@astrosheep/keiyaku 2.9.11 → 2.9.13

package/build/core/derived-replay.js

@@ -5,6 +5,9 @@ import { FlowError } from "../flow-error.js";
 import { runGitProcess } from "../git/core.js";
 import { KEIYAKU_FILE } from "../keiyaku.js";
 import { inventoryIgnorePatternsForWorktree } from "./repository-ledger/inventory.js";
+import { isJsonObject } from "./outcome-base.js";
+import { carrierRetirementInputIdentity, deliveryRefInputIdentity, narrowIgnoreInputIdentity, renewDeliveryInputIdentity, sameInputIdentity, taskBoardInputIdentity, targetWorktreeInputIdentity, worktreeInputIdentity, } from "./repository-ledger/identity.js";
+import { resolveAcceptedLifecycleTransaction, } from "./repository-ledger/accepted-tail.js";
 import { readTaskBoardGeneration, reconcileTaskForfeit, replayClaimTasks, replayCommittedTaskBind, } from "./task/index.js";
 function terminalEntry(model) {
     return [...model.history].reverse().find(({ entry }) => (entry.kind === "claim" || entry.kind === "forfeit"));
@@ -13,10 +16,101 @@ function receipt(model, surface, status, facts) {
     return {
         surface,
         status,
-        authoritativeHead: model.observedLedgerHead,
+        authoritativeHead: model.contractHead,
         ...(facts ? { facts } : {}),
     };
 }
+function currentTransaction(repository, model) {
+    const node = repository.topology.nodes.find((candidate) => (candidate.type === "transaction"
+        && candidate.contract === model.contract
+        && candidate.finalEntryObjectId === model.contractHead));
+    if (!node || node.type !== "transaction") {
+        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} has no accepted transaction for ${model.contractHead}`);
+    }
+    const accepted = resolveAcceptedLifecycleTransaction({
+        read: repository,
+        transactionObjectId: node.objectId,
+        expectedContract: model.contract,
+    });
+    if (accepted.status !== "accepted") {
+        throw new FlowError("INTERNAL_STATE", `contract ${model.contract} transaction ${node.objectId} is not replayable (${accepted.reason})`);
+    }
+    return accepted;
+}
+function obligation(transactionObjectId, surface, expected) {
+    return {
+        transactionObjectId,
+        surface,
+        expected,
+        idempotencyKey: `${transactionObjectId}:${surface}`,
+    };
+}
+/**
+ * Purely derive every required surface for the accepted transaction that
+ * advanced this folded contract head. No journal, carrier bytes, or filesystem
+ * observation participates in this calculation.
+ */
+export function deriveReplayObligations(input) {
+    const { repository, lifecycle: model, target, expectedCarrierIdentity } = input;
+    const transaction = input.transaction ?? currentTransaction(repository, model);
+    const base = { contractId: model.contract, contractHead: model.contractHead };
+    const terminal = terminalEntry(model);
+    const required = [];
+    const taskIds = model.resources.tasks.map(({ taskId }) => taskId);
+    if (taskIds.length > 0) {
+        required.push(obligation(transaction.transactionObjectId, "task-board", taskBoardInputIdentity({
+            ...base, taskIds, phase: model.phase,
+        })));
+    }
+    if (terminal) {
+        required.push(obligation(transaction.transactionObjectId, "carrier-retirement", carrierRetirementInputIdentity({
+            ...base,
+            target: target.status === "available" ? target.path : `${target.workspace}:${target.reason}`,
+        })), obligation(transaction.transactionObjectId, "worktree", worktreeInputIdentity({
+            ...base,
+            deliveryHead: model.pins.delivery,
+        })), obligation(transaction.transactionObjectId, "delivery-ref", deliveryRefInputIdentity({
+            ...base, deliveryRef: model.resources.deliveryRef,
+        })));
+        if (terminal.entry.kind === "claim" && terminal.entry.data && typeof terminal.entry.data.target === "string") {
+            required.push(obligation(transaction.transactionObjectId, "target-worktree", targetWorktreeInputIdentity({
+                ...base,
+                target: terminal.entry.data.target,
+                targetHead: terminal.entry.data.targetHead,
+                mergeCommit: terminal.entry.data.mergeCommit,
+            })));
+        }
+        if (target.status === "available") {
