@astrosheep/keiyaku 2.9.12 → 2.9.13

package/build/core/contract-carrier-runtime.js

@@ -1,75 +1,80 @@
 import * as fs from "node:fs/promises";
+import * as path from "node:path";
 import { FlowError } from "../flow-error.js";
+import { isCommitAncestor, readCommitCoordinate } from "../git/commits.js";
+import { runGitProcess } from "../git/core.js";
 import { replayCommittedDerivedState } from "./derived-replay.js";
 import { EffectJournal } from "./outcome-base.js";
-import { readRepositoryLifecycle } from "./repository-ledger/read-model.js";
-import { REPOSITORY_LEDGER_REF } from "./repository-ledger/codec.js";
 import { resolveAcceptedLifecycleTransaction } from "./repository-ledger/accepted-tail.js";
 import { publishAuthoritativeTransaction } from "./repository-ledger/write-transaction.js";
-import { cleanupContractWorkspace, contractWorktreePathFromBind, observeTerminalDeliveryRef, resolveContractCarrierTarget, stableRepoRoot } from "./worktree-path.js";
+import { cleanupContractWorkspace, contractWorktreePathFromStableRoot, observeTerminalDeliveryRef, resolveContractCarrierTarget, stableRepoRoot } from "./worktree-path.js";
 import { defaultCreateWorktree } from "./bind-workspace.js";
 import { replayClaimTargetWorktree } from "./settlement/claim-delivery.js";
+import { lifecycleTransactionId } from "./repository-ledger/identity.js";
 let acceptedBind, acquireGate, carrierMatches, checkCancellation;
-let observe, observedLedgerHead, projectRenewDeliveryWorktree, publishCarrier;
-let readCarrierIdentity, reconcileFoldedDeliveryWorktree, releaseGate, resolveCommitOrNull, retireTerminalHereCarrier;
+let expectedCarrierIdentity, observe, observedLedgerHead, publishCarrier;
+let verifyCarrier, reconcileFoldedDeliveryWorktree, releaseGate, retireTerminalHereCarrier;
 export function installCarrierRuntimePorts(ports) {
-    ({ acceptedBind, acquireGate, carrierMatches, checkCancellation, observe, observedLedgerHead,
-        projectRenewDeliveryWorktree, publishCarrier, readCarrierIdentity, reconcileFoldedDeliveryWorktree,
-        releaseGate, resolveCommitOrNull, retireTerminalHereCarrier } = ports);
+    ({ acceptedBind, acquireGate, carrierMatches, checkCancellation, expectedCarrierIdentity, observe, observedLedgerHead,
+        publishCarrier, verifyCarrier, reconcileFoldedDeliveryWorktree,
+        releaseGate, retireTerminalHereCarrier } = ports);
 }
 export async function withContractCarrierSession(input, action) {
     const stableRoot = await stableRepoRoot(input.cwd);
     if (input.mode === "observe-only") {
         checkCancellation(input.signal);
         const { repository, lifecycle, target, pins } = await observe(stableRoot, input.contractId);
-        const projectedCarrier = target.status === "available" ? await readCarrierIdentity(target.path) : null;
+        const projectedCarrier = target.status === "available" ? await verifyCarrier({ target: target.path, lifecycle }) : undefined;
         const initialCarrier = target.status === "available"
-            ? { status: carrierMatches(projectedCarrier, input.contractId, lifecycle.observedLedgerHead) ? "current" : "stale", ledgerHead: lifecycle.observedLedgerHead, target: target.path }
-            : { status: "target-unavailable", ledgerHead: lifecycle.observedLedgerHead, reason: target.reason };
-        return action(createSession(input.mode, stableRoot, input.contractId, repository, lifecycle, target, pins, initialCarrier, input.signal, input.contractViewWriter, input.renewDeliveryProjector, input.terminalWorkspaceCleanup));
+            ? { status: projectedCarrier && carrierMatches(projectedCarrier) ? "current" : "stale", contractHead: lifecycle.contractHead, target: target.path }
+            : { status: "target-unavailable", contractHead: lifecycle.contractHead, reason: target.reason };
+        return action(createSession(input.mode, stableRoot, input.contractId, repository, lifecycle, target, pins, initialCarrier, input.signal, input.contractViewWriter, input.renewDeliveryProjector, input.terminalWorkspaceCleanup, input.transactionRunner));
     }
-    // Closure/fold observation can be comparatively expensive. Do it before the
-    // repository-wide carrier gate, then admit the snapshot only if the sole
-    // authoritative coordinate still names the same ledger tip under the gate.
