@allocator-one/rcl 4.4.19

package/dist/dispatch/checkpoint.js

@@ -0,0 +1,1418 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { link, lstat, mkdir, open, readdir, realpath, unlink } from 'node:fs/promises';
+import { join, relative, resolve, basename } from 'node:path';
+import { z } from 'zod';
+import { originalRawFindingSchema } from '../telemetry/recovery/source.js';
+import { MAX_ARTIFACT_BYTES } from '../telemetry/envelope-validation.js';
+import { MAX_VERIFICATION_PHASE_RECORDS } from './checkpoint-phase-limits.js';
+import { syncNativeDirectory } from '../converge/native-lock.js';
+import { verificationContextFromValidatedCheckpoint } from './checkpoint-verification-context.js';
+import { appendVerificationRecordWithSuccessor, cloneValidatedVerificationRecords, encodeVerificationProof, parseVerificationAnswer, snapshotVerificationEvent, validateVerificationRecordsForAppend, verificationDigest, } from './checkpoint-verification.js';
+import { assertNativeTargetOwnership, ownedNativeTargetCommonDir, withOwnedNativeOperation, } from '../converge/target-ownership.js';
+const VERSION = 1;
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+export const MAX_CHECKPOINT_PROOF_BYTES = 25 * 1024 * 1024;
+// Ordinary reads may retain more than a portable proof, but never unbounded
+// results. Count original file bytes, including whitespace, before allocation.
+const MAX_CHECKPOINT_READ_BYTES = 64 * 1024 * 1024;
+const integer = z.number().int().nonnegative().safe();
+const digestSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const bindingNameSchema = z.enum(['captured-inputs', 'source', 'operation', 'launch', 'supplemental-async']);
+const bindingReferenceSchema = z.object({ name: bindingNameSchema, file: z.string(), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict()
+    .refine(binding => binding.file === bindingFile(binding.name));
+const attemptSchema = z.object({ id: z.string().regex(/^[A-Za-z0-9._:-]{1,160}$/), kind: z.enum(['paid', 'unknown']) }).strict();
+const rawFindingSchema = originalRawFindingSchema.extend({
+    locationProvenance: z.object({
+        version: z.literal(1), source: z.literal('parser'), reason: z.literal('reversed_range'),
+        originalStartLine: integer, originalEndLine: integer,
+    }).strict().optional(),
+}).strict().refine(finding => finding.endLine >= finding.startLine && (!finding.locationProvenance ||
+    finding.locationProvenance.originalStartLine > finding.locationProvenance.originalEndLine &&
+        finding.startLine === finding.locationProvenance.originalEndLine && finding.endLine === finding.locationProvenance.originalStartLine));
+const reviewSchema = z.object({
+    model: z.string().min(1), role: z.string().min(1), provider: z.string().min(1),
+    findings: z.array(rawFindingSchema), durationMs: z.number().finite().nonnegative(),
+    status: z.enum(['success', 'timeout', 'error', 'parse_failed', 'canceled']),
+    usage: z.object({ inputTokens: integer.optional(), outputTokens: integer.optional(), reasoningTokens: integer.optional() }).strict().optional(),
+    error: z.string().optional(), droppedFindings: integer.optional(), warnings: z.array(z.string()).optional(),
+    async: z.literal(false).optional(),
+    adapterAttempts: integer.optional(),
+}).strict();
+/** Strict raw blocking-review wire schema, shared by supplemental async capture. */
+export const blockingCheckpointReviewSchema = reviewSchema;
+const resultSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('success'), chunk: integer, reviewBytes: z.string().min(1) }).strict(),
+    z.object({ kind: z.literal('failure'), chunk: integer, reviewBytes: z.string().min(1), possiblyBilled: z.boolean() }).strict(),
+]);
+const resultReferenceSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('success'), chunk: integer, reviewSha256: digestSchema, resultFile: z.string() }).strict(),
+    z.object({ kind: z.literal('failure'), chunk: integer, reviewSha256: digestSchema, resultFile: z.string(), possiblyBilled: z.boolean() }).strict(),
+]);
+const recordBase = { sequence: integer.min(1), previousDigest: digestSchema, digest: digestSchema };
+const attemptRecord = { cell: z.string().min(1), paidAttempt: attemptSchema };
+const journalRecordSchema = z.discriminatedUnion('type', [
+    z.object({ ...recordBase, type: z.literal('binding'), binding: bindingReferenceSchema }).strict(),
+    z.object({ ...recordBase, ...attemptRecord, type: z.literal('intent') }).strict(),
+    z.object({ ...recordBase, ...attemptRecord, type: z.literal('result'), result: resultReferenceSchema }).strict(),
+    z.object({ ...recordBase, ...attemptRecord, type: z.literal('uncertain'), reason: z.string().refine(value => !!value.trim() && !/[\0\r\n]/.test(value)) }).strict(),
+    z.object({ ...recordBase, type: z.literal('finalization'), finalizedDigest: digestSchema }).strict(),
+]);
+const verificationLateRecordSchema = z.object({ sequence: integer.positive(), previousDigest: digestSchema, digest: digestSchema,
+    version: z.literal(1), type: z.literal('late-verification-result'), verificationTerminalDigest: digestSchema,
+    result: z.object({ batchIndex: integer, attemptId: z.string().regex(/^[A-Za-z0-9._:-]{1,160}$/), finishedAtMs: integer, answerBytes: z.string().min(1) }).strict(),
+}).strict();
+const lateRecordSchema = z.object({ ...recordBase, ...attemptRecord,
+    version: z.literal(1), type: z.literal('late-result'), planDigest: digestSchema,
+    finalizationDigest: digestSchema, intentDigest: digestSchema, reviewSha256: digestSchema, reviewBytes: z.string().min(1),
+}).strict();
+// Inline JSON escaping can enlarge a valid raw 8 MiB review. Main file bounds stay unchanged.
+const lateFileOptions = Object.freeze({ maxBytes: MAX_ARTIFACT_BYTES, singleLink: true });
+const terminalPayloadSchema = z.object({ reportBytes: z.string().min(1), reviewerArtifactBytes: z.string().min(1) }).strict();
+const terminalManifestSchema = z.object({ version: z.literal(1), planDigest: digestSchema, finalizationDigest: digestSchema,
+    reportSha256: digestSchema, reviewerArtifactSha256: digestSchema,
+    reportByteLength: integer.min(1).max(MAX_ARTIFACT_BYTES), reviewerArtifactByteLength: integer.min(1).max(MAX_ARTIFACT_BYTES),
+}).strict();
+const terminalPayloadOptions = Object.freeze({ maxBytes: MAX_ARTIFACT_BYTES, singleLink: true });
+const terminalManifestOptions = Object.freeze({ singleLink: true });
+const terminalFileNames = ['manifest.json', 'report.json', 'reviewer-artifact.json'];
+const bindingsSchema = z.object({ 'captured-inputs': z.string().optional(), source: z.string().optional(),
+    operation: z.string().optional(), launch: z.string().optional(), 'supplemental-async': z.string().optional() }).strict();
+const proofWireSchema = z.object({ version: z.literal(1), plan: z.unknown(), records: z.array(z.unknown()),
+    outcomes: z.array(z.object({ resultFile: z.string(), reviewBytes: z.string() }).strict()), bindings: bindingsSchema }).strict();
+const frozenPlanSchema = z.object({
+    version: z.union([z.literal(1), z.literal(2)]), digest: digestSchema, target: z.string(), headSha: z.string(), mergeBaseSha: z.string(),
+    patchSha256: digestSchema, configSha256: digestSchema, specSha256: digestSchema, contextSha256: digestSchema, toolsSha256: digestSchema,
+    parser: z.object({ name: z.string(), version: integer.min(1) }).strict(),
+    roster: z.array(z.object({ seat: z.string(), model: z.string(), role: z.string(), route: z.string(), lane: z.enum(['blocking', 'secondary']).optional() }).strict()),
+    chunks: z.array(z.object({ index: integer, total: integer.min(1), digest: digestSchema }).strict()),
+    prompts: z.array(z.object({ seat: z.string(), chunk: integer, systemSha256: digestSchema, userSha256: digestSchema }).strict()),
+    cells: z.array(z.object({ id: z.string(), seat: z.string(), chunk: integer, route: z.string(), model: z.string(), role: z.string(), chunkDigest: digestSchema, systemPromptSha256: digestSchema, userPromptSha256: digestSchema }).strict()),
+}).strict();
+const validatedProofs = new WeakSet();
+function sha256(value) { return createHash('sha256').update(value).digest('hex'); }
+function canonical(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+}
+function recordDigest(value) { return sha256(canonical(value)); }
+function requireText(value, name) { if (typeof value !== 'string' || !value.trim() || /[\0\r\n]/.test(value))
+    throw new Error(`checkpoint_invalid_${name}`); return value; }
+function requireDigest(value, name) { if (!/^[a-f0-9]{64}$/.test(value))
+    throw new Error(`checkpoint_invalid_${name}`); return value; }
+function directoryKey(target) { return sha256(target).slice(0, 32); }
+export function checkpointPath(commonDir, target, namespace) {
+    if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(namespace))
+        throw new Error('checkpoint_invalid_namespace');
+    return join(resolve(commonDir), 'rcl-checkpoints', directoryKey(target), namespace);
+}
+function planPayload(plan, cells) {
+    return { version: plan.version ?? VERSION, target: plan.target, headSha: plan.headSha, mergeBaseSha: plan.mergeBaseSha, patchSha256: plan.patchSha256, configSha256: plan.configSha256, specSha256: plan.specSha256, contextSha256: plan.contextSha256, toolsSha256: plan.toolsSha256, parser: { ...plan.parser }, roster: plan.roster.map(item => ({ ...item })), chunks: plan.chunks.map(item => ({ ...item })), prompts: plan.prompts.map(item => ({ ...item })), cells };
+}
+function deepFreeze(value) { if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        deepFreeze(child);
+} return value; }
+export function freezeCheckpointPlan(input) {
+    requireText(input.target, 'target');
+    for (const [name, value] of Object.entries({ head: input.headSha, merge_base: input.mergeBaseSha }))
+        if (!/^[a-f0-9]{40}$/.test(value))
