, task),
        daemon=False,
    )
    deadline = time.monotonic() + timeout
    tracked_descendants: set[int] | None = None
    started = False
    try:
        process.start()
        started = True
        sender.close()
        remaining = deadline - time.monotonic()
        if remaining <= 0 or not receiver.poll(remaining):
            tracked_descendants = _terminate_processor_child(process)
            raise TimeoutError
        try:
            ready = receiver.recv_bytes(1)
        except OSError:
            raise QueueOperationError("processor_result_malformed") from None
        except EOFError:
            raise QueueOperationError("processor_result_malformed") from None
        if ready != b"R":
            raise QueueOperationError("processor_result_malformed")
        tracked_descendants = _tracked_descendant_pids(process.pid, os.name)
        receiver.send_bytes(b"A")
        remaining = deadline - time.monotonic()
        if remaining <= 0 or not receiver.poll(remaining):
            tracked_descendants = _terminate_processor_child(
                process, tracked_descendants=tracked_descendants
            )
            raise TimeoutError
        try:
            frame = receiver.recv_bytes(_MAX_RESULT_BYTES + 1)
        except OSError:
            receiver.close()
            process.join(0.5)
            if process.is_alive():
                tracked_descendants = _terminate_processor_child(
                    process, tracked_descendants=tracked_descendants
                )
            raise QueueOperationError("processor_result_oversize") from None
        except EOFError:
            raise QueueOperationError("processor_result_malformed") from None
        remaining = deadline - time.monotonic()
        if remaining <= 0:
            tracked_descendants = _terminate_processor_child(
                process, tracked_descendants=tracked_descendants
            )
            raise TimeoutError
        process.join(remaining)
        if process.is_alive():
            tracked_descendants = _terminate_processor_child(
                process, tracked_descendants=tracked_descendants
            )
            raise TimeoutError
        if process.exitcode != 0:
            raise QueueOperationError("processor_child_failed")
        return _decode_processor_frame(frame)
    finally:
        receiver.close()
        if started:
            _terminate_processor_child(
                process, tracked_descendants=tracked_descendants
            )


def _work_one(
    queue: MemoryQueue,
    processor: Callable[[dict], bool | DeferredResult],
    processor_runner: Callable[
        [Callable[[dict], bool | DeferredResult], dict[str, Any], float],
        bool | DeferredResult,
    ],
    *,
    owner: str,
    deadline: float,
    monotonic: Callable[[], float],
    lease_seconds: int,
    heartbeat_seconds: int,
    max_attempts: int,
    retry_base_seconds: int,
    retry_cap_seconds: int,
) -> dict[str, int]:
    counts = {"ok": 0, "failed": 0, "dead": 0, "skipped": 0, "halted": 0}
    lease = queue.claim(
        owner, lease_seconds=lease_seconds, max_attempts=max_attempts
    )
    if lease is None:
        return counts
    adopted = queue.adopt_published_result(lease, operation_id=lease.id)
    if adopted == "adopted":
        _count_terminal(counts, queue.acknowledge(lease))
        return counts
    if adopted == "corrupt":
        _count_terminal(counts, queue.get(lease.id))
        return counts
    heartbeat = _LeaseHeartbeat(
        queue,
        lease,
        heartbeat_seconds=heartbeat_seconds,
        lease_seconds=lease_seconds,
    )
    heartbeat.start()
    timed_out = False
    cleanup_failed = False
    outcome: bool | DeferredResult = False
    try:
        remaining = deadline - monotonic()
        if remaining <= 0:
            timed_out = True
        else:
            try:
                outcome = processor_runner(processor, _compat_task(lease), remaining)
            except TimeoutError:
                timed_out = True
            except QueueOperationError as exc:
                if exc.code == "process_cleanup_failed":
                    cleanup_failed = True
                else:
                    outcome = False
            except Exception:  # noqa: BLE001 - queue exposes stable codes only
                outcome = False
        if monotonic() >= deadline:
            timed_out = True
    finally:
        heartbeat.stop()
    if heartbeat.error is not None and not cleanup_failed:
        counts["failed"] += 1
        return counts
    try:
        if cleanup_failed:
            counts["halted"] = 1
            queue.fail(
                lease,
                QueueFailure(
                    "process_cleanup_failed",
                    blocked_capability="process_cleanup",
                ),
                max_attempts=max_attempts,
                retry_base_seconds=retry_base_seconds,
                retry_cap_seconds=retry_cap_seconds,
            )
            _count_terminal(counts, queue.get(lease.id))
        elif timed_out:
            queue.fail(
                lease,
                QueueFailure("worker_timeout"),
                max_attempts=max_attempts,
                retry_base_seconds=retry_base_seconds,
                retry_cap_seconds=retry_cap_seconds,
            )
            _count_terminal(counts, queue.get(lease.id))
        elif bool(outcome):
            result = outcome.data if isinstance(outcome, DeferredResult) else b""
            queue.publish_result(lease, operation_id=lease.id, result=result)
            _count_terminal(counts, queue.acknowledge(lease))
        else:
            queue.fail(
                lease,
                QueueFailure("processor_failed"),
                max_attempts=max_attempts,
                retry_base_seconds=retry_base_seconds,
                retry_cap_seconds=retry_cap_seconds,
            )
            _count_terminal(counts, queue.get(lease.id))
    except (LeaseFenceError, ResultConflictError):
        counts["failed"] += 1
        task = queue.get(lease.id)
        if task.state == "dead":
            counts["dead"] += 1
    return counts