+    // Publication coordination is scoped to the contract's proven physical target.
     const preGateObserved = await observe(stableRoot, input.contractId);
-    const gate = await acquireGate(stableRoot, input.signal);
+    const gate = await acquireGate(stableRoot, input.contractId, preGateObserved.target.status === "available" ? preGateObserved.target.path : `unavailable:${input.contractId}`, input.signal);
     try {
         checkCancellation(input.signal);
-        const observedHead = await resolveCommitOrNull(stableRoot, REPOSITORY_LEDGER_REF);
-        const { repository, lifecycle, target, pins } = observedHead === preGateObserved.lifecycle.observedLedgerHead
-            ? preGateObserved
-            : await observe(stableRoot, input.contractId);
-        const projectedCarrier = target.status === "available" ? await readCarrierIdentity(target.path) : null;
+        const { repository, lifecycle, target, pins } = preGateObserved;
+        const projectedCarrier = target.status === "available" ? await verifyCarrier({ target: target.path, lifecycle }) : undefined;
         const initialCarrier = target.status === "available"
-            ? { status: carrierMatches(projectedCarrier, input.contractId, lifecycle.observedLedgerHead) ? "current" : "stale", ledgerHead: lifecycle.observedLedgerHead, target: target.path }
-            : { status: "target-unavailable", ledgerHead: lifecycle.observedLedgerHead, reason: target.reason };
+            ? { status: projectedCarrier && carrierMatches(projectedCarrier) ? "current" : "stale", contractHead: lifecycle.contractHead, target: target.path }
+            : { status: "target-unavailable", contractHead: lifecycle.contractHead, reason: target.reason };
         checkCancellation(input.signal);
-        const session = createSession(input.mode, stableRoot, input.contractId, repository, lifecycle, target, pins, initialCarrier, input.signal, input.contractViewWriter, input.renewDeliveryProjector, input.terminalWorkspaceCleanup);
+        const session = createSession(input.mode, stableRoot, input.contractId, repository, lifecycle, target, pins, initialCarrier, input.signal, input.contractViewWriter, input.renewDeliveryProjector, input.terminalWorkspaceCleanup, input.transactionRunner);
         return await action(session);
     }
     finally {
         releaseGate(gate);
     }
 }
-function createSession(mode, stableRoot, contractId, repository, lifecycle, target, pins, initialCarrier, signal, contractViewWriter, renewDeliveryProjector, terminalWorkspaceCleanup) {
-    const admittedLedgerHead = lifecycle.observedLedgerHead;
-    const admittedLifecycleTail = lifecycle.history.at(-1)?.objectId;
-    if (!admittedLifecycleTail)
-        throw new FlowError("INTERNAL_STATE", `carrier admission ${contractId} has no accepted lifecycle tail`);
+/** Bind-only carrier admission from the immutable Observe snapshot. */
+export async function withObservedContractCarrierSession(input, action) {
+    checkCancellation(input.signal);
+    const gate = await acquireGate(input.stableRoot, input.contractId, input.observation.target.status === "available" ? input.observation.target.path : `unavailable:${input.contractId}`, input.signal);
+    try {
+        const { repository, lifecycle, target, pins } = input.observation;
+        const projectedCarrier = target.status === "available" ? await verifyCarrier({ target: target.path, lifecycle }) : undefined;
+        const initialCarrier = target.status === "available"
+            ? { status: projectedCarrier && carrierMatches(projectedCarrier) ? "current" : "stale", contractHead: lifecycle.contractHead, target: target.path }
+            : { status: "target-unavailable", contractHead: lifecycle.contractHead, reason: target.reason };
+        return await action(createSession("mutation", input.stableRoot, input.contractId, repository, lifecycle, target, pins, initialCarrier, input.signal, input.contractViewWriter, undefined, input.terminalWorkspaceCleanup, undefined));
+    }
+    finally {
+        releaseGate(gate);
+    }
+}
+function createSession(mode, stableRoot, contractId, repository, lifecycle, target, pins, initialCarrier, signal, contractViewWriter, renewDeliveryProjector, terminalWorkspaceCleanup, transactionRunner) {
+    const admittedLedgerHead = pins.repositoryLedgerHead;
+    const admittedLifecycleTail = lifecycle.contractHead;
     let currentLifecycle = lifecycle;
+    let currentObservation = { repository, lifecycle, target, pins };
     let authoritativeTransactionSelected = false;
     let effectsStarted = false;
     let committedResult;
-    const journal = new EffectJournal(`${contractId}:${lifecycle.observedLedgerHead}`);
+    const journal = new EffectJournal(`${contractId}:${lifecycle.contractHead}`);
     async function finalizeCommitted(input) {
         effectsStarted = true;
-        if (input.renewProjection) {
-            await journal.run({
-                effect: "delivery-worktree-projection",
-                idempotencyKey: `${contractId}:${input.head}:delivery-worktree-projection`,
-                run: async () => (renewDeliveryProjector ?? projectRenewDeliveryWorktree)(input.renewProjection.target, input.renewProjection.oldHead, input.renewProjection.newHead),
-            });
-        }
         let resolvedTransaction;
