fix(release): read inline migration pairs in the release chain reader (#811)

BUILD-LOG.md

@@ -6115,3 +6115,5 @@ runs were joined. Queue remains with the lead after the linked-worktree refusal.
 Local commit only; no push or live instance/credential-file access.
 2026-11-04T17:21:41Z | Codex implementation sub-agent, t3/lifecycle-task-6b | #797 / Gitea #1839 lifecycle Task 6b before/after | Before: origin/refactor 103168614 includes Task 6a intake/staff tools and Task 5a create recovery; Task 4 source 76207fe48 cherry-picked as e41ec8159d23d52963d869abf22fc9d430831f44 with both append-only log sides retained. No checked task/review advancement or durable role continuation recovery existed. After: PM-only submit_prd and advance_request map to exact PRD submission and evidence-derived planning → implementation → review → delivery → complete transitions (changes return to implementation); task-create/assignment, latest project push/review/verdict and closure evidence are rechecked under the request revision and current snapshot. Eligible PM/CTO intake_status path reads expose only selected committed draft documents. Durable continuation intents are keyed by request/revision/target/step and composed atomically with outgoing messages; immutable attempt, manifest and exact launch-refusal receipts deduplicate retries. Message reads never acknowledge progress; validated lifecycle transitions and the chief's delivery effect in the originating assistant session do. Startup/event recovery plus a single-flight 30-second pass bounded to 64 requests catches missed wakeups. Successors receive the same unfinished key, with existing routed/effect receipts rechecked before resending. The launcher starts only the configured chief through its existing launchPm path; workers use that chief's real launch/end authority. Old product manifests drain their current turn, then the chief relaunches with request.admission and real ensureCheckouts. Exact refusals appear as RequestState.launch_refusal for intake-panel integration; no Console panel is present in this base. No synthetic capability, PM launch grant, hire through the empty chief hireable list, roles/*.json change, extra scheduler service, live-instance action, configuration/credential mount or new worker import was added. Six role duty documents updated. Migration 3q-3r is necessary solely to add the checked advanced lifecycle event to the closed request_events kind list; it preserves rows, sequence and all append-only guards, with historical fixture/version pins updated. Corrections: migration digest/pins and one bundle tool-list assertion were updated; notification scheduling was narrowed so reads do not cause unsolicited bootstrap retries; an accidental repository-root npm test invocation reported no test script and was corrected to packages/harness. One broad bus run hit the pre-existing #656 FIFO child niceness 16 vs 19 assertion (also recorded by Task 4); that test passed 21/21 in isolation and the final full bus rerun passed without a source change to it. Final GREEN, zero skips: new 43/43, focused compatibility 56/56, harness 227/227, bus 1512/1512, business 305/305, launcher 36/36; extra sandbox import closure 11/11, git diff --check clean. Logs: /mnt/storage/scratch/tmp/task6b-final-new.log, task6b-final-focused.log, task6b-final-harness.log, task6b-final-bus.log, task6b-final-business.log, task6b-final-launcher.log and task6b-final-sandbox.log in the same directory; earlier failure/isolated logs retained. All test invocations used fresh TMPDIR directories from /mnt/storage/scratch/tmp/XXXXXX. Queue command refused this linked worktree, so no queue movement was attempted in the canonical checkout. One local implementation commit only; no push, merge, release, deployment or live-instance changes.
 2026-11-04T17:57:52Z | Codex implementation sub-agent, t3/lifecycle-task-6b-r2 | #797 / Gitea #1839 Task 6b rebase before/after | Before: local 347791b55 on the superseded Task 4 cherry-pick e41ec8159; origin/refactor is b5a58b48b4c254f166135c24e22bd63ce4b5e0b9 with Task 4 c098fa022, #772 793f3b157, Task 3 and Task 5b. After: replay only 347791b55 on the explicitly requested new branch t3/lifecycle-task-6b-r2; e41ec8159 is dropped. Shipped Task 3 migration 3q-3r and all seventeen existing migration files are byte-identical to the base. New 3r-3s rebuild preserves all fifteen shipped event kinds (including question.asked, question.answered, attach.selected and every Task 4 PRD/mode kind) and adds advanced, for sixteen; schema.sql matches, SCHEMA_VERSION=3s, SCHEMA_SHA256=fde7a46505a964d0e3802aaee96a1e2d9fb8c7163fbafc2f86aca914ecc50f03. The migration test carries rows of every prior