@askdkc/kiokuko 0.2.2 → 0.2.4

package/dist/enno-oduno/service.js

@@ -12,17 +12,20 @@ import { canonicalContentHash, canonicalJson } from '../serialization/validate.j
 import { sanitizeJson } from '../security/sanitize.js';
 import { LedgerStore } from '../ledger/store.js';
 import { directiveForIntake, directiveForRun } from './directives.js';
-import { advisoryDirectiveForSnapshot, advisoryInputDigest, advisoryPhaseForStatus } from './advisory.js';
-import { createAdvisoryRoundInTransaction, ensureAdvisoryRoundConsumedInTransaction, readAdvisoryRound, } from './advisory-store.js';
+import { advisoryContextForSnapshot, advisoryInputDigest, advisoryPhaseForStatus, normalizeAdvisoryContributions } from './advisory.js';
+import { createAdvisoryRoundInTransaction, ensureAdvisoryRoundConsumedInTransaction, readAdvisoryRound, readSubmittedAdvisoryRound, } from './advisory-store.js';
 import { assertWorkPlanExpertCoverage } from './experts.js';
 import { buildEnnoRequestHandoff } from './handoff.js';
 import { identifyEnnoClientKind } from './harness.js';
-import { assertContractVerifierCwds, parseEnnoAnswer, parseAdviceSubmission, parseFinishRequest, parseIdealSubmission, parseMeditationSubmission, parseOdunoIdeal, parseOdunoMeditation, parsePlanSubmission, parseWorkReport, } from './schemas.js';
+import { assertContractVerifierCwds, parseEnnoAnswer, parseAdviceSubmission, parseFinishRequest, parseIdealSubmission, parseMeditationSubmission, parsePlanSubmission, parseVerificationPrepare, parseWorkReport, } from './schemas.js';
 import { completeRequiredSkillList, createSkillSetEntries, orderedUniqueSkillNames, unavailableRequiredSkills, } from './skills.js';
-import { appendEnnoEventInTransaction, completeOperationInTransaction, createEnnoDraft, finishVerifierRunsInTransaction, readEnnoSnapshot, readFreshFinalVerifierResults, readOperationReceipt, replaceWorkUnitsInTransaction, setWorkUnitStatusInTransaction, startOperationInTransaction, startVerifierRunsInTransaction, terminalizeLedgerRunInTransaction, updateContractInTransaction, } from './store.js';
+import { appendEnnoEventInTransaction, assertExecutionLeaseInTransaction, claimExecutionLeaseInTransaction, completeOperationInTransaction, createEnnoDraft, finishVerifierRunsInTransaction, readEnnoSnapshot, readFreshFinalVerifierResults, readOperationReceipt, releaseExecutionLeaseInTransaction, renewExecutionLeaseInTransaction, resolveEnnoIdentity, replaceWorkUnitsInTransaction, setWorkUnitStatusInTransaction, startOperationInTransaction, startVerifierRunsInTransaction, operationLeaseMsForVerifiers, terminalizeLedgerRunInTransaction, updateContractInTransaction, } from './store.js';
 import { ENNO_APPLICABLE_TASK_TYPES, ENNO_MAX_EXTERNAL_SKILLS, ENNO_MAX_TOTAL_SKILL_QUERIES, ENNO_PROVENANCE_KEYS, } from './types.js';
 import { runVerifiers } from './verifier.js';
-import { planStartRecoveryError } from './plan-recovery.js';
+import { planStartRecoveryBlocker, planStartRecoveryError, planStartRecoveryReasonFromBlocker, } from './plan-recovery.js';
+import { ennoValidationError } from './validation-errors.js';
+import { captureRepositoryState } from './repository-state.js';
+import { sanitizeEnnoAnswer, sanitizeFinishRequest, sanitizeIdealSubmission, sanitizeMeditationSubmission, sanitizePlanSubmission, sanitizeWorkReport, } from './sanitize.js';
 import { STANDARD_FUNCTION_SKILL_NAME, STANDARD_SOUL_SKILL_NAME, STANDARD_UI_SKILL_NAME, } from '../setup/standard-skills.js';
 function stateForSnapshot(snapshot) {
     let nextAction;
@@ -37,7 +40,7 @@ function stateForSnapshot(snapshot) {
     else if (snapshot.status === 'goki_executing')
         nextAction = 'execute_work_unit';
     else if (snapshot.status === 'enno_verifying')
-        nextAction = 'run_final_verification';
+        nextAction = snapshot.finalEvidenceReady ? 'submit_final_review' : 'run_final_verification';
     else if (snapshot.status === 'oduno_meditation')
         nextAction = 'submit_meditation';
     else if (snapshot.status === 'blocked')
@@ -56,11 +59,13 @@ function stateForSnapshot(snapshot) {
             identified: snapshot.clientKind !== null,
         },
         contractRevision: snapshot.revision,
+        routeEpoch: snapshot.routeEpoch ?? 0,
         ideal: snapshot.ideal,
         meditation: snapshot.meditation,
         currentRole: directive?.role ?? null,
         directive,
         nextAction,
+        advisoryPhaseState: snapshot.advisoryPhaseState ?? { state: 'not_started' },
     };
 }
 function intakeEnnoState(input) {
@@ -76,11 +81,13 @@ function intakeEnnoState(input) {
             identified: input.clientKind !== null,
         },
         contractRevision: null,
+        routeEpoch: null,
         ideal: null,
         meditation: null,
         currentRole: 'enno-oduno',
         directive,
         nextAction: 'answer_intake',
+        advisoryPhaseState: { state: 'not_started' },
     };
 }
 export function inapplicableEnnoState() {
@@ -90,11 +97,13 @@ export function inapplicableEnnoState() {
         orchestrationId: null,
         clientBinding: null,
         contractRevision: null,
+        routeEpoch: null,
         ideal: null,
         meditation: null,
         currentRole: null,
         directive: null,
         nextAction: 'complete',
+        advisoryPhaseState: { state: 'not_started' },
     };
 }
 export function ennoStateForPreparedTask(database, prepared, client) {
@@ -143,20 +152,27 @@ export function ennoStateForPreparedTask(database, prepared, client) {
     return stateForSnapshot(snapshot);
 }
 function operationIdentity(operation, idempotencyKey, input) {
+    const semanticInput = typeof input === 'object' && input !== null && !Array.isArray(input)
+        ? Object.fromEntries(Object.entries(input)
+            .filter(([key]) => !['workspace', 'orchestrationId', 'resumeToken', 'idempotencyKey'].includes(key)))
+        : input;
+    const requestDigest = canonicalContentHash({ version: 1, operation, input: semanticInput });
+    const legacyRequestDigest = canonicalContentHash({ version: 1, operation, input });
     return {
         operation,
         idempotencyKey,
-        requestDigest: canonicalContentHash({ version: 1, operation, input }),
+        requestDigest,
+        ...(legacyRequestDigest === requestDigest ? {} : { legacyRequestDigests: [legacyRequestDigest] }),
     };
 }
 function advisoryContextForSubmission(snapshot, phase) {
-    const directive = advisoryDirectiveForSnapshot(snapshot);
-    if (directive === undefined || directive.phase !== phase) {
+    if (advisoryPhaseForStatus(snapshot.status) !== phase
+        || (phase === 'final_review' && !snapshot.finalEvidenceReady)) {
         throw new KiokukoError('CONFLICT', 'Advisory round is not valid for the current Enno phase');
     }
-    return directive.context;
+    return advisoryContextForSnapshot(snapshot, phase);
 }
-function assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest) {
+function assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest, validationOperation) {