def run_worker(
    processor: Callable[[dict], bool | DeferredResult],
    *,
    max_tasks: int = DEFAULTS.worker_max_tasks,
    max_seconds: int = DEFAULTS.worker_max_seconds,
    idle_seconds: int = DEFAULTS.worker_idle_seconds,
    lease_seconds: int = DEFAULTS.queue_lease_seconds,
    heartbeat_seconds: int = DEFAULTS.queue_heartbeat_seconds,
    max_attempts: int = DEFAULTS.queue_max_attempts,
    retry_base_seconds: int = DEFAULTS.retry_base_seconds,
    retry_cap_seconds: int = DEFAULTS.retry_cap_seconds,
    monotonic: Callable[[], float] = time.monotonic,
    sleep: Callable[[float], None] = time.sleep,
    processor_runner: Callable[
        [Callable[[dict], bool | DeferredResult], dict[str, Any], float],
        bool | DeferredResult,
    ] = _run_processor_child,
    cancelled: Callable[[], bool] | None = None,
) -> WorkerSummary:
    """Run a short-lived worker bounded by tasks, wall time, and idle time."""
    if max_tasks < 0 or max_seconds < 0 or idle_seconds < 0:
        raise ValueError("worker limits must be non-negative")
    _validate_worker_policy(
        lease_seconds,
        heartbeat_seconds,
        max_attempts,
        retry_base_seconds,
        retry_cap_seconds,
    )
    started = monotonic()
    idle_started: float | None = None
    totals = {"ok": 0, "failed": 0, "dead": 0, "skipped": 0}
    processed = 0
    queue = _queue(
        max_attempts=max_attempts,
        retry_base_seconds=retry_base_seconds,
        retry_cap_seconds=retry_cap_seconds,
    )
    owner = f"worker-{os.getpid()}-{uuid.uuid4().hex}"
    deadline = started + max_seconds
    while processed < max_tasks:
        if cancelled and cancelled():
            break
        now = monotonic()
        if now >= deadline:
            break
        if idle_started is not None and now - idle_started >= idle_seconds:
            break
        counts = _work_one(
            queue,
            processor,
            processor_runner,
            owner=owner,
            deadline=deadline,
            monotonic=monotonic,
            lease_seconds=lease_seconds,
            heartbeat_seconds=heartbeat_seconds,
            max_attempts=max_attempts,
            retry_base_seconds=retry_base_seconds,
            retry_cap_seconds=retry_cap_seconds,
        )
        handled = counts["ok"] + counts["failed"]
        for key in totals:
            totals[key] += counts[key]
        if handled:
            processed += handled
            idle_started = None
            if counts.get("halted"):
                break
            continue
        if idle_seconds == 0:
            break
        if idle_started is None:
            idle_started = now
        idle_remaining = idle_seconds - (now - idle_started)
        budget_remaining = deadline - monotonic()
        if budget_remaining <= 0:
            break
        sleep(min(1.0, idle_remaining, budget_remaining))
    return WorkerSummary(
        processed,
        totals["ok"],
        totals["failed"],
        totals["dead"],
        totals["skipped"],
        queue.count_eligible(max_attempts=max_attempts),
    )


