@6reduk/workspace-pipeline 0.1.0

package/src/operations/lifecycle.js

@@ -0,0 +1,133 @@
+import {preparePlan} from './plan.js';
+import {applyPrepared,preflightApply} from './apply.js';
+import {applyRetention} from './retention-apply.js';
+import {readRetentionPolicy,retentionLimits} from './retention-policy.js';
+import {scanRetention} from './retention-scan.js';
+import {scanCombinedRetention} from './retention-combined-scan.js';
+import {readState} from './state.js';
+import {acquireWorkspaceLock} from './lock.js';
+import {inspectHistory} from './history.js';
+import {requestShape} from './ownership.js';
+import {absoluteRoot,resolveChild} from '../workspace/paths.js';
+import {ContractError,fail} from '../contracts/parse.js';
+
+const commandGuard=command=>{if(!['setup','update'].includes(command))fail('lifecycle.command');};
+function registryGuard(registry) {
+  requestShape(registry,['adapters','sharedAdapter'],[],'provider.interface');
+}
+async function previousState(wrapper) {
+  try{return (await readState(resolveChild(wrapper,'.pipeline/state.json'))).value;}
+  catch(e){if(e.code==='record.missing')return null;throw e;}
+}
+function stateCommand(command,previous) {
+  if (command!==(previous?.active?'update':'setup')) fail('lifecycle.command-state');
+}
+async function historyGuard(wrapper) {
+  const history=await inspectHistory(wrapper);
+  if (!history.complete || history.diagnostics.length) fail('lifecycle.history');
+}
+
+// Preview may acquire source into temporary storage outside the workspace.
+// It never authorizes apply, edits provider files or manufactures user approval.
+export async function prepareLifecycle(input,registry) {
+  requestShape(input,['command','wrapper'],['manifestPath','network','tempRoot','rebind'],'lifecycle.input');
+  commandGuard(input.command);registryGuard(registry);
+  const wrapper=absoluteRoot(input.wrapper);
+  stateCommand(input.command,await previousState(wrapper));await historyGuard(wrapper);
+  const {command,...options}=input;
+  const prepared=await preparePlan({...options,wrapper,...registry});
+  if(prepared.preview.plan.command!==command)fail('lifecycle.command-drift');
+  return prepared;
+}
+
+// Trusted caller supplies both provider registry and output transport. Neither
+// callback nor executable adapters are accepted from pipeline package data.
+// The returned report contains locations/status codes, never raw config values.
+export async function applyLifecycle(input,registry,{report=async()=>{},retention=null}={}) {
+  requestShape(input,['command','wrapper','prepared','approval'],[],'lifecycle.input');
+  commandGuard(input.command);registryGuard(registry);
+  if(typeof report!=='function')fail('lifecycle.reporter');
+  // This is a separately approved exact cleanup, never a supplier policy or an
+  // implied consequence of approving setup/update. Detach before asynchronous IO.
+  if(retention!==null) {
+    requestShape(retention,['preview','approval'],[],'lifecycle.retention');
+    retention=structuredClone(retention);
+  }
+  requestShape(input.prepared,['kind','preview','stateFileHash','rebind','preparation','runtime','digest'],[],'lifecycle.prepared');
+  requestShape(input.prepared.preview,['schemaVersion','plan','observations','outputs','digest'],[],'lifecycle.preview');
+  requestShape(input.prepared.preview.plan,['schemaVersion','kind','workspace','command','beforeStateHash','source','desired','targets'],[],'lifecycle.plan');
+  const wrapper=absoluteRoot(input.wrapper),result={command:input.command,workspace:wrapper,status:'failed',
+    journal:null,recovery:null,error:null,lockRelease:'not-acquired',runtime:'not-run'};
+  let lock;
+  const emit=async event=>{try{await report(structuredClone(event));}catch{fail('lifecycle.report');}};
+  try {
+    // Reject wrong verb/root before acquiring a lock or creating metadata.