     if (snapshot.mutationRevision !== mutationRevision) {
         throw new KiokukoError('CONFLICT', 'Enno mutation revision changed');
     }
@@ -171,11 +187,18 @@ function assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, in
         allowlistedContext: context,
     });
     if (expectedDigest !== inputDigest) {
+        if (validationOperation !== undefined) {
+            throw ennoValidationError(validationOperation, [{
+                    path: ['advisoryRoundDigest'],
+                    reasonCode: 'advisory_digest_stale',
+                }], 'refresh_state');
+        }
         throw new KiokukoError('CONFLICT', 'Advisory round digest does not match the current contract');
     }
 }
 function requireAdvisoryRound(database, snapshot, phase, mutationRevision, context, inputDigest) {
-    assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest);
+    const operation = phase === 'planning' ? 'plan_submit' : phase === 'ideal' ? 'ideal_submit' : 'finish';
+    assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest, operation);
     const round = readAdvisoryRound(database, {
         runId: snapshot.runId,
         contractRevision: snapshot.revision,
@@ -186,25 +209,113 @@ function requireAdvisoryRound(database, snapshot, phase, mutationRevision, conte
     if (round === undefined)
         throw new KiokukoError('CONFLICT', 'Required advisory round was not submitted');
 }
-function consumeAdvisoryRoundIfPresent(database, snapshot, phase, mutationRevision, context, inputDigest) {
-    if (inputDigest === undefined)
+function assertDispositionCoversRound(operation, round, dispositions) {
+    const expected = new Set(round.contributions.map((contribution) => contribution.slotId));
+    const covered = new Set();
+    for (const [index, disposition] of dispositions.entries()) {
+        if (!expected.has(disposition.slotId)) {
+            throw ennoValidationError(operation, [{
+                    path: ['advisoryDisposition', index, 'slotId'],
+                    reasonCode: 'advisory_slot_missing',
+                    expected: { requiredSlotIds: [...expected] },
+                }]);
+        }
+        if (covered.has(disposition.slotId)) {
+            throw ennoValidationError(operation, [{
+                    path: ['advisoryDisposition', index, 'slotId'],
+                    reasonCode: 'advisory_slot_duplicate',
+                    expected: { requiredSlotIds: [...expected] },
+                }]);
+        }
+        const contribution = round.contributions.find((item) => item.slotId === disposition.slotId);
+        const compatible = contribution.outcome === 'completed'
+            ? disposition.disposition === 'adopted' || disposition.disposition === 'not_adopted'
+            : disposition.disposition === 'unavailable';
+        if (!compatible) {
+            throw ennoValidationError(operation, [{
+                    path: ['advisoryDisposition', index, 'disposition'],
+                    reasonCode: 'invalid_enum',
+                    expected: { allowedValues: contribution.outcome === 'completed' ? ['adopted', 'not_adopted'] : ['unavailable'] },
+                }]);
+        }
+        covered.add(disposition.slotId);
+    }
+    for (const slotId of expected) {
+        if (!covered.has(slotId)) {
+            throw ennoValidationError(operation, [{
+                    path: ['advisoryDisposition'],
+                    reasonCode: 'advisory_slot_missing',
+                    expected: { requiredSlotIds: [...expected] },
+                }]);
+        }
+    }
+}
+function consumeAdvisoryRoundIfPresent(database, snapshot, phase, mutationRevision, context, inputDigest, disposition) {
+    if (inputDigest === undefined) {
+        const submitted = readSubmittedAdvisoryRound(database, {
+            runId: snapshot.runId,
+            contractRevision: snapshot.revision,
+            mutationRevision,
+            phase,
+        });
+        if (submitted !== undefined) {
+            throw ennoValidationError(phase === 'planning' ? 'plan_submit' : phase === 'ideal' ? 'ideal_submit' : 'finish', [{
+                    path: ['advisoryRoundDigest'],
+                    reasonCode: 'advisory_consumption_required',
+                    expected: { requiredSlotIds: submitted.contributions.map((item) => item.slotId) },
+                }]);
+        }
         return undefined;
-    assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest);
-    return ensureAdvisoryRoundConsumedInTransaction(database, {
+    }
+    if (context === undefined) {
+        throw new KiokukoError('CONFLICT', 'Advisory round is not valid for the current Enno phase');
+    }
+    const operation = phase === 'planning' ? 'plan_submit' : phase === 'ideal' ? 'ideal_submit' : 'finish';
+    assertAdvisoryRoundInput(snapshot, phase, mutationRevision, context, inputDigest, operation);
+    const dispositions = disposition ?? [];
+    if (dispositions.length === 0) {
+        throw ennoValidationError(phase === 'planning' ? 'plan_submit' : phase === 'ideal' ? 'ideal_submit' : 'finish', [{
+                path: ['advisoryDisposition'],
+                reasonCode: 'advisory_digest_requires_disposition',
+            }]);
+    }
+    const pendingRound = readAdvisoryRound(database, {
         runId: snapshot.runId,
         contractRevision: snapshot.revision,
         mutationRevision,
         phase,
         inputDigest,
     });
+    if (pendingRound === undefined)
+        throw new KiokukoError('CONFLICT', 'Required advisory round was not submitted');
+    assertDispositionCoversRound(operation, pendingRound, dispositions);
+    const round = ensureAdvisoryRoundConsumedInTransaction(database, {
+        runId: snapshot.runId,
+        contractRevision: snapshot.revision,
+        mutationRevision,
+        phase,
+        inputDigest,
+    });
+    appendEnnoEventInTransaction(database, snapshot.runId, 'enno.advice_disposition', 'enno-oduno', 'recorded', {
+        phase,
+        contractRevision: snapshot.revision,
+        mutationRevision,
+        inputDigest,
+        dispositions: dispositions.map((entry) => ({ slotId: entry.slotId, disposition: entry.disposition, rationale: entry.rationale })),
+    });
+    return round;
 }
 export function submitEnnoAdvice(database, rawInput) {
-    const input = parseAdviceSubmission(rawInput);
+    const parsedInput = parseAdviceSubmission(rawInput);
+    const input = {
+        ...parsedInput,
+        contributions: normalizeAdvisoryContributions(parsedInput.phase, parsedInput.contributions),
+    };
+    const before = readEnnoSnapshot(database, identity(database, input));
     const operation = operationIdentity('advice_submit', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
-    const before = readEnnoSnapshot(database, identity(input));
     const expectedPhase = advisoryPhaseForStatus(before.status);
     if (expectedPhase !== input.phase)
