@akagilnc/pi-workflow-roles 0.1.3932 → 0.1.3975

package/src/ticket-provenance.ts

@@ -56,25 +56,51 @@ export function ticketProvenanceEntryIdentity(
 
 export type AppendTicketProvenanceInput = {
   readonly ticketNumber: number;
-  readonly entry: TicketProvenanceEntry;
   readonly cwd: string;
+  /** Original diarist row (or `{ original, unprojected: true }` envelope). */
+  readonly payload: unknown;
   /** Explicit package home (tests / admitted run); never process.env.HOME (#604). */
   readonly home?: string;
   readonly host?: string;
   readonly source?: string;
 };
 
-/** Append one transcribed block; returns existing pointer on identity hit. */
+function identityFromPayload(ticketNumber: number, payload: unknown): string {
+  if (
+    typeof payload === "object"
+    && payload !== null
+    && !Array.isArray(payload)
+  ) {
+    const record = payload as Record<string, unknown>;
+    if (typeof record.sourceKind === "string" && typeof record.transcript === "string") {
+      const sourceRef = typeof record.sourceRef === "object" && record.sourceRef !== null && !Array.isArray(record.sourceRef)
+        ? record.sourceRef as TicketProvenanceIdentityInput["sourceRef"]
+        : {};
+      return ticketProvenanceEntryIdentity({
+        ticketNumber,
+        sourceKind: record.sourceKind,
+        sourceRef,
+        transcript: record.transcript,
+      });
+    }
+  }
+  return createHash("sha256")
+    .update(`${String(ticketNumber)}\u0000${JSON.stringify(payload)}`, "utf8")
+    .digest("hex");
+}
+
+/** Append one original row; returns existing pointer on identity hit. */
 export function appendTicketProvenanceEntry(
   input: AppendTicketProvenanceInput,
 ): RecordPointer {
   const subject = ticketProvenanceSubject(input.ticketNumber);
-  const identity = ticketProvenanceEntryIdentity({
-    ticketNumber: input.ticketNumber,
-    sourceKind: input.entry.sourceKind,
-    sourceRef: input.entry.sourceRef,
-    transcript: input.entry.transcript,
-  });
+  const identity = identityFromPayload(input.ticketNumber, input.payload);
+  const record = typeof input.payload === "object" && input.payload !== null && !Array.isArray(input.payload)
+    ? input.payload as Record<string, unknown>
+    : undefined;
+  const sourceRef = record !== undefined && typeof record.sourceRef === "object" && record.sourceRef !== null && !Array.isArray(record.sourceRef)
+    ? record.sourceRef as { sessionFile?: unknown; entryId?: unknown }
+    : undefined;
   return sitianReport({
     level: "event",
     kind: TICKET_PROVENANCE_KIND,
@@ -84,13 +110,14 @@ export function appendTicketProvenanceEntry(
     ...(input.home === undefined ? {} : { home: input.home }),
     host: input.host ?? "diarist",
     source: input.source ?? "diarist",
-    payload: input.entry,
+    payload: input.payload,
     raw:
-      input.entry.sourceRef.sessionFile !== undefined &&
-      input.entry.sourceRef.entryId !== undefined
+      sourceRef !== undefined
+      && typeof sourceRef.sessionFile === "string"
+      && (typeof sourceRef.entryId === "string" || typeof sourceRef.entryId === "number")
         ? {
-            sessionFile: input.entry.sourceRef.sessionFile,
-            entryId: input.entry.sourceRef.entryId,
+            sessionFile: sourceRef.sessionFile,
+            entryId: sourceRef.entryId,
           }
         : undefined,
   });
@@ -125,6 +152,11 @@ export function resolveTicketProvenanceVolume(
 export type ReadTicketProvenanceResult = {
   /** Readable diary body entries only. */
   readonly entries: readonly TicketProvenanceEntry[];
+  /**
+   * Original payloads that did not project — kept beside typed entries (#836 / ADR 0075).
+   * Never dropped from the volume.
+   */
+  readonly unprojected: readonly unknown[];
   /** Typed diagnostics on the same partition (collector/issue-source failures). */
   readonly diagnostics: readonly TicketProvenanceDiagnostic[];
   readonly records: readonly SitianRecord[];
@@ -142,6 +174,7 @@ export async function readTicketProvenance(
   const { recordFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
   const { records } = await readSitianRecords(recordFile);
   const entries: TicketProvenanceEntry[] = [];
+  const unprojected: unknown[] = [];
   const diagnostics: TicketProvenanceDiagnostic[] = [];
   let skipped = 0;
   for (const record of records) {
@@ -157,12 +190,12 @@ export async function readTicketProvenance(
     }
     const entry = projectTicketProvenanceEntry(record.payload);
     if (entry === undefined) {
-      skipped += 1;
+      unprojected.push(record.payload);
       continue;
     }
     entries.push(entry);
   }
-  return { entries, diagnostics, records, recordFile, skipped };
+  return { entries, unprojected, diagnostics, records, recordFile, skipped };
 }
 