+    if(input.prepared?.preview?.plan?.command!==input.command || input.prepared?.preview?.plan?.workspace!==wrapper)
+      fail('lifecycle.prepared-binding');
+    lock=await acquireWorkspaceLock(wrapper);result.lockRelease='pending';
+    const previous=await previousState(wrapper);stateCommand(input.command,previous);
+    await historyGuard(wrapper);
+    const localPolicy=await readRetentionPolicy(wrapper);
+    if(localPolicy.mode==='automatic' && retention!==null)fail('lifecycle.retention-conflict');
+    if(localPolicy.mode==='automatic') {
+      await preflightApply(lock,input.prepared,input.approval,registry,previous);
+      retention={preview:await (localPolicy.policy.schemaVersion===2?scanCombinedRetention:scanRetention)(wrapper,{policy:retentionLimits(localPolicy.policy),now:Date.now()}),
+        approval:{decision:'workspace-policy',policyHash:localPolicy.hash}};
+    }
+    if(retention!==null) {
+      // No cleanup for a stale/unapproved main operation. Preflight is read-only.
+      await preflightApply(lock,input.prepared,input.approval,registry,previous);
+      result.cleanup={status:'not-started'};
+      try {
+        let announced=false;
+        result.cleanup=await applyRetention(lock,retention.preview,retention.approval,{report:async event=>{
+          if(!announced) {
+            announced=true;
+            await emit({kind:'startup-retention',previewDigest:retention.preview.digest,
+              policy:retention.preview.retention.policy,policyPath:localPolicy.path,policyHash:localPolicy.hash,
+              authorization:retention.approval.decision,totals:retention.preview.retention.totals,
+              protectedCount:retention.preview.retention.protected.length});
+          }
+          await emit(event);
+        }});
+      }catch(e) {
+        result.cleanup={status:'failed',error:e instanceof ContractError?e.code:'retention-apply.io'};
+      }
+      // Cleanup failure blocks new target writes. Keep its outcome separate:
+      // partial cleanup must not be described as a failed setup execution.
+      if(result.cleanup.status!=='completed' || result.cleanup.outputError) {
+        result.status='not-started';fail('lifecycle.retention');
+      }
+      await historyGuard(wrapper);
+    }
+    // Fresh preflight inside applyPrepared rechecks the main operation after
+    // cleanup. Its new journal does not exist during startup cleanup.
+    const applied=await applyPrepared(lock,input.prepared,input.approval,registry,previous,{
+      onJournal:async location=>{
+        const runId=location.relative.split('/').at(-1);
+        result.journal={runId,path:location.directory,status:location.status};
+        result.recovery={path:resolveChild(wrapper,'.pipeline/transactions/'+runId+'/recovery.json'),status:'not-created'};
+        await emit({kind:'journal-location',...result.journal,recovery:result.recovery});
+      },
+      ioBoundary:async detail=>{
+        if(detail.purpose==='recovery' && detail.phase==='opened') {
+          result.recovery.status='created-unverified';await emit({kind:'recovery-location',...result.recovery});
+        }
+        if(detail.purpose==='recovery' && detail.phase==='readback') {
+          result.recovery.status='verified';await emit({kind:'recovery-location',...result.recovery});
+        }
+      }
+    });
+    result.status=applied.status;
+  } catch(e) {result.error=e instanceof ContractError?e.code:'lifecycle.io';}
+  finally {
+    if(lock) {
+      try{await lock.release();result.lockRelease='released';}
+      catch(e){result.lockRelease='failed';result.releaseError=e instanceof ContractError?e.code:'lock.release';}
+    }
+  }
+  // Output failure after a committed installation must not rewrite its outcome.
+  try{await emit({kind:'operation-result',...result});}
+  catch{result.outputError='lifecycle.report';}
+  return result;
+}