kind, preserves a sqlite_sequence high-water mark, index and every request/effect guard, then appends advanced at the next sequence. Current-version, offline-chain and synthetic future-step test pins updated through 3s (future fixture 3t). Conflicts resolved by keeping both behavior sets: broker retains Console owner/verb guards, request question/answer/attach/cancel handlers, Task 5b builtin binding and scoped requirements/git admission, plus 6b advance and continuation services; lifecycle exports the union of Task 3 and 6b operations; runtime retains Task 5b builtin binding and #772 pending-product readiness while adding 6b recovery; harness keeps Task 5b project/snapshot/op schemas and catalog prose while adding 6b tools, with duplicate schema properties removed; six role duty documents merged cleanly and retained; append-only logs keep both sides. Integration corrections: unanswered owner questions suspend new continuation dispatch, answer evidence resumes it, and planning continuations carry the stable create op required by Task 5b. A real Task 5b adapter test creates/assigns the task with that op, advances it and keeps cross-project git refused. First full bus run 1554/1555 found a Task 3 global-zero-effects assertion; it now asserts attach preserves the exact preexisting continuation receipts. Another bus run and isolated #656 control reproduced the existing nice 16 versus 19 race: the installed Node scheduling rule changes startup priority. The owned FIFO child now sets priority after fixture construction immediately before the measured operation; all priority/nonblocking assertions remain intact, no daemon or live instance changed. FIFO 21/21 and final full bus 1555/1555 pass. First WebUI run 537/540, two failures and one skip: missing local esbuild 0.28.2 and one browser refresh timeout; npm ci --ignore-scripts installed only the locked WebUI dependencies, the browser file passes 2/2 in isolation, and whole WebUI passes 540/540 with MOSAIC_REQUIRE_EDITOR_BUILD=1 and test-concurrency=4. An accidental root npm test invocation reported no script and ran no tests; corrected to the bus package. Final GREEN, zero skips/cancellations: new 45/45, bus 1555/1555, harness 228/228, business 307/307, launch 8/8, whole WebUI 540/540. Every test invocation used its own mktemp -d /mnt/storage/scratch/tmp/XXXXXX TMPDIR. Logs /mnt/storage/scratch/tmp/task6b-r2-new-final.log, task6b-r2-bus-final.log, task6b-r2-harness.log, task6b-r2-business.log, task6b-r2-launch.log, task6b-r2-webui-final.log; complete per-run counts in task6b-r2-runs.json and schema evidence in task6b-r2-schema-proof.json in the same directory. No unresolved conflict, role JSON authority change, shipped migration edit, credential/config mount, push, merge, deployment or live-instance action. Queue command again refused this linked worktree; canonical coordination is unchanged. Local rebase only, with no attribution trailers.
+
+2026-11-04 | Codex implementation sub-agent, t3/release-811-migration-reader | Tracker #811 before/after | Before: on base 647626bdd1dbfe0fd5eebd1b0e717a2da8d2a644, the release admission and plan text readers omitted the inline 3p-to-3q and 3r-to-3s pairs, leaving 15 of the engine's 17 starting versions; the .53 Window C plan predicted store-newer for a 3r store. After: both readers recognize separate-line and inline pairs, and malformed key syntax is refused rather than silently skipped; the existing plan refusal for incomplete pairs remains. The regression imports the engine's private migration array through an in-memory test-only export, compares all 17 pairs and their order, exercises mixed layouts and malformed input, and failed on the unmodified script before passing. No store or migration changed. A full release run initially had 17 rehearsal failures because the requested base's rehearsal fixture omitted Task 5b's config imports; the test fixture now copies those dependencies, the affected rehearsal sweep passes, and the full release rerun passes. Final gates, zero skips: release 226/226, external release 25/25, stack-upgrade 34/34, focused rehearsal 21/21; syntax and diff checks passed. Each test run used a fresh TMPDIR from /mnt/storage/scratch/tmp/XXXXXX and fixture services, without Docker or live hosts. Logs: /mnt/storage/scratch/tmp/bqRed6/ (red.log, focused-final.log, stack-release.pre-fixture.log, rehearsal-group.log, stack-release.test.mjs.log, stack-release-external.test.mjs.log, stack-upgrade.test.mjs.log, static.log); interrupted preliminary runs also retained there. Canonical queue next for codex returned nothing; the linked worktree itself refused queue access. Local commit only, no push or live-instance action.