         throw new KiokukoError('CONFLICT', 'Advisory phase does not match the current Enno state');
@@ -219,12 +330,12 @@ export function submitEnnoAdvice(database, rawInput) {
         const replayed = readOperationReceipt(database, input.runId, operation);
         if (replayed !== undefined)
             return replayed;
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, [
             input.phase === 'ideal' ? 'oduno_ideal' : input.phase === 'planning' ? 'zenki_planning' : 'enno_verifying',
         ]);
         assertAdvisoryRoundInput(current, input.phase, input.mutationRevision, context, inputDigest);
-        startOperationInTransaction(database, input.runId, operation);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
         const existing = readAdvisoryRound(database, {
             runId: input.runId,
             contractRevision: current.revision,
@@ -232,14 +343,24 @@ export function submitEnnoAdvice(database, rawInput) {
             phase: input.phase,
             inputDigest,
         });
-        const round = existing ?? createAdvisoryRoundInTransaction(database, {
-            runId: input.runId,
-            contractRevision: current.revision,
-            mutationRevision: input.mutationRevision,
-            phase: input.phase,
-            inputDigest,
-            contributions: input.contributions,
-        });
+        let round;
+        if (existing !== undefined) {
+            const incoming = normalizeAdvisoryContributions(input.phase, input.contributions);
+            if (canonicalJson(existing.contributions) !== canonicalJson(incoming)) {
+                throw new KiokukoError('CONFLICT', 'Advisory round was already submitted with different contributions');
+            }
+            round = existing;
+        }
+        else {
+            round = createAdvisoryRoundInTransaction(database, {
+                runId: input.runId,
+                contractRevision: current.revision,
+                mutationRevision: input.mutationRevision,
+                phase: input.phase,
+                inputDigest,
+                contributions: input.contributions,
+            });
+        }
         appendEnnoEventInTransaction(database, input.runId, 'enno.advice_submitted', 'enno-oduno', 'aggregated', {
             phase: input.phase,
             contractRevision: current.revision,
@@ -247,17 +368,16 @@ export function submitEnnoAdvice(database, rawInput) {
             inputDigest,
             degraded: round.degraded,
         });
-        const response = { ennoOduno: stateForSnapshot(current), advisoryRound: round };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        const response = {
+            ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(database, input))),
+            advisoryRound: round,
+        };
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
-function identity(input) {
-    return {
-        runId: input.runId,
-        workspace: input.workspace,
-        orchestrationId: input.orchestrationId,
-    };
+function identity(database, input) {
+    return resolveEnnoIdentity(database, input);
 }
 function assertExpected(snapshot, expectedRevision, statuses) {
     if (snapshot.revision !== expectedRevision)
@@ -274,7 +394,7 @@ function startFirstReadyUnit(database, snapshot) {
     const next = firstReadyUnit(snapshot);
     if (next === undefined) {
         if (snapshot.workUnits.every((unit) => unit.status === 'completed'))
-            return;
+            return undefined;
         throw new KiokukoError('CONFLICT', 'Enno WorkPlan dependencies cannot advance');
     }
     setWorkUnitStatusInTransaction(database, {
@@ -288,6 +408,12 @@ function startFirstReadyUnit(database, snapshot) {
         workUnitId: next.workUnit.id,
         contractRevision: snapshot.revision,
     });
+    if (snapshot.clientKind === null || snapshot.clientSessionId === null)
+        return undefined;
+    return claimExecutionLeaseInTransaction(database, snapshot, next.workUnit.id, {
+        clientKind: snapshot.clientKind,
+        sessionId: snapshot.clientSessionId,
+    });
 }
 function requiresConfirmation(provenance) {
     return ENNO_PROVENANCE_KEYS.some((key) => provenance[key] !== 'explicit_user');
@@ -372,7 +498,7 @@ async function discoverZenkiSkills(database, snapshot, plan, dependencies) {
         return claimed.summary;
     if (claimed.queryBudget === 0 || claimed.selectionBudget === 0) {
         return completeAgentTaskSkillDiscoveryAttempt(database, attempt, emptyDiscovery(intake.mode), () => {
-            assertExpected(readEnnoSnapshot(database, identity(plan)), plan.expectedRevision, ['zenki_planning']);
+            assertExpected(readEnnoSnapshot(database, identity(database, plan)), plan.expectedRevision, ['zenki_planning']);
         });
     }
     try {
@@ -386,10 +512,10 @@ async function discoverZenkiSkills(database, snapshot, plan, dependencies) {
             ...(dependencies.fetchImpl === undefined ? {} : { fetchImpl: dependencies.fetchImpl }),
         }, {
             ...(dependencies.fetchImpl === undefined ? {} : { fetchImpl: dependencies.fetchImpl }),
-            assertBeforePersist: () => assertExpected(readEnnoSnapshot(database, identity(plan)), plan.expectedRevision, ['zenki_planning']),
+            assertBeforePersist: () => assertExpected(readEnnoSnapshot(database, identity(database, plan)), plan.expectedRevision, ['zenki_planning']),
         });
         return completeAgentTaskSkillDiscoveryAttempt(database, attempt, summary, () => {
-            assertExpected(readEnnoSnapshot(database, identity(plan)), plan.expectedRevision, ['zenki_planning']);
+            assertExpected(readEnnoSnapshot(database, identity(database, plan)), plan.expectedRevision, ['zenki_planning']);
         });
     }
     catch (error) {
@@ -397,13 +523,11 @@ async function discoverZenkiSkills(database, snapshot, plan, dependencies) {
     }
 }
 function planChangesCode(plan, taskType) {
-    return taskType !== 'review'
-        || plan.skillRequirements.some((skill) => skill.purposes.includes('implementation'))
-        || plan.workPlan.units.some((unit) => unit.skillNames.includes('kiokuko-single-purpose-functions'));
+    return plan.workPlan.units.some((unit) => unit.routes.includes('code') || unit.routes.includes('ui'))
+        || (taskType !== 'review' && plan.skillRequirements.some((skill) => skill.purposes.includes('implementation')));
 }
 function planHasUi(plan) {
-    return plan.skillRequirements.some((skill) => skill.purposes.includes('ui'))
-        || plan.workPlan.units.some((unit) => unit.skillNames.includes('kiokuko-ui-design-soul'));
+    return plan.workPlan.units.some((unit) => unit.routes.includes('ui'));
 }
 function assertIdealSkillCoverage(snapshot, ideal) {
     const expected = snapshot.contract.skillSet.intakeDiscovery.selected.map((skill) => skill.name);
@@ -412,26 +536,43 @@ function assertIdealSkillCoverage(snapshot, ideal) {
     }
     const actual = ideal.skillContributions.map((contribution) => contribution.skillName);