 /**
@@ -187,45 +220,76 @@ function markdownFenceFor(text: string): string {
 export function renderTicketProvenanceMarkdown(input: {
   readonly ticketNumber: number;
   readonly entries: readonly TicketProvenanceEntry[];
+  readonly unprojected?: readonly unknown[];
 }): string {
+  const unprojected = input.unprojected ?? [];
   const lines: string[] = [
     `# 起居录 · #${input.ticketNumber}`,
     "",
-    `条目数：${input.entries.length}`,
+    `条目数：${input.entries.length + unprojected.length}`,
     "",
   ];
   let index = 0;
   for (const entry of input.entries) {
     index += 1;
-    lines.push(`## ${index}. ${entry.sourceKind} · ${entry.timestamp}`);
+    const sourceKind = typeof entry.sourceKind === "string" ? entry.sourceKind : "未投影";
+    const timestamp = typeof entry.timestamp === "string" ? entry.timestamp : "";
+    lines.push(`## ${index}. ${sourceKind} · ${timestamp}`);
     lines.push("");
-    lines.push(`- basis.method: \`${entry.basis.method}\``);
-    if (entry.basis.anchors !== undefined && entry.basis.anchors.length > 0) {
-      lines.push(`- anchors: ${entry.basis.anchors.map((a) => `\`${a}\``).join(", ")}`);
+    const basis = entry.basis;
+    const method =
+      typeof basis === "object" && basis !== null && !Array.isArray(basis) && typeof basis.method === "string"
+        ? basis.method
+        : "未投影";
+    lines.push(`- basis.method: \`${method}\``);
+    if (
+      typeof basis === "object" &&
+      basis !== null &&
+      !Array.isArray(basis) &&
+      Array.isArray(basis.anchors) &&
+      basis.anchors.length > 0
+    ) {
+      lines.push(`- anchors: ${basis.anchors.map((a) => `\`${String(a)}\``).join(", ")}`);
     }
-    if (entry.basis.note !== undefined) {
-      lines.push(`- note: ${entry.basis.note}`);
+    if (typeof basis === "object" && basis !== null && !Array.isArray(basis) && basis.note !== undefined) {
+      lines.push(`- note: ${String(basis.note)}`);
     }
+    const sourceRef =
+      typeof entry.sourceRef === "object" && entry.sourceRef !== null && !Array.isArray(entry.sourceRef)
+        ? entry.sourceRef as { sessionFile?: unknown; entryId?: unknown; path?: unknown; url?: unknown }
+        : {};
     const refParts: string[] = [];
-    if (entry.sourceRef.sessionFile !== undefined) {
-      refParts.push(`sessionFile=${entry.sourceRef.sessionFile}`);
+    if (sourceRef.sessionFile !== undefined) {
+      refParts.push(`sessionFile=${String(sourceRef.sessionFile)}`);
     }
-    if (entry.sourceRef.entryId !== undefined) {
-      refParts.push(`entryId=${String(entry.sourceRef.entryId)}`);
+    if (sourceRef.entryId !== undefined) {
+      refParts.push(`entryId=${String(sourceRef.entryId)}`);
     }
-    if (entry.sourceRef.path !== undefined) {
-      refParts.push(`path=${entry.sourceRef.path}`);
+    if (sourceRef.path !== undefined) {
+      refParts.push(`path=${String(sourceRef.path)}`);
     }
-    if (entry.sourceRef.url !== undefined) {
-      refParts.push(`url=${entry.sourceRef.url}`);
+    if (sourceRef.url !== undefined) {
+      refParts.push(`url=${String(sourceRef.url)}`);
     }
     if (refParts.length > 0) {
       lines.push(`- sourceRef: ${refParts.join(" · ")}`);
     }
     lines.push("");
-    const fence = markdownFenceFor(entry.transcript);
+    const transcript = typeof entry.transcript === "string" ? entry.transcript : JSON.stringify(entry);
+    const fence = markdownFenceFor(transcript);
+    lines.push(fence);
+    lines.push(transcript);
+    lines.push(fence);
+    lines.push("");
+  }
+  for (const payload of unprojected) {
+    index += 1;
+    lines.push(`## ${index}. 未投影`);
+    lines.push("");
+    const text = typeof payload === "string" ? payload : JSON.stringify(payload);
+    const fence = markdownFenceFor(text);
     lines.push(fence);
-    lines.push(entry.transcript);
+    lines.push(text);
     lines.push(fence);
     lines.push("");
   }
@@ -257,11 +321,13 @@ export function writeTicketProvenanceHumanView(input: {
   readonly cwd: string;
   readonly home?: string;
   readonly entries: readonly TicketProvenanceEntry[];
+  readonly unprojected?: readonly unknown[];
 }): string {
   const volume = ensureTicketProvenanceVolume(input.ticketNumber, input.cwd, input.home);
   const md = renderTicketProvenanceMarkdown({
     ticketNumber: input.ticketNumber,
     entries: input.entries,
+    ...(input.unprojected === undefined ? {} : { unprojected: input.unprojected }),
   });
   writeFileSync(volume.humanViewFile, md, "utf8");
   return volume.humanViewFile;

