@aldus-runtime/release 0.2.0-next.20 → 0.2.0-next.21

package/dist/adapter.d.ts

@@ -35,6 +35,21 @@ export type AdapterOutcome = {
     remoteId?: string;
     /** Address of the released item, where one is meaningful. */
     remoteUrl?: string;
+    /**
+     * Something an operator needs to know about a success (§20; #169 item 4).
+     *
+     * `failed` has `message` and `pending` has `message?`; `succeeded` had nowhere to put a
+     * sentence at all. An adapter that removed a marker from one video of several, or that found
+     * no marker and therefore removed nothing, succeeded — and had to discard the only part an
+     * operator would have wanted.
+     *
+     * **Not a channel for a qualified absence.** An adapter that cannot establish remote state
+     * returns {@link cannotEstablish} from `lookup`; using this to footnote a fabricated
+     * `exists: false` would be the same false record with better documentation (#169 item 3).
+     *
+     * Already redacted by the adapter (§19.2), like every other adapter-supplied string.
+     */
+    note?: string;
 } | {
     status: "failed";
     /** Operator-facing reason, already redacted by the adapter (contract §19.2). */
@@ -53,13 +68,51 @@ export type AdapterOutcome = {
     status: "pending";
     message?: string;
 };
+/** @see CannotEstablish */
+declare const CANNOT_ESTABLISH: unique symbol;
+/**
+ * The destination could not be queried, so whether it holds the operation is unknown (#169).
+ *
+ * Distinct from `exists: false` in the way that matters: **`exists: false` is the answer only a
+ * completed search can give.** Before this, an adapter that could not establish the answer had two
+ * options — return `false` and assert a search nobody performed, or throw and abort the whole
+ * reconciliation pass before a single operation executed. Both were forced, and adopters took the
+ * first.
+ *
+ * Minted by {@link cannotEstablish} and not assemblable, because a state that suppresses a
+ * publish-safety check must not be reachable by writing an object literal.
+ */
+export interface CannotEstablish {
+    readonly [CANNOT_ESTABLISH]: "cannot_establish";
+    /**
+     * Why the answer could not be established, for the operator (§20).
+     *
+     * **Required.** An adapter that cannot establish something and cannot say why has produced a
+     * finding nobody can act on — a rate limit, a permission, and a destination that does not retain
+     * what would identify the operation are three different problems with three different responses.
+     */
+    readonly reason: string;
+}
+/**
+ * Declare that the destination could not be queried (§17, §19.1; #169).
+ *
+ * @throws {AldusError} when the reason is empty.
+ */
+export declare function cannotEstablish(reason: string): CannotEstablish;
+/** Whether a remote state is an issued {@link CannotEstablish}. Membership, not shape. */
+export declare function isCannotEstablish(state: RemoteState): state is CannotEstablish;
 /** What reconciliation found at the destination. */
-export interface RemoteState {
-    /** Whether the destination holds the result of this operation. */
+export type RemoteState = {
+    /**
+     * Whether the destination holds the result of this operation.
+     *
+     * `false` asserts a **completed search**. An adapter that did not or could not search
+     * returns {@link cannotEstablish} instead.
+     */
     exists: boolean;
     remoteId?: string;
     remoteUrl?: string;
-}
+} | CannotEstablish;
 /**
  * An adopter's implementation for one destination.
  *
@@ -97,14 +150,29 @@ export declare class AdapterRegistry {
      */
     require(destination: string): ReleaseAdapter;
 }
-/** Scripted behaviour for {@link RecordingReleaseAdapter}. */
 export interface RecordingAdapterOptions {
     /** Outcome per `operationId`. Anything unlisted succeeds. */
     outcomes?: Readonly<Record<string, AdapterOutcome>>;
-    /** Remote state per idempotency key, as reconciliation would find it. */
-    remote?: Readonly<Record<string, RemoteState>>;
+    /**
+     * Remote state per idempotency key, as reconciliation would find it.
+     *
+     * A plain object or a `Map`, because the field it becomes is a `Map` and seeding it with one is
+     * the natural mistake. `Object.entries(aMap)` is `[]`, so a `Map` used to seed **nothing**, with
+     * no error — and every lookup then fell through to `{ exists: false }`, which reads as a
+     * completed search finding nothing. The same trap as an adapter returning `{ present: false }`:
+     * an input accepted quietly and answered as though nothing was there.
+     */
+    remote?: Readonly<Record<string, RemoteState>> | ReadonlyMap<string, RemoteState>;
     /** Omit `lookup` entirely, modelling a destination that cannot be queried. */
     withoutLookup?: boolean;
+    /**
+     * Make `lookup` throw for these `operationId`s, modelling an unanticipated query failure.
+     *
+     * Distinct from returning {@link cannotEstablish}: an adapter that knows it cannot answer says
+     * so, and this is the adapter that does not know — a quota error, a dropped connection. The
+     * executor has to survive both (#169).
+     */
+    lookupThrowsFor?: readonly string[];
 }
 /**
  * A test double that records what it was asked to do.
@@ -137,4 +205,5 @@ export declare class RecordingReleaseAdapter implements ReleaseAdapter {
     /** How many times an operation was actually sent to the destination. */
     executionCount(operationId: string): number;
 }
+export {};
 //# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,MAAM,cAAc,GACtB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACD;IACE;;;;;;;OAOG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACxD;AAED,+BAA+B;AAC/B,qBAAa,eAAe;;IAG1B,YAAY,QAAQ,GAAE,SAAS,cAAc,EAAO,EAEnD;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAEtC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEpD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAU3C;CACF;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpD,yEAAyE;IACzE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,cAAc;;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IACzC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IAEzC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,EAUrE;IAED,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAexD;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1C;CACF"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,MAAM,cAAc,GACtB;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IACE,MAAM,EAAE,QAAQ,CAAC;IACjB,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACD;IACE;;;;;;;OAOG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,2BAA2B;AAC3B,OAAO,CAAC,MAAM,gBAAgB,EAAE,OAAO,MAAM,CAAC;AAY9C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAa/D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,IAAI,eAAe,CAE9E;AAED,oDAAoD;AACpD,MAAM,MAAM,WAAW,GACnB;IACE;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD,eAAe,CAAC;AAEpB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACxD;AAED,+BAA+B;AAC/B,qBAAa,eAAe;;IAG1B,YAAY,QAAQ,GAAE,SAAS,cAAc,EAAO,EAEnD;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAEtC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEpD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAU3C;CACF;AA0BD,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpD;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClF,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,cAAc;;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IACzC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAM;IAEzC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,EAarE;IAED,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAexD;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1C;CACF"}