+            throw new Error(`checkpoint_invalid_${name}`);
+    for (const [name, value] of Object.entries({ patch: input.patchSha256, config: input.configSha256, spec: input.specSha256, context: input.contextSha256, tools: input.toolsSha256 }))
+        requireDigest(value, name);
+    if (!Number.isSafeInteger(input.parser.version) || input.parser.version < 1)
+        throw new Error('checkpoint_invalid_parser');
+    requireText(input.parser.name, 'parser');
+    if (!input.roster.length)
+        throw new Error('checkpoint_missing_roster');
+    const version = input.version ?? 1;
+    if (version !== 1 && version !== 2 || input.roster.some(seat => version === 2
+        ? seat.lane !== 'blocking' && seat.lane !== 'secondary' : seat.lane !== undefined))
+        throw new Error('checkpoint_invalid_lane_binding');
+    const seats = new Set();
+    for (const item of input.roster) {
+        requireText(item.seat, 'seat');
+        requireText(item.model, 'model');
+        requireText(item.role, 'role');
+        requireText(item.route, 'route');
+        if (seats.has(item.seat))
+            throw new Error('checkpoint_duplicate_cell');
+        seats.add(item.seat);
+    }
+    const chunks = [...input.chunks].sort((a, b) => a.index - b.index);
+    if (!chunks.length)
+        throw new Error('checkpoint_missing_chunks');
+    const total = chunks[0].total;
+    if (!Number.isSafeInteger(total) || total < 1 || chunks.length !== total || chunks.some((chunk, index) => chunk.index !== index || chunk.total !== total))
+        throw new Error('checkpoint_incomplete_chunks');
+    const prompts = new Map();
+    for (const prompt of input.prompts) {
+        if (!seats.has(prompt.seat) || !Number.isSafeInteger(prompt.chunk) || prompt.chunk < 0 || prompt.chunk >= total)
+            throw new Error('checkpoint_invalid_prompt');
+        const key = `${prompt.seat}:${prompt.chunk}`;
+        if (prompts.has(key))
+            throw new Error('checkpoint_duplicate_cell');
+        requireDigest(prompt.systemSha256, 'system_prompt');
+        requireDigest(prompt.userSha256, 'user_prompt');
+        prompts.set(key, { systemSha256: prompt.systemSha256, userSha256: prompt.userSha256 });
+    }
+    const cells = [];
+    for (const chunk of chunks) {
+        requireDigest(chunk.digest, 'chunk_digest');
+        for (const seat of input.roster) {
+            const id = `${seat.seat}:${chunk.index}`, prompt = prompts.get(id);
+            if (!prompt)
+                throw new Error('checkpoint_missing_prompt');
+            cells.push({ id, seat: seat.seat, chunk: chunk.index, route: seat.route, model: seat.model, role: seat.role, chunkDigest: chunk.digest, systemPromptSha256: prompt.systemSha256, userPromptSha256: prompt.userSha256 });
+        }
+    }
+    if (prompts.size !== cells.length)
+        throw new Error('checkpoint_extra_prompt');
+    const payload = planPayload(input, cells), plan = { ...payload, digest: sha256(canonical(payload)) };
+    if (!frozenPlanSchema.safeParse(plan).success)
+        throw new Error('checkpoint_invalid_plan');
+    return deepFreeze(plan);
+}
+/** Original seat IDs, never merged model-role opinions, define retained quorum. */
+export function blockingCheckpointSeatIds(plan) {
+    return plan.roster.filter(seat => plan.version === 1 || seat.lane === 'blocking').map(seat => seat.seat);
+}
+/** Keep wire cells unchanged; bind internal eligibility to their immutable roster lane. */
+export function checkpointRecoveryCells(plan) {
+    const lanes = new Map(plan.roster.map(seat => [seat.seat, plan.version === 1 ? 'blocking' : seat.lane]));
+    return plan.cells.map(cell => ({ ...cell, lane: lanes.get(cell.seat) }));
+}
+/** Old bytes remain inspectable, but cannot authorize a new retained operation. */
+export function requireReviewerLaneBinding(plan) {
+    if (plan.version !== 2)
+        throw new Error('reviewer_lane_binding_required');
+}
+async function inspectDirectory(path) {
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(path) !== path || (stat.mode & 0o7777) !== 0o700 || (process.geteuid && stat.uid !== process.geteuid()))
+        throw new Error('checkpoint_unsafe_directory');
+}
+async function ensurePrivateChild(parent, child) {
+    if (await realpath(parent) !== parent)
+        throw new Error('checkpoint_ancestor_alias');
+    const path = join(parent, child);
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await inspectDirectory(path);
+    await syncNativeDirectory(parent);
+    return path;
+}
+async function readSafe(path, preserveBom = false, options = {}) {
+    const entry = await lstat(path);
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size > (options.maxBytes ?? MAX_FILE_BYTES) || options.singleLink && entry.nlink !== 1 || (entry.mode & 0o7777) !== 0o600 || (process.geteuid && entry.uid !== process.geteuid()))
+        throw new Error('checkpoint_symlink');
+    if (options.budget && entry.size > options.budget.remaining)
+        throw new Error(options.budget.error);
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.size !== entry.size || before.ino !== entry.ino || before.dev !== entry.dev || before.mtimeMs !== entry.mtimeMs || before.ctimeMs !== entry.ctimeMs || options.singleLink && before.nlink !== 1)
+            throw new Error('checkpoint_changing_source');
+        const bytes = Buffer.alloc(before.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const next = await handle.read(bytes, offset, bytes.length - offset, offset);
+            if (!next.bytesRead)
+                break;
+            offset += next.bytesRead;
+        }
+        const after = await handle.stat(), current = await lstat(path);
+        if (offset !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || current.ino !== before.ino || current.dev !== before.dev || current.mtimeMs !== before.mtimeMs || current.ctimeMs !== before.ctimeMs || current.isSymbolicLink() || options.singleLink && (after.nlink !== 1 || current.nlink !== 1))
+            throw new Error('checkpoint_changing_source');
+        const decoded = new TextDecoder('utf-8', { fatal: true, ignoreBOM: preserveBom }).decode(bytes);
+        if (options.budget)
+            options.budget.remaining -= before.size;
+        return decoded;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Event records are staged outside the observed journal namespace before an exclusive link publishes them. */
+async function publishEventExclusive(journalPath, name, bytes, maxBytes = MAX_FILE_BYTES) {
+    await publishExclusive(resolve(journalPath, '..'), join(journalPath, 'events', name), bytes, maxBytes);
+}
+function publicationPrefix(root, path, bytes) {
+    return `${sha256(relative(root, path))}-${sha256(bytes)}-`;
+}
+/** Complete bytes become visible without replacing any existing destination. */
+async function publishExclusive(root, published, bytes, maxBytes = MAX_FILE_BYTES) {
+    boundedBytes(bytes, maxBytes);
+    const directory = resolve(published, '..');
+    await inspectDirectory(directory);
+    const stagingDirectory = await ensurePrivateChild(root, '.staging');
+    const staged = join(stagingDirectory, `${publicationPrefix(root, published, bytes)}${randomUUID()}.pending`);
+    const handle = await open(staged, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+    const identity = await handle.stat();
+    let linked = false;
+    try {
+        try {
+            await handle.writeFile(bytes);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await syncNativeDirectory(stagingDirectory);
+        await link(staged, published);
+        linked = true;
+        await syncNativeDirectory(directory);
+    }
+    finally {
+        // Only this invocation's exclusively created inode may be removed here.
+        const current = await lstat(staged);
+        if (current.isSymbolicLink() || current.ino !== identity.ino || current.dev !== identity.dev || current.nlink !== (linked ? 2 : 1))
+            throw new Error('checkpoint_changing_source');
+        await unlink(staged);
+        await syncNativeDirectory(stagingDirectory);
+    }
+    if (linked)
+        await syncExisting(published, bytes, true, { maxBytes, singleLink: true });
+}
+/** An owned caller may inspect a qualified staging pair, but must validate its full history before cleanup. */
+async function readPublished(path, root, options, pending) {
+    if (!pending || (await lstat(path)).nlink === 1)
+        return readSafe(path, true, options);
+    const entry = await lstat(path);
+    if (entry.nlink !== 2)
+        throw new Error('checkpoint_symlink');
+    const bytes = await readSafe(path, true, { maxBytes: options.maxBytes });
+    const staging = join(root, '.staging');
+    try {
+        await inspectDirectory(staging);
+    }
+    catch {
+        throw new Error('checkpoint_symlink');
+    }
+    const prefix = publicationPrefix(root, path, bytes);
+    const names = (await readdir(staging)).filter(name => name.startsWith(prefix) && /^[a-f0-9-]{36}\.pending$/.test(name.slice(prefix.length)));
+    if (names.length !== 1)
+        throw new Error('checkpoint_symlink');
+    const staged = join(staging, names[0]), counterpart = await lstat(staged);
+    if (counterpart.nlink !== 2 || counterpart.ino !== entry.ino || counterpart.dev !== entry.dev ||
+        await readSafe(staged, true, { maxBytes: options.maxBytes }) !== bytes)
+        throw new Error('checkpoint_symlink');
+    pending.push({ path, staged, bytes, maxBytes: options.maxBytes ?? MAX_FILE_BYTES, ino: entry.ino, dev: entry.dev });
+    return bytes;
+}
+/** Called only inside owned writes; read-only readers never repair filesystem state. */
+async function recoverPublications(read) {
+    const pending = [], value = await read(pending);
+    // The caller's full semantic validation has succeeded before any link is removed.