         await journal.run({
             effect: "committed-ledger-reread",
@@ -81,15 +86,15 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 if (accepted.status !== "accepted")
                     throw new FlowError("COMMITTED_LEDGER_REREAD_FAILED", `accepted ledger transaction ${input.head} could not be reread (${accepted.reason})`);
                 resolvedTransaction = accepted;
-                return { head: observed.lifecycle.observedLedgerHead };
+                return { head: observed.lifecycle.contractHead };
             },
         });
         journal.beginDerivedReplay();
         const carrier = input.carrier === "retire"
-            ? { status: "retired", ledgerHead: input.head, reason: "terminal" }
+            ? { status: "retired", contractHead: currentLifecycle.contractHead, reason: "terminal" }
             : target.status === "available"
-                ? { status: "stale", ledgerHead: currentLifecycle.observedLedgerHead, target: target.path }
-                : { status: "target-unavailable", ledgerHead: currentLifecycle.observedLedgerHead, reason: target.reason };
+                ? { status: "stale", contractHead: currentLifecycle.contractHead, target: target.path }
+                : { status: "target-unavailable", contractHead: currentLifecycle.contractHead, reason: target.reason };
         committedResult = {
             status: "committed",
             head: input.head,
@@ -100,32 +105,35 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
         };
         return committedResult;
     }
-    async function publishRepository(transaction, additionalReplaySteps = []) {
+    async function publishRepository(transaction) {
         if (mode !== "mutation")
             throw new FlowError("INTERNAL_STATE", `carrier ${mode} session cannot publish repository ledger facts`);
         if (!effectsStarted)
             checkCancellation(signal);
         let replayed;
         let carrier = target.status === "available"
-            ? { status: "stale", ledgerHead: currentLifecycle.observedLedgerHead, target: target.path }
-            : { status: "target-unavailable", ledgerHead: currentLifecycle.observedLedgerHead, reason: target.reason };
+            ? { status: "stale", contractHead: currentLifecycle.contractHead, target: target.path }
+            : { status: "target-unavailable", contractHead: currentLifecycle.contractHead, reason: target.reason };
         const replayPlan = {
             steps: [
-                ...additionalReplaySteps,
                 {
                     effect: "committed-ledger-reread",
-                    dependencies: additionalReplaySteps.map((step) => step.effect),
+                    dependencies: [],
                     run: async ({ ledgerHead }) => {
                         replayed = await observe(stableRoot, contractId);
-                        if (replayed.lifecycle.observedLedgerHead !== ledgerHead) {
-                            throw new FlowError("COMMITTED_LEDGER_REREAD_FAILED", `committed ledger head ${ledgerHead} could not be reread (observed ${replayed.lifecycle.observedLedgerHead})`);
+                        if (replayed.repository.observedLedgerHead !== ledgerHead) {
+                            throw new FlowError("COMMITTED_LEDGER_REREAD_FAILED", `committed ledger head ${ledgerHead} could not be reread (observed ${replayed.repository.observedLedgerHead})`);
                         }
                         currentLifecycle = replayed.lifecycle;
+                        currentObservation = replayed;
                     },
                 },
             ],
         };
-        const publication = await publishAuthoritativeTransaction(stableRoot, transaction, { replayPlan });
+        const publication = await publishAuthoritativeTransaction(stableRoot, transaction, {
+            replayPlan,
+            ...(transactionRunner ? { transactionRunner } : {}),
+        });
         const result = publication.write;
         if (result.family === "refused-before-effects") {
             return {
@@ -166,9 +174,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 authorityProof: result.authorityProof,
             },
         });
-        const replayDependencyEffects = {
-            "committed-ledger-reread": additionalReplaySteps.at(-1)?.effect ?? ledgerCasKey,
-        };
+        const replayDependencyEffects = { "committed-ledger-reread": ledgerCasKey };
         const replayKeys = new Map();
         for (const effect of result.replay.effects) {
             const idempotencyKey = `${contractId}:${result.ledgerHead}:${effect.effect}`;
@@ -190,7 +196,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
         }
         const observedTransaction = resolveAcceptedLifecycleTransaction({
             read: replayed?.repository ?? (await observe(stableRoot, contractId)).repository,
-            transactionObjectId: result.ledgerHead,
+            transactionObjectId: lifecycleTransactionId(result.ledgerHead),
             expectedContract: contractId,
         });
         if (observedTransaction.status !== "accepted") {
@@ -198,7 +204,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
         }
         committedResult = {
             status: "committed",
-            head: result.ledgerHead,