+            required.push(obligation(transaction.transactionObjectId, "narrow-ignore", narrowIgnoreInputIdentity({
+                ...base,
+                inventory: JSON.stringify(inventoryIgnorePatternsForWorktree(repository, model)),
+                occupancy: `${target.workspace}:${target.root}`,
+            })));
+        }
+        return required;
+    }
+    const deliveryHead = model.pins.delivery;
+    if (deliveryHead !== null) {
+        required.push(obligation(transaction.transactionObjectId, "worktree", worktreeInputIdentity({ ...base, deliveryHead })));
+    }
+    const patterns = inventoryIgnorePatternsForWorktree(repository, model);
+    required.push(obligation(transaction.transactionObjectId, "narrow-ignore", narrowIgnoreInputIdentity({
+        ...base,
+        inventory: JSON.stringify(patterns),
+        occupancy: `${target.workspace}:${target.status === "available" ? target.root : target.reason}`,
+    })), obligation(transaction.transactionObjectId, "carrier", expectedCarrierIdentity));
+    if (transaction.verb === "renew") {
+        const renew = transaction.entries.find((entry) => entry.kind === "renew");
+        if (renew?.kind === "renew") {
+            required.push(obligation(transaction.transactionObjectId, "renew-delivery", renewDeliveryInputIdentity({
+                ...base,
+                oldHead: renew.data.oldHead,
+                newHead: renew.data.newHead,
+            })));
+        }
+    }
+    return required;
+}
 async function gitExit(cwd, args) {
     const result = await runGitProcess(cwd, args);
     if (result.error || (result.status !== 0 && result.status !== 1)) {
@@ -83,14 +177,9 @@ async function replayTaskBoard(cwd, model, adapters) {
                 taskIds,
                 updatedAt: terminal.entry.at,
             });
-        const warnings = await adapters.replayClaimTarget({
-            target: terminal.entry.data.target,
-            targetHead: terminal.entry.data.targetHead,
-            mergeCommit: replay.commit,
-        });
         return {
             status: taskIds.length === 0 ? "already-present" : replay.worktree === "ref-only" ? "ref-only" : "created",
-            facts: { taskCount: replay.taskCount, commit: replay.commit, worktree: replay.worktree, warnings: [...warnings] },
+            facts: { taskCount: replay.taskCount, commit: replay.commit, worktree: replay.worktree },
         };
     }
     if (terminal?.entry.kind === "forfeit") {
@@ -113,10 +202,10 @@ async function replayTaskBoard(cwd, model, adapters) {
     const status = await replayCommittedTaskBind(cwd, bind.data.base, taskIds);
     return { status, facts: { taskCount: taskIds.length } };
 }
-function recordSurface(journal, model, surface, run) {
+function recordSurface(journal, replay, run) {
     return journal.run({
-        effect: `${surface}-projection`,
-        idempotencyKey: `${model.contract}:${model.observedLedgerHead}:${surface}`,
+        effect: `${replay.surface}-projection`,
+        idempotencyKey: replay.idempotencyKey,
         run: async () => structuredClone(await run()),
     });
 }
@@ -124,29 +213,65 @@ function recordSurface(journal, model, surface, run) {
 export async function replayCommittedDerivedState(input) {
     const { lifecycle: model, journal } = input;
     const terminal = terminalEntry(model);
+    const transaction = input.transaction ?? currentTransaction(input.repository, model);
+    const expectedCarrierIdentity = input.adapters.expectedCarrierIdentity(model);
+    if (expectedCarrierIdentity.contractId !== model.contract
+        || expectedCarrierIdentity.contractHead !== model.contractHead) {
+        throw new FlowError("INTERNAL_STATE", "carrier identity semantics did not derive the folded contract coordinate");
+    }
+    const obligations = new Map(deriveReplayObligations({
+        ...input,
+        transaction,
+        expectedCarrierIdentity,
+    }).map((item) => [item.surface, item]));
     let projectedTarget = input.target;
     const receipts = [];
-    const run = async (surface, operation) => {
-        const row = await recordSurface(journal, model, surface, operation);
+    const run = async (surface, operation, current) => {
+        const replay = obligations.get(surface);
+        if (!replay)
+            return;
+        const row = await recordSurface(journal, replay, async () => {