package/dist/adapter.js

@@ -13,6 +13,34 @@
  * double.
  */
 import { ReleaseErrorCodes, releaseError } from "./errors.js";
+/**
+ * Authorities this process minted. A cast cannot manufacture membership.
+ *
+ * The same runtime proof `SynthesisPermit` uses, and for the same reason: the brand above is a
+ * phantom, absent at runtime, so a `RemoteState` narrowing that trusted it would trust a type
+ * assertion. #170 has the longer version of this argument — a check that assumes the type it is
+ * checking is not a check.
+ */
+const ISSUED_CANNOT_ESTABLISH = new WeakSet();
+/**
+ * Declare that the destination could not be queried (§17, §19.1; #169).
+ *
+ * @throws {AldusError} when the reason is empty.
+ */
+export function cannotEstablish(reason) {
+    if (typeof reason !== "string" || reason.trim().length === 0) {
+        throw releaseError(ReleaseErrorCodes.OPERATION_INVALID, "An unestablished remote state must say why. A rate limit, a permission problem and a " +
+            "destination that does not retain what identifies the operation call for three different " +
+            "responses, and an operator cannot tell them apart from the absence of an answer (§17).", { category: "validation", retryable: false, details: {} });
+    }
+    const state = { reason };
+    ISSUED_CANNOT_ESTABLISH.add(state);
+    return state;
+}
+/** Whether a remote state is an issued {@link CannotEstablish}. Membership, not shape. */
+export function isCannotEstablish(state) {
+    return typeof state === "object" && state !== null && ISSUED_CANNOT_ESTABLISH.has(state);
+}
 /** Adapters by destination. */
 export class AdapterRegistry {
     #byDestination = new Map();
@@ -43,6 +71,27 @@ export class AdapterRegistry {
         return adapter;
     }
 }
+/** Scripted behaviour for {@link RecordingReleaseAdapter}. */
+/**
+ * Build the remote-state map from either accepted shape, and refuse anything else.
+ *
+ * Refusing rather than tolerating, because the failure this replaces was silence: a mis-seeded
+ * harness answered every lookup as a completed search finding nothing, and a test written against
+ * it would assert the wrong behaviour and pass. A double that lies quietly is worse than one that
+ * will not start.
+ */
+function seedRemote(remote) {
+    if (remote === undefined)
+        return new Map();
+    if (remote instanceof Map)
+        return new Map(remote);
+    if (typeof remote === "object" && remote !== null && !Array.isArray(remote)) {
+        return new Map(Object.entries(remote));
+    }
+    throw releaseError(ReleaseErrorCodes.OPERATION_INVALID, "A recording adapter's `remote` seed must be a plain object or a Map keyed by idempotency " +
+        "key. Anything else seeds nothing, and every lookup then answers as a completed search " +
+        "that found nothing — which is the defect this double is used to test for.", { category: "validation", retryable: false, details: {} });
+}
 /**
  * A test double that records what it was asked to do.
  *
@@ -72,10 +121,13 @@ export class RecordingReleaseAdapter {
     constructor(destination, options = {}) {
         this.destination = destination;
         this.#options = options;
-        this.remote = new Map(Object.entries(options.remote ?? {}));
+        this.remote = seedRemote(options.remote);
         if (options.withoutLookup !== true) {
             this.lookup = (request) => {
                 this.lookedUp.push(request);
+                if (options.lookupThrowsFor?.includes(request.operation.operationId) === true) {
+                    return Promise.reject(new Error("destination query failed"));
+                }
                 return Promise.resolve(this.remote.get(request.idempotencyKey) ?? { exists: false });
             };
         }