+            head: lifecycleTransactionId(result.ledgerHead),
             transaction: observedTransaction,
             carrier,
             effects: journal.all(),
@@ -207,13 +213,16 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
         return committedResult;
     }
     async function replayDerivedState() {
-        const observed = await observe(stableRoot, contractId);
+        const observed = currentObservation.lifecycle.contractHead === currentLifecycle.contractHead
+            ? currentObservation
+            : await observe(stableRoot, contractId);
+        currentObservation = observed;
         currentLifecycle = observed.lifecycle;
         const bind = acceptedBind(observed.lifecycle);
         let committedTarget = observed.target;
         let materialized = {
             status: "failed",
-            ledgerHead: observed.lifecycle.observedLedgerHead,
+            contractHead: observed.lifecycle.contractHead,
             cause: "carrier projection was not attempted",
         };
         await replayCommittedDerivedState({
@@ -227,7 +236,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                     committedTarget = await resolveContractCarrierTarget(stableRoot, contractId, bind);
                     let created = false;
                     if (committedTarget.status !== "available" && bind.data.workspace === "worktree") {
-                        const worktreePath = await contractWorktreePathFromBind(stableRoot, contractId, bind);
+                        const worktreePath = contractWorktreePathFromStableRoot(stableRoot, contractId, bind);
                         try {
                             await fs.access(worktreePath);
                             throw Object.assign(new Error(`worktree path ${worktreePath} is occupied by an unowned filesystem entry`), { code: "BIND_WORKTREE_PATH_OCCUPIED", facts: { path: worktreePath, occupant: "unowned-filesystem-entry" } });
@@ -248,11 +257,23 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                     }
                     if (committedTarget.status !== "available")
                         throw new FlowError("CARRIER_TARGET_UNAVAILABLE", committedTarget.reason);
-                    const renewed = await reconcileFoldedDeliveryWorktree({ targetRoot: committedTarget.root, lifecycle: observed.lifecycle });
-                    return { status: created || renewed === "created" ? "created" : "already-present", target: committedTarget };
+                    return { status: created ? "created" : "already-present", target: committedTarget };
+                },
+                reconcileRenewDelivery: async ({ lifecycle: accepted, target: acceptedTarget, transaction }) => {
+                    if (acceptedTarget.status !== "available")
+                        throw new FlowError("CARRIER_TARGET_UNAVAILABLE", acceptedTarget.reason);
+                    const renew = transaction.entries.find((entry) => entry.kind === "renew");
+                    if (!renew || renew.kind !== "renew") {
+                        throw new FlowError("INTERNAL_STATE", `accepted renew transaction ${transaction.transactionObjectId} has no renew entry`);
+                    }
+                    if (renewDeliveryProjector) {
+                        await renewDeliveryProjector(acceptedTarget, renew.data.oldHead, renew.data.newHead);
+                        return "created";
+                    }
+                    return reconcileFoldedDeliveryWorktree({ targetRoot: acceptedTarget.root, lifecycle: accepted });
                 },
                 materializeContractView: async ({ lifecycle: accepted, target: acceptedTarget }) => {
-                    const projected = await convergeCarrier(stableRoot, contractId, observed.repository, accepted, acceptedTarget, contractViewWriter);
+                    const projected = await convergeCarrier(stableRoot, contractId, accepted, acceptedTarget, contractViewWriter);
                     materialized = projected;
                     if (projected.status === "failed")
                         throw new FlowError("CARRIER_MATERIALIZATION_FAILED", projected.cause);
@@ -263,14 +284,122 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 retireContractView: async ({ lifecycle: accepted, target: acceptedTarget }) => {
                     return retireTerminalHereCarrier(accepted, acceptedTarget);
                 },
+                expectedCarrierIdentity,
+                inspectSurface: async ({ obligation }) => {
+                    switch (obligation.surface) {
+                        case "carrier": {
+                            if (committedTarget.status !== "available")
+                                return null;
+                            const verification = await verifyCarrier({ target: committedTarget.path, lifecycle: observed.lifecycle });
+                            return verification.status === "current" ? verification.actual : null;
+                        }
+                        case "carrier-retirement": {
+                            if (committedTarget.status !== "available")
+                                return obligation.expected;
+                            try {
+                                await fs.access(committedTarget.path);
+                                return null;