     if (actual.length !== expected.length || expected.some((name) => !actual.includes(name))) {
-        throw new KiokukoError('VALIDATION_ERROR', 'Oduno ideal must account for every Akinator-discovered Skill exactly once');
+        throw ennoValidationError('ideal_submit', [{
+                path: ['ideal', 'skillContributions'],
+                reasonCode: actual.length < expected.length ? 'too_few_items' : 'undeclared_skill',
+                ...(actual.length < expected.length ? { expected: { minItems: expected.length } } : {}),
+            }]);
     }
 }
-function assertPlanCapabilityCatalog(database, input) {
-    if (input.capabilities === undefined) {
-        throw planStartRecoveryError('environment_information_missing');
-    }
-    const run = new LedgerStore(database).readRun(input.runId, input.workspace);
+function planCapabilityRecoveryReason(database, input, workspace) {
+    if (input.capabilities === undefined)
+        return 'environment_information_missing';
+    const run = new LedgerStore(database).readRun(input.runId, workspace);
     if (run === undefined)
         throw new KiokukoError('INTEGRITY_ERROR', 'Enno ledger run disappeared during plan validation');
     try {
         assertCapabilityCatalogBinding(run.metadata, input.capabilities);
+        return null;
     }
     catch (error) {
         if (error instanceof KiokukoError && error.code === 'CONFLICT') {
-            throw planStartRecoveryError('environment_changed');
+            return 'environment_changed';
         }
         throw error;
     }
 }
+function pausePlanStartRecovery(database, snapshot, reason) {
+    withImmediateTransaction(database, () => {
+        const updated = database.prepare(`
+      UPDATE enno_contracts
+      SET blocker = ?, updated_at = ?
+      WHERE run_id = ? AND revision = ? AND status = 'zenki_planning'
+      RETURNING run_id AS runId
+    `).get(planStartRecoveryBlocker(reason), new Date().toISOString(), snapshot.runId, snapshot.revision);
+        if (updated?.runId !== snapshot.runId)
+            throw new KiokukoError('CONFLICT', 'Enno plan state changed concurrently');
+    });
+    throw planStartRecoveryError(reason);
+}
 function endedBeforeWorkBecausePlanCatalogWasLost(database, snapshot, capabilities) {
     if (capabilities === undefined
         || snapshot.status !== 'blocked'
@@ -459,31 +600,29 @@ function endedBeforeWorkBecausePlanCatalogWasLost(database, snapshot, capabiliti
         throw error;
     }
 }
-function sanitizedIdeal(ideal, repositoryRoot) {
-    return parseOdunoIdeal(sanitizeJson(ideal, { workspace: repositoryRoot }).value);
-}
 export function submitOdunoIdeal(database, rawInput) {
-    const input = parseIdealSubmission(rawInput);
+    const parsedInput = parseIdealSubmission(rawInput);
+    const before = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizeIdealSubmission(parsedInput, before.repositoryRoot);
     const operation = operationIdentity('ideal_submit', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
-    const before = readEnnoSnapshot(database, identity(input));
     assertExpected(before, input.expectedRevision, ['oduno_ideal']);
     if (input.advisoryRoundDigest !== undefined) {
         requireAdvisoryRound(database, before, 'ideal', before.mutationRevision, advisoryContextForSubmission(before, 'ideal'), input.advisoryRoundDigest);
     }
-    const ideal = sanitizedIdeal(input.ideal, before.repositoryRoot);
+    const ideal = input.ideal;
     assertIdealSkillCoverage(before, ideal);
     return withImmediateTransaction(database, () => {
         const replayed = readOperationReceipt(database, input.runId, operation);
         if (replayed !== undefined)
             return replayed;
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['oduno_ideal']);
         assertIdealSkillCoverage(current, ideal);
-        startOperationInTransaction(database, input.runId, operation);
-        const advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'ideal', current.mutationRevision, advisoryContextForSubmission(current, 'ideal'), input.advisoryRoundDigest);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
+        const advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'ideal', current.mutationRevision, advisoryContextForSubmission(current, 'ideal'), input.advisoryRoundDigest, input.advisoryDisposition);
         updateContractInTransaction(database, current, {
             contract: current.contract,
             status: 'zenki_planning',
@@ -497,16 +636,17 @@ export function submitOdunoIdeal(database, rawInput) {
             successSignalCount: ideal.successSignals.length,
         });
         const response = {
-            ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(input))),
+            ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(database, input))),
             ...(advisoryRound === undefined ? {} : { advisoryRound }),
         };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
 export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
-    const input = parsePlanSubmission(rawInput);
-    const current = readEnnoSnapshot(database, identity(input));
+    const parsedInput = parsePlanSubmission(rawInput);
+    const current = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizePlanSubmission(parsedInput, current.repositoryRoot);
     if (endedBeforeWorkBecausePlanCatalogWasLost(database, current, input.capabilities)) {
         throw planStartRecoveryError('previous_attempt_ended');
     }
@@ -516,13 +656,33 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
         return replay;
     const before = current;
     assertExpected(before, input.expectedRevision, ['zenki_planning']);
-    assertPlanCapabilityCatalog(database, input);
+    const pendingRecovery = planStartRecoveryReasonFromBlocker(before.blocker);
+    if (pendingRecovery === 'environment_information_missing') {
+        if (input.recoveryAction === undefined)
+            throw planStartRecoveryError(pendingRecovery);
+    }
+    else if (pendingRecovery !== null) {
+        throw planStartRecoveryError(pendingRecovery);
+    }
+    else if (input.recoveryAction !== undefined) {
+        throw new KiokukoError('CONFLICT', 'Enno plan has no pending same-run recovery choice');
+    }
+    if (input.maxAttempts <= before.attempts) {
+        throw ennoValidationError('plan_submit', [{
+                path: ['maxAttempts'],
+                reasonCode: 'too_few_items',
+                expected: { minItems: before.attempts + 1 },
+            }]);
+    }
+    const recoveryReason = planCapabilityRecoveryReason(database, input, before.workspace);
+    if (recoveryReason !== null)
+        pausePlanStartRecovery(database, before, recoveryReason);
     if (input.advisoryRoundDigest !== undefined) {
         requireAdvisoryRound(database, before, 'planning', before.mutationRevision, advisoryContextForSubmission(before, 'planning'), input.advisoryRoundDigest);
     }