package/src/worker-role.ts

@@ -1,5 +1,4 @@
 import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
-import { stringEnum } from "./host-contracts.ts";
 import { Type, type Static } from "typebox";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
 import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
@@ -20,7 +19,7 @@ import {
   type WorkerOutput,
   type WorkerRoleLabel,
 } from "./package-contracts/worker-output.ts";
-import { fixerOutputSchema, validateFixerOutput, validateFixerOutputForPacket, type FixerPhase } from "./package-contracts/fixer-output.ts";
+import { fixerOutputSchema, validateFixerOutput, type FixerPhase } from "./package-contracts/fixer-output.ts";
 import {
   FixerPacketValidationError,
   parseFixerPrerequisites,
@@ -45,25 +44,28 @@ export {
 };
 export type { WorkerOutput };
 
+// #836 r16 class 1: report/remainingScope are LLM/human-read narrative content —
+// no code branches on their length. `reason` alone keeps minLength: the worker
+// gate reads `reason.trim().length > 0` to pick typed-reminder-bounce vs accept
+// (src/worker-submission-gates.ts:159-163,297-302).
+// #836 (ADR 0003 Amendment): status kept open like countersignStatus
+// (src/countersign-role.ts) — one shared description across every variant
+// so openToolObjectFromUnion's identical-declaration collapse drops none of it.
+const CODER_STATUS_DESCRIPTION =
+  "planned | completed | refused | unfinished — 形状指引，非 schema 闸；completed 回执含 TDD、同模式、引入回归、行为事实四项证据；unfinished 缺前置或违宪约束致本局未完成时可用，缺待决 owner 决定或答复属缺前置。" as const;
 const coderOutputVariants = Type.Union([
   Type.Object({
-    status: stringEnum(["planned"] as const, { description: "planned — 形状指引，非 schema 闸" }),
-    report: Type.String({ minLength: 1, description: "如实结果报告" }),
+    status: Type.Unknown({ description: CODER_STATUS_DESCRIPTION }),
+    report: Type.String({ description: "如实结果报告" }),
   }, { additionalProperties: false }),
   Type.Object({
-    status: stringEnum(["completed", "refused"] as const, {
-      description:
-        "completed | refused — 形状指引，非 schema 闸；completed 回执含 TDD、同模式、引入回归、行为事实四项证据",
-    }),
-    report: Type.String({ minLength: 1, description: "如实结果报告" }),
+    status: Type.Unknown({ description: CODER_STATUS_DESCRIPTION }),
+    report: Type.String({ description: "如实结果报告" }),
   }, { additionalProperties: false }),
   Type.Object({
-    status: stringEnum(["unfinished"] as const, {
-      description:
-        "unfinished — 形状指引，非 schema 闸；缺前置或违宪约束致本局未完成时可用。缺待决 owner 决定或答复属缺前置。",
-    }),
-    report: Type.String({ minLength: 1, description: "如实结果报告" }),
-    remainingScope: Type.String({ minLength: 1, description: "本局后剩余工作" }),
+    status: Type.Unknown({ description: CODER_STATUS_DESCRIPTION }),
+    report: Type.String({ description: "如实结果报告" }),
+    remainingScope: Type.String({ description: "本局后剩余工作" }),
     reason: Type.Optional(Type.String({
       minLength: 1,
       description:
@@ -151,6 +153,17 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * Read the accepted receipt's own `status` word as submitted (#836: `status`
+ * stays an open Type.Unknown provider field, so FixerOutput's Static type no
+ * longer narrows it to a literal union — code still just reads whatever
+ * string the role wrote; a non-string status reads as "" and simply misses
+ * every known-status gate below, same as any other unrecognized status).
+ */
+function workerStatusOf(output: WorkerOutput): string {
+  return typeof output.status === "string" ? output.status : "";
+}
+
 function deepFreeze<T>(value: T): T {
   if (typeof value !== "object" || value === null || Object.isFrozen(value)) return value;
   for (const child of Object.values(value)) deepFreeze(child);
@@ -261,16 +274,16 @@ export function createFixerRoleRuntime(
             if (packet === undefined || phase === undefined) {
               throw new Error("修内司修理包与阶段未装载");
             }
-            const output = deepFreeze(validateFixerOutputForPacket(parameters, phase, packet));
+            const output = deepFreeze(validateFixerOutput(parameters, phase));
             assertAcceptableThroughHost(
               submissionGate,
-              output.status,
+              workerStatusOf(output),
               output,
               hostActions,
               ctx,
               toolCallId,
             );
-            if (WORKER_DONE_STATUSES.has(output.status)) {
+            if (WORKER_DONE_STATUSES.has(workerStatusOf(output))) {
               await pi.requireGatekeeperPass!({
                 context: ctx,
                 subject: { kind: "worker_completion" },
@@ -331,7 +344,6 @@ export function createCoderRoleRuntime(
   let tddInvocationInjected = false;
   let originalRequest: string | undefined;
   let expansionPending = false;
-  let expansionCaptured = false;
   let lifecycleRegistered = false;
   const submissionGate = createWorkerSubmissionGate();
 