+                            }
+                            catch (error) {
+                                return error instanceof Error && "code" in error && error.code === "ENOENT" ? obligation.expected : null;
+                            }
+                        }
+                        case "narrow-ignore": {
+                            if (committedTarget.status !== "available")
+                                return null;
+                            const expected = JSON.parse(obligation.expected.inventory);
+                            const bytes = expected.length === 0 ? "" : `${expected.join("\n")}\n`;
+                            try {
+                                return await fs.readFile(path.join(committedTarget.root, ".gitignore"), "utf8") === bytes ? obligation.expected : null;
+                            }
+                            catch {
+                                return null;
+                            }
+                        }
+                        case "worktree": {
+                            if (observed.lifecycle.phase === "claimed" || observed.lifecycle.phase === "forfeited") {
+                                return committedTarget.workspace === "here" || committedTarget.status === "unavailable"
+                                    ? obligation.expected
+                                    : null;
+                            }
+                            if (committedTarget.status !== "available")
+                                return null;
+                            const [head, clean] = await Promise.all([
+                                readCommitCoordinate(committedTarget.root, "HEAD"),
+                                runGitProcess(committedTarget.root, ["status", "--porcelain=v1", "--untracked-files=no"]),
+                            ]);
+                            const expectedHead = obligation.expected.deliveryHead;
+                            return head.status === "ok" && clean.status === 0 && !clean.error && head.coordinate.commit === expectedHead && clean.stdout === ""
+                                ? obligation.expected
+                                : null;
+                        }
+                        case "renew-delivery": {
+                            if (committedTarget.status !== "available")
+                                return null;
+                            const [head, clean] = await Promise.all([
+                                readCommitCoordinate(committedTarget.root, "HEAD"),
+                                runGitProcess(committedTarget.root, ["status", "--porcelain=v1", "--untracked-files=no"]),
+                            ]);
+                            const expectedHead = obligation.expected.newHead;
+                            return head.status === "ok" && clean.status === 0 && !clean.error && head.coordinate.commit === expectedHead && clean.stdout === ""
+                                ? obligation.expected
+                                : null;
+                        }
+                        case "delivery-ref": {
+                            const projection = await observeTerminalDeliveryRef(stableRoot, contractId);
+                            return projection.status === "aligned" ? obligation.expected : null;
+                        }
+                        case "target-worktree": {
+                            const expected = obligation.expected;
+                            const listed = await runGitProcess(stableRoot, ["worktree", "list", "--porcelain", "-z"]);
+                            if (listed.error || listed.status !== 0)
+                                return null;
+                            let worktree;
+                            for (const field of listed.stdout.split("\0")) {
+                                if (field.startsWith("worktree "))
+                                    worktree = field.slice("worktree ".length);
+                                if (field === `branch ${expected.target}` && worktree) {
+                                    const [head, clean, target] = await Promise.all([
+                                        readCommitCoordinate(worktree, "HEAD"),
+                                        runGitProcess(worktree, ["status", "--porcelain=v1", "--untracked-files=no"]),
+                                        readCommitCoordinate(stableRoot, expected.target),
+                                    ]);
+                                    return head.status === "ok"
+                                        && clean.status === 0 && !clean.error && clean.stdout === ""
+                                        && target.status === "ok" && head.coordinate.commit === target.coordinate.commit
+                                        ? obligation.expected
+                                        : null;
+                                }
+                            }
+                            return obligation.expected;
+                        }
+                        case "task-board": {
+                            // An open bind projects the exact bind-base task bytes into the
+                            // index and working tree. Terminal task settlement has distinct
+                            // target/ref semantics and is deliberately reconciled below.