     const includesCodeChanges = planChangesCode(input, before.taskType);
     const includesUiWork = planHasUi(input);
-    assertWorkPlanExpertCoverage(input.workPlan, { includesCodeChanges, includesUiWork });
+    assertWorkPlanExpertCoverage(input.workPlan);
     assertContractVerifierCwds(before.repositoryRoot, {
         workPlan: input.workPlan,
         finalVerifiers: input.finalVerifiers,
@@ -539,11 +699,6 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
         discoveries: [before.contract.skillSet.intakeDiscovery, zenkiDiscovery],
     });
     const unavailable = unavailableRequiredSkills(entries);
-    const mandatoryWorkSkills = [
-        STANDARD_SOUL_SKILL_NAME,
-        ...(includesCodeChanges ? [STANDARD_FUNCTION_SKILL_NAME] : []),
-        ...(includesUiWork ? [STANDARD_UI_SKILL_NAME] : []),
-    ];
     const nextRevision = input.expectedRevision + 1;
     const contract = {
         revision: nextRevision,
@@ -556,7 +711,12 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
                 ...unit,
                 scope: [...unit.scope],
                 dependencies: [...unit.dependencies],
-                skillNames: orderedUniqueSkillNames(mandatoryWorkSkills, unit.skillNames),
+                routes: [...unit.routes],
+                skillNames: orderedUniqueSkillNames([
+                    STANDARD_SOUL_SKILL_NAME,
+                    ...(unit.routes.includes('code') || unit.routes.includes('ui') ? [STANDARD_FUNCTION_SKILL_NAME] : []),
+                    ...(unit.routes.includes('ui') ? [STANDARD_UI_SKILL_NAME] : []),
+                ], unit.skillNames),
                 expertRefs: unit.expertRefs.map((reference) => ({ ...reference })),
                 acceptanceCriteria: [...unit.acceptanceCriteria],
                 focusedVerifiers: unit.focusedVerifiers.map((verifier) => ({ ...verifier, args: [...verifier.args] })),
@@ -577,10 +737,10 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
         const replayed = readOperationReceipt(database, input.runId, operation);
         if (replayed !== undefined)
             return replayed;
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['zenki_planning']);
-        startOperationInTransaction(database, input.runId, operation);
-        const advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'planning', current.mutationRevision, advisoryContextForSubmission(current, 'planning'), input.advisoryRoundDigest);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
+        const advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'planning', current.mutationRevision, advisoryContextForSubmission(current, 'planning'), input.advisoryRoundDigest, input.advisoryDisposition);
         const status = unavailable.length > 0
             ? 'blocked'
             : needsConfirmation ? 'needs_confirmation' : 'goki_executing';
@@ -599,7 +759,8 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
             contractRevision: nextRevision,
             workUnitIds: contract.workPlan.units.map((unit) => unit.id),
         });
-        let updated = readEnnoSnapshot(database, identity(input));
+        let updated = readEnnoSnapshot(database, identity(database, input));
+        let executionLease;
         if (status === 'blocked') {
             appendEnnoEventInTransaction(database, input.runId, 'enno.blocked', 'enno-oduno', 'blocked', {
                 reason: blocker,
@@ -611,28 +772,32 @@ export async function submitEnnoPlan(database, rawInput, dependencies = {}) {
             appendEnnoEventInTransaction(database, input.runId, 'enno.plan_confirmed', 'enno-oduno', 'not_required', {
                 contractRevision: nextRevision,
             });
-            startFirstReadyUnit(database, updated);
-            updated = readEnnoSnapshot(database, identity(input));
+            executionLease = startFirstReadyUnit(database, updated);
+            updated = readEnnoSnapshot(database, identity(database, input));
         }
         const response = {
             ennoOduno: stateForSnapshot(updated),
             ...(advisoryRound === undefined ? {} : { advisoryRound }),
+            ...(executionLease === undefined ? {} : { executionLease }),
         };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
 export function answerEnno(database, rawInput) {
-    const input = parseEnnoAnswer(rawInput);
+    const parsedInput = parseEnnoAnswer(rawInput);
+    const before = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizeEnnoAnswer(parsedInput, before.repositoryRoot);
     const operation = operationIdentity('answer', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
     return withImmediateTransaction(database, () => {
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, input.action === 'cancel' ? ['needs_confirmation', 'zenki_planning'] : ['needs_confirmation']);
-        startOperationInTransaction(database, input.runId, operation);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
         let next;
+        let executionLease;
         if (input.action === 'approve') {
             updateContractInTransaction(database, current, {
                 contract: current.contract,
@@ -642,9 +807,9 @@ export function answerEnno(database, rawInput) {
             appendEnnoEventInTransaction(database, input.runId, 'enno.plan_confirmed', 'enno-oduno', 'approved', {
                 contractRevision: current.revision,
             });
-            next = readEnnoSnapshot(database, identity(input));
-            startFirstReadyUnit(database, next);
-            next = readEnnoSnapshot(database, identity(input));
+            next = readEnnoSnapshot(database, identity(database, input));
+            executionLease = startFirstReadyUnit(database, next);
+            next = readEnnoSnapshot(database, identity(database, input));
         }
         else if (input.action === 'revise') {
             const revisedContract = {
@@ -657,7 +822,7 @@ export function answerEnno(database, rawInput) {
                 confirmationState: 'revision_requested',
                 blocker: input.requestedChanges ?? null,
             });
-            next = readEnnoSnapshot(database, identity(input));
+            next = readEnnoSnapshot(database, identity(database, input));
         }
         else {
             updateContractInTransaction(database, current, {
@@ -669,10 +834,13 @@ export function answerEnno(database, rawInput) {
                 contractRevision: current.revision,
             });
             terminalizeLedgerRunInTransaction(database, input.runId, 'cancelled');
-            next = readEnnoSnapshot(database, identity(input));
+            next = readEnnoSnapshot(database, identity(database, input));
         }
-        const response = { ennoOduno: stateForSnapshot(next) };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        const response = {
+            ennoOduno: stateForSnapshot(next),
+            ...(executionLease === undefined ? {} : { executionLease }),
+        };