package/src/operations/lineage-guard.js

@@ -0,0 +1,20 @@
+import {fail} from '../contracts/parse.js';
+
+export const MAX_CONTINUATION_DEPTH=32;
+const recoveryPath=/^\.pipeline\/transactions\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\/recovery\.json$/;
+
+export function assertContinuationCapacity(depth) {
+  if(!Number.isSafeInteger(depth) || depth<0 || depth>=MAX_CONTINUATION_DEPTH)fail('reconciliation.depth');
+}
+
+// One guard per traversal. Reject before opening the next record; package data
+// cannot change this limit or supply an alternative identity for the same path.
+export function createLineageGuard() {
+  const seen=new Set();
+  return Object.freeze({visit(path) {
+    if(typeof path!=='string' || !recoveryPath.test(path))fail('reconciliation.lineage');
+    if(seen.has(path))fail('reconciliation.cycle');
+    assertContinuationCapacity(seen.size);
+    seen.add(path);
+  }});
+}

package/src/operations/lock.js

@@ -0,0 +1,109 @@
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import { mkdir, open, readdir, unlink, rmdir, lstat } from 'node:fs/promises';
+import { ContractError, fail } from '../contracts/parse.js';
+import { absoluteRoot, inspectDirectory, resolveChild } from '../workspace/paths.js';
+import { readRecord } from './state.js';
+import { sha256 } from '../source/inventory.js';
+import { assertNoRepositoryPending,inspectRepositoryPending } from './repository-pending.js';
+import { assertBootstrapLockHeld } from './bootstrap-lock.js';
+import {assertNoMigrationPending} from './migration-pending.js';
+import {assertLegacyUnityLease,legacyUnityLeasePayload} from '../migrations/legacy-unity-lease.js';
+
+const heldLocks = new WeakMap();
+const migrationLocks = new WeakMap();
+export async function assertMigrationLockHeld(lock,recoveryPath,recoveryHash){
+  await assertLockHeld(lock);
+  const lease=migrationLocks.get(lock);
+  if(!lease)fail('migration.lock-capability');
+  const expected=legacyUnityLeasePayload(lease,lock.workspace);
+  if(expected.recoveryPath!==recoveryPath||expected.recoveryHash!==recoveryHash)fail('migration.lock-binding');
+}
+export async function assertLockHeld(lock) {
+  const check = lock && heldLocks.get(lock);
+  if (!check) fail('lock.capability');
+  await check();
+}
+
+// Cooperative workspace-local exclusion. Existing/stale locks are never stolen.
+// This does not prevent an editor or hostile process from replacing filesystem
+// entries; S5 apply must independently recheck each subject before every write.
+export async function acquireWorkspaceLock(workspace,{repositoryOperation,migrationOperation}={}) {
+  workspace = absoluteRoot(workspace);
+  if(repositoryOperation!==undefined&&migrationOperation!==undefined)fail('lock.capability-conflict');
+  const guard=async()=>{
+    if(migrationOperation!==undefined){
+      await assertLegacyUnityLease(migrationOperation,workspace);
+      const pending=await inspectRepositoryPending(workspace);
+      if(pending.blockers.some(b=>b.code!=='migration.pending'))fail('lock.repository-pending');
+    }else if(repositoryOperation!==undefined) {
+      // A repository-operation capability does not authorize migration recovery.
+      await assertNoMigrationPending(workspace);
+      await assertBootstrapLockHeld(repositoryOperation);
+      if(repositoryOperation.workspace!==workspace)fail('lock.repository-capability');
+    } else await assertNoRepositoryPending(workspace);
+  };
+  if (!(await inspectDirectory(workspace)).exists) fail('lock.workspace-missing');
+  await guard();
+  const metadata = resolveChild(workspace, '.pipeline');
+  const directory = resolveChild(workspace, '.pipeline/lock');
+  const ownerFile = resolveChild(workspace, '.pipeline/lock/owner.json');
+  let createdMetadata = null;
+  try {
+    try { await mkdir(metadata); createdMetadata = await lstat(metadata); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+    await inspectDirectory(metadata);
+    try { await mkdir(directory); }
+    catch (error) { if (error.code === 'EEXIST') fail('lock.busy'); throw error; }
+    // Failure after mkdir deliberately leaves a non-acquirable lock for review.
+    await inspectDirectory(directory);
+    const owner = { schemaVersion: 1, workspace, token: randomUUID(), pid: process.pid,
+      host: hostname(), createdAt: new Date().toISOString() };
+    const bytes = Buffer.from(JSON.stringify(owner) + '\n');
+    const handle = await open(ownerFile, 'wx', 0o600);
+    try { await handle.writeFile(bytes); await handle.sync(); }
+    finally { await handle.close(); }
+    const digest = sha256(bytes);
+    if ((await readRecord(ownerFile)).digest !== digest) fail('lock.readback');
+    await guard();
+    let released = false;
+    const check = async () => {
+      if (released) fail('lock.released');
+      await inspectDirectory(directory);
+      if ((await readRecord(ownerFile)).digest !== digest) fail('lock.owner-changed');
+      await guard();
+    };
+    const lock = Object.freeze({ workspace, directory, token: owner.token,
+      async release({removeEmptyMetadata=false}={}) {
+        if (released) fail('lock.released');
+        try {
+          await inspectDirectory(directory);
+          if ((await readRecord(ownerFile)).digest !== digest) fail('lock.owner-changed');
+          const entries = await readdir(directory);
+          if (entries.length !== 1 || entries[0] !== 'owner.json') fail('lock.foreign-entry');
+          await unlink(ownerFile);
+          // Non-recursive only: concurrent/foreign files prevent removal.
+          await rmdir(directory);
+          released = true;
+          // Only a failed migration start may remove metadata created by this
+          // lock. Never recursively delete, remove pre-existing metadata, or
+          // discard a marker/recovery/foreign entry left by an interrupted write.
+          if(removeEmptyMetadata && migrationOperation!==undefined && createdMetadata) {
+            const current=await lstat(metadata);
+            if(current.isDirectory() && !current.isSymbolicLink() &&
+                current.dev===createdMetadata.dev && current.ino===createdMetadata.ino) {
+              try { await rmdir(metadata); }
+              catch(error) { if(!['ENOTEMPTY','EEXIST'].includes(error.code))throw error; }
+            }
+          }
+        } catch (error) {
+          throw error instanceof ContractError ? error : new ContractError('lock.release-failed');
+        }
+      }
+    });
+    heldLocks.set(lock, check);
+    if(migrationOperation!==undefined)migrationLocks.set(lock,migrationOperation);
+    return lock;
+  } catch (error) {
+    throw error instanceof ContractError ? error : new ContractError('lock.io');
+  }
+}