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4E9D,+BAA+B;AAC/B,MAAM,OAAO,eAAe;IACjB,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE5D,YAAY,QAAQ,GAA8B,EAAE;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAuB;QAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAmB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,YAAY,CAChB,iBAAiB,CAAC,sBAAsB,EACxC,qDAAqD,WAAW,IAAI,EACpE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAYD;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACzB,WAAW,CAAS;IAC7B,yDAAyD;IAChD,QAAQ,GAAqB,EAAE,CAAC;IACzC,wDAAwD;IAC/C,QAAQ,GAAqB,EAAE,CAAC;IAChC,QAAQ,CAA0B;IAC3C,8FAA8F;IACrF,MAAM,CAA2B;IAE1C;;;;;;;;;OASG;IACM,MAAM,CAAqD;IAEpE,YAAY,WAAmB,EAAE,OAAO,GAA4B,EAAE;QACpE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAuB,EAAwB,EAAE;gBAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAuB;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,OAAO,GAAmB,QAAQ,IAAI;YAC1C,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,UAAU,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SACpD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAmB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACjG,CAAC;CACF"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiE9D;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAU,CAAC;AA0BtD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,uFAAuF;YACrF,0FAA0F;YAC1F,wFAAwF,EAC1F,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAqB,CAAC;IAC5C,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,KAAkB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAsCD,+BAA+B;AAC/B,MAAM,OAAO,eAAe;IACjB,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE5D,YAAY,QAAQ,GAA8B,EAAE;QAClD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,OAAuB;QAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,qDAAqD;IACrD,IAAI,CAAC,WAAmB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,YAAY,CAChB,iBAAiB,CAAC,sBAAsB,EACxC,qDAAqD,WAAW,IAAI,EACpE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,8DAA8D;AAC9D;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAyC;IAC3D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,IAAI,MAAM,YAAY,GAAG;QAAE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,2FAA2F;QACzF,wFAAwF;QACxF,2EAA2E,EAC7E,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC1D,CAAC;AACJ,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACzB,WAAW,CAAS;IAC7B,yDAAyD;IAChD,QAAQ,GAAqB,EAAE,CAAC;IACzC,wDAAwD;IAC/C,QAAQ,GAAqB,EAAE,CAAC;IAChC,QAAQ,CAA0B;IAC3C,8FAA8F;IACrF,MAAM,CAA2B;IAE1C;;;;;;;;;OASG;IACM,MAAM,CAAqD;IAEpE,YAAY,WAAmB,EAAE,OAAO,GAA4B,EAAE;QACpE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAuB,EAAwB,EAAE;gBAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC9E,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,CAAC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAuB;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,OAAO,GAAmB,QAAQ,IAAI;YAC1C,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,UAAU,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SACpD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,cAAc,CAAC,WAAmB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACjG,CAAC;CACF"}

package/dist/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,6FAA6F;IAC7F,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,gBAAgB,EAAE,CAE/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CA2B7D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAQxE"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,6FAA6F;IAC7F,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC5C;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,gBAAgB,EAAE,CAE/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAiE7D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,CAQxE"}

package/dist/bundle.js

@@ -40,6 +40,38 @@ export function assertBundleValid(bundle) {
             });
         }
         seen.add(operation.operationId);
+        // Checked at runtime, because the type is not the enforcement. `repeatable()` refuses an empty
+        // reason and nothing stops a caller writing `{ reason: "" } as RepeatableDeclaration` — and
+        // the code that will assemble operations from configuration is exactly the code that does
+        // that. Without this the operation was treated as repeatable and the warning ended in a bare
+        // colon where the justification should be.
+        //
+        // Higher stakes than the usual version of this argument: the declaration licenses performing
+        // an external effect more than once, and §13.4 binds a release approval to the bundle, so a
+        // blank reason is an approval of nothing.
+        //
+        // The **shape** as well as the emptiness. The first version read `repeatable.reason.trim()`,
+        // which assumes `reason` is a string — the assumption this check exists because it cannot
+        // make. `repeatable: true` is the single most likely thing someone writes in a config file
+        // when they mean this, and it threw a bare `TypeError` with no code, no bundle or operation
+        // id, and no sentence saying what was wrong. Fail-closed, so nothing unsafe happened; what was
+        // lost was the refusal, arriving from exactly the source the paragraph above names.
+        const declaration = operation.repeatable;
+        if (declaration !== undefined) {
+            const reason = typeof declaration === "object" && declaration !== null
+                ? declaration.reason
+                : undefined;
+            if (typeof reason !== "string" || reason.trim().length === 0) {
+                throw releaseError(ReleaseErrorCodes.OPERATION_INVALID, `Release bundle "${bundle.bundleId}" declares "${operation.operationId}" safe to ` +
+                    "repeat without a usable reason. Repeating an external effect is something an " +
+                    "approver accepts, and neither a blank justification nor a value that is not a " +
+                    "declaration is something anyone can approve. Build it with `repeatable(reason)` " +
+                    "(contract §13.4, §17).", {
+                    category: "validation",
+                    details: { bundleId: bundle.bundleId, operationId: operation.operationId },
+                });
+            }
+        }
     }
 }
 /**