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
@@ -718,7 +886,20 @@ function sanitizedReviewSummary(summary, repositoryRoot) {
     return sanitizeJson({ summary }, { workspace: repositoryRoot }).value.summary;
 }
 function blockedForAttemptLimit(database, snapshot, operation) {
-    startOperationInTransaction(database, snapshot.runId, operation);
+    const operationOwner = startOperationInTransaction(database, snapshot.runId, operation);
+    const activeUnit = snapshot.workUnits.find((candidate) => candidate.status === 'in_progress');
+    if (activeUnit !== undefined) {
+        setWorkUnitStatusInTransaction(database, {
+            runId: snapshot.runId,
+            contractRevision: snapshot.revision,
+            workUnitId: activeUnit.workUnit.id,
+            from: 'in_progress',
+            to: 'blocked',
+            attemptCount: activeUnit.attemptCount,
+            result: activeUnit.result,
+        });
+    }
+    releaseExecutionLeaseInTransaction(database, snapshot.runId);
     updateContractInTransaction(database, snapshot, {
         contract: snapshot.contract,
         status: 'blocked',
@@ -735,28 +916,36 @@ function blockedForAttemptLimit(database, snapshot, operation) {
             workspace: snapshot.workspace,
             orchestrationId: snapshot.orchestrationId,
         })) };
-    completeOperationInTransaction(database, snapshot.runId, operation, response);
+    completeOperationInTransaction(database, snapshot.runId, operation, operationOwner, response);
     return response;
 }
 export async function reportEnnoWork(database, rawInput, dependencies = {}) {
-    const input = parseWorkReport(rawInput);
+    const parsedInput = parseWorkReport(rawInput);
+    const initial = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizeWorkReport(parsedInput, initial.repositoryRoot);
     const operation = operationIdentity('work_report', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
-    const before = readEnnoSnapshot(database, identity(input));
+    const before = initial;
     assertExpected(before, input.expectedRevision, ['goki_executing']);
     const unit = before.workUnits.find((candidate) => candidate.workUnit.id === input.workUnitId);
     if (unit === undefined || unit.status !== 'in_progress')
         throw new KiokukoError('CONFLICT', 'Reported Enno WorkUnit is not active');
     if (before.attempts >= before.contract.maxAttempts) {
-        return withImmediateTransaction(database, () => blockedForAttemptLimit(database, readEnnoSnapshot(database, identity(input)), operation));
+        return withImmediateTransaction(database, () => {
+            const current = readEnnoSnapshot(database, identity(database, input));
+            assertExpected(current, input.expectedRevision, ['goki_executing']);
+            assertExecutionLeaseInTransaction(database, current, input);
+            return blockedForAttemptLimit(database, current, operation);
+        });
     }
     if (input.result.outcome !== 'completed') {
         return withImmediateTransaction(database, () => {
-            const current = readEnnoSnapshot(database, identity(input));
+            const current = readEnnoSnapshot(database, identity(database, input));
             assertExpected(current, input.expectedRevision, ['goki_executing']);
-            startOperationInTransaction(database, input.runId, operation);
+            assertExecutionLeaseInTransaction(database, current, input);
+            const operationOwner = startOperationInTransaction(database, input.runId, operation);
             const currentUnit = current.workUnits.find((candidate) => candidate.workUnit.id === input.workUnitId);
             const attempts = current.attempts + 1;
             const mustBlock = input.result.outcome === 'blocked' || attempts >= current.contract.maxAttempts;
@@ -781,21 +970,25 @@ export async function reportEnnoWork(database, rawInput, dependencies = {}) {
                 attempt: attempts,
             });
             if (mustBlock) {
+                releaseExecutionLeaseInTransaction(database, input.runId);
                 appendEnnoEventInTransaction(database, input.runId, 'enno.blocked', 'enno-oduno', 'blocked', {
                     reason: input.result.summary,
                 });
                 terminalizeLedgerRunInTransaction(database, input.runId, 'failed');
             }
-            const response = { ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(input))) };
-            completeOperationInTransaction(database, input.runId, operation, response);
+            const response = { ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(database, input))) };
+            completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
             return response;
         });
     }
     let verifierRunIds = [];
+    let operationOwner = '';
+    const verifierLeaseMs = operationLeaseMsForVerifiers(unit.workUnit.focusedVerifiers);
     withImmediateTransaction(database, () => {
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['goki_executing']);
-        startOperationInTransaction(database, input.runId, operation);
+        renewExecutionLeaseInTransaction(database, current, input, verifierLeaseMs);
+        operationOwner = startOperationInTransaction(database, input.runId, operation, verifierLeaseMs);
         const currentUnit = current.workUnits.find((candidate) => candidate.workUnit.id === input.workUnitId);
         if (currentUnit === undefined || currentUnit.status !== 'in_progress') {
             throw new KiokukoError('CONFLICT', 'Reported Enno WorkUnit changed concurrently');
@@ -817,8 +1010,9 @@ export async function reportEnnoWork(database, rawInput, dependencies = {}) {
     }
     const results = sanitizedVerifierResults(rawResults, before.repositoryRoot);
     return withImmediateTransaction(database, () => {
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['goki_executing']);
+        assertExecutionLeaseInTransaction(database, current, input);
         finishVerifierRunsInTransaction(database, verifierRunIds, results);
         const passed = results.every((result) => result.status === 'passed');
         const unsafe = results.some((result) => result.status === 'spawn_failed');
@@ -849,7 +1043,9 @@ export async function reportEnnoWork(database, rawInput, dependencies = {}) {
             mutated: input.result.mutated,
             changedPaths: input.result.changedPaths,
         });
-        let next = readEnnoSnapshot(database, identity(input));
+        releaseExecutionLeaseInTransaction(database, input.runId);
+        let next = readEnnoSnapshot(database, identity(database, input));
+        let executionLease;
         if (mustBlock) {
             appendEnnoEventInTransaction(database, input.runId, 'enno.blocked', 'enno-oduno', 'blocked', {
                 reason: unsafe ? 'spawn_failed' : 'focused_verification_failed',
@@ -865,67 +1061,70 @@ export async function reportEnnoWork(database, rawInput, dependencies = {}) {