def _count_terminal(counts: dict[str, int], task: QueueTask) -> None:
    if task.state == "succeeded":
        counts["ok"] += 1
        return
    counts["failed"] += 1
    if task.state == "dead":
        counts["dead"] += 1


def status() -> dict[str, Any]:
    queue = _queue()
    tasks = queue.list_tasks(states=("ready", "leased", "blocked", "dead"))
    by_type: dict[str, int] = {}
    for task in tasks:
        by_type[task.kind] = by_type.get(task.kind, 0) + 1
    return {
        "pending_total": len(tasks),
        "by_type": by_type,
        "permanently_failed": sum(task.state == "dead" for task in tasks),
        "queue_dir": str(queue.run_dir),
    }


def _operator_status() -> dict[str, object]:
    tasks = _queue().list_tasks()
    states = {state: 0 for state in _STATES}
    capabilities: set[str] = set()
    codes: set[str] = set()
    for task in tasks:
        states[task.state] += 1
        if task.blocked_capability:
            capabilities.add(task.blocked_capability)
        if task.error_code:
            codes.add(task.error_code)
    return {
        "counts": {"total": len(tasks)},
        "states": states,
        "capabilities": sorted(capabilities),
        "codes": sorted(codes),
    }


def _manual_processor(task: dict[str, Any]) -> bool | DeferredResult:
    from llm_client import call_llm

    task_type = task.get("type")
    payload = task.get("payload", {})
    if task_type == "query":
        prompt = payload.get("prompt", "")
        if not prompt:
            return False
        result = call_llm(
            prompt,
            payload.get("system_prompt", ""),
            max_tokens=int(payload.get("max_tokens") or 4000),
        )
        if not result:
            return False
        return DeferredResult(result.encode("utf-8"))
    if task_type == "flush":
        prompt = payload.get("prompt", "")
        if not prompt:
            return False
        now = _utc_now()
        raw_day = payload.get("day")
        day = now.strftime("%Y-%m-%d") if raw_day is None else raw_day
        if not isinstance(day, str) or re.fullmatch(r"\d{4}-\d{2}-\d{2}", day) is None:
            return False
        try:
            if datetime.strptime(day, "%Y-%m-%d").strftime("%Y-%m-%d") != day:
                return False
        except ValueError:
            return False
        root = Path(os.environ.get("LLM_WIKI_ROOT", ".")).resolve()
        daily_dir = (root / "knowledge" / "daily").resolve()
        daily_path = (daily_dir / f"{day}.md").resolve()
        try:
            daily_path.relative_to(daily_dir)
        except ValueError:
            return False
        result = call_llm(
            prompt,
            payload.get("system_prompt", ""),
            max_tokens=int(payload.get("max_tokens") or 1500),
        )
        if not result:
            return False
        from daily_log_append import locked_append_once
        from flush_memory import _classify_response