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuB9D,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,CAChB,iBAAiB,CAAC,YAAY,EAC9B,mBAAmB,MAAM,CAAC,QAAQ,yDAAyD;YACzF,8CAA8C,EAChD,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,CAChB,iBAAiB,CAAC,mBAAmB,EACrC,mBAAmB,MAAM,CAAC,QAAQ,eAAe,SAAS,CAAC,WAAW,WAAW;gBAC/E,gFAAgF;gBAChF,wCAAwC,EAC1C;gBACE,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;aAC3E,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA2B;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;KAC/C,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuB9D,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,CAChB,iBAAiB,CAAC,YAAY,EAC9B,mBAAmB,MAAM,CAAC,QAAQ,yDAAyD;YACzF,8CAA8C,EAChD,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,YAAY,CAChB,iBAAiB,CAAC,mBAAmB,EACrC,mBAAmB,MAAM,CAAC,QAAQ,eAAe,SAAS,CAAC,WAAW,WAAW;gBAC/E,gFAAgF;gBAChF,wCAAwC,EAC1C;gBACE,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;aAC3E,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEhC,+FAA+F;QAC/F,4FAA4F;QAC5F,0FAA0F;QAC1F,6FAA6F;QAC7F,2CAA2C;QAC3C,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,0CAA0C;QAC1C,EAAE;QACF,6FAA6F;QAC7F,0FAA0F;QAC1F,2FAA2F;QAC3F,4FAA4F;QAC5F,+FAA+F;QAC/F,oFAAoF;QACpF,MAAM,WAAW,GAAa,SAAsC,CAAC,UAAU,CAAC;QAChF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GACV,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI;gBACrD,CAAC,CAAE,WAAoC,CAAC,MAAM;gBAC9C,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,YAAY,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,mBAAmB,MAAM,CAAC,QAAQ,eAAe,SAAS,CAAC,WAAW,YAAY;oBAChF,+EAA+E;oBAC/E,gFAAgF;oBAChF,kFAAkF;oBAClF,wBAAwB,EAC1B;oBACE,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;iBAC3E,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA2B;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;KAC/C,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/dist/errors.d.ts

@@ -24,6 +24,13 @@ export declare const ReleaseErrorCodes: {
     readonly DUPLICATE_OPERATION: "ALDUS_RELEASE_DUPLICATE_OPERATION";
     /** A bundle was constructed with no operations at all. */
     readonly EMPTY_BUNDLE: "ALDUS_RELEASE_EMPTY_BUNDLE";
+    /**
+     * An operation declaration is not usable as written (#169).
+     *
+     * Today: a repeatable declaration with no reason. It licenses performing an external effect more
+     * than once, and an approver cannot accept that from a bare flag (§13.4, §17).
+     */
+    readonly OPERATION_INVALID: "ALDUS_RELEASE_OPERATION_INVALID";
     /**
      * A required operation failed, so the release did not complete.
      *