                 });
             }
             else {
-                startFirstReadyUnit(database, next);
+                executionLease = startFirstReadyUnit(database, next);
             }
-            next = readEnnoSnapshot(database, identity(input));
+            next = readEnnoSnapshot(database, identity(database, input));
         }
-        const response = { ennoOduno: stateForSnapshot(next), verifierResults: results };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        const response = {
+            ennoOduno: stateForSnapshot(next),
+            verifierResults: results,
+            ...(executionLease === undefined ? {} : { executionLease }),
+        };
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
-export async function finishEnno(database, rawInput, dependencies = {}) {
-    const input = parseFinishRequest(rawInput);
-    const operation = operationIdentity('finish', input.idempotencyKey, input);
+export async function prepareEnnoVerification(database, rawInput, dependencies = {}) {
+    const input = parseVerificationPrepare(rawInput);
+    const before = readEnnoSnapshot(database, identity(database, input));
+    const operation = operationIdentity('verify_prepare', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
-    const before = readEnnoSnapshot(database, identity(input));
     assertExpected(before, input.expectedRevision, ['enno_verifying']);
-    if (input.advisoryRoundDigest !== undefined) {
-        requireAdvisoryRound(database, before, 'final_review', before.mutationRevision, advisoryContextForSubmission(before, 'final_review'), input.advisoryRoundDigest);
-    }
-    const reviewSummary = sanitizedReviewSummary(input.review.summary, before.repositoryRoot);
+    const preRepositoryState = captureRepositoryState(before.repositoryRoot);
+    const verifierSpecDigest = canonicalContentHash(before.contract.finalVerifiers);
     if (before.attempts >= before.contract.maxAttempts) {
-        return withImmediateTransaction(database, () => blockedForAttemptLimit(database, readEnnoSnapshot(database, identity(input)), operation));
+        return withImmediateTransaction(database, () => blockedForAttemptLimit(database, readEnnoSnapshot(database, identity(database, input)), operation));
     }
     let verifierRunIds = [];
-    let cachedVerifierResults;
-    let advisoryRound;
+    let operationOwner = '';
+    let cachedResults;
+    const verifierLeaseMs = operationLeaseMsForVerifiers(before.contract.finalVerifiers);
     withImmediateTransaction(database, () => {
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['enno_verifying']);
-        advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'final_review', current.mutationRevision, advisoryContextForSubmission(current, 'final_review'), input.advisoryRoundDigest);
-        startOperationInTransaction(database, input.runId, operation);
-        cachedVerifierResults = readFreshFinalVerifierResults(database, {
+        operationOwner = startOperationInTransaction(database, input.runId, operation, verifierLeaseMs);
+        cachedResults = readFreshFinalVerifierResults(database, {
             runId: input.runId,
             revision: current.revision,
             mutationRevision: current.mutationRevision,
             verifiers: current.contract.finalVerifiers,
+            repositoryDigest: preRepositoryState.digest,
         });
-        if (cachedVerifierResults === undefined) {
+        if (cachedResults === undefined) {
             verifierRunIds = startVerifierRunsInTransaction(database, {
                 runId: input.runId,
                 workUnitId: null,
                 revision: current.revision,
                 mutationRevision: current.mutationRevision,
                 verifiers: current.contract.finalVerifiers,
+                repositoryEvidence: {
+                    policyVersion: preRepositoryState.policyVersion,
+                    preDigest: preRepositoryState.digest,
+                    verifierSpecDigest,
+                },
             });
         }
-        appendEnnoEventInTransaction(database, input.runId, 'enno.review_started', 'enno-oduno', 'started', {
-            contractRevision: current.revision,
-            mutationRevision: current.mutationRevision,
-            requestedDecision: input.review.decision,
-        });
-        appendEnnoEventInTransaction(database, input.runId, 'enno.verification_started', 'enno-oduno', cachedVerifierResults === undefined ? 'started' : 'reused', {
+        appendEnnoEventInTransaction(database, input.runId, 'enno.verification_started', 'enno-oduno', cachedResults === undefined ? 'started' : 'reused', {
             contractRevision: current.revision,
             mutationRevision: current.mutationRevision,
             verifierIds: current.contract.finalVerifiers.map((verifier) => verifier.id),
         });
     });
     let results;
-    if (cachedVerifierResults !== undefined) {
-        results = cachedVerifierResults;
+    if (cachedResults !== undefined) {
+        results = cachedResults;
     }
     else {
         try {
@@ -935,11 +1134,84 @@ export async function finishEnno(database, rawInput, dependencies = {}) {
             results = spawnFailedVerifierResults(before.contract.finalVerifiers);
         }
     }
+    const postRepositoryState = captureRepositoryState(before.repositoryRoot);
+    const changedDuringVerification = postRepositoryState.digest !== preRepositoryState.digest
+        || results.some((result) => result.changedDuringVerification === true);
+    results = results.map((result) => ({
+        ...result,
+        repositoryStatePolicyVersion: postRepositoryState.policyVersion,
+        repositoryStateDigest: postRepositoryState.digest,
+        changedDuringVerification,
+    }));
     return withImmediateTransaction(database, () => {
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['enno_verifying']);
         if (verifierRunIds.length > 0)
-            finishVerifierRunsInTransaction(database, verifierRunIds, results);
+            finishVerifierRunsInTransaction(database, verifierRunIds, results, {
+                postDigest: postRepositoryState.digest,
+                changedDuringVerification,
+            });
+        const response = {
+            ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(database, input))),
+            verifierResults: results,
+        };
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
+        return response;
+    });
+}
+export async function finishEnno(database, rawInput, dependencies = {}) {
+    const parsedInput = parseFinishRequest(rawInput);
+    const initial = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizeFinishRequest(parsedInput, initial.repositoryRoot);
+    const operation = operationIdentity('finish', input.idempotencyKey, input);
+    const replay = readOperationReceipt(database, input.runId, operation);
+    if (replay !== undefined)
+        return replay;
+    const before = initial;