@@ -352,7 +364,6 @@ export function createCoderRoleRuntime(
       tddInvocationInjected = false;
       originalRequest = undefined;
       expansionPending = false;
-      expansionCaptured = false;
       soul = (await dependencies.loadSoul()).trim();
       if (soul.length === 0) throw new Error("Coder soul is empty");
       const selectedPhase = pi.getFlag("ak-coder-phase");
@@ -400,23 +411,17 @@ export function createCoderRoleRuntime(
               throw new Error("将作监任务与阶段未装载");
             }
             const output = validateWorkerOutput(parameters, phase, "Coder");
-            if (
-              phase === "apply" && output.status === "completed" &&
-              !expansionCaptured
-            ) {
-              const rejection = new CoderSkillExpansionEvidenceMissingError();
-              hostActions.bindSubmissionNonPass(toolCallId, rejection.result);
-              throw rejection;
-            }
+            // #836: skill-expansion evidence rejection deleted (陛下「2.4/5 删」).
+            // Skill still ships with the package (ADR 0052); code no longer refuses on it.
             assertAcceptableThroughHost(
               submissionGate,
-              output.status,
+              workerStatusOf(output),
               output,
               hostActions,
               ctx,
               toolCallId,
             );
-            if (WORKER_DONE_STATUSES.has(output.status)) {
+            if (WORKER_DONE_STATUSES.has(workerStatusOf(output))) {
               await pi.requireGatekeeperPass!({
                 context: ctx,
                 subject: { kind: "worker_completion" },
@@ -459,12 +464,6 @@ export function createCoderRoleRuntime(
             }
             if (expansionPending) {
               expansionPending = false;
-              if (originalRequest !== undefined) {
-                expansionCaptured = binding.captureExpansion(
-                  pi.capabilities?.skillExpansion(event.prompt),
-                  originalRequest,
-                ) !== undefined;
-              }
             }
           }
           return {