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,kDAAkD;AAClD,eAAO,MAAM,iBAAiB;IAC5B;;;;;;;OAOG;aACH,sBAAsB,EAAE,8BAA8B;IACtD,+DAA+D;aAC/D,sBAAsB,EAAE,sCAAsC;IAC9D,oEAAoE;aACpE,mBAAmB,EAAE,mCAAmC;IACxD,0DAA0D;aAC1D,YAAY,EAAE,4BAA4B;IAC1C;;;;;;OAMG;aACH,yBAAyB,EAAE,yCAAyC;IACpE;;;;;;OAMG;aACH,gBAAgB,EAAE,gCAAgC;IAClD;;;;;;OAMG;aACH,0BAA0B,EAAE,0CAA0C;CAC9D,CAAC;AAEX,6BAA6B;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE1F,2DAA2D;AAC3D,wBAAgB,YAAY,CAC1B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,UAAU,CAEZ"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,kDAAkD;AAClD,eAAO,MAAM,iBAAiB;IAC5B;;;;;;;OAOG;aACH,sBAAsB,EAAE,8BAA8B;IACtD,+DAA+D;aAC/D,sBAAsB,EAAE,sCAAsC;IAC9D,oEAAoE;aACpE,mBAAmB,EAAE,mCAAmC;IACxD,0DAA0D;aAC1D,YAAY,EAAE,4BAA4B;IAC1C;;;;;OAKG;aACH,iBAAiB,EAAE,iCAAiC;IACpD;;;;;;OAMG;aACH,yBAAyB,EAAE,yCAAyC;IACpE;;;;;;OAMG;aACH,gBAAgB,EAAE,gCAAgC;IAClD;;;;;;OAMG;aACH,0BAA0B,EAAE,0CAA0C;CAC9D,CAAC;AAEX,6BAA6B;AAC7B,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE1F,2DAA2D;AAC3D,wBAAgB,YAAY,CAC1B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,UAAU,CAEZ"}

package/dist/errors.js

@@ -24,6 +24,13 @@ export const ReleaseErrorCodes = {
     DUPLICATE_OPERATION: "ALDUS_RELEASE_DUPLICATE_OPERATION",
     /** A bundle was constructed with no operations at all. */
     EMPTY_BUNDLE: "ALDUS_RELEASE_EMPTY_BUNDLE",
+    /**
+     * An operation declaration is not usable as written (#169).
+     *
+     * Today: a repeatable declaration with no reason. It licenses performing an external effect more
+     * than once, and an approver cannot accept that from a bare flag (§13.4, §17).
+     */
+    OPERATION_INVALID: "ALDUS_RELEASE_OPERATION_INVALID",
     /**
      * A required operation failed, so the release did not complete.
      *

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAErE,kDAAkD;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;;;;;;;OAOG;IACH,sBAAsB,EAAE,8BAA8B;IACtD,+DAA+D;IAC/D,sBAAsB,EAAE,sCAAsC;IAC9D,oEAAoE;IACpE,mBAAmB,EAAE,mCAAmC;IACxD,0DAA0D;IAC1D,YAAY,EAAE,4BAA4B;IAC1C;;;;;;OAMG;IACH,yBAAyB,EAAE,yCAAyC;IACpE;;;;;;OAMG;IACH,gBAAgB,EAAE,gCAAgC;IAClD;;;;;;OAMG;IACH,0BAA0B,EAAE,0CAA0C;CAC9D,CAAC;AAKX,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAC1B,IAAsB,EACtB,OAAe,EACf,OAA4F;IAE5F,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AAErE,kDAAkD;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;;;;;;;OAOG;IACH,sBAAsB,EAAE,8BAA8B;IACtD,+DAA+D;IAC/D,sBAAsB,EAAE,sCAAsC;IAC9D,oEAAoE;IACpE,mBAAmB,EAAE,mCAAmC;IACxD,0DAA0D;IAC1D,YAAY,EAAE,4BAA4B;IAC1C;;;;;OAKG;IACH,iBAAiB,EAAE,iCAAiC;IACpD;;;;;;OAMG;IACH,yBAAyB,EAAE,yCAAyC;IACpE;;;;;;OAMG;IACH,gBAAgB,EAAE,gCAAgC;IAClD;;;;;;OAMG;IACH,0BAA0B,EAAE,0CAA0C;CAC9D,CAAC;AAKX,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAC1B,IAAsB,EACtB,OAAe,EACf,OAA4F;IAE5F,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC"}

package/dist/executor.d.ts

@@ -67,7 +67,6 @@ export interface BundleStatus {
     /** Operation ids that still need to run for the release to complete. */
     remaining: string[];
 }
-/** What reconciliation did about one operation. */
 export interface ReconciliationFinding {
     operationId: string;
     idempotencyKey: string;
@@ -79,7 +78,21 @@ export interface ReconciliationFinding {
     /** The destination does not hold it, so the operation genuinely still needs to run. */
      | "confirmed_absent"
     /** The adapter cannot query the destination (contract §17 "where the platform allows it"). */
-     | "unavailable";
+     | "unavailable"
+    /**
+     * The operation declares its effect safe to repeat, so it was not queried (#169).
+     *
+     * Deliberately its own action rather than folded into `confirmed_absent`. Nothing was
+     * searched for, and saying it was absent would be the false statement this exists to stop.
+     */
+     | "not_reconciled_repeatable"
+    /**
+     * The adapter was asked and could not establish whether the operation happened (#169).
+     *
+     * Distinct from `unavailable`, which is a destination that cannot be queried at all, and from
+     * `confirmed_absent`, which is a completed search. This one asked and got no answer.
+     */
+     | "cannot_establish";
     explanation?: string;
 }
 /** What a reconciliation pass found. */