+    assertExpected(before, input.expectedRevision, ['enno_verifying']);
+    if (input.advisoryRoundDigest !== undefined) {
+        if (!before.finalEvidenceReady) {
+            throw ennoValidationError('finish', [{
+                    path: ['advisoryRoundDigest'],
+                    reasonCode: 'advisory_digest_stale',
+                }], 'refresh_state');
+        }
+        requireAdvisoryRound(database, before, 'final_review', before.mutationRevision, advisoryContextForSubmission(before, 'final_review'), input.advisoryRoundDigest);
+    }
+    const reviewSummary = sanitizedReviewSummary(input.review.summary, before.repositoryRoot);
+    if (before.attempts >= before.contract.maxAttempts) {
+        return withImmediateTransaction(database, () => blockedForAttemptLimit(database, readEnnoSnapshot(database, identity(database, input)), operation));
+    }
+    return withImmediateTransaction(database, () => {
+        const current = readEnnoSnapshot(database, identity(database, input));
+        assertExpected(current, input.expectedRevision, ['enno_verifying']);
+        const currentRepositoryDigest = captureRepositoryState(current.repositoryRoot).digest;
+        const results = readFreshFinalVerifierResults(database, {
+            runId: input.runId,
+            revision: current.revision,
+            mutationRevision: current.mutationRevision,
+            verifiers: current.contract.finalVerifiers,
+            repositoryDigest: currentRepositoryDigest,
+        });
+        if (results === undefined) {
+            throw new KiokukoError('CONFLICT', 'Final verification evidence is not prepared; call enno_verify_prepare first');
+        }
+        if (results.some((result) => result.repositoryStateDigest !== currentRepositoryDigest
+            || result.changedDuringVerification !== false)) {
+            throw new KiokukoError('CONFLICT', 'Final verification evidence is stale for the current repository state');
+        }
+        const advisoryRound = consumeAdvisoryRoundIfPresent(database, current, 'final_review', current.mutationRevision, input.advisoryRoundDigest === undefined ? undefined : advisoryContextForSubmission(current, 'final_review'), input.advisoryRoundDigest, input.advisoryDisposition);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
+        appendEnnoEventInTransaction(database, input.runId, 'enno.review_started', 'enno-oduno', 'started', {
+            contractRevision: current.revision,
+            mutationRevision: current.mutationRevision,
+            requestedDecision: input.review.decision,
+        });
+        appendEnnoEventInTransaction(database, input.runId, 'enno.verification_started', 'enno-oduno', 'reused', {
+            contractRevision: current.revision,
+            mutationRevision: current.mutationRevision,
+            verifierIds: current.contract.finalVerifiers.map((verifier) => verifier.id),
+        });
         const passed = results.length > 0 && results.every((result) => result.status === 'passed');
         const unsafe = results.some((result) => result.status === 'spawn_failed');
         const attempts = current.attempts + 1;
@@ -971,7 +1243,7 @@ export async function finishEnno(database, rawInput, dependencies = {}) {
             mutationRevision: current.mutationRevision,
             statuses: results.map((result) => ({ verifierId: result.verifier.id, status: result.status })),
         });
-        let next = readEnnoSnapshot(database, identity(input));
+        let next = readEnnoSnapshot(database, identity(database, input));
         if (accepted) {
             appendEnnoEventInTransaction(database, input.runId, 'enno.review_accepted', 'enno-oduno', 'accepted', {
                 contractRevision: current.revision,
@@ -999,40 +1271,38 @@ export async function finishEnno(database, rawInput, dependencies = {}) {
                 toContractRevision: next.revision,
                 reason: reviewFeedback,
             });
-            next = readEnnoSnapshot(database, identity(input));
+            next = readEnnoSnapshot(database, identity(database, input));
         }
         const response = {
             ennoOduno: stateForSnapshot(next),
             verifierResults: results,
             ...(advisoryRound === undefined ? {} : { advisoryRound }),
         };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }
-function sanitizedMeditation(meditation, repositoryRoot) {
-    return parseOdunoMeditation(sanitizeJson(meditation, { workspace: repositoryRoot }).value);
-}
 export function submitOdunoMeditation(database, rawInput) {
-    const input = parseMeditationSubmission(rawInput);
+    const parsedInput = parseMeditationSubmission(rawInput);
+    const before = readEnnoSnapshot(database, identity(database, parsedInput));
+    const input = sanitizeMeditationSubmission(parsedInput, before.repositoryRoot);
     const operation = operationIdentity('meditation_submit', input.idempotencyKey, input);
     const replay = readOperationReceipt(database, input.runId, operation);
     if (replay !== undefined)
         return replay;
-    const before = readEnnoSnapshot(database, identity(input));
     assertExpected(before, input.expectedRevision, ['oduno_meditation']);
     if (before.ideal === null)
         throw new KiokukoError('INTEGRITY_ERROR', 'Oduno meditation requires a persisted ideal');
-    const meditation = sanitizedMeditation(input.meditation, before.repositoryRoot);
+    const meditation = input.meditation;
     return withImmediateTransaction(database, () => {
         const replayed = readOperationReceipt(database, input.runId, operation);
         if (replayed !== undefined)
             return replayed;
-        const current = readEnnoSnapshot(database, identity(input));
+        const current = readEnnoSnapshot(database, identity(database, input));
         assertExpected(current, input.expectedRevision, ['oduno_meditation']);
         if (current.ideal === null)
             throw new KiokukoError('INTEGRITY_ERROR', 'Oduno meditation requires a persisted ideal');
-        startOperationInTransaction(database, input.runId, operation);
+        const operationOwner = startOperationInTransaction(database, input.runId, operation);
         updateContractInTransaction(database, current, {
             contract: current.contract,
             status: 'completed',
@@ -1050,8 +1320,8 @@ export function submitOdunoMeditation(database, rawInput) {
             mutationRevision: current.mutationRevision,
         });
         terminalizeLedgerRunInTransaction(database, input.runId, 'completed');
-        const response = { ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(input))) };
-        completeOperationInTransaction(database, input.runId, operation, response);
+        const response = { ennoOduno: stateForSnapshot(readEnnoSnapshot(database, identity(database, input))) };
+        completeOperationInTransaction(database, input.runId, operation, operationOwner, response);
         return response;
     });
 }