        tier, body = _classify_response(result)
        if tier != "ok" and body:
            session_id = payload.get("session_id", "deferred")
            event = payload.get("event", "session-end")
            block = (
                f"\n## [{now.strftime('%H:%M:%S')}] deferred-{event} | {session_id}\n"
                f"- Tier: `{tier}`\n\n{redact_secrets(body)}\n"
            )
            locked_append_once(daily_path, block, str(task["id"]))
        return True
    if task_type == "compile":
        root = Path(os.environ.get("LLM_WIKI_ROOT", ".")).resolve()
        command = [
            sys.executable,
            str(root / "scripts" / "compile_memory.py"),
            "--trigger",
            "auto",
        ]
        completed = subprocess.run(
            command,
            cwd=root,
            check=False,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
        )
        return completed.returncode == 0
    return False


def _cli_error_code(error: BaseException) -> str:
    if isinstance(error, QueueOperationError):
        code = error.code
        if re.fullmatch(r"[a-z][a-z0-9_]{0,63}", code):
            return code
        return "internal_error"
    if isinstance(error, KeyError):
        return "task_not_found"
    if isinstance(error, PermissionError):
        return "permission_denied"
    if isinstance(error, sqlite3.Error):
        return "sqlite_error"
    if isinstance(error, (UnicodeError, json.JSONDecodeError)):
        return "decode_error"
    if isinstance(
        error,
        (
            subprocess.SubprocessError,
            multiprocessing.ProcessError,
            BrokenPipeError,
            EOFError,
            ChildProcessError,
        ),
    ):
        return "process_error"
    if isinstance(error, TimeoutError):
        return "worker_timeout"
    if isinstance(error, OSError):
        return "os_error"
    if isinstance(error, (TypeError, ValueError)):
        return "invalid_input"
    return "internal_error"


def _emit_cli_error(error: BaseException) -> int:
    payload = canonical_json_bytes({"codes": [_cli_error_code(error)]})
    print(payload.decode("utf-8"))
    return 2


def _emit_invalid_arguments() -> int:
    payload = canonical_json_bytes({"ok": False, "code": "invalid_arguments"})
    print(payload.decode("utf-8"))
    return 2