docs/SESSIONS.md

@@ -2013,3 +2013,4 @@ are never rewritten or removed; corrections are new entries.
 2026-11-04 | Codex implementation sub-agent, t3/lifecycle-task-6b | #797 / Gitea #1839 Task 6b | Typed PRD/advance and scoped draft reads; durable continuations, evidence acknowledgements, chief launch refusal/retry and manifest drain/relaunch; migration 3q-3r. New 43/43, focused 56/56, harness 227/227, bus 1512/1512, business 305/305, launcher 36/36, extra sandbox 11/11, zero skips; /mnt/storage/scratch/tmp/task6b-final-*.log. Task 4 cherry-pick e41ec8159 from 76207fe48; one local commit only, no push/live changes, queue left to canonical coordinator after linked-worktree refusal.
 2026-11-04 | Codex implementation sub-agent, t3/lifecycle-task-6b-r2 | #797 / Gitea #1839 Task 6b rebase onto b5a58b48b | Dropped e41ec8159; merged Task 3 controls/questions, Task 5b scope/op admission and 6b continuations. New migration 3r-3s retains all fifteen shipped kinds plus advanced; all shipped migrations unchanged. Added question/op integration checks and fixed owned FIFO priority setup timing without weakening assertions. Final new 45/45, bus 1555/1555, harness 228/228, business 307/307, launch 8/8, whole WebUI 540/540, zero skips; per-run counts/log paths /mnt/storage/scratch/tmp/task6b-r2-runs.json. Both append-only logs retained; local rebase only, no attribution trailers or push/live changes; queue remains with canonical coordinator after linked-worktree refusal.
 2026-11-04 | Codex implementation sub-agent, t3/lifecycle-task-6b-r3 | #797 / Gitea #1839 Task 6b rebase onto 68bef84fa | Kept both append-only log sides, the Task 4 snapshot-counter behavior and the full 6b continuation changes; 3r-3s migration remains byte-identical to 65588327d. Gates, zero skips: bus 1556/1556, harness 228/228, business 307/307, webui 554/554; logs /mnt/storage/scratch/tmp/nj4n7n/gate-*.log. Local commit only, no push.
+2026-11-04 | Codex implementation sub-agent, t3/release-811-migration-reader | Tracker #811 | Fixed inline migration-pair reading for release admission and plan; engine-order regression red before fix and green after, mixed and malformed fixtures covered. Repaired the pre-existing rehearsal test fixture's missing Task 5b imports. Final gates: release 226/226, external release 25/25, stack-upgrade 34/34, rehearsal sweep 21/21, zero skips; logs /mnt/storage/scratch/tmp/bqRed6/. Queue next returned nothing in canonical checkout; local commit only, no push or live-instance action.

packages/cli/tests/stack-release.test.mjs

@@ -297,6 +297,32 @@ test('T27 --plan names each migration step, or says the steps cannot be read',as
  assert.ok(short.out.includes(`\nmigration: 3f to 3g, after a backup of the stopped store\nmigration steps: cannot be read from ${COPIES}/${A}/packages/bus/src/store.mjs\nneeds: --migrate`),short.out);
 });
 