package/src/operations/maintenance.js

@@ -0,0 +1,62 @@
+import {prepareRepairPlan,validateRepairRecord} from './repair.js';
+import {prepareRemoval,validateRemovalRecord} from './remove.js';
+import {applyRepair,applyRemoval} from './apply.js';
+import {acquireWorkspaceLock} from './lock.js';
+import {inspectHistory} from './history.js';
+import {requestShape} from './ownership.js';
+import {absoluteRoot,resolveChild} from '../workspace/paths.js';
+import {ContractError,fail} from '../contracts/parse.js';
+
+function guard(input,registry,apply=false) {
+  requestShape(input,apply?['command','wrapper','prepared','approval']:['command','wrapper'],apply?[]:['providers','bundles'],'maintenance.input');
+  if(!['repair','remove'].includes(input.command) || (input.command==='repair' && (input.providers!==undefined || input.bundles!==undefined)))fail('maintenance.command');
+  requestShape(registry,['adapters','sharedAdapter'],[],'provider.interface');
+  return absoluteRoot(input.wrapper);
+}
+async function historyGuard(workspace) {
+  const history=await inspectHistory(workspace);
+  if(!history.complete || history.diagnostics.length)fail('maintenance.history');
+}
+
+// Installed-snapshot operations only: no source acquisition or manifest rebind.
+export async function prepareMaintenance(input,registry) {
+  const workspace=guard(input,registry);await historyGuard(workspace);
+  return input.command==='repair'?prepareRepairPlan(workspace,registry):
+    prepareRemoval(workspace,registry,{...(input.providers===undefined?{}:{providers:input.providers}),
+      ...(input.bundles===undefined?{}:{bundles:input.bundles})});
+}
+
+export async function applyMaintenance(input,registry,{report=async()=>{}}={}) {
+  const workspace=guard(input,registry,true);
+  if(typeof report!=='function')fail('maintenance.reporter');
+  const result={command:input.command,workspace,status:'failed',journal:null,recovery:null,
+    error:null,lockRelease:'not-acquired',runtime:'not-run'};
+  const emit=async event=>{try{await report(structuredClone(event));}catch{fail('maintenance.report');}};
+  let lock;
+  try {
+    const prepared=(input.command==='repair'?validateRepairRecord:validateRemovalRecord)(input.prepared,input.approval);
+    if(prepared.preview?.plan?.workspace!==workspace || prepared.preview.plan.command!==input.command)fail('maintenance.prepared-binding');
+    lock=await acquireWorkspaceLock(workspace);result.lockRelease='pending';await historyGuard(workspace);
+    const applied=await (input.command==='repair'?applyRepair:applyRemoval)(lock,prepared,input.approval,registry,{
+      onJournal:async location=>{
+        const runId=location.relative.split('/').at(-1);
+        result.journal={runId,path:location.directory,status:location.status};
+        result.recovery={path:resolveChild(workspace,'.pipeline/transactions/'+runId+'/recovery.json'),status:'not-created'};
+        await emit({kind:'journal-location',...result.journal,recovery:result.recovery});
+      },
+      ioBoundary:async detail=>{
+        if(detail.purpose==='recovery' && ['opened','readback'].includes(detail.phase)) {
+          result.recovery.status=detail.phase==='opened'?'created-unverified':'verified';
+          await emit({kind:'recovery-location',...result.recovery});
+        }
+      }
+    });
+    result.status=applied.status;
+  }catch(error){result.error=error instanceof ContractError?error.code:'maintenance.io';}
+  finally {
+    if(lock)try{await lock.release();result.lockRelease='released';}
+    catch(error){result.lockRelease='failed';result.releaseError=error instanceof ContractError?error.code:'lock.release';}
+  }
+  try{await emit({kind:'operation-result',...result});}catch{result.outputError='maintenance.report';}
+  return result;
+}