+            const actual = await input.adapters.inspectSurface({ obligation: replay });
+            if (sameInputIdentity(actual, replay.expected)) {
+                return current?.() ?? receipt(model, surface, "already-present", { inputIdentity: replay.expected });
+            }
+            return operation();
+        });
         if (row.status === "succeeded")
             receipts.push(row.receipt);
     };
-    await run("status", async () => receipt(model, "status", "already-present", { phase: model.phase }));
-    await run("registry", async () => receipt(model, "registry", terminal ? "retired" : "already-present", {
-        source: "repository-ledger-fold",
-        effectiveScope: [...model.effectiveScope],
-    }));
     await run("task-board", async () => {
         const replay = await replayTaskBoard(input.cwd, model, input.adapters);
         return receipt(model, "task-board", replay.status, replay.facts);
     });
+    if (terminal?.entry.kind === "claim") {
+        const claim = terminal.entry;
+        await run("target-worktree", async () => {
+            const taskRow = journal.all().find((row) => row.effect === "task-board-projection" && row.status === "succeeded");
+            const taskFacts = taskRow?.status === "succeeded" ? taskRow.receipt?.facts : undefined;
+            const commit = isJsonObject(taskFacts) && typeof taskFacts.commit === "string"
+                ? taskFacts.commit
+                : claim.data.mergeCommit;
+            const warnings = await input.adapters.replayClaimTarget({
+                target: claim.data.target,
+                targetHead: claim.data.targetHead,
+                mergeCommit: commit,
+            });
+            return receipt(model, "target-worktree", warnings.length === 0 ? "created" : "mismatch", {
+                target: claim.data.target,
+                targetHead: claim.data.targetHead,
+                mergeCommit: commit,
+                warnings: [...warnings],
+            });
+        });
+    }
     if (terminal) {
         let carrierRetired = false;
-        await run("carrier", async () => {
+        await run("carrier-retirement", async () => {
             const status = await input.adapters.retireContractView({ lifecycle: model, target: input.target });
-            carrierRetired = true;
-            return receipt(model, "carrier", status);
+            return receipt(model, "carrier-retirement", status);
         });
+        carrierRetired = journal.all().some((row) => (row.effect === "carrier-retirement-projection" && row.status === "succeeded"));
         await run("narrow-ignore", async () => {
             if (!carrierRetired) {
                 throw new FlowError("CARRIER_MATERIALIZATION_FAILED", "cannot retire narrow ignore before carrier retirement");
@@ -159,19 +284,23 @@ export async function replayCommittedDerivedState(input) {
         });
         await run("worktree", async () => {
             const cleanup = await input.adapters.cleanupWorkspace(input.cwd, model);
-            if (cleanup.worktreeRemoveFailure)
-                throw new FlowError("INTERNAL_STATE", cleanup.worktreeRemoveFailure.reason);
             return receipt(model, "worktree", cleanup.absent.includes("worktree") ? "already-present" : "retired", {
                 absent: cleanup.absent,
                 ...(cleanup.removedWorktreePath ? { removedWorktreePath: cleanup.removedWorktreePath } : {}),
+                ...(cleanup.worktreeRemoveFailure ? { worktreeRemoveFailure: cleanup.worktreeRemoveFailure } : {}),
             });
-        });
+        }, () => receipt(model, "worktree", "already-present", { absent: ["worktree"] }));
         await run("delivery-ref", async () => {
             const observation = await input.adapters.observeDeliveryRef(input.cwd, model.contract);
             return observation.status === "aligned"
                 ? receipt(model, "delivery-ref", "already-present", observation)
                 : receipt(model, "delivery-ref", "mismatch", observation);
-        });
+        }, () => receipt(model, "delivery-ref", "already-present", {
+            status: "aligned",
+            ref: model.resources.deliveryRef,
+            expected: "absent",
+            observed: "absent",
+        }));
         return receipts;
     }
     await run("worktree", async () => {