+    for (const item of pending) {
+        const current = await lstat(item.path), staged = await lstat(item.staged);
+        if (current.nlink !== 2 || staged.nlink !== 2 || current.ino !== item.ino || staged.ino !== item.ino ||
+            current.dev !== item.dev || staged.dev !== item.dev || current.isSymbolicLink() || staged.isSymbolicLink())
+            throw new Error('checkpoint_changing_source');
+        await syncExisting(item.path, item.bytes, true, { maxBytes: item.maxBytes });
+        if (await readSafe(item.staged, true, { maxBytes: item.maxBytes }) !== item.bytes)
+            throw new Error('checkpoint_changing_source');
+        await unlink(item.staged);
+        await syncNativeDirectory(resolve(item.staged, '..'));
+        await syncExisting(item.path, item.bytes, true, { maxBytes: item.maxBytes, singleLink: true });
+    }
+    // Re-read strictly after cleanup; no validated disk state is cached across calls.
+    return pending.length ? read() : value;
+}
+function boundedBytes(bytes, maxBytes = MAX_FILE_BYTES) {
+    if (Buffer.byteLength(bytes, 'utf8') > maxBytes)
+        throw new Error('checkpoint_file_too_large');
+}
+/** An identical visible file is not proof that a previous fsync succeeded. */
+async function syncExisting(path, expected, preserveBom = false, options = {}) {
+    await inspectDirectory(resolve(path, '..'));
+    const entry = await lstat(path);
+    const bytes = await readSafe(path, preserveBom, options);
+    if (expected !== undefined && bytes !== expected)
+        throw new Error('checkpoint_changing_source');
+    const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.ino !== entry.ino || opened.dev !== entry.dev || opened.size !== entry.size ||
+            opened.mtimeMs !== entry.mtimeMs || opened.ctimeMs !== entry.ctimeMs || options.singleLink && opened.nlink !== 1)
+            throw new Error('checkpoint_changing_source');
+        await handle.sync();
+        const current = await lstat(path);
+        if (current.ino !== opened.ino || current.dev !== opened.dev || current.mtimeMs !== opened.mtimeMs ||
+            current.ctimeMs !== opened.ctimeMs || current.isSymbolicLink() || options.singleLink && current.nlink !== 1)
+            throw new Error('checkpoint_changing_source');
+    }
+    finally {
+        await handle.close();
+    }
+    await syncNativeDirectory(resolve(path, '..'));
+}
+function decodePlan(text) {
+    boundedBytes(text);
+    let plan;
+    try {
+        plan = frozenPlanSchema.parse(JSON.parse(text));
+    }
+    catch {
+        throw new Error('checkpoint_invalid_plan');
+    }
+    const recalculated = freezeCheckpointPlan(plan);
+    if (plan.digest !== recalculated.digest || canonical(plan) !== canonical(recalculated))
+        throw new Error('checkpoint_invalid_plan');
+    return recalculated;
+}
+function matchingPlan(actual, expected) { return actual.digest === expected.digest && canonical(actual) === canonical(expected); }
+function eventFile(sequence) { return `${String(sequence).padStart(8, '0')}.json`; }
+function bindingFile(name) { return `binding-${name}.data`; }
+function validAttempt(value) { return attemptSchema.safeParse(value).success; }
+function snapshotAttempt(value) {
+    const parsed = attemptSchema.safeParse(value);
+    if (!parsed.success)
+        throw new Error('checkpoint_invalid_attempt');
+    return parsed.data;
+}
+function snapshotResult(value) {
+    const parsed = resultSchema.safeParse(value);
+    if (!parsed.success)
+        throw new Error('checkpoint_invalid_result');
+    boundedBytes(parsed.data.reviewBytes);
+    return parsed.data;
+}
+function resultFileFor(cell, attempt) { return `${sha256(cell).slice(0, 16)}-${sha256(attempt.id).slice(0, 16)}.json`; }
+function validResultReference(value, cell, attempt) { return Number.isSafeInteger(value.chunk) && value.chunk >= 0 && (value.kind === 'success' || value.kind === 'failure') && /^[a-f0-9]{64}$/.test(value.reviewSha256) && value.resultFile === resultFileFor(cell, attempt) && basename(value.resultFile) === value.resultFile && (value.kind !== 'failure' || typeof value.possiblyBilled === 'boolean'); }
+function validateReviewBytes(bytes, cell) {
+    if (typeof bytes !== 'string' || !bytes)
+        throw new Error('checkpoint_invalid_result');
+    boundedBytes(bytes);
+    let review;
+    try {
+        review = JSON.parse(bytes);
+    }
+    catch {
+        throw new Error('checkpoint_invalid_result');
+    }
+    const parsed = reviewSchema.safeParse(review);
+    // The retained executor disables internal adapter retries: each durable
+    // physical intent can bind at most one observed SDK invocation. Preserve
+    // that counter in exact raw bytes; do not relabel it as billing or a claim.
+    if (!parsed.success || (parsed.data.adapterAttempts ?? 0) > 1)
+        throw new Error('checkpoint_invalid_result');
+    const item = parsed.data;
+    if (item.model !== cell.model || item.role !== cell.role || item.provider !== cell.route)
+        throw new Error('checkpoint_result_cell_mismatch');
+    return item;
+}
+function validateResult(result, cell) {
+    if (!Number.isSafeInteger(result.chunk) || result.chunk !== cell.chunk || typeof result.reviewBytes !== 'string' || !result.reviewBytes)
+        throw new Error('checkpoint_result_cell_mismatch');
+    const item = validateReviewBytes(result.reviewBytes, cell);
+    if ((result.kind === 'success') !== (item.status === 'success'))
+        throw new Error('checkpoint_result_cell_mismatch');
+}
+function boundedOpaqueBytes(bytes) {
+    boundedBytes(bytes);
+    if (Buffer.from(bytes, 'utf8').toString('utf8') !== bytes)
+        throw new Error('checkpoint_invalid_bytes');
+}
+function validateRecordChain(input, plan) {
+    let previous = plan.digest;
+    return input.map((value, index) => {
+        const parsed = journalRecordSchema.safeParse(value);
+        if (!parsed.success)
+            throw new Error('checkpoint_invalid_record');
+        const record = parsed.data, { digest, ...unsigned } = record;
+        boundedBytes(canonical(record));
+        if (record.sequence !== index + 1 || record.previousDigest !== previous || digest !== recordDigest(unsigned))
+            throw new Error('checkpoint_invalid_record');
+        if (record.type === 'result' && !validResultReference(record.result, record.cell, record.paidAttempt))
+            throw new Error('checkpoint_invalid_record');
+        previous = digest;
+        return record;
+    });
+}
+/** One semantic validator for both private files and portable proof bytes. */
+function validateHistory(plan, records, resultBytes, suppliedBindings) {
+    const cells = new Set(plan.cells.map(cell => cell.id));
+    const intents = new Map(), terminalAttempts = new Map(), outcomes = [], successes = [];
+    const successfulCells = new Set(), attemptIds = new Set(), bindings = {};
+    let finalized = false;
+    for (let index = 0; index < records.length; index++) {
+        const record = records[index];
+        if (record.type === 'binding') {
+            const parsed = bindingReferenceSchema.safeParse(record.binding);
+            if (!parsed.success || Object.keys(record).some(key => !['sequence', 'previousDigest', 'digest', 'type', 'binding'].includes(key)))
+                throw new Error('checkpoint_invalid_binding');
+            if (finalized || intents.size)
+                throw new Error('checkpoint_binding_closed');
+            const binding = parsed.data;
+            if (Object.hasOwn(bindings, binding.name))
+                throw new Error('checkpoint_duplicate_binding');
+            const bytes = suppliedBindings[binding.name];
+            if (typeof bytes !== 'string')
+                throw new Error('checkpoint_missing_binding');
+            boundedOpaqueBytes(bytes);
+            if (sha256(bytes) !== binding.sha256)
+                throw new Error('checkpoint_binding_tampered');
+            bindings[binding.name] = bytes;
+            continue;
+        }
+        if (Object.hasOwn(record, 'binding'))
+            throw new Error('checkpoint_invalid_record');
+        if (record.type === 'finalization') {
+            if (finalized || !record.finalizedDigest || index !== records.length - 1 || record.finalizedDigest !== sha256(canonical(records.slice(0, -1))))
+                throw new Error('checkpoint_invalid_finalization');
+            finalized = true;
+            continue;
+        }
+        if (finalized || !record.cell || !record.paidAttempt || !cells.has(record.cell) || !validAttempt(record.paidAttempt))
+            throw new Error('checkpoint_invalid_record');
+        const key = `${record.cell}\0${record.paidAttempt.id}`;
+        if (record.type === 'intent') {
+            if (successfulCells.has(record.cell))
+                throw new Error('checkpoint_success_immutable');
+            if (intents.has(key) || attemptIds.has(record.paidAttempt.id))
+                throw new Error('checkpoint_duplicate_attempt');
+            intents.set(key, record.paidAttempt);
+            attemptIds.add(record.paidAttempt.id);
+            continue;
+        }
+        if (!intents.has(key) || intents.get(key).kind !== record.paidAttempt.kind)
+            throw new Error('checkpoint_missing_intent');
+        if (record.type === 'uncertain') {
+            if (terminalAttempts.has(key))
+                throw new Error('checkpoint_terminal_result_exists');