package/src/operations/migration-pending.js

@@ -0,0 +1,22 @@
+import {lstat} from 'node:fs/promises';
+import {absoluteRoot,resolveChild,inspectDirectory} from '../workspace/paths.js';
+import {fail,ContractError} from '../contracts/parse.js';
+
+// Presence is a blocker regardless of record validity. A partial write, directory
+// or link must never be interpreted as permission to start a different lifecycle.
+// This reader does not follow the marker, delete it or infer recovery authority.
+export async function inspectMigrationPending(workspace){
+ workspace=absoluteRoot(workspace);
+ const relative='.pipeline/migration-operation.json',subject=resolveChild(workspace,relative);
+ try{
+  await inspectDirectory(resolveChild(workspace,'.pipeline'));
+  await lstat(subject);
+  return {workspace,blocked:true,blockers:[{code:'migration.pending',subject}]};
+ }catch(error){
+  if(error.code==='ENOENT')return {workspace,blocked:false,blockers:[]};
+  throw error instanceof ContractError?error:new ContractError('migration.pending-io');
+ }
+}
+export async function assertNoMigrationPending(workspace){
+ if((await inspectMigrationPending(workspace)).blocked)fail('migration.pending');
+}

package/src/operations/ownership.js

@@ -0,0 +1,122 @@
+import { fail } from '../contracts/parse.js';
+import { contractDigest } from '../contracts/semantic.js';
+
+const hashPattern = /^sha256:[a-f0-9]{64}$/;
+const validHash = value => value === null || (typeof value === 'string' && hashPattern.test(value));
+
+// Only plain own data properties: fail before invoking getters or reading fields.
+export function requestShape(value, required, optional, code) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value) ||
+      ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail(code);
+  const allowed = new Set([...required, ...optional]);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!allowed.has(key) || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) fail(code);
+  }
+  if (required.some(key => !Object.hasOwn(value, key))) fail(code);
+}
+
+// Pure reconciliation, not authorization or a state writer. Null means absent;
+// JSON null has a non-null digest. Explicit takeover is bound to observed bytes
+// (or field value); the final preview still needs user approval before apply.
+export function reconcileOwnership({ currentHash, desiredHash, managedHash = null, takeover = null }) {
+  if (![currentHash, desiredHash, managedHash].every(validHash)) fail('ownership.hash');
+  if (takeover !== null && (typeof takeover !== 'object' ||
+      Object.keys(takeover).sort().join(',') !== 'beforeHash,desiredHash' ||
+      takeover.beforeHash !== currentHash || takeover.desiredHash !== desiredHash)) fail('ownership.takeover');
+
+  if (managedHash !== null && currentHash !== managedHash) fail('ownership.drift');
+  if (desiredHash === null) {
+    if (managedHash === null) return { action: 'preserve', owned: false, backupRequired: false };
+    return { action: 'delete', owned: false, backupRequired: true };
+  }
+  if (managedHash !== null) return {
+    action: currentHash === desiredHash ? 'preserve' : 'replace', owned: true,
+    backupRequired: currentHash !== desiredHash
+  };
+  if (currentHash === null) return { action: 'create', owned: true, backupRequired: false };
+  if (takeover !== null) return {
+    action: currentHash === desiredHash ? 'preserve' : 'replace', owned: true, backupRequired: true
+  };
+  if (currentHash === desiredHash) return { action: 'preserve', owned: false, backupRequired: false };
+  fail('ownership.foreign');
+}
+
+function tokens(pointer) {
+  if (typeof pointer !== 'string' || !pointer.startsWith('/') || /~(?![01])/.test(pointer)) fail('ownership.pointer');
+  const result = pointer.slice(1).split('/').map(s => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+  if (result.some(s => ['__proto__', 'prototype', 'constructor'].includes(s))) fail('ownership.pointer');