package/dist/activation-ledger-session.js

@@ -1,105 +0,0 @@
-import { lstatSync, realpathSync, statSync, writeFileSync, } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
-import { errnoCode, errorText, } from "./activation-ledger-topology.js";
-/**
- * Typed missing durable session principal. Callers discriminate with instanceof/code;
- * never by parsing message prose. Original filesystem causes are retained.
- */
-export class ActivationSessionFileMissingError extends Error {
-    code = "AK_ACTIVATION_SESSION_FILE_MISSING";
-    path;
-    constructor(path, options) {
-        super(`Workflow role activation durable session file does not exist: ${path}`, options?.cause === undefined ? undefined : { cause: options.cause });
-        this.name = "ActivationSessionFileMissingError";
-        this.path = path;
-    }
-}
-function materializeDeferredSessionFile(sessionManager, resolvedFile) {
-    const header = sessionManager.getHeader?.();
-    if (header === null || header === undefined || header.type !== "session") {
-        throw new ActivationSessionFileMissingError(resolvedFile);
-    }
-    // Activation does not own record placement (ADR 0065 / #221). Parent directory is the
-    // SessionManager principal's own dir — write the header in place; do not pull ledgerHome
-    // containment or ensureRealDirectoryTree back onto this admission path.
-    try {
-        writeFileSync(resolvedFile, `${JSON.stringify(header)}\n`, { flag: "wx" });
-    }
-    catch (error) {
-        if (errnoCode(error) !== "EEXIST") {
-            throw new Error(`Workflow role activation failed to materialize durable session file (${resolvedFile}): ${errorText(error)}`, { cause: error });
-        }
-        // Lost a create race — validate the winner below.
-    }
-    // Rebind full SessionManager so subsequent Pi appends use O_APPEND (flushed=true)
-    // instead of exclusive wx create against the file we just wrote.
-    if (typeof sessionManager.setSessionFile === "function") {
-        sessionManager.setSessionFile(resolvedFile);
-    }
-}
-/**
- * Admit a durable Pi session file principal (ADR 0048/0065).
- * Requires an existing regular file at admission (or a live SessionManager header that
- * can be materialized onto the same path). Rejects relative paths, directories,
- * non-files, and nonexistent paths that cannot be materialized. Original filesystem
- * causes are retained.
- *
- * Record-placement (session must live under the ledger book) is NOT enforced here —
- * that check lives on the archivist record entry (createRecordSession). Activation only
- * binds the durable principal identity for the role run.
- *
- * Upstream Pi defers exclusive create until the first assistant message. When the path
- * is the live SessionManager principal and only the header is in memory, admission
- * materializes that header onto the same path before the fact is written so the role
- * fact never points at a session that may be created later.
- */
-export function durableSessionPointer(sessionManager) {
-    const file = sessionManager.getSessionFile?.();
-    if (typeof file !== "string" || file.length === 0) {
-        throw new Error("Workflow role activation requires a durable Pi session file principal (getSessionFile); directory-only or --no-session invocations are rejected");
-    }
-    if (!isAbsolute(file)) {
-        throw new Error(`Workflow role activation requires an absolute durable session file path; got relative path: ${file}`);
-    }
-    const resolvedFile = resolve(file);
-    try {
-        lstatSync(resolvedFile);
-    }
-    catch (error) {
-        if (errnoCode(error) !== "ENOENT") {
-            throw new Error(`Workflow role activation failed to stat durable session file (${resolvedFile}): ${errorText(error)}`, { cause: error });
-        }
-        try {
-            materializeDeferredSessionFile(sessionManager, resolvedFile);
-        }
-        catch (materializeError) {
-            // Missing principal: rethrow typed missing-file identity with the original ENOENT cause.
-            // Other materialize failures keep their own typed/native identity.
-            if (materializeError instanceof ActivationSessionFileMissingError) {
-                throw new ActivationSessionFileMissingError(resolvedFile, { cause: error });
-            }
-            throw materializeError;
-        }
-    }
-    let realFile;
-    try {
-        realFile = realpathSync(resolvedFile);
-    }
-    catch (error) {
-        throw new ActivationSessionFileMissingError(resolvedFile, { cause: error });
-    }
-    let info;
-    try {
-        info = statSync(realFile);
-    }
-    catch (error) {
-        throw new Error(`Workflow role activation failed to stat durable session file (${realFile}): ${errorText(error)}`, { cause: error });
-    }
-    if (info.isDirectory()) {
-        throw new Error(`Workflow role activation durable session principal must be a file, not a directory: ${realFile}`);
-    }
-    if (!info.isFile()) {
-        throw new Error(`Workflow role activation durable session principal is not a regular file: ${realFile}`);
-    }
-    return { kind: "session-file", path: realFile };
-}