+                            if (observed.lifecycle.phase === "claimed" || observed.lifecycle.phase === "forfeited")
+                                return null;
+                            const bind = acceptedBind(observed.lifecycle);
+                            const taskIds = obligation.expected.taskIds;
+                            const paths = taskIds.map((taskId) => `.keiyaku/tasks/${taskId}.md`);
+                            const [cached, worktree] = await Promise.all([
+                                runGitProcess(stableRoot, ["diff", "--quiet", "--cached", bind.data.base, "--", ...paths]),
+                                runGitProcess(stableRoot, ["diff", "--quiet", "--", ...paths]),
+                            ]);
+                            return cached.status === 0 && !cached.error && worktree.status === 0 && !worktree.error
+                                ? obligation.expected
+                                : null;
+                        }
+                    }
+                },
                 replayClaimTarget: (landing) => replayClaimTargetWorktree(stableRoot, landing),
                 cleanupWorkspace: terminalWorkspaceCleanup ?? cleanupContractWorkspace,
                 observeDeliveryRef: observeTerminalDeliveryRef,
             },
         });
-        const carrierProjection = journal.all().find((row) => row.effect === "carrier-projection");
+        const carrierProjection = journal.all().find((row) => row.effect === "carrier-retirement-projection");
         if (["claimed", "forfeited"].includes(observed.lifecycle.phase) && carrierProjection?.status === "succeeded") {
-            materialized = { status: "retired", ledgerHead: observed.lifecycle.observedLedgerHead, reason: "terminal" };
+            materialized = { status: "retired", contractHead: observed.lifecycle.contractHead, reason: "terminal" };
         }
         return materialized;
     }
@@ -302,6 +431,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 checkCancellation(signal);
             const observed = await observe(stableRoot, contractId);
             currentLifecycle = observed.lifecycle;
+            currentObservation = observed;
             if (!effectsStarted)
                 checkCancellation(signal);
             return { lifecycle: observed.lifecycle, repository: observed.repository, target: observed.target, pins: observed.pins };
@@ -311,6 +441,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 checkCancellation(signal);
             const observed = await observe(stableRoot, contractId);
             currentLifecycle = observed.lifecycle;
+            currentObservation = observed;
             if (!effectsStarted)
                 checkCancellation(signal);
             return { lifecycle: observed.lifecycle, repository: observed.repository, target: observed.target, pins: observed.pins };
@@ -339,15 +470,7 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
                 throw new FlowError("CONCURRENT_MODIFICATION", `authoritative transaction ledger CAS does not match immutable carrier admission ${contractId}`);
             if (transaction.acceptedLifecycleTail !== admittedLifecycleTail)
                 throw new FlowError("CONCURRENT_MODIFICATION", `authoritative transaction lifecycle tail does not match immutable carrier admission ${contractId}`);
-            const accepted = transaction.entries.at(-1);
-            const replaySteps = transaction.verb === "renew" && accepted.kind === "renew" && "delivery" in transaction
-                ? [{
-                        effect: "delivery-worktree-projection",
-                        dependencies: [],
-                        run: async () => (renewDeliveryProjector ?? projectRenewDeliveryWorktree)(target, transaction.delivery.expectedOid, accepted.data.newHead),
-                    }]
-                : [];
-            return publishRepository(transaction, replaySteps);
+            return publishRepository(transaction);
         },
         async replayCommitted(input) {
             if (mode !== "mutation")
@@ -357,35 +480,21 @@ function createSession(mode, stableRoot, contractId, repository, lifecycle, targ
             if (accepted.status !== "accepted")