+            if (successfulCells.has(record.cell))
+                throw new Error('checkpoint_success_immutable');
+            continue;
+        }
+        if (record.type === 'result') {
+            if (!record.result || terminalAttempts.has(key) || successfulCells.has(record.cell) || !validResultReference(record.result, record.cell, record.paidAttempt))
+                throw new Error('checkpoint_invalid_record');
+            terminalAttempts.set(key, record);
+            const bytes = resultBytes.get(record.result.resultFile);
+            if (typeof bytes !== 'string')
+                throw new Error('checkpoint_missing_result');
+            boundedOpaqueBytes(bytes);
+            if (sha256(bytes) !== record.result.reviewSha256)
+                throw new Error('checkpoint_result_tampered');
+            const cell = plan.cells.find(candidate => candidate.id === record.cell);
+            const result = record.result.kind === 'success' ? { kind: 'success', chunk: record.result.chunk, reviewBytes: bytes } : { kind: 'failure', chunk: record.result.chunk, reviewBytes: bytes, possiblyBilled: record.result.possiblyBilled === true };
+            validateResult(result, cell);
+            outcomes.push({ cell: record.cell, paidAttempt: record.paidAttempt, result });
+            if (record.result.kind === 'success') {
+                successfulCells.add(record.cell);
+                successes.push({ cell: record.cell, paidAttempt: record.paidAttempt, reviewBytes: bytes });
+            }
+        }
+    }
+    const uncertain = [...intents.entries()].filter(([key]) => !terminalAttempts.has(key)).map(([key, paidAttempt]) => ({ cell: key.split('\0')[0], paidAttempt }));
+    if (Object.keys(bindings).length !== Object.keys(suppliedBindings).length || terminalAttempts.size !== resultBytes.size)
+        throw new Error('checkpoint_unreferenced_bytes');
+    return { state: { records, outcomes, successes, uncertain, finalized }, bindings };
+}
+/** Structural integrity only: this brand does not attest providers or source authority. */
+export function isCheckpointProof(value) {
+    return typeof value === 'object' && value !== null && validatedProofs.has(value);
+}
+/** Decode canonical portable bytes using the same plan, chain and outcome validation as disk reads. */
+export function decodeCheckpointProof(bytes, expectedPlan) {
+    if (typeof bytes !== 'string')
+        throw new Error('checkpoint_invalid_proof');
+    if (Buffer.byteLength(bytes, 'utf8') > MAX_CHECKPOINT_PROOF_BYTES)
+        throw new Error('checkpoint_proof_too_large');
+    let value;
+    try {
+        value = JSON.parse(bytes);
+    }
+    catch {
+        throw new Error('checkpoint_invalid_proof');
+    }
+    const parsed = proofWireSchema.safeParse(value);
+    if (!parsed.success)
+        throw new Error('checkpoint_invalid_proof');
+    const wire = parsed.data;
+    // Validate the untrusted branches before recursively canonicalizing the
+    // portable envelope. The wire schema intentionally leaves plan and records
+    // opaque until their dedicated validators run.
+    const suppliedPlan = frozenPlanSchema.safeParse(wire.plan);
+    if (!suppliedPlan.success)
+        throw new Error('checkpoint_invalid_plan');
+    const plan = decodePlan(canonical(suppliedPlan.data));
+    if (expectedPlan && !matchingPlan(plan, decodePlan(canonical(expectedPlan))))
+        throw new Error('checkpoint_plan_mismatch');
+    const records = validateRecordChain(wire.records, plan);
+    const references = records.filter(record => record.type === 'result');
+    if (references.length !== wire.outcomes.length)
+        throw new Error('checkpoint_proof_outcomes_mismatch');
+    const resultBytes = new Map();
+    for (const [index, outcome] of wire.outcomes.entries()) {
+        if (references[index].result.resultFile !== outcome.resultFile || resultBytes.has(outcome.resultFile))
+            throw new Error('checkpoint_proof_outcomes_mismatch');
+        resultBytes.set(outcome.resultFile, outcome.reviewBytes);
+    }
+    const { state, bindings } = validateHistory(plan, records, resultBytes, wire.bindings);
+    if (!state.finalized)
+        throw new Error('checkpoint_proof_unsealed');
+    if (canonical(wire) !== bytes)
+        throw new Error('checkpoint_proof_noncanonical');
+    const proof = deepFreeze({ version: 1, bytes, digest: sha256(bytes), plan, state, bindings });
+    validatedProofs.add(proof);
+    return proof;
+}
+/** Export only a validated sealed journal. No live provider or lineage authority is inferred. */
+export function exportCheckpointProof(journal) {
+    return journal.exportProof();
+}
+export class CheckpointJournal {
+    path;
+    plan;
+    commonDir;
+    needsResync = false;
+    verificationAcknowledgment;
+    verificationPrefixCache;
+    constructor(path, plan, commonDir) {
+        this.path = path;
+        this.plan = plan;
+        this.commonDir = commonDir;
+    }
+    static async create(input) {
+        const { namespace, ownership, commonDir: requestedCommonDir } = input;
+        const plan = freezeCheckpointPlan(input.plan);
+        if (canonical(plan) !== canonical(input.plan))
+            throw new Error('checkpoint_invalid_plan');
+        const planBytes = `${canonical(plan)}\n`;
+        boundedBytes(planBytes);
+        checkpointPath(requestedCommonDir, plan.target, namespace);
+        const commonDir = await ownedNativeTargetCommonDir(ownership, requestedCommonDir, plan.target);
+        return withOwnedNativeOperation(ownership, commonDir, plan.target, async (active) => {
+            await assertNativeTargetOwnership(active, commonDir, plan.target);
+            const path = checkpointPath(commonDir, plan.target, namespace);
+            if (relative(commonDir, path).startsWith('..'))
+                throw new Error('checkpoint_root_outside_common_dir');
+            const root = await ensurePrivateChild(commonDir, 'rcl-checkpoints');
+            const targetRoot = await ensurePrivateChild(root, directoryKey(plan.target));
+            if (relative(targetRoot, path).startsWith('..'))
+                throw new Error('checkpoint_root_outside_common_dir');
+            await ensurePrivateChild(targetRoot, namespace);
+            await ensurePrivateChild(path, 'events');
+            await ensurePrivateChild(path, 'results');
+            await publishExclusive(path, join(path, 'plan.json'), planBytes);
+            return new CheckpointJournal(path, plan, commonDir);
+        });
+    }
+    static async openRead(path, expected) {
+        const frozenExpected = freezeCheckpointPlan(expected);
+        if (canonical(frozenExpected) !== canonical(expected))
+            throw new Error('checkpoint_invalid_plan');
+        const canonicalPath = resolve(path);
+        await inspectDirectory(canonicalPath);
+        await inspectDirectory(join(canonicalPath, 'events'));
+        await inspectDirectory(join(canonicalPath, 'results'));
+        const actual = decodePlan((await readSafe(join(canonicalPath, 'plan.json'))).trim());
+        if (!matchingPlan(actual, frozenExpected))
+            throw new Error('checkpoint_plan_mismatch');
+        const journal = new CheckpointJournal(canonicalPath, actual);
+        await journal.read();
+        return journal;
+    }
+    /**
+     * Structural inspection only: validate the stored plan and complete history.
+     * This supplies no freshness, source authority or recovery eligibility proof.
+     * Callers needing an expected input binding must still use openRead(expected).
+     */
+    static async inspectRead(path) {
+        const canonicalPath = resolve(path);
+        await inspectDirectory(canonicalPath);
+        const stored = decodePlan((await readSafe(join(canonicalPath, 'plan.json'))).trim());
+        return CheckpointJournal.openRead(canonicalPath, stored);
+    }
+    static async openWrite(input) {
+        const { namespace, ownership, commonDir: requestedCommonDir } = input;
+        const plan = freezeCheckpointPlan(input.plan);
+        if (canonical(plan) !== canonical(input.plan))
+            throw new Error('checkpoint_invalid_plan');
+        const commonDir = await ownedNativeTargetCommonDir(ownership, requestedCommonDir, plan.target);
+        return withOwnedNativeOperation(ownership, commonDir, plan.target, async (active) => {
+            await assertNativeTargetOwnership(active, commonDir, plan.target);
+            const journal = await CheckpointJournal.openRead(checkpointPath(commonDir, plan.target, namespace), plan);
+            const writable = new CheckpointJournal(journal.path, plan, commonDir);
+            await recoverPublications(async (pending) => {
+                const bytes = await readPublished(join(writable.path, 'plan.json'), writable.path, { singleLink: true }, pending);
+                if (!matchingPlan(decodePlan(bytes.trim()), plan))
+                    throw new Error('checkpoint_plan_mismatch');
+            });
+            await writable.syncHistory(await writable.read());
+            return writable;
+        });
+    }
+    getPlan() { return this.plan; }
+    async read() { return (await this.readValidated()).state; }
+    /** Exact immutable metadata bytes; validates the entire journal without writing. */
+    async readBindings() { return (await this.readValidated()).bindings; }
+    /**
+     * Freeze a distinct, explicitly capped verifier phase after reviewer sealing.