+  return result;
+}
+
+// Accept only JSON-domain data, including null-prototype parser objects. No
+// getters, exotic prototypes, sparse arrays, cycles, or implicit JSON coercions.
+function jsonCopy(value, depth = 0, seen = new Set()) {
+  if (depth > 64) fail('ownership.value');
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
+  if (typeof value === 'number' && Number.isFinite(value) && (!Number.isInteger(value) || Number.isSafeInteger(value))) return value;
+  if (typeof value !== 'object' || seen.has(value)) fail('ownership.value');
+  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+  if (!array && proto !== null && proto !== Object.prototype) fail('ownership.value');
+  seen.add(value);
+  const result = array ? [] : Object.create(null);
+  const keys = Reflect.ownKeys(value).filter(k => !(array && k === 'length'));
+  if (array && (keys.length !== value.length || keys.some((k, i) => k !== String(i)))) fail('ownership.value');
+  for (const key of keys) {
+    const d = Object.getOwnPropertyDescriptor(value, key);
+    if (typeof key !== 'string' || !d.enumerable || !Object.hasOwn(d, 'value') ||
+        ['__proto__', 'prototype', 'constructor'].includes(key)) fail('ownership.value');
+    result[key] = jsonCopy(d.value, depth + 1, seen);
+  }
+  seen.delete(value);
+  return result;
+}
+
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+function field(root, parts) {
+  let node = root;
+  for (const part of parts) {
+    if (!object(node)) fail('ownership.ancestor');
+    if (!Object.hasOwn(node, part)) return { present: false };
+    node = node[part];
+  }
+  return { present: true, value: node };
+}
+
+// Trusted adapters supply requests for exact JSON pointers. Arrays may be owned
+// as whole values, never addressed by index. Foreign siblings stay intact.
+// This layer does not infer provider/path permissions or persist backup records.
+export function reconcileFields(current, requests) {
+  const result = jsonCopy(current);
+  if (!object(result) || !Array.isArray(requests) || requests.length > 1000) fail('ownership.fields');
+  const ordered = Array.from(requests, request => {
+    requestShape(request, ['pointer', 'present'], ['value', 'managedHash', 'takeover'], 'ownership.fields');
+    const parts = tokens(request.pointer);
+    if (typeof request.present !== 'boolean' || (request.present && !Object.hasOwn(request, 'value'))) fail('ownership.fields');
+    return { request, parts };
+  }).sort((a, b) => a.request.pointer < b.request.pointer ? -1 : a.request.pointer > b.request.pointer ? 1 : 0);
+  for (let i = 0; i < ordered.length; i++) for (let j = 0; j < i; j++) {
+    const a = ordered[i].parts, b = ordered[j].parts;
+    if (a.slice(0, Math.min(a.length, b.length)).every((p, k) => p === b[k])) fail('ownership.overlap');
+  }
+  const decisions = [];
+  for (const { request, parts } of ordered) {
+    const before = field(result, parts), desired = request.present ? jsonCopy(request.value) : undefined;
+    const currentHash = before.present ? contractDigest(before.value) : null;
+    const desiredHash = request.present ? contractDigest(desired) : null;
+    const decision = reconcileOwnership({ currentHash, desiredHash, managedHash: request.managedHash ?? null, takeover: request.takeover ?? null });
+    if (decision.action !== 'preserve') {
+      let parent = result;
+      for (const part of parts.slice(0, -1)) {
+        if (!Object.hasOwn(parent, part)) parent[part] = Object.create(null);
+        if (!object(parent[part])) fail('ownership.ancestor');
+        parent = parent[part];
+      }
+      const last = parts.at(-1);
+      if (decision.action === 'delete') delete parent[last];
+      else parent[last] = desired;
+    }
+    decisions.push({ pointer: request.pointer, currentHash, desiredHash, ...decision });
+  }
+  return { value: result, decisions };
+}