@@ -179,6 +308,18 @@ export async function replayCommittedDerivedState(input) {
         projectedTarget = replay.target;
         return receipt(model, "worktree", replay.status);
     });
+    if (obligations.has("renew-delivery")) {
+        await run("renew-delivery", async () => {
+            if (transaction.verb !== "renew")
+                throw new FlowError("INTERNAL_STATE", "renew delivery obligation lacks an accepted renew transaction");
+            const renew = transaction.entries.find((entry) => entry.kind === "renew");
+            if (!renew || renew.kind !== "renew")
+                throw new FlowError("INTERNAL_STATE", "accepted renew transaction lacks a renew entry");
+            if (projectedTarget.status !== "available")
+                throw new FlowError("CARRIER_TARGET_UNAVAILABLE", projectedTarget.reason);
+            return receipt(model, "renew-delivery", await input.adapters.reconcileRenewDelivery({ lifecycle: model, target: projectedTarget, transaction }), { oldHead: renew.data.oldHead, newHead: renew.data.newHead });
+        });
+    }
     await run("narrow-ignore", async () => {
         if (projectedTarget.status !== "available")
             throw new FlowError("CARRIER_TARGET_UNAVAILABLE", projectedTarget.reason);
@@ -187,21 +328,13 @@ export async function replayCommittedDerivedState(input) {
             patterns,
         });
     });
-    let viewStatus = "already-present";
-    let viewProjected = false;
-    await run("contract-view", async () => {
+    await run("carrier", async () => {
         const incomplete = journal.all().find((row) => row.status !== "succeeded");
         if (incomplete) {
             throw new FlowError("CARRIER_MATERIALIZATION_FAILED", `cannot advance carrier checkpoint while ${incomplete.effect} is ${incomplete.status}`);
         }
-        viewStatus = await input.adapters.materializeContractView({ lifecycle: model, target: projectedTarget });
-        viewProjected = true;
-        return receipt(model, "contract-view", viewStatus, { path: projectedTarget.status === "available" ? path.join(projectedTarget.root, KEIYAKU_FILE) : null });
-    });
-    await run("carrier", async () => {
-        if (!viewProjected)
-            throw new FlowError("CARRIER_MATERIALIZATION_FAILED", "contract view was not materialized");
-        return receipt(model, "carrier", viewStatus, { checkpoint: model.observedLedgerHead });
+        const status = await input.adapters.materializeContractView({ lifecycle: model, target: projectedTarget });
+        return receipt(model, "carrier", status, { path: projectedTarget.status === "available" ? path.join(projectedTarget.root, KEIYAKU_FILE) : null });
     });
     return receipts;
 }

package/build/core/draft.js

@@ -3,8 +3,16 @@ import { parseToAST } from "./markdown/parser.js";
 import { extractListItems, renderSectionContent } from "./markdown/render.js";
 import { normalizeSectionTitle } from "./markdown/titles.js";
 import { markdownSourceSections, renderScopeFragment, validateScopeFragmentLines } from "./scope.js";
-const KNOWN_SECTIONS = new Set(["context", "objective", "design", "scope", "criteria", "verification"]);
-const RETIRED_OR_MALFORMED_CORE_SECTIONS = new Set(["title", "name", "checks"]);
+import { parseVerificationDeclarations, renderVerificationDeclarations, } from "./verification-declaration.js";
+const KNOWN_SECTIONS = new Map([
+    ["context", "context"],
+    ["objective", "objective"],
+    ["design & approach", "design"],
+    ["scope", "scope"],
+    ["criteria", "criteria"],
+    ["verification", "verification"],
+]);
+const RETIRED_OR_MALFORMED_CORE_SECTIONS = new Set(["title", "name", "design", "checks"]);
 const BIND_DRAFT_SECTION_ORDER = ["title", "context", "objective", "design", "scope", "criteria", "verification"];
 function invalidBindDraft(message) {
     throw new FlowError("INVALID_KEIYAKU_DRAFT", `INVALID_BIND_DRAFT: ${message}`);
@@ -75,6 +83,9 @@ function extractSingleLineDeclarations(section, heading) {
         return trimmed;
     });
 }
+function verificationDeclarations(section, heading) {
+    return parseVerificationDeclarations(renderSectionContent(section), { heading });
+}
 function collectBindDraftNodes(content) {
     // Scope is parsed from source lines below. Hide its body from the Markdown AST
     // so fence-like and heading-like payload bytes cannot acquire structure there.