+// Exercise the actual shell readers on the target source, not a hand-maintained migration list.
+// The engine's private array is exported only in this in-memory module used by the test.
+test('#811 migration readers follow the engine order and refuse malformed pairs',async(t)=>{
+ const source=readFileSync(join(ROOT,'packages/bus/src/store.mjs'),'utf8');
+ const engineSource=source.replace('const migrations =', 'export const migrations =')
+  .replaceAll('import.meta.url',JSON.stringify(pathToFileURL(join(ROOT,'packages/bus/src/store.mjs')).href));
+ assert.notEqual(engineSource,source);
+ const engine=await import(`data:text/javascript;base64,${Buffer.from(engineSource).toString('base64')}`);
+ const pairs=engine.migrations.map(({from,to})=>[from,to]);
+ assert.equal(pairs.length,17);assert.deepEqual(pairs.at(-1),['3r','3s']);
+ const release=readFileSync(join(ROOT,'scripts/stack-release.sh'),'utf8');
+ const fn=(name)=>{const m=release.match(new RegExp(`^${name}\\(\\) \{[\\s\\S]*?^\}`, 'm'));assert.ok(m,name);return m[0]};
+ const functions=['copy_schema','target_schema','plan_steps'].map(fn).join('\n');
+ const dir=mkdtempSync(join(tmpdir(),'release-chain-'));t.after(()=>rmSync(dir,{recursive:true,force:true}));
+ const file=join(dir,'copy/packages/bus/src/store.mjs');mkdirSync(dirname(file),{recursive:true});
+ const read=(text,start,target)=>{
+  writeFileSync(file,text);
+  return spawnSync('bash',['-c',`${functions}\nCOPIES=$1; TO=copy; S_SCHEMA=$2; T_SCHEMA=$3\nif target_schema copy; then printf 'schema-ok\\n'; else printf 'schema-refused\\n'; T_CHAIN=(); fi\nprintf '%s\\n' "\${T_CHAIN[*]}"\nplan_steps`, 'reader',dir,start,target],{encoding:'utf8'});
+ };
+ const check=(text,steps)=>{const r=read(text,steps[0][0],steps.at(-1)[1]);assert.equal(r.status,0,r.stderr);assert.deepEqual(r.stdout.trimEnd().split('\n'),['schema-ok',steps.map(([from])=>from).join(' '),steps.map(([from,to])=>`${from} to ${to}`).join(', ')]);};
+ check(source,pairs);
+ check("export const SCHEMA_VERSION = '3e';\nfrom: '3b', to: '3c',\nfrom: '3c',\nto: '3d',\nfrom: '3d', to: '3e',\n",[['3b','3c'],['3c','3d'],['3d','3e']]);
+ const bad=read("export const SCHEMA_VERSION = '3d';\nfrom: '3b', to: '3c',\nfrom: '3c',\nto: ???,\n",'3b','3d');
+ assert.equal(bad.status,0,bad.stderr);assert.deepEqual(bad.stdout.trimEnd().split('\n'),['schema-refused','',`cannot be read from ${file}`]);
+});
+
 test('T25 --plan refuses copies-unrelated when neither copy is an ancestor of the other',async(t)=>{
  const e=await mk(t);await seed(e,{pointer:'hand'});
  const r=await run(e,'activate',S,'acme','--plan');assert.equal(r.code,3);
@@ -2038,11 +2064,12 @@ export class Store {
 