package/dist/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAc,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGhF,OAAO,KAAK,EAAE,eAAe,EAAkC,MAAM,cAAc,CAAC;AACpF,OAAO,EAA2C,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,KAAK,EAAE,oBAAoB,EAAoB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAe,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,kCAAkC;AAClC,eAAO,MAAM,gBAAgB;AAC3B,oDAAoD;AACpD,aAAa;AACb,wFAAwF;AACxF,SAAS;AACT,oCAAoC;AACpC,WAAW;AACX,iDAAiD;AACjD,QAAQ;AACR,mEAAmE;AACnE,SAAS,CACD,CAAC;AAEX,4BAA4B;AAC5B,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,WAAW,EAAE,oBAAoB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1E,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM;IACJ,yDAAyD;IACvD,kBAAkB;IACpB,sFAAsF;OACpF,UAAU;IACZ,uFAAuF;OACrF,kBAAkB;IACpB,8FAA8F;OAC5F,aAAa,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,mDAAmD;IACnD,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,YAAY,CAAC;IACrB,+CAA+C;IAC/C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,KAAK,EAAE,QAAQ,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,kGAAkG;IAClG,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,2CAA2C;AAC3C,qBAAa,eAAe;;IAS1B,YAAY,OAAO,EAAE,sBAAsB,EAQ1C;IAED;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBzD;IAED;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoE/F;IAED;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAsHrF;CAwGF"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAc,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIhF,OAAO,KAAK,EAAE,eAAe,EAA+C,MAAM,cAAc,CAAC;AACjG,OAAO,EAA2C,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,KAAK,EAAE,oBAAoB,EAAoB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAe,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEjF,kCAAkC;AAClC,eAAO,MAAM,gBAAgB;AAC3B,oDAAoD;AACpD,aAAa;AACb,wFAAwF;AACxF,SAAS;AACT,oCAAoC;AACpC,WAAW;AACX,iDAAiD;AACjD,QAAQ;AACR,mEAAmE;AACnE,SAAS,CACD,CAAC;AAEX,4BAA4B;AAC5B,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,WAAW,EAAE,oBAAoB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1E,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,wEAAwE;IACxE,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAkCD,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM;IACJ,yDAAyD;IACvD,kBAAkB;IACpB,sFAAsF;OACpF,UAAU;IACZ,uFAAuF;OACrF,kBAAkB;IACpB,8FAA8F;OAC5F,aAAa;IACf;;;;;OAKG;OACD,2BAA2B;IAC7B;;;;;OAKG;OACD,kBAAkB,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,mDAAmD;IACnD,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,YAAY,CAAC;IACrB,+CAA+C;IAC/C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,KAAK,EAAE,QAAQ,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,kGAAkG;IAClG,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;IAC7B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,2CAA2C;AAC3C,qBAAa,eAAe;;IAS1B,YAAY,OAAO,EAAE,sBAAsB,EAQ1C;IAED;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAmBzD;IAED;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuL/F;IAED;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CA2IrF;CA6GF"}