@@ -105,14 +116,19 @@ function collectBindDraftNodes(content) {
             continue;
         const normalized = normalizeSectionName(node.title);
         if (RETIRED_OR_MALFORMED_CORE_SECTIONS.has(normalized)) {
-            const replacement = normalized === "checks" ? "Criteria and Verification" : "the H1 Title";
+            const replacement = normalized === "checks"
+                ? "Criteria and Verification"
+                : normalized === "design"
+                    ? "Design & Approach"
+                    : "the H1 Title";
             invalidBindDraft(`obsolete or malformed core section '${node.title}'; use ${replacement}`);
         }
-        if (KNOWN_SECTIONS.has(normalized)) {
-            if (sections.has(normalized)) {
+        const coreSection = KNOWN_SECTIONS.get(normalized);
+        if (coreSection) {
+            if (sections.has(coreSection)) {
                 invalidBindDraft(`duplicate section '${node.title}' in bind draft`);
             }
-            sections.set(normalized, node);
+            sections.set(coreSection, node);
             continue;
         }
         extensions.push({
@@ -155,7 +171,9 @@ export function parsePartialBindDraft(content) {
         if (!section)
             continue;
         const text = renderSectionContent(section).trim();
-        const heading = `${sectionName[0].toUpperCase()}${sectionName.slice(1)}`;
+        const heading = sectionName === "design"
+            ? "Design & Approach"
+            : `${sectionName[0].toUpperCase()}${sectionName.slice(1)}`;
         if (!text)
             invalidBindDraft(`${heading} section cannot be empty`);
         partial[sectionName] = text;
@@ -169,7 +187,7 @@ export function parsePartialBindDraft(content) {
         partial.criteria = extractSingleLineDeclarations(criteria, "Criteria");
     const verification = sections.get("verification");
     if (verification)
-        partial.verification = extractSingleLineDeclarations(verification, "Verification");
+        partial.verification = verificationDeclarations(verification, "## Verification");
     if (extensions.length > 0)
         partial.extensions = extensions;
     return partial;
@@ -229,7 +247,7 @@ export function renderMissingBindSectionsTemplate(missing) {
             continue;
         }
         if (section === "design") {
-            lines.push("## Design", "<settled owner, boundaries, flow, state, and failure behavior>");
+            lines.push("## Design & Approach", "<settled owner, boundaries, flow, state, and failure behavior>");
             continue;
         }
         if (section === "scope") {
@@ -240,18 +258,28 @@ export function renderMissingBindSectionsTemplate(missing) {
             lines.push("## Criteria", "- <declarative acceptance criterion>");
             continue;
         }
-        lines.push("## Verification", "- <executable command or testimony declaration>");
+        lines.push("## Verification", "```bash", "<verification script>", "```");
     }
     return lines.join("\n");
 }
 export function describeMissingBindSections(missing) {
-    if (missing.length === 0)
+    const labels = {
+        title: "Title",
+        context: "Context",
+        objective: "Objective",
+        design: "Design & Approach",
+        scope: "Scope",
+        criteria: "Criteria",
+        verification: "Verification",
+    };
+    const named = missing.map((section) => labels[section]);
+    if (named.length === 0)
         return "";
-    if (missing.length === 1)
-        return missing[0];
-    if (missing.length === 2)
-        return `${missing[0]} or ${missing[1]}`;
-    return `${missing.slice(0, -1).join(", ")}, or ${missing[missing.length - 1]}`;
+    if (named.length === 1)
+        return named[0];
+    if (named.length === 2)