                 throw new FlowError("CONCURRENT_MODIFICATION", `cannot replay unproved transaction ${input.transactionObjectId}`);
             const renew = accepted.entries.find((entry) => entry.kind === "renew");
-            if (renew && (observed.lifecycle.pins.base !== renew.data.newBase || observed.lifecycle.pins.delivery !== renew.data.newHead || observed.pins.delivery.head !== renew.data.newHead || observed.pins.target.head !== renew.data.newBase)) {
+            const deliveryDescendsFromRenew = renew && observed.pins.delivery.head
+                ? await isCommitAncestor(stableRoot, renew.data.newHead, observed.pins.delivery.head)
+                : false;
+            if (renew && (observed.lifecycle.pins.base !== renew.data.newBase
+                || observed.lifecycle.pins.delivery !== renew.data.newHead
+                || !deliveryDescendsFromRenew)) {
                 throw new FlowError("CONCURRENT_MODIFICATION", `accepted renew transaction ${input.transactionObjectId} no longer matches current coordinates`);
             }
             currentLifecycle = observed.lifecycle;
-            return finalizeCommitted({
-                head: input.transactionObjectId,
-                ...(renew ? { renewProjection: { target: observed.target, oldHead: renew.data.oldHead, newHead: renew.data.newHead } } : {}),
-                carrier: input.carrier,
-            });
+            return finalizeCommitted({ head: input.transactionObjectId, carrier: input.carrier });
         },
     };
 }
-async function convergeCarrier(stableRoot, contractId, initialRepository, initialLifecycle, initialTarget, contractViewWriter) {
-    let repository = initialRepository;
-    let lifecycle = initialLifecycle;
-    let target = initialTarget;
-    for (let attempt = 0; attempt < 4; attempt += 1) {
-        const published = await publishCarrier({ stableRoot, contractId, repository, lifecycle, target, contractViewWriter });
-        if (published.status !== "failed")
-            return published;
-        const activeHead = (await readRepositoryLifecycle(stableRoot)).observedLedgerHead;
-        if (activeHead === lifecycle.observedLedgerHead)
-            return published;
-        const observed = await observe(stableRoot, contractId);
-        repository = observed.repository;
-        lifecycle = observed.lifecycle;
-        target = observed.target;
-    }
-    return { status: "failed", ledgerHead: lifecycle.observedLedgerHead, ...(target.status === "available" ? { target: target.path } : {}), cause: "carrier convergence did not reach a stable ledger head" };
+async function convergeCarrier(stableRoot, contractId, lifecycle, target, contractViewWriter) {
+    return publishCarrier({ stableRoot, contractId, lifecycle, target, contractViewWriter });
 }
 export async function convergeContractCarrier(input) {
     return withContractCarrierSession({ ...input, mode: "observe-only" }, async (session) => ({ lifecycle: session.lifecycle, repository: session.repository, target: session.target, carrier: session.initialCarrier }));
@@ -394,15 +503,10 @@ export async function convergeContractCarrier(input) {
 export async function reconcileContractCarrierProjection(input) {
     checkCancellation(input.signal);
     const stableRoot = await stableRepoRoot(input.cwd);
-    const observed = await observe(stableRoot, input.contractId);
-    const carrier = await convergeCarrier(stableRoot, input.contractId, observed.repository, observed.lifecycle, observed.target, input.contractViewWriter);
-    const reconciled = carrier.ledgerHead === observed.lifecycle.observedLedgerHead
-        ? observed
-        : await observe(stableRoot, input.contractId);
-    return {
-        lifecycle: reconciled.lifecycle,
-        repository: reconciled.repository,
-        target: reconciled.target,
-        carrier,
-    };
+    return withContractCarrierSession({ cwd: stableRoot, contractId: input.contractId, mode: "mutation", signal: input.signal, contractViewWriter: input.contractViewWriter }, async (session) => ({
+        lifecycle: session.lifecycle,
+        repository: session.repository,
+        target: session.target,
+        carrier: await convergeCarrier(stableRoot, input.contractId, session.lifecycle, session.target, input.contractViewWriter),
+    }));
 }