package/dist/executor.js

@@ -23,6 +23,7 @@
  * the work it describes did not.
  */
 import { SCHEMA_VERSION, newEventId, newReleaseId } from "@aldus-runtime/core";
+import { cannotEstablish, isCannotEstablish } from "./adapter.js";
 import { assertBundleValid, deriveIdempotencyKey } from "./bundle.js";
 import { ReleaseErrorCodes, releaseError } from "./errors.js";
 import { latestByKey } from "./ports.js";
@@ -40,6 +41,37 @@ export const OPERATION_STATES = [
     /** Deliberately not attempted — no authority, or nothing to do. */
     "skipped",
 ];
+/** What reconciliation did about one operation. */
+/**
+ * Which reconciliation findings an operator is warned about (§20; #169).
+ *
+ * An **allow-list**, keyed on the action. It was a deny-list — any finding carrying an explanation
+ * except `confirmed_absent` — so every action added later was opted in by default, with nobody
+ * deciding. `not_reconciled_repeatable` was opted in exactly that way, and appeared in the
+ * warnings of every ordinary release of a bundle holding a repeatable operation, reporting that
+ * the expected thing had happened.
+ *
+ * Membership answers the question a warning asks: **did something go differently than intended?**
+ *
+ * - `repaired` — yes. The local record was wrong and had to be corrected.
+ * - `unavailable` — yes. Reconciliation could not run, so an operator is being told that a
+ *   protection they may assume is absent.
+ * - `confirmed_absent` — no. The ordinary path; most operations in a fresh bundle are absent, and
+ *   one line each would bury the two above.
+ * - `not_reconciled_repeatable` — no. The declared, approved state of the bundle. The reason is in
+ *   the reconciliation report for anyone reading it.
+ *
+ * Adding an action now requires either adding it here or leaving it out, and both are decisions.
+ * Neither happens by default.
+ */
+const OPERATOR_FACING_FINDINGS = new Set([
+    "repaired",
+    "unavailable",
+    // Yes. The operation may or may not have happened and nobody can tell — the state an operator
+    // most needs to see, and the one the deny-list would have surfaced by accident rather than by
+    // decision (#169).
+    "cannot_establish",
+]);
 /** Executes release bundles, resumably. */
 export class ReleaseExecutor {
     #adapters;
@@ -91,7 +123,7 @@ export class ReleaseExecutor {
         const latest = latestByKey(await this.#receipts.list(bundle.runId));
         const findings = [];
         const repaired = [];
-        for (const { operation, idempotencyKey } of this.#plan(bundle)) {
+        for (const { operation, criticality, idempotencyKey } of this.#plan(bundle)) {
             const receipt = latest.get(idempotencyKey);
             if (receipt !== undefined && receipt.status !== "pending") {
                 findings.push({
@@ -101,6 +133,21 @@ export class ReleaseExecutor {
                 });
                 continue;
             }
+            // Asked of nothing, because the answer would change nothing. A repeatable operation may be
+            // performed again whatever the destination holds, so querying it buys no decision — and
+            // where reconciliation runs before execution, as it does inside `execute`, a "not there"
+            // reading can mean "the operation before it has not run yet" rather than "it did not
+            // happen". An adapter forced to answer that question has to invent one (#169).
+            if (operation.repeatable !== undefined) {
+                findings.push({
+                    operationId: operation.operationId,
+                    idempotencyKey,
+                    action: "not_reconciled_repeatable",
+                    explanation: `"${operation.operationId}" declares its effect safe to repeat, so the destination ` +
+                        `was not queried: ${operation.repeatable.reason}`,
+                });
+                continue;
+            }
             const adapter = this.#adapters.require(operation.destination);
             if (adapter.lookup === undefined) {
                 findings.push({
@@ -117,8 +164,91 @@ export class ReleaseExecutor {
                 idempotencyKey,
                 runId: bundle.runId,
             };
-            const remote = await adapter.lookup(request);
+            // Guarded, and the guard is criticality-aware. `reconcile` used to `await` this bare, so a
+            // throw from any operation's `lookup` aborted the whole pass before a single `execute` —
+            // a quota error raised while asking about a tidy-up blocked the upload beside it (#169).
+            //
+            // A required operation's throw still aborts. Fail-closed belongs where a mistake publishes
+            // twice; it does not belong where a best-effort tidy-up could not be queried.
+            let remote;
+            try {
+                remote = await adapter.lookup(request);
+            }
+            catch (thrown) {
+                if (criticality === "required")
+                    throw thrown;
+                remote = cannotEstablish(`querying destination "${operation.destination}" failed: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+            }
+            if (isCannotEstablish(remote)) {
+                // Asked, and no answer. What happens next depends on what the operation is for.
+                if (criticality === "required") {
+                    // Unknown must never license a publish. A required operation whose prior outcome cannot
+                    // be established is refused before anything executes, because performing it might
+                    // repeat it and skipping it might drop it, and neither is a choice to make blind.
+                    throw releaseError(ReleaseErrorCodes.RECONCILIATION_UNAVAILABLE, `Whether required operation "${operation.operationId}" already happened could not be ` +
+                        `established: ${remote.reason}. Executing would risk performing it twice and ` +
+                        "skipping it would risk dropping it, so the bundle is refused until the outcome is " +
+                        "known (contract §17).", {
+                        category: "conflict",
+                        retryable: false,
+                        details: {
+                            runId: bundle.runId,
+                            operationId: operation.operationId,
+                            destination: operation.destination,
+                        },
+                    });
+                }
+                // Best-effort: **no receipt**, and not performed this pass.
+                //
+                // Writing a `skipped` receipt was the obvious thing and it was wrong in the way this whole
+                // issue is about. `skipped` is terminal in both directions — `execute` skips it and
+                // `reconcile` treats it as already recorded — so one momentary query failure permanently
+                // retired the operation for that bundle. At the destination that produced #169 quota
+                // exhaustion is routine, so a rate limit while *asking about* a tidy-up would silently