+        return `${named[0]} or ${named[1]}`;
+    return `${named.slice(0, -1).join(", ")}, or ${named[named.length - 1]}`;
 }
 export function materializeBindDraft(partial) {
     const missing = missingBindDraftSections(partial);
@@ -272,7 +300,7 @@ export function materializeBindDraft(partial) {
 export function parseBindDraft(content) {
     const { title, sections, extensions } = collectBindDraftNodes(content);
     if (!title) {
-        invalidBindDraft("missing H1 Title in bind draft; expected '# <title>' followed by Context, Objective, Design, Scope, and Criteria; Verification is optional");
+        invalidBindDraft("missing H1 Title in bind draft; expected '# <title>' followed by Context, Objective, Design & Approach, Scope, and Criteria; Verification is optional");
     }
     const context = sections.get("context");
     const objective = sections.get("objective");
@@ -285,7 +313,7 @@ export function parseBindDraft(content) {
     if (!objective)
         invalidBindDraft("missing Objective section in bind draft");
     if (!design)
-        invalidBindDraft("missing Design section in bind draft");
+        invalidBindDraft("missing Design & Approach section in bind draft");
     if (!scope)
         invalidBindDraft("missing Scope section in bind draft");
     const parsedScope = parseScopeSection(content);
@@ -299,7 +327,7 @@ export function parseBindDraft(content) {
     if (!objectiveText)
         invalidBindDraft("Objective section cannot be empty");
     if (!designText)
-        invalidBindDraft("Design section cannot be empty");
+        invalidBindDraft("Design & Approach section cannot be empty");
     return {
         title,
         context: contextText,
@@ -307,7 +335,7 @@ export function parseBindDraft(content) {
         design: designText,
         scope: parsedScope,
         criteria: extractSingleLineDeclarations(criteria, "Criteria"),
-        verification: verification ? extractSingleLineDeclarations(verification, "Verification") : [],
+        verification: verification ? verificationDeclarations(verification, "## Verification") : [],
         extensions,
     };
 }
@@ -316,12 +344,12 @@ export function renderBindDraft(draft) {
         `# ${draft.title}`,
         `## Context\n${draft.context}`,
         `## Objective\n${draft.objective}`,
-        `## Design\n${draft.design}`,
+        `## Design & Approach\n${draft.design}`,
         `## Scope\n${renderScopeFragment(draft.scope)}`,
         `## Criteria\n${draft.criteria.map((criterion) => `- ${criterion}`).join("\n")}`,
     ];
     if (draft.verification.length > 0) {
-        sections.push(`## Verification\n${draft.verification.map((declaration) => `- ${declaration}`).join("\n")}`);
+        sections.push(`## Verification\n${renderVerificationDeclarations(draft.verification)}`);
     }
     for (const extension of draft.extensions) {
         const content = normalizeExtensionContent(extension.content);
@@ -340,7 +368,6 @@ export function compileBindDraftFlags(input) {
         ["--context", input.context],
         ["--objective", input.objective],
         ["--design", input.design],
-        ["--scope", input.scope],
         ["--criteria", input.criteria],
         ["--verification", input.verification],
     ]) {
@@ -348,6 +375,12 @@ export function compileBindDraftFlags(input) {
             throw new FlowError("EMPTY_PARAM", `${flag} must be a single line`);
         }
     }
+    const scope = typeof input.scope === "string" ? [input.scope] : input.scope;
+    for (const pattern of scope ?? []) {
+        if (pattern.includes("\n") || pattern.includes("\r")) {
+            throw new FlowError("EMPTY_PARAM", "--scope must be a single line");
+        }
+    }
     const sections = [];
     if (input.title !== undefined)