+     * This storage contract never expands reviewer-cell caps or establishes spend,
+     * capture, provider or server authority. The executor must regenerate the plan
+     * from validated captures, authorize its separate cap and disable SDK retries.
+     */
+    async beginVerification(input, ownership) {
+        await this.appendVerification({ type: 'plan', plan: input }, ownership);
+    }
+    /**
+     * True only for a newly durable intent. False means a prior intent exists and
+     * must NEVER be launched again, even when its first fsync acknowledgment failed.
+     * A true result is a storage claim, not independent provider launch authority.
+     */
+    async recordVerificationIntent(input, ownership, afterIntent) {
+        return this.appendVerification({ type: 'intent', intent: input }, ownership, afterIntent);
+    }
+    /** Late verifier answers are audit-only and never change the sealed verifier proof. */
+    async readLateVerificationAudit() {
+        const main = await this.readValidated(), context = this.verificationContext(main);
+        const verification = await this.readVerificationValidated(context);
+        if (!verification?.terminal)
+            throw new Error('checkpoint_verification_late_requires_terminal');
+        return this.readLateVerificationAuditValidated(verification);
+    }
+    async recordLateVerificationResult(input, ownership) {
+        const snapshot = snapshotVerificationEvent({ type: 'result', result: input });
+        if (snapshot.type !== 'result')
+            throw new Error('checkpoint_verification_late_invalid_result');
+        const result = snapshot.result;
+        return this.write(ownership, async () => {
+            const main = await this.readValidated(), context = this.verificationContext(main);
+            const verification = await recoverPublications(pending => this.readVerificationValidated(context, pending));
+            if (!verification?.terminal)
+                throw new Error('checkpoint_verification_late_requires_terminal');
+            parseVerificationAnswer(result.answerBytes, verification.plan);
+            const intent = verification.intents.find(item => item.batchIndex === result.batchIndex && item.attemptId === result.attemptId);
+            if (!intent || result.finishedAtMs < intent.startedAtMs ||
+                verification.notDispatched.some(item => item.attemptId === result.attemptId))
+                throw new Error('checkpoint_verification_late_invalid_result');
+            const prior = await recoverPublications(pending => this.readLateVerificationAuditValidated(verification, pending));
+            const existing = prior.find(item => item.result.attemptId === result.attemptId);
+            if (existing) {
+                if (existing.result.batchIndex !== result.batchIndex || existing.result.finishedAtMs !== result.finishedAtMs || existing.result.answerBytes !== result.answerBytes)
+                    throw new Error('checkpoint_verification_late_conflict');
+                const events = join(this.path, 'verification-late-audit', 'events');
+                for (const record of prior)
+                    await syncExisting(join(events, eventFile(record.sequence)), `${canonical(record)}\n`, true, { maxBytes: MAX_ARTIFACT_BYTES, singleLink: true });
+                return;
+            }
+            if (prior.length >= verification.intents.length - verification.notDispatched.length)
+                throw new Error('checkpoint_verification_late_call_cap');
+            const directory = await ensurePrivateChild(this.path, 'verification-late-audit');
+            await ensurePrivateChild(directory, 'events');
+            const terminalDigest = verification.records.at(-1).digest;
+            const unsigned = { sequence: prior.length + 1, previousDigest: prior.at(-1)?.digest ?? terminalDigest,
+                version: 1, type: 'late-verification-result', verificationTerminalDigest: terminalDigest, result };
+            const record = { ...unsigned, digest: verificationDigest(canonical(unsigned)) };
+            const total = prior.reduce((sum, item) => sum + Buffer.byteLength(`${canonical(item)}\n`, 'utf8'), 0) + Buffer.byteLength(`${canonical(record)}\n`, 'utf8');
+            if (total > MAX_ARTIFACT_BYTES)
+                throw new Error('checkpoint_verification_late_too_large');
+            const events = join(directory, 'events');
+            for (const existingRecord of prior)
+                await syncExisting(join(events, eventFile(existingRecord.sequence)), `${canonical(existingRecord)}\n`, true, { maxBytes: MAX_ARTIFACT_BYTES, singleLink: true });
+            await publishEventExclusive(directory, eventFile(record.sequence), `${canonical(record)}\n`, MAX_ARTIFACT_BYTES);
+        });
+    }
+    async readLateVerificationAuditValidated(verification, pending) {
+        const directory = join(this.path, 'verification-late-audit');
+        try {
+            await lstat(directory);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return Object.freeze([]);
+            throw error;
+        }
+        await inspectDirectory(directory);
+        const rootEntries = await readdir(directory);
+        if (rootEntries.some(name => name !== 'events'))
+            throw new Error('checkpoint_verification_late_unknown_entry');
+        if (!verification.terminal)
+            throw new Error('checkpoint_verification_late_requires_terminal');
+        const terminalDigest = verification.records.at(-1).digest;
+        const events = join(directory, 'events');
+        try {
+            await lstat(events);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return Object.freeze([]);
+            throw error;
+        }
+        await inspectDirectory(events);
+        const names = (await readdir(events)).sort();
+        if (names.length > verification.intents.length - verification.notDispatched.length)
+            throw new Error('checkpoint_verification_late_call_cap');
+        const records = [];
+        const attempts = new Set();
+        let previous = terminalDigest;
+        let total = 0;
+        for (const [index, name] of names.entries()) {
+            if (name !== eventFile(index + 1))
+                throw new Error('checkpoint_verification_late_unknown_entry');
+            const bytes = await readPublished(join(events, name), this.path, { maxBytes: MAX_ARTIFACT_BYTES, singleLink: true }, pending);
+            total += Buffer.byteLength(bytes, 'utf8');
+            if (total > MAX_ARTIFACT_BYTES)
+                throw new Error('checkpoint_verification_late_too_large');
+            let value;
+            try {
+                value = JSON.parse(bytes);
+            }
+            catch {
+                throw new Error('checkpoint_verification_late_invalid_record');
+            }
+            const parsed = verificationLateRecordSchema.safeParse(value);
+            if (!parsed.success)
+                throw new Error('checkpoint_verification_late_invalid_record');
+            const record = parsed.data, { digest: hash, ...unsigned } = record;
+            if (record.sequence !== index + 1 || record.previousDigest !== previous || record.verificationTerminalDigest !== terminalDigest ||
+                hash !== verificationDigest(canonical(unsigned)) || bytes !== `${canonical(record)}\n` || attempts.has(record.result.attemptId))
+                throw new Error('checkpoint_verification_late_invalid_record');
+            const intent = verification.intents.find(item => item.batchIndex === record.result.batchIndex && item.attemptId === record.result.attemptId);
+            if (!intent || record.result.finishedAtMs < intent.startedAtMs ||
+                verification.notDispatched.some(item => item.attemptId === record.result.attemptId))
+                throw new Error('checkpoint_verification_late_invalid_record');
+            parseVerificationAnswer(record.result.answerBytes, verification.plan);
+            attempts.add(record.result.attemptId);
+            records.push(deepFreeze(record));
+            previous = hash;
+        }
+        return Object.freeze(records);
+    }
+    /** Exact observed adapter bytes; failed/late answers remain physical history. */
+    async recordVerificationResult(input, ownership) {
+        await this.appendVerification({ type: 'result', result: input }, ownership);
+    }
+    /** A terminal storage outcome, never a finding verdict or approval. */
+    async finalizeVerification(input, ownership) {
+        await this.appendVerification({ type: 'terminal', terminal: input }, ownership);
+    }
+    async readVerification() {
+        const directory = join(this.path, 'verification');
+        // Validate main history even when no phase has been created.
+        const main = await this.readValidated();
+        try {
+            await lstat(directory);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        return this.readVerificationValidated(this.verificationContext(main));
+    }
+    async exportVerificationProof() {
+        const context = this.verificationContext(await this.readValidated());
+        const state = await this.readVerificationValidated(context);
+        if (!state?.terminal)
+            throw new Error('checkpoint_verification_unsealed');
+        return encodeVerificationProof(state, context);
+    }
+    verificationContext(main) {
+        return verificationContextFromValidatedCheckpoint(this.plan, main);
+    }
+    async readVerificationValidated(context, pending) {
+        return (await this.readVerificationValidatedForAppend(context, pending)).snapshot.state;
+    }
+    async readVerificationValidatedForAppend(context, pending, ownership) {
+        const directory = join(this.path, 'verification');
+        try {
+            await lstat(directory);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { snapshot: validateVerificationRecordsForAppend([], context), bytes: [] };
+            throw error;
+        }
+        await inspectDirectory(directory);
+        const entries = await readdir(directory);
+        if (entries.some(name => name !== 'events'))
+            throw new Error('checkpoint_verification_unknown_entry');
+        // A crash while publishing the empty directories consumed no intent.