package/dist/activation-ledger.js

@@ -1,139 +0,0 @@
-import { constants, closeSync, fstatSync, openSync, writeSync, } from "node:fs";
-import { dirname, isAbsolute, resolve } from "node:path";
-import { ActivationLedgerError, activationWaitingLedgerPath, assertLedgerFileInsideHome, ensureRealDirectoryTree, errorText, } from "./activation-ledger-topology.js";
-/** Private open flags: O_NOFOLLOW closes the lstat→open TOCTOU window. */
-const ACTIVATION_LEDGER_APPEND_OPEN_FLAGS = constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY | constants.O_NOFOLLOW;
-export { ActivationGitRepositoryRequiredError, resolveBookKeyFromGit, } from "./activation-ledger-git.js";
-export { ActivationSessionFileMissingError, durableSessionPointer, } from "./activation-ledger-session.js";
-export { ActivationLedgerError, activationBookDirectory, activationWaitingLedgerPath, resolveActivationLedgerHome, } from "./activation-ledger-topology.js";
-export const ACCEPTED_ACTIVATION_EVENT = "accepted-activation";
-/**
- * Package-owned index-only top-level keys for accepted-activation facts (ADR 0049).
- * Sole machine key contract: projection and tests consume this descriptor — not prose markers.
- */
-export const ACCEPTED_ACTIVATION_FACT_KEYS = Object.freeze([
-    "event",
-    "role",
-    "observedAt",
-    "bookKey",
-    "session",
-    "correlation",
-]);
-const _acceptedActivationFactKeysMatch = true;
-void _acceptedActivationFactKeysMatch;
-/**
- * Host correlation channel (not a CLI flag): a non-blank AK_CORRELATION_ID carries
- * the caller id verbatim; missing/blank/whitespace-only yields the typed absent identity.
- */
-export function correlationIdentityFromEnv(env = process.env) {
-    const raw = env.AK_CORRELATION_ID;
-    if (typeof raw === "string" && raw.trim().length > 0) {
-        return { kind: "caller", id: raw };
-    }
-    return { kind: "absent" };
-}
-/**
- * Descriptor-driven top-level pick: only ACCEPTED_ACTIVATION_FACT_KEYS leave this boundary.
- * Nested session/correlation are rebuilt closed before the pick (ADR 0049 zero-content by construction).
- */
-function projectAcceptedActivationFact(input) {
-    const closed = {
-        event: ACCEPTED_ACTIVATION_EVENT,
-        role: input.role,
-        observedAt: input.observedAt,
-        bookKey: input.bookKey,
-        session: { kind: "session-file", path: input.session.path },
-        correlation: input.correlation.kind === "caller"
-            ? { kind: "caller", id: input.correlation.id }
-            : { kind: "absent" },
-    };
-    // Descriptor is the sole top-level emission contract (typed pick; no content keys).
-    return Object.fromEntries(ACCEPTED_ACTIVATION_FACT_KEYS.map((key) => [key, closed[key]]));
-}
-/** Construct the closed fact from trusted typed inputs only (descriptor projection — no content keys). */
-export function buildAcceptedActivationFact(input) {
-    return projectAcceptedActivationFact(input);
-}
-/** Serialize only the closed index fields (descriptor projection — no content keys). */
-export function serializeAcceptedActivationFact(fact) {
-    return `${JSON.stringify(projectAcceptedActivationFact(fact))}\n`;
-}
-/**
- * Bare O_APPEND write of one complete line under an absolute ledger home.
- * Private helper: production-bound to writeSync; owns open/write/close honesty only.
- * Close failure cannot mask open/write; simultaneous close is nested evidence.
- */
-function appendActivationLedgerLine(ledgerPath, line, options) {
-    if (!isAbsolute(options.ledgerHome)) {
-        throw new ActivationLedgerError(`activation ledger home must be absolute: ${options.ledgerHome}`);