         sections.push(`# ${input.title}`);
@@ -356,12 +389,12 @@ export function compileBindDraftFlags(input) {
     if (input.objective !== undefined)
         sections.push(`## Objective\n${input.objective}`);
     if (input.design !== undefined)
-        sections.push(`## Design\n${input.design}`);
-    if (input.scope !== undefined)
-        sections.push(`## Scope\n~~~\n${input.scope}\n~~~`);
+        sections.push(`## Design & Approach\n${input.design}`);
+    if (scope !== undefined)
+        sections.push(`## Scope\n~~~\n${scope.join("\n")}\n~~~`);
     if (input.criteria !== undefined)
         sections.push(`## Criteria\n- ${input.criteria}`);
     if (input.verification !== undefined)
-        sections.push(`## Verification\n- ${input.verification}`);
+        sections.push(`## Verification\n\`\`\`bash\n${input.verification}\n\`\`\``);
     return sections.length > 0 ? `${sections.join("\n\n")}\n` : "";
 }

package/build/core/forfeit.js

@@ -88,7 +88,7 @@ export async function forfeitContract(input) {
                 : await context.publishAuthoritative({
                     verb: "forfeit",
                     admittedLedgerHead: admission.ledgerHead,
-                    acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId,
+                    acceptedLifecycleTail: context.session.lifecycle.contractHead,
                     entries: [prepared.entry],
                     delivery: {
                         ref: repositoryDeliveryRef(input.contractId),

package/build/core/lifecycle-history.js

@@ -33,3 +33,16 @@ export function effectiveCriteria(entries) {
     }
     return criteria;
 }
+/** Ordered effective contract Verification declarations from admitted lifecycle history. */
+export function effectiveVerification(entries) {
+    const bind = entries.find((entry) => entry.kind === "bind");
+    if (!bind)
+        throw new FlowError("INTERNAL_STATE", "lifecycle history must contain bind entry");
+    let declarations = [...bind.data.verification];
+    for (const entry of entries) {
+        if (entry.kind === "amend" && entry.data.verificationDelta) {
+            declarations = [...entry.data.verificationDelta.replace];
+        }
+    }
+    return declarations;
+}

package/build/core/lifecycle-recovery.js

@@ -1,12 +1,16 @@
 import { withContractCarrierSession } from "./contract-carrier.js";
 import { resolveAcceptedLifecycleTransaction, } from "./repository-ledger/accepted-tail.js";
+import { lifecycleTransactionId } from "./repository-ledger/identity.js";
 export async function reconcileCommittedMutation(plan) {
     const observed = await withContractCarrierSession({ cwd: plan.cwd, contractId: plan.contractId, mode: "observe-only", signal: plan.signal }, async (session) => ({
         model: session.lifecycle,
         repository: session.repository,
     }));
-    const authoritativeHead = observed.model.observedLedgerHead;
-    const accepted = findLatestAcceptedTransaction(observed.repository, plan.contractId, observed.model.history.at(-1)?.objectId ?? null);
+    const authoritativeHead = observed.repository.observedLedgerHead;
+    if (authoritativeHead === null) {
+        throw new Error(`accepted contract ${plan.contractId} has no repository ledger observation`);
+    }
+    const accepted = findLatestAcceptedTransaction(observed.repository, plan.contractId, observed.model.contractHead);
     if (accepted.status === "refused") {
         return {
             kind: "refused",
@@ -38,6 +42,11 @@ export async function reconcileCommittedMutation(plan) {
                 return replayed;
             return observeOrdinaryCoordinate(plan);
         }
+        // A matching retry is still a mutating verb. Its accepted authority never
+        // proves that derived surfaces survived process death or manual removal.