+        if (!entries.length)
+            return { snapshot: validateVerificationRecordsForAppend([], context), bytes: [] };
+        const events = join(directory, 'events');
+        await inspectDirectory(events);
+        const names = (await readdir(events)).sort(), bytesBySequence = [];
+        if (names.length > MAX_VERIFICATION_PHASE_RECORDS)
+            throw new Error('checkpoint_verification_too_many_records');
+        let totalBytes = 0;
+        for (const [index, name] of names.entries()) {
+            if (name !== eventFile(index + 1))
+                throw new Error('checkpoint_verification_sequence_gap');
+            const bytes = await readPublished(join(events, name), this.path, { maxBytes: MAX_ARTIFACT_BYTES, singleLink: true }, pending);
+            totalBytes += Buffer.byteLength(bytes, 'utf8');
+            if (totalBytes > MAX_ARTIFACT_BYTES)
+                throw new Error('checkpoint_verification_too_large');
+            let value;
+            try {
+                value = JSON.parse(bytes);
+            }
+            catch {
+                throw new Error('checkpoint_verification_invalid_record');
+            }
+            if (bytes !== `${canonical(value)}\n`)
+                throw new Error('checkpoint_verification_noncanonical');
+            bytesBySequence.push(bytes);
+        }
+        const cache = this.verificationPrefixCache;
+        if (cache && cache.ownership === ownership && cache.context.runId === context.runId && cache.context.planDigest === context.planDigest &&
+            cache.bytes.length === bytesBySequence.length && cache.bytes.every((bytes, index) => bytes === bytesBySequence[index])) {
+            try {
+                return { snapshot: cloneValidatedVerificationRecords(cache.snapshot, context), bytes: bytesBySequence };
+            }
+            catch {
+                this.verificationPrefixCache = undefined;
+            }
+        }
+        else if (cache)
+            this.verificationPrefixCache = undefined;
+        const values = bytesBySequence.map(bytes => JSON.parse(bytes));
+        return { snapshot: validateVerificationRecordsForAppend(values, context), bytes: bytesBySequence };
+    }
+    async appendVerification(input, ownership, afterIntent) {
+        const event = snapshotVerificationEvent(input);
+        return this.write(ownership, async () => {
+            const context = this.verificationContext(await this.readValidated());
+            const read = await recoverPublications(pending => this.readVerificationValidatedForAppend(context, pending, ownership)), snapshot = read.snapshot, state = snapshot.state, records = state?.records ?? [];
+            const prior = records.find(row => row.event.type === event.type &&
+                (event.type === 'intent' ? row.event.type === 'intent' && row.event.intent.attemptId === event.intent.attemptId
+                    : event.type === 'result' || event.type === 'not-dispatched'
+                        ? row.event.type === event.type && row.event.result.attemptId === event.result.attemptId : true));
+            if (prior && canonical(prior.event) !== canonical(event))
+                throw new Error('checkpoint_verification_conflict');
+            // An immutable report, including a surviving partial publication, closes
+            // this run to new paid work. Only identical records of a sealed phase can
+            // be re-acknowledged afterward; they never return a new launch claim.
+            if (await this.terminalReportEntries() !== undefined && (!state?.terminal || !prior)) {
+                throw new Error('checkpoint_verification_report_finalized');
+            }
+            const appended = prior ? undefined : appendVerificationRecordWithSuccessor(snapshot, event, context);
+            const record = appended?.record;
+            if (!state && event.type !== 'plan')
+                throw new Error('checkpoint_verification_missing_plan');
+            const directory = await ensurePrivateChild(this.path, 'verification');
+            await ensurePrivateChild(directory, 'events');
+            const tip = records.at(-1);
+            const acknowledged = this.verificationAcknowledgment;
+            const canSkipHistorySync = tip !== undefined && acknowledged?.ownership === ownership &&
+                acknowledged.sequence === tip.sequence && acknowledged.digest === tip.digest;
+            try {
+                if (!canSkipHistorySync) {
+                    for (const existing of records) {
+                        await syncExisting(join(directory, 'events', eventFile(existing.sequence)), `${canonical(existing)}\n`, true, { maxBytes: MAX_ARTIFACT_BYTES, singleLink: true });
+                    }
+                }
+                if (!record)
+                    return false;
+                const recordBytes = `${canonical(record)}\n`;
+                await publishEventExclusive(directory, eventFile(record.sequence), recordBytes, MAX_ARTIFACT_BYTES);
+                let finalRecord = record, finalSnapshot = appended.successor, finalBytes = [...read.bytes, recordBytes];
+                if (event.type === 'intent' && afterIntent) {
+                    const result = afterIntent(event.intent);
+                    if (result) {
+                        if (result.batchIndex !== event.intent.batchIndex || result.attemptId !== event.intent.attemptId) {
+                            throw new Error('checkpoint_verification_not_dispatched_mismatch');
+                        }
+                        const resultEvent = snapshotVerificationEvent({ type: 'not-dispatched', result });
+                        const successor = appendVerificationRecordWithSuccessor(finalSnapshot, resultEvent, context);
+                        const resultBytes = `${canonical(successor.record)}\n`;
+                        await publishEventExclusive(directory, eventFile(successor.record.sequence), resultBytes, MAX_ARTIFACT_BYTES);
+                        finalRecord = successor.record;
+                        finalSnapshot = successor.successor;
+                        finalBytes = [...finalBytes, resultBytes];
+                    }
+                }
+                this.verificationAcknowledgment = { ownership, sequence: finalRecord.sequence, digest: finalRecord.digest };
+                this.verificationPrefixCache = { ownership, context, bytes: finalBytes, snapshot: finalSnapshot };
+                return true;
+            }
+            catch (error) {
+                this.verificationAcknowledgment = undefined;
+                this.verificationPrefixCache = undefined;
+                throw error;
+            }
+        }).catch(error => {
+            this.verificationAcknowledgment = undefined;
+            this.verificationPrefixCache = undefined;
+            throw error;
+        });
+    }
+    /**
+     * Retain opaque terminal bytes after sealing, under the caller's ownership.
+     * Exact orphan payloads can resume; no existing bytes are replaced. The final
+     * manifest publishes the pair and does not confer producer authority.
+     */
+    async retainTerminalReport(input, ownership) {
+        const parsed = terminalPayloadSchema.safeParse(input);
+        if (!parsed.success)
+            throw new Error('checkpoint_invalid_terminal_report');
+        const captured = parsed.data;
+        for (const bytes of Object.values(captured)) {
+            boundedBytes(bytes, MAX_ARTIFACT_BYTES);
+            if (Buffer.from(bytes, 'utf8').toString('utf8') !== bytes)
+                throw new Error('checkpoint_invalid_bytes');
+        }
+        return this.write(ownership, async () => {
+            const state = await this.read();
+            if (!state.finalized)
+                throw new Error('checkpoint_terminal_report_requires_finalization');
+            let verification;
+            let hasVerification = false;
+            try {
+                await lstat(join(this.path, 'verification'));
+                hasVerification = true;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            if (hasVerification) {
+                const context = this.verificationContext(await this.readValidated());
+                verification = await recoverPublications(pending => this.readVerificationValidated(context, pending));
+            }
+            if (verification && !verification.terminal)
+                throw new Error('checkpoint_terminal_report_verification_pending');
+            const directory = join(this.path, 'terminal-report');
+            const payloads = [['report.json', captured.reportBytes], ['reviewer-artifact.json', captured.reviewerArtifactBytes]];
+            await recoverPublications(async (pending) => {
+                const entries = await this.terminalReportEntries();
+                if (entries?.includes('manifest.json')) {
+                    const report = await this.readTerminalReportValidated(state, pending);
+                    if (report.reportBytes !== captured.reportBytes || report.reviewerArtifactBytes !== captured.reviewerArtifactBytes)
+                        throw new Error('checkpoint_terminal_report_conflict');
+                }
+                else {
+                    for (const [name, bytes] of payloads) {
+                        if (entries?.includes(name) && await readPublished(join(directory, name), this.path, terminalPayloadOptions, pending) !== bytes)
+                            throw new Error('checkpoint_terminal_report_conflict');
+                    }
+                }
+            });
+            const names = await this.terminalReportEntries();
+            await ensurePrivateChild(this.path, 'terminal-report');
+            for (const [name, bytes] of payloads) {
+                const path = join(directory, name);
+                if (!names?.includes(name))
+                    await publishExclusive(this.path, path, bytes, MAX_ARTIFACT_BYTES);
+                await syncExisting(path, bytes, true, terminalPayloadOptions);
+            }
+            const manifest = { version: 1, planDigest: this.plan.digest, finalizationDigest: state.records.at(-1).digest,
+                reportSha256: sha256(captured.reportBytes), reviewerArtifactSha256: sha256(captured.reviewerArtifactBytes),
+                reportByteLength: Buffer.byteLength(captured.reportBytes, 'utf8'), reviewerArtifactByteLength: Buffer.byteLength(captured.reviewerArtifactBytes, 'utf8') };
+            const bytes = `${canonical(manifest)}\n`, path = join(directory, 'manifest.json');
+            if (!names?.includes('manifest.json'))
+                await publishExclusive(this.path, path, bytes);
+            await syncExisting(path, bytes, true, terminalManifestOptions);
+        });
+    }
+    /** Exact private payloads only after complete publication; no report semantics are inferred. */
+    async readTerminalReport() {