-    }
-    const resolvedLedger = resolve(ledgerPath);
-    const resolvedHome = resolve(options.ledgerHome);
-    const parent = dirname(resolvedLedger);
-    ensureRealDirectoryTree(resolvedHome, parent);
-    assertLedgerFileInsideHome(resolvedLedger, resolvedHome);
-    // Fail-closed guard (same shape as PR #418's publication seam): on platforms
-    // without O_NOFOLLOW (e.g. Windows, nodejs/node#41590) the JS bitwise-or in
-    // ACTIVATION_LEDGER_APPEND_OPEN_FLAGS would silently drop the flag and the
-    // lstat→open TOCTOU anti-symlink protection would vanish while the comment
-    // above still claims it. Refuse loudly via the existing typed ledger failure
-    // channel instead of appending unprotected; never silently degrade.
-    if (typeof constants.O_NOFOLLOW !== "number") {
-        throw new ActivationLedgerError("activation ledger append requires O_NOFOLLOW open-flag support (anti-symlink TOCTOU protection must not be silently dropped); refusing to append");
-    }
-    const bytes = Buffer.isBuffer(line) ? line : Buffer.from(line);
-    let ledgerFd;
-    let primaryFailure;
-    try {
-        try {
-            ledgerFd = openSync(resolvedLedger, ACTIVATION_LEDGER_APPEND_OPEN_FLAGS, 0o644);
-        }
-        catch (error) {
-            // Native ELOOP/filesystem cause retained; no errno dispatch.
-            throw new ActivationLedgerError(`activation ledger failed to open ledger file (${resolvedLedger}): ${errorText(error)}`, { cause: error });
-        }
-        let opened;
-        try {
-            opened = fstatSync(ledgerFd);
-        }
-        catch (error) {
-            throw new ActivationLedgerError(`activation ledger failed to fstat ledger file (${resolvedLedger}): ${errorText(error)}`, { cause: error });
-        }
-        if (!opened.isFile()) {
-            throw new ActivationLedgerError(`activation ledger is not a regular file: ${resolvedLedger}`);
-        }
-        const written = writeSync(ledgerFd, bytes, 0, bytes.length, null);
-        if (written !== bytes.length) {
-            throw new ActivationLedgerError(`activation ledger short write: wrote ${written} of ${bytes.length} bytes to ${resolvedLedger}`);
-        }
-    }
-    catch (error) {
-        primaryFailure = error;
-    }
-    if (ledgerFd !== undefined) {
-        try {
-            closeSync(ledgerFd);
-        }
-        catch (closeFailure) {
-            if (primaryFailure !== undefined) {
-                throw new AggregateError([primaryFailure, closeFailure], "activation ledger operation and close failed", { cause: primaryFailure });
-            }
-            throw closeFailure;
-        }
-    }
-    if (primaryFailure !== undefined)
-        throw primaryFailure;
-}
-/**
- * Append one complete JSONL record with one O_APPEND write of the full record.
- * Shared-ledger contract: concurrent successful append-only producers cannot
- * overwrite one another. A short write is an honest infrastructure failure
- * (ADR 0049) — no non-append rollback/truncate. Close failure cannot mask the
- * primary write cause; simultaneous close evidence is retained.
- */
-export function appendAcceptedActivationFact(ledgerPath, fact, options) {
-    appendActivationLedgerLine(ledgerPath, Buffer.from(serializeAcceptedActivationFact(fact), "utf8"), { ledgerHome: options.ledgerHome });
-}
-export function appendAcceptedActivationToBook(options) {
-    appendAcceptedActivationFact(activationWaitingLedgerPath(options.ledgerHome, options.fact.bookKey), options.fact, { ledgerHome: options.ledgerHome });
-}