+        const replayed = await alignDerivedTransaction(plan, transaction);
+        if (replayed.kind === "refused")
+            return replayed;
         return {
             kind: "aligned",
             coordinate: { state: "verb-committed", invokedVerb: plan.mutation.verb, transaction, authoritativeHead },
@@ -50,23 +59,7 @@ export async function reconcileCommittedMutation(plan) {
             refusal: { code: "CONTRACT_TERMINAL", message: `contract ${plan.contractId} is terminal (${observed.model.phase})` },
         };
     }
-    const bindObjectId = observed.model.history.find(({ entry }) => entry.kind === "bind")?.objectId;
-    if (!bindObjectId) {
-        return {
-            kind: "refused",
-            authoritativeHead,
-            refusal: { code: "INTERNAL_STATE", message: `contract ${plan.contractId} typed lifecycle has no bind object` },
-        };
-    }
-    return {
-        kind: "aligned",
-        coordinate: {
-            state: "bind-aligned",
-            invokedVerb: plan.mutation.verb,
-            bindObjectId,
-            authoritativeHead,
-        },
-    };
+    return bindAligned(observed.repository, observed.model, plan, authoritativeHead);
 }
 async function alignDerivedTransaction(plan, transaction) {
     return withContractCarrierSession({ cwd: plan.cwd, contractId: plan.contractId, mode: "mutation", signal: plan.signal }, async (session) => {
@@ -81,7 +74,7 @@ async function alignDerivedTransaction(plan, transaction) {
         catch (error) {
             return {
                 kind: "refused",
-                authoritativeHead: session.lifecycle.observedLedgerHead,
+                authoritativeHead: session.pins.repositoryLedgerHead,
                 refusal: {
                     code: "LIFECYCLE_RECONCILIATION_INCOMPLETE",
                     message: error instanceof Error ? error.message : `contract ${plan.contractId} derived replay did not complete`,
@@ -91,18 +84,30 @@ async function alignDerivedTransaction(plan, transaction) {
     });
 }
 async function observeOrdinaryCoordinate(plan) {
-    return withContractCarrierSession({ cwd: plan.cwd, contractId: plan.contractId, mode: "observe-only", signal: plan.signal }, async (session) => bindAligned(session.lifecycle.history, plan, session.lifecycle.observedLedgerHead));
+    return withContractCarrierSession({ cwd: plan.cwd, contractId: plan.contractId, mode: "observe-only", signal: plan.signal }, async (session) => bindAligned(session.repository, session.lifecycle, plan, session.pins.repositoryLedgerHead));
 }
-function bindAligned(history, plan, authoritativeHead) {
-    const bindObjectId = history.find(({ entry }) => entry.kind === "bind")?.objectId;
-    if (!bindObjectId) {
+function bindAligned(repository, lifecycle, plan, authoritativeHead) {
+    const bindObjectId = lifecycle.history.find(({ entry }) => entry.kind === "bind")?.objectId;
+    const transaction = repository.topology.nodes.find((node) => (node.type === "transaction"
+        && node.contract === lifecycle.contract
+        && node.finalEntryObjectId === lifecycle.contractHead));
+    if (!bindObjectId || !transaction || transaction.type !== "transaction") {
         return {
             kind: "refused",
             authoritativeHead,
-            refusal: { code: "INTERNAL_STATE", message: "typed lifecycle has no bind object" },
+            refusal: { code: "INTERNAL_STATE", message: "typed lifecycle lacks a replayable bind transaction" },
         };
     }
-    return { kind: "aligned", coordinate: { state: "bind-aligned", invokedVerb: plan.mutation.verb, bindObjectId, authoritativeHead } };
+    return {
+        kind: "aligned",
+        coordinate: {
+            state: "bind-aligned",
+            invokedVerb: plan.mutation.verb,
+            bindObjectId,
+            transactionObjectId: lifecycleTransactionId(transaction.objectId),
+            authoritativeHead,
+        },
+    };
 }
 function findLatestAcceptedTransaction(read, contractId, finalEntryObjectId) {
     if (finalEntryObjectId === null)
@@ -112,6 +117,6 @@ function findLatestAcceptedTransaction(read, contractId, finalEntryObjectId) {
         && candidate.finalEntryObjectId === finalEntryObjectId);
     if (!node || node.type !== "transaction")
         return { status: "none" };
-    const resolved = resolveAcceptedLifecycleTransaction({ read, transactionObjectId: node.objectId, expectedContract: contractId });
+    const resolved = resolveAcceptedLifecycleTransaction({ read, transactionObjectId: lifecycleTransactionId(node.objectId), expectedContract: contractId });
     return resolved.status === "accepted" ? { status: "accepted", transaction: resolved } : resolved;
 }