+        return this.readTerminalReportValidated(await this.read());
+    }
+    async terminalReportEntries() {
+        const path = join(this.path, 'terminal-report');
+        try {
+            await lstat(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        await inspectDirectory(path);
+        const names = (await readdir(path)).sort();
+        if (names.some(name => !terminalFileNames.includes(name)))
+            throw new Error('checkpoint_terminal_report_unknown_entry');
+        return names;
+    }
+    async readTerminalReportValidated(state, pending) {
+        const names = await this.terminalReportEntries();
+        if (names === undefined)
+            return undefined;
+        if (!state.finalized)
+            throw new Error('checkpoint_terminal_report_requires_finalization');
+        if (names.length !== terminalFileNames.length)
+            throw new Error('checkpoint_terminal_report_incomplete');
+        const path = join(this.path, 'terminal-report'), bytes = await readPublished(join(path, 'manifest.json'), this.path, terminalManifestOptions, pending);
+        let value;
+        try {
+            value = JSON.parse(bytes);
+        }
+        catch {
+            throw new Error('checkpoint_invalid_terminal_manifest');
+        }
+        const parsed = terminalManifestSchema.safeParse(value);
+        if (!parsed.success)
+            throw new Error('checkpoint_invalid_terminal_manifest');
+        const manifest = parsed.data;
+        if (bytes !== `${canonical(manifest)}\n` || manifest.planDigest !== this.plan.digest ||
+            manifest.finalizationDigest !== state.records.at(-1).digest)
+            throw new Error('checkpoint_invalid_terminal_manifest');
+        const reportBytes = await readPublished(join(path, 'report.json'), this.path, terminalPayloadOptions, pending);
+        const reviewerArtifactBytes = await readPublished(join(path, 'reviewer-artifact.json'), this.path, terminalPayloadOptions, pending);
+        if (Buffer.byteLength(reportBytes, 'utf8') !== manifest.reportByteLength || Buffer.byteLength(reviewerArtifactBytes, 'utf8') !== manifest.reviewerArtifactByteLength ||
+            sha256(reportBytes) !== manifest.reportSha256 || sha256(reviewerArtifactBytes) !== manifest.reviewerArtifactSha256)
+            throw new Error('checkpoint_terminal_report_tampered');
+        return Object.freeze({ reportBytes, reviewerArtifactBytes, reportSha256: manifest.reportSha256, reviewerArtifactSha256: manifest.reviewerArtifactSha256 });
+    }
+    /** Late observations are audit-only and never enter the sealed main proof or accounting. */
+    async readLateAudit() {
+        return this.readLateAuditValidated(await this.read());
+    }
+    async readLateAuditValidated(state, pending) {
+        const path = join(this.path, 'late-audit');
+        try {
+            await lstat(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return Object.freeze([]);
+            throw error;
+        }
+        await inspectDirectory(path);
+        if (!state.finalized)
+            throw new Error('checkpoint_late_requires_finalization');
+        const finalization = state.records.at(-1);
+        const names = (await readdir(path)).sort(), records = [], attempts = new Set();
+        let previous = finalization.digest;
+        for (const [index, name] of names.entries()) {
+            if (name !== eventFile(index + 1))
+                throw new Error('checkpoint_late_unknown_entry');
+            const bytes = await readPublished(join(path, name), this.path, lateFileOptions, pending);
+            let value;
+            try {
+                value = JSON.parse(bytes);
+            }
+            catch {
+                throw new Error('checkpoint_invalid_late_record');
+            }
+            const parsed = lateRecordSchema.safeParse(value);
+            if (!parsed.success)
+                throw new Error('checkpoint_invalid_late_record');
+            const record = parsed.data, { digest, ...unsigned } = record;
+            if (record.sequence !== index + 1 || record.previousDigest !== previous || digest !== sha256(canonical(unsigned)) ||
+                bytes !== `${canonical(record)}\n` || record.planDigest !== this.plan.digest || record.finalizationDigest !== finalization.digest || attempts.has(record.paidAttempt.id))
+                throw new Error('checkpoint_invalid_late_record');
+            const intent = state.records.find(row => row.type === 'intent' && row.cell === record.cell && row.paidAttempt?.id === record.paidAttempt.id && row.paidAttempt.kind === record.paidAttempt.kind);
+            const cell = this.plan.cells.find(cell => cell.id === record.cell);
+            if (!intent || !cell || intent.digest !== record.intentDigest)
+                throw new Error('checkpoint_late_missing_intent');
+            boundedOpaqueBytes(record.reviewBytes);
+            validateReviewBytes(record.reviewBytes, cell);
+            if (sha256(record.reviewBytes) !== record.reviewSha256)
+                throw new Error('checkpoint_late_tampered');
+            attempts.add(record.paidAttempt.id);
+            previous = digest;
+            records.push(record);
+        }
+        return deepFreeze(records);
+    }
+    async syncLateRecord(record) {
+        await syncExisting(join(this.path, 'late-audit', eventFile(record.sequence)), `${canonical(record)}\n`, true, lateFileOptions);
+    }
+    /** Caller retains live original ownership while draining; no ownership is created here. */
+    async recordLateResult(cell, paidAttempt, rawReviewBytes, ownership) {
+        const attempt = snapshotAttempt(paidAttempt);
+        this.cell(cell);
+        validateReviewBytes(rawReviewBytes, this.plan.cells.find(candidate => candidate.id === cell));
+        boundedOpaqueBytes(rawReviewBytes);
+        return this.write(ownership, async () => {
+            const state = await this.read();
+            if (!state.finalized)
+                throw new Error('checkpoint_late_requires_finalization');
+            const intent = state.records.find(row => row.type === 'intent' && row.cell === cell && row.paidAttempt?.id === attempt.id && row.paidAttempt.kind === attempt.kind);
+            if (!intent)
+                throw new Error('checkpoint_late_missing_intent');
+            const records = await recoverPublications(pending => this.readLateAuditValidated(state, pending));
+            const prior = records.find(record => record.paidAttempt.id === attempt.id);
+            if (prior && prior.reviewBytes !== rawReviewBytes)
+                throw new Error('checkpoint_late_conflict');
+            const finalizationDigest = state.records.at(-1).digest;
+            const unsigned = { version: 1, type: 'late-result', sequence: records.length + 1, previousDigest: records.at(-1)?.digest ?? finalizationDigest,
+                planDigest: this.plan.digest, finalizationDigest, intentDigest: intent.digest, cell, paidAttempt: attempt,
+                reviewSha256: sha256(rawReviewBytes), reviewBytes: rawReviewBytes };
+            const record = { ...unsigned, digest: sha256(canonical(unsigned)) };
+            const bytes = `${canonical(record)}\n`;
+            boundedBytes(bytes, lateFileOptions.maxBytes);
+            const path = await ensurePrivateChild(this.path, 'late-audit');
+            // Reflush acknowledged history too: a prior process may have lost an fsync acknowledgment.
+            for (const existing of records)
+                await this.syncLateRecord(existing);
+            if (prior)
+                return;
+            await publishExclusive(this.path, join(path, eventFile(record.sequence)), bytes, lateFileOptions.maxBytes);
+            await this.syncLateRecord(record);
+        });
+    }
+    async exportProof() {
+        const { state, bindings } = await this.readValidated(MAX_CHECKPOINT_PROOF_BYTES);
+        if (!state.finalized)
+            throw new Error('checkpoint_proof_unsealed');
+        let outcomeIndex = 0;
+        const outcomes = state.records.filter(record => record.type === 'result').map(record => ({
+            resultFile: record.result.resultFile, reviewBytes: state.outcomes[outcomeIndex++].result.reviewBytes,
+        }));
+        const bytes = canonical({ version: 1, plan: this.plan, records: state.records, outcomes, bindings });
+        return decodeCheckpointProof(bytes, this.plan);
+    }
+    async readValidated(maxReadBytes = MAX_CHECKPOINT_READ_BYTES) {
+        await inspectDirectory(this.path);
+        await inspectDirectory(join(this.path, 'events'));
+        await inspectDirectory(join(this.path, 'results'));
+        const budget = { remaining: maxReadBytes, error: maxReadBytes === MAX_CHECKPOINT_PROOF_BYTES ? 'checkpoint_proof_too_large' : 'checkpoint_journal_too_large' };
+        const actual = decodePlan((await readSafe(join(this.path, 'plan.json'), false, { budget })).trim());
+        if (!matchingPlan(actual, this.plan))
+            throw new Error('checkpoint_plan_mismatch');
+        const names = (await readdir(join(this.path, 'events'))).sort();
+        const rawRecords = [];
+        for (let i = 0; i < names.length; i++) {
+            if (names[i] !== eventFile(i + 1))
+                throw new Error('checkpoint_sequence_gap');
+            let bytes = '';
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    bytes = await readSafe(join(this.path, 'events', names[i]), false, { budget });
+                    break;
+                }
+                catch (error) {
+                    if (error instanceof Error && error.message === 'checkpoint_changing_source' && attempt < 2)
+                        continue;
+                    if (error instanceof Error && (error.message === 'checkpoint_symlink' || error.message === budget.error))
+                        throw error;
+                    throw new Error('checkpoint_invalid_record');
+                }
+            }
+            let record;
+            try {
+                record = JSON.parse(bytes);
+            }
+            catch {
+                throw new Error('checkpoint_invalid_record');
+            }
+            rawRecords.push(record);
+        }
+        const records = validateRecordChain(rawRecords, this.plan);
+        const resultBytes = new Map(), suppliedBindings = {};
+        for (const record of records) {
+            if (record.binding)
+                suppliedBindings[record.binding.name] = await readSafe(join(this.path, record.binding.file), true, { budget });
+            if (record.result)
+                resultBytes.set(record.result.resultFile, await readSafe(join(this.path, 'results', record.result.resultFile), true, { budget }));
+        }
+        return { ...validateHistory(this.plan, records, resultBytes, suppliedBindings), bytesRead: maxReadBytes - budget.remaining };
+    }
+    async write(ownership, operation) {
+        if (!this.commonDir)