 // B (3g) and C (3h) have --no-launch. A is a copy from before row 163, whose host has no such flag.
 // C1's scripts/mosaic runs B's host, as a copy-check failure needs.
-// Row 294: config.mjs imports access.mjs, which imports transport.mjs, so each copy carries both.
+// Row 294: config.mjs imports access/transport. Task 5b also imports the built-in catalogue and
+// its task, bus, seat and processing-control dependencies; the rehearsal needs those files too.
 const RCOPIES=join(base,'rcopies');mkdirSync(RCOPIES);
 for(const [id,v,froms] of [[B,'3g',['3f']],[C,'3h',['3f','3g']],[A,'3g',['3f']],[C1,'3g',['3f']]]){
  const d=join(RCOPIES,id);
- for(const p of ['scripts/mosaic','scripts/mosaic-config.mjs','packages/cli/src/config.mjs','packages/cli/src/errors.mjs','packages/cli/src/access.mjs','packages/cli/src/transport.mjs','packages/bus/src/business.mjs','packages/plugins/src/kinds.mjs','packages/business/src','packages/library/src','roles'])cpSync(join(repo,p),join(d,p),{recursive:true});
+ for(const p of ['scripts/mosaic','scripts/mosaic-config.mjs','packages/cli/src/config.mjs','packages/cli/src/errors.mjs','packages/cli/src/access.mjs','packages/cli/src/transport.mjs','packages/bus/src/business.mjs','packages/bus/src/request-store.mjs','packages/bus/src/requirement-catalog.mjs','packages/tasks/src','packages/seat/src/landing.mjs','packages/seat/src/checkout.mjs','packages/processing-control/src','packages/plugins/src/kinds.mjs','packages/business/src','packages/library/src','roles'])cpSync(join(repo,p),join(d,p),{recursive:true});
  // Row 333 R2 (#1831): what the business loader imports from outside its directory, model-quota.mjs included.
  for(const p of businessImportedFiles(repo))if(!existsSync(join(d,p)))cpSync(join(repo,p),join(d,p));
  if(id===C1)writeFileSync(join(d,'scripts','mosaic'),`#!/usr/bin/env bash\nexec node "${join(RCOPIES,B,'packages','cli','src','cli.mjs')}" "$@"\n`,{mode:0o755});

scripts/stack-release.sh

@@ -316,10 +316,12 @@ copy_exists() ( source "$REPO/scripts/stack-copy.sh"; ID="$1"; COPIES="$COPIES_D
 copy_schema() {
     local f="$COPIES/$1/packages/bus/src/store.mjs" v
     [ -f "$f" ] || return 1
+    # A line that looks like a migration key but uses an unreadable layout must not be skipped.
+    if grep -E "^[[:space:]]*(from|to):" "$f" | grep -Ev "^[[:space:]]*((from|to): '[A-Za-z0-9]+',|from: '[A-Za-z0-9]+',[[:space:]]*to: '[A-Za-z0-9]+',)\$" >/dev/null; then return 1; fi
     v="$(grep -E "^export const SCHEMA_VERSION = '[A-Za-z0-9]+';\$" "$f")" || return 1
     [ "$(wc -l <<< "$v")" = 1 ] || return 1
     v="${v#*\'}"; echo "${v%%\'*}"
-    { grep -E "^[[:space:]]*from: '[A-Za-z0-9]+',\$" "$f" || true; } | sed "s/.*from: '\\([A-Za-z0-9]*\\)',\$/\\1/"
+    { grep -E "^[[:space:]]*from: '[A-Za-z0-9]+',([[:space:]]*to: '[A-Za-z0-9]+',)?\$" "$f" || true; } | sed -E "s/^[[:space:]]*from: '([A-Za-z0-9]+)',.*/\\1/"
 }
 
 # Sets T_SCHEMA and T_CHAIN (array) for copy $1; returns 1 when either read fails.
@@ -1391,7 +1393,8 @@ plan_steps() {
     local f="$COPIES/$TO/packages/bus/src/store.mjs" v="$S_SCHEMA" out="" i
     local -a l
     local -A next=()
-    mapfile -t l < <(grep -E "^[[:space:]]*(from|to): '[A-Za-z0-9]+',\$" "$f" | sed -E "s/^[[:space:]]*(from|to): '([A-Za-z0-9]*)',\$/\\1 \\2/")
+    mapfile -t l < <(grep -E "^[[:space:]]*(from|to):" "$f" |
+        sed -E "s/^[[:space:]]*from: '([A-Za-z0-9]+)',[[:space:]]*to: '([A-Za-z0-9]+)',\$/from \\1\\nto \\2/; s/^[[:space:]]*(from|to): '([A-Za-z0-9]+)',\$/\\1 \\2/")
     (( ${#l[@]} % 2 == 0 )) || { echo "cannot be read from $f"; return; }
     for ((i = 0; i < ${#l[@]}; i += 2)); do
         [[ "${l[i]}" == "from "* && "${l[i+1]}" == "to "* ]] || { echo "cannot be read from $f"; return; }