package/dist/activation-trace.js

@@ -1,33 +0,0 @@
-import { Type } from "typebox";
-const causeSchema = Type.Object({
-    identity: Type.String({ minLength: 1 }),
-    name: Type.String({ minLength: 1 }),
-    message: Type.String(),
-    evidenceId: Type.Optional(Type.String({ minLength: 1 })),
-}, { additionalProperties: false });
-export const activationTraceRecordSchema = Type.Object({
-    role: Type.String({ minLength: 1 }),
-    stageId: Type.String({ pattern: "^[a-z][a-z0-9-]*$" }),
-    status: Type.Literal("failed"),
-    timestamp: Type.String({ format: "date-time" }),
-    cause: causeSchema,
-}, { additionalProperties: false });
-let activationCauseEvidence = 0;
-const retainedActivationCauses = new Map();
-export function namedActivationCause(error) {
-    const evidenceId = `activation-cause-${++activationCauseEvidence}`;
-    retainedActivationCauses.set(evidenceId, error);
-    if (error instanceof Error) {
-        const code = error.code;
-        const name = error.name || "Error";
-        return { identity: typeof code === "string" && code.length > 0 ? code : name, name, message: error.message, evidenceId };
-    }
-    let message;
-    try {
-        message = typeof error === "string" ? error : JSON.stringify(error) ?? String(error);
-        return { identity: "UnknownThrownCause", name: "UnknownThrownCause", message, evidenceId };
-    }
-    catch {
-        return { identity: "UnknownThrownCause", name: "UnknownThrownCause", message: String(error), evidenceId };
-    }
-}