+            throw new Error('checkpoint_read_only');
+        return withOwnedNativeOperation(ownership, this.commonDir, this.plan.target, async (active) => {
+            await assertNativeTargetOwnership(active, this.commonDir, this.plan.target);
+            try {
+                if (this.needsResync) {
+                    await this.syncHistory(await this.read());
+                    this.needsResync = false;
+                }
+                return await operation(active);
+            }
+            catch (error) {
+                this.needsResync = true;
+                throw error;
+            }
+        });
+    }
+    async syncRecord(record) {
+        if (record.binding) {
+            const path = join(this.path, record.binding.file), bytes = await readSafe(path, true);
+            if (sha256(bytes) !== record.binding.sha256)
+                throw new Error('checkpoint_binding_tampered');
+            await syncExisting(path, bytes, true);
+        }
+        if (record.result) {
+            const path = join(this.path, 'results', record.result.resultFile), bytes = await readSafe(path, true);
+            if (sha256(bytes) !== record.result.reviewSha256)
+                throw new Error('checkpoint_result_tampered');
+            await syncExisting(path, bytes, true);
+        }
+        await syncExisting(join(this.path, 'events', eventFile(record.sequence)), `${canonical(record)}\n`);
+    }
+    async syncHistory(state) {
+        await syncExisting(join(this.path, 'plan.json'), `${canonical(this.plan)}\n`);
+        for (const record of state.records)
+            await this.syncRecord(record);
+    }
+    async append(record, snapshot) {
+        const { state, bytesRead } = snapshot;
+        const previousDigest = state.records.at(-1)?.digest ?? this.plan.digest;
+        const unsigned = { ...record, sequence: state.records.length + 1, previousDigest };
+        const complete = { ...unsigned, digest: recordDigest(unsigned) };
+        const bytes = `${canonical(complete)}\n`;
+        const addedFile = record.binding ? join(this.path, record.binding.file) : record.result ? join(this.path, 'results', record.result.resultFile) : undefined;
+        const addedBytes = addedFile ? (await lstat(addedFile)).size : 0;
+        if (bytesRead + addedBytes + Buffer.byteLength(bytes, 'utf8') > MAX_CHECKPOINT_READ_BYTES)
+            throw new Error('checkpoint_journal_too_large');
+        await publishEventExclusive(this.path, eventFile(complete.sequence), bytes);
+    }
+    cell(cell) { if (!this.plan.cells.some(candidate => candidate.id === cell))
+        throw new Error('checkpoint_unknown_cell'); }
+    /** Bind opaque UTF-8 bytes before work begins. Identical replay re-establishes durability. */
+    async bind(name, bytes, ownership) {
+        const parsed = bindingNameSchema.safeParse(name);
+        if (!parsed.success || typeof bytes !== 'string')
+            throw new Error('checkpoint_invalid_binding');
+        boundedBytes(bytes);
+        if (Buffer.from(bytes, 'utf8').toString('utf8') !== bytes)
+            throw new Error('checkpoint_invalid_binding');
+        const binding = { name: parsed.data, file: bindingFile(parsed.data), sha256: sha256(bytes) };
+        return this.write(ownership, async () => {
+            const snapshot = await this.readValidated();
+            const { state, bindings } = snapshot;
+            const prior = state.records.find(record => record.type === 'binding' && record.binding?.name === binding.name);
+            if (prior) {
+                if (bindings[binding.name] !== bytes)
+                    throw new Error('checkpoint_binding_conflict');
+                await this.syncRecord(prior);
+                return;
+            }
+            if (state.finalized)
+                throw new Error('checkpoint_finalized');
+            if (state.records.some(record => record.type === 'intent'))
+                throw new Error('checkpoint_binding_closed');
+            const path = join(this.path, binding.file);
+            try {
+                await publishExclusive(this.path, path, bytes);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                await recoverPublications(async (pending) => {
+                    if (await readPublished(path, this.path, { singleLink: true }, pending) !== bytes)
+                        throw new Error('checkpoint_binding_conflict');
+                });
+                await syncExisting(path, bytes, true, { singleLink: true });
+            }
+            await this.append({ type: 'binding', binding }, snapshot);
+        });
+    }
+    async recordIntent(cell, paidAttempt, ownership) {
+        const attempt = snapshotAttempt(paidAttempt);
+        return this.write(ownership, async () => {
+            this.cell(cell);
+            const snapshot = await this.readValidated();
+            const state = snapshot.state;
+            if (state.finalized)
+                throw new Error('checkpoint_finalized');
+            const prior = state.records.find(record => record.type === 'intent' && record.paidAttempt?.id === attempt.id);
+            if (prior) {
+                if (prior.cell !== cell || prior.paidAttempt?.kind !== attempt.kind)
+                    throw new Error('checkpoint_duplicate_attempt');
+                await this.syncRecord(prior);
+                return;
+            }
+            if (state.successes.some(success => success.cell === cell))
+                throw new Error('checkpoint_success_immutable');
+            await this.append({ type: 'intent', cell, paidAttempt: attempt }, snapshot);
+        });
+    }
+    async recordUncertain(cell, paidAttempt, reason, ownership) {
+        const attempt = snapshotAttempt(paidAttempt);
+        requireText(reason, 'reason');
+        return this.write(ownership, async () => {
+            this.cell(cell);
+            const snapshot = await this.readValidated();
+            const state = snapshot.state;
+            if (state.finalized)
+                throw new Error('checkpoint_finalized');
+            if (!state.records.some(record => record.type === 'intent' && record.cell === cell && record.paidAttempt?.id === attempt.id && record.paidAttempt.kind === attempt.kind))
+                throw new Error('checkpoint_missing_intent');
+            const prior = state.records.find(record => record.type === 'uncertain' && record.cell === cell && record.paidAttempt?.id === attempt.id && record.reason === reason);
+            if (prior) {
+                await this.syncRecord(prior);
+                return;
+            }
+            if (state.records.some(record => record.type === 'result' && record.cell === cell && record.paidAttempt?.id === attempt.id))
+                throw new Error('checkpoint_terminal_result_exists');
+            if (state.successes.some(success => success.cell === cell))
+                throw new Error('checkpoint_success_immutable');
+            await this.append({ type: 'uncertain', cell, paidAttempt: attempt, reason }, snapshot);
+        });
+    }
+    async recordResult(cell, paidAttempt, result, ownership) {
+        const attempt = snapshotAttempt(paidAttempt), captured = snapshotResult(result);
+        this.cell(cell);
+        validateResult(captured, this.plan.cells.find(candidate => candidate.id === cell));
+        return this.write(ownership, async () => {
+            const snapshot = await this.readValidated();
+            const state = snapshot.state;
+            if (state.finalized)
+                throw new Error('checkpoint_finalized');
+            const existing = state.records.find(record => record.type === 'result' && record.cell === cell && record.paidAttempt?.id === attempt.id);
+            if (existing) {
+                if (existing.result?.reviewSha256 === sha256(captured.reviewBytes) && existing.result.kind === captured.kind && existing.result.chunk === captured.chunk && existing.paidAttempt?.kind === attempt.kind && (captured.kind !== 'failure' || existing.result.possiblyBilled === captured.possiblyBilled)) {
+                    await this.syncRecord(existing);
+                    return;
+                }
+                throw new Error('checkpoint_terminal_result_exists');
+            }
+            if (state.successes.some(success => success.cell === cell))
+                throw new Error('checkpoint_success_immutable');
+            if (!state.records.some(record => record.type === 'intent' && record.cell === cell && record.paidAttempt?.id === attempt.id && record.paidAttempt.kind === attempt.kind))
+                throw new Error('checkpoint_missing_intent');
+            const resultFile = resultFileFor(cell, attempt), resultPath = join(this.path, 'results', resultFile);
+            try {
+                await publishExclusive(this.path, resultPath, captured.reviewBytes);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                await recoverPublications(async (pending) => {
+                    if (await readPublished(resultPath, this.path, { singleLink: true }, pending) !== captured.reviewBytes)
+                        throw new Error('checkpoint_changing_source');
+                });
+                await syncExisting(resultPath, captured.reviewBytes, true, { singleLink: true });
+            }
+            await this.append({ type: 'result', cell, paidAttempt: attempt, result: { kind: captured.kind, chunk: captured.chunk, reviewSha256: sha256(captured.reviewBytes), resultFile, ...(captured.kind === 'failure' ? { possiblyBilled: captured.possiblyBilled } : {}) } }, snapshot);
+        });
+    }
+    finalize(ownership) {
+        return this.write(ownership, async (active) => {
+            // Retained async delegates share a short phase lock. Close admission
+            // before publishing immutable reviewer history; never await providers.
+            let asyncPhase = false;
+            try {
+                await lstat(join(this.path, 'async'));
+                asyncPhase = true;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            if (asyncPhase) {
+                const { sealAsyncPhase } = await import('./checkpoint-async-store.js');
+                await sealAsyncPhase({ commonDir: this.commonDir, namespace: basename(this.path), plan: this.plan, ownership: active });
+            }
+            const snapshot = await this.readValidated();
+            const state = snapshot.state;
+            for (const record of state.records)
+                if (record.type === 'binding')
+                    await this.syncRecord(record);
+            if (state.finalized) {
+                await this.syncRecord(state.records.at(-1));
+                return;
+            }
+            await this.append({ type: 'finalization', finalizedDigest: sha256(canonical(state.records)) }, snapshot);
+        });
+    }
+}
+//# sourceMappingURL=checkpoint.js.map