def _cli() -> int:
    parser = _RedactedArgumentParser()
    parser.add_argument(
        "command",
        choices=[
            "list",
            "status",
            "work",
            "cancel",
            "redrive",
            "migrate",
            "purge",
            "quarantine-corrupt",
            "purge-corrupt",
        ],
    )
    parser.add_argument("task_id", nargs="?")
    parser.add_argument("--max-tasks", type=int, default=DEFAULTS.worker_max_tasks)
    parser.add_argument("--max-seconds", type=int, default=DEFAULTS.worker_max_seconds)
    parser.add_argument("--idle-seconds", type=int, default=DEFAULTS.worker_idle_seconds)
    parser.add_argument("--lease-seconds", type=int, default=DEFAULTS.queue_lease_seconds)
    parser.add_argument(
        "--heartbeat-seconds", type=int, default=DEFAULTS.queue_heartbeat_seconds
    )
    parser.add_argument("--max-attempts", type=int, default=DEFAULTS.queue_max_attempts)
    parser.add_argument(
        "--retry-base-seconds", type=int, default=DEFAULTS.retry_base_seconds
    )
    parser.add_argument(
        "--retry-cap-seconds", type=int, default=DEFAULTS.retry_cap_seconds
    )
    parser.add_argument("--terminal-before")
    parser.add_argument("--export", type=Path)
    parser.add_argument("--reason")
    try:
        args = parser.parse_args()
        if args.command == "list":
            records = [
                {"id": task.id, "state": task.state} for task in _queue().list_tasks()
            ]
            print(json.dumps(records, sort_keys=True))
            return 0
        if args.command == "status":
            print(json.dumps(_operator_status(), sort_keys=True))
            return 0
        if args.command == "work":
            try:
                _validate_worker_policy(
                    args.lease_seconds,
                    args.heartbeat_seconds,
                    args.max_attempts,
                    args.retry_base_seconds,
                    args.retry_cap_seconds,
                )
            except ValueError as exc:
                parser.error(str(exc))
            summary = run_worker(
                _manual_processor,
                max_tasks=args.max_tasks,
                max_seconds=args.max_seconds,
                idle_seconds=args.idle_seconds,
                lease_seconds=args.lease_seconds,
                heartbeat_seconds=args.heartbeat_seconds,
                max_attempts=args.max_attempts,
                retry_base_seconds=args.retry_base_seconds,
                retry_cap_seconds=args.retry_cap_seconds,
            )
            counts = {
                "dead": summary.dead,
                "failed": summary.failed,
                "processed": summary.processed,
                "remaining_eligible": summary.remaining_eligible,
                "skipped": summary.skipped,
                "succeeded": summary.succeeded,
            }
            print(json.dumps({"counts": counts}, sort_keys=True))
            return 1 if summary.failed or summary.dead or summary.remaining_eligible else 0
        if args.command == "migrate":
            receipt = migrate_legacy_queue(_state_root())
            print(
                json.dumps(
                    {
                        "codes": list(receipt.codes),
                        "counts": {
                            "imported": receipt.imported,
                            "quarantined": receipt.quarantined,
                        },
                    },
                    sort_keys=True,
                )
            )
            return 0
        if args.command in ("cancel", "redrive") and not args.task_id:
            raise QueueOperationError("task_id_required")
        if args.command == "quarantine-corrupt":
            if not args.task_id:
                raise QueueOperationError("task_id_required")
            if (
                not isinstance(args.reason, str)
                or not 1 <= len(args.reason.encode("utf-8")) <= 4096
            ):
                raise ValueError("quarantine reason is invalid")
            queue = _v3_queue_for_cli()
            with _repair_owner_for_cli() as owner:
                progress = queue.quarantine_corrupt(
                    args.task_id, reason=args.reason, owner=owner
                )
            print(
                json.dumps(
                    {
                        "code": progress.code,
                        "complete": progress.complete,
                        "operation_id": progress.operation_id,
                        "page_count": progress.pages_written,
                        "state": progress.state,
                        "task_id": progress.task_id,
                    },
                    sort_keys=True,
                )
            )
            return 0
        if args.command == "purge-corrupt":
            if not args.task_id:
                raise QueueOperationError("task_id_required")
            queue = _v3_queue_for_cli()
            with _repair_owner_for_cli() as owner:
                progress = queue.purge_quarantined(args.task_id, owner=owner)
            print(
                json.dumps(
                    {
                        "code": progress.code,
                        "complete": progress.complete,
                        "links_deleted": progress.links_deleted,
                        "operation_id": progress.operation_id,
                        "page_count": progress.pages_written,
                        "state": progress.state,
                        "task_id": progress.task_id,
                    },
                    sort_keys=True,
                )
            )
            return 0
        if args.command == "cancel":
            changed = cancel(args.task_id)
            state = _queue().get(args.task_id).state if changed else "unchanged"
            print(json.dumps({"id": args.task_id, "state": state}, sort_keys=True))
            return 0 if changed else 1
        if args.command == "redrive":
            task_id = redrive(args.task_id)
            print(json.dumps({"id": task_id, "state": "ready"}, sort_keys=True))
            return 0
        if args.command == "purge":
            if args.terminal_before is None:
                raise QueueOperationError("terminal_before_required")
            if args.export is None:
                raise QueueOperationError("export_required")
            try:
                terminal_before = datetime.fromisoformat(args.terminal_before)
            except ValueError:
                raise QueueOperationError("terminal_before_invalid") from None
            receipt = purge(
                terminal_before=terminal_before,
                export_path=args.export,
            )
            print(
                json.dumps(
                    {"counts": {"purged": receipt.purged}, "ids": list(receipt.task_ids)},
                    sort_keys=True,
                )
            )
            return 0
    except _InvalidArguments:
        return _emit_invalid_arguments()
    except Exception as exc:  # noqa: BLE001 - CLI is a redacted trust boundary
        return _emit_cli_error(exc)
    return 2


if __name__ == "__main__":
    raise SystemExit(_cli())