+                // drop it forever, and the record would say `skipped`: a decision, when what happened was
+                // an unanswered question.
+                //
+                // A durable record of a transient failure is the same defect as a durable record of a
+                // search nobody performed. So the not-performing lives in this pass only — the finding and
+                // the warning say what happened now, and the next pass asks again.
+                //
+                // Not performed either, because executing on an unknown prior state is the other half of
+                // the trap: it might repeat an operation that already happened.
+                findings.push({
+                    operationId: operation.operationId,
+                    idempotencyKey,
+                    action: "cannot_establish",
+                    explanation: `Whether "${operation.operationId}" already happened could not be established, so it ` +
+                        `was not attempted: ${remote.reason}`,
+                });
+                continue;
+            }
+            // Not an issued cannot-establish, so it must be the other arm — and that has to be checked
+            // rather than assumed. An assembled `{ reason: "..." }` is not an issued state, so
+            // `isCannotEstablish` correctly rejects it, and it would then reach `!remote.exists` with
+            // `exists` undefined and be recorded as `confirmed_absent`: a completed search, asserted
+            // from a value that is not a `RemoteState` at all.
+            //
+            // Fifth instance of the same lesson in this contract (#170 has the other four). A narrowing
+            // that trusts the declared type is not a narrowing.
+            if (typeof remote.exists !== "boolean") {
+                throw releaseError(ReleaseErrorCodes.OPERATION_INVALID, `The adapter for destination "${operation.destination}" answered the lookup for ` +
+                    `"${operation.operationId}" with a value that is neither a remote state nor an ` +
+                    "issued `cannotEstablish`. Reading it as absent would record a completed search that " +
+                    "did not happen (contract §17).", {
+                    category: "validation",
+                    retryable: false,
+                    details: {
+                        runId: bundle.runId,
+                        operationId: operation.operationId,
+                        destination: operation.destination,
+                    },
+                });
+            }
             if (!remote.exists) {
+                // Reserved to a `lookup` that actually returned `exists: false`. Every other reason an
+                // operation might not have been found now has its own action, so this one means what it
+                // says: a completed search established that the destination does not hold it (#169).
                 findings.push({
                     operationId: operation.operationId,
                     idempotencyKey,
@@ -151,11 +281,18 @@ export class ReleaseExecutor {
         assertBundleValid(bundle);
         const warnings = [];
         const written = [];
+        // Operations this pass must not attempt, held in memory and never written down. A best-effort
+        // operation whose prior state could not be established is not performed now — executing on an
+        // unknown prior state might repeat something that already happened — and leaves no durable
+        // trace, so the next pass asks again rather than finding a terminal receipt (#169).
+        const unestablished = new Set();
         if (options.reconcile !== false) {
             const report = await this.reconcile(bundle, { actor: options.actor });
             written.push(...report.repaired);
             for (const finding of report.findings) {
-                if (finding.explanation !== undefined && finding.action !== "confirmed_absent") {
+                if (finding.action === "cannot_establish")
+                    unestablished.add(finding.operationId);
+                if (finding.explanation !== undefined && OPERATOR_FACING_FINDINGS.has(finding.action)) {
                     warnings.push(finding.explanation);
                 }
             }
@@ -172,13 +309,27 @@ export class ReleaseExecutor {
                     "succeed.");
                 continue;
             }
+            // Skipped for this pass only. No receipt was written, so a later pass reaches the same
+            // operation with the same undecided state and asks the destination again.
+            if (unestablished.has(operation.operationId))
+                continue;
             const existing = latest.get(idempotencyKey);
             if (existing?.status === "succeeded" || existing?.status === "skipped")
                 continue;
             // An operation whose outcome was never confirmed must not be retried (contract §17). If
             // reconciliation could have resolved it, it already ran above and this receipt would be
             // terminal; reaching here means the destination cannot be queried.
-            if (existing?.status === "pending") {
+            //
+            // Unless the operation says repeating it is safe, which is exactly the fact this refusal
+            // needs and previously had no way to hear. Without it a best-effort tidy-up whose outcome
+            // was once unconfirmed refused **every later release of that bundle** — the same operation
+            // whose failure `execute` treats as a warning, blocking the release forever because one
+            // past attempt went unanswered (#169).
+            if (existing?.status === "pending" && operation.repeatable !== undefined) {
+                warnings.push(`"${operation.operationId}" has an unconfirmed earlier outcome and declares its effect ` +
+                    `safe to repeat, so it is being performed again: ${operation.repeatable.reason}`);
+            }
+            else if (existing?.status === "pending") {
                 throw releaseError(ReleaseErrorCodes.RECONCILIATION_UNAVAILABLE, `"${operation.operationId}" was attempted and its outcome was never confirmed, and ` +
                     `destination "${operation.destination}" cannot be queried to find out. Retrying ` +
                     "would risk performing it twice, so it is refused until the outcome is established.", {
@@ -272,6 +423,11 @@ export class ReleaseExecutor {
             ...(outcome.status === "succeeded" && outcome.remoteUrl !== undefined
                 ? { remoteUrl: outcome.remoteUrl }
                 : {}),
+            // Carried through to the durable record. A field an adapter can set and nothing reads is
+            // the defect #107 reported, one contract over.
+            ...(outcome.status === "succeeded" && outcome.note !== undefined
+                ? { note: outcome.note }
+                : {}),
             // `pending` is not terminal, so it carries no completion time (contract §17).
             ...(outcome.status === "pending" ? {} : { completedAt: at }),
             ...(outcome.status === "failed"