@astrosheep/keiyaku 2.9.12 → 2.9.13

package/build/core/renew.js

@@ -6,6 +6,7 @@ import { withContractCarrierSession } from "./contract-carrier.js";
 import { runLifecycle } from "./lifecycle-runner.js";
 import { committedLifecycleFacts, derivedCleanupFacts, isCompleteLifecycleOutcome, } from "./outcome-base.js";
 import { abortDetachedRenewChain, readDetachedRenewScratch, renewScratchName, } from "./renew-rewrite.js";
+import { scopePathEvidence } from "./scope.js";
 import { persistResponseHistory } from "./transcripts.js";
 import { admitRenew, checkCancellation, prepareRenew, sameAdmission, scopeEntry } from "./renew-plan.js";
 async function persistRenewResponse(journal, facts, persist) {
@@ -46,6 +47,7 @@ async function executeRenew(input, continuation) {
         },
         signal: input.signal,
         ...(input.renewDeliveryProjector ? { renewDeliveryProjector: input.renewDeliveryProjector } : {}),
+        ...(input.transactionRunner ? { transactionRunner: input.transactionRunner } : {}),
         admit: (session, replay) => admitRenew(session, input, replay, continuation?.scratch),
         prepare: (admission) => prepareRenew(admission.business, input, continuation),
         revalidate: async ({ session, admission }) => {
@@ -79,7 +81,11 @@ async function executeRenew(input, continuation) {
             if (admission.business.acceptedReplay) {
                 const accepted = admission.business.acceptedReplay;
                 const replayed = await context.replayCommitted({ transactionObjectId: accepted.transactionObjectId });
-                const sealed = { ...accepted.seal.data, scopeViolationEvidence: [], ledgerHead: accepted.sealObjectId };
+                const sealed = {
+                    ...accepted.seal.data,
+                    scopeViolationEvidence: await scopePathEvidence(admission.business.targetRoot, admission.business.model.effectiveScope, accepted.seal.data.scopeAudit.violations),
+                    ledgerHead: accepted.sealObjectId,
+                };
                 const value = {
                     ...committedLifecycleFacts({ head: accepted.transactionObjectId, entryKind: "renew", contractId: input.contractId, carrier: replayed.carrier }),
                     contractId: input.contractId,
@@ -95,13 +101,6 @@ async function executeRenew(input, continuation) {
                     carrier: replayed.carrier,
                     targetRoot: admission.business.targetRoot,
                 };
-                if (continuation) {
-                    await context.journal.run({
-                        effect: "renew-scratch-cleanup",
-                        idempotencyKey: `${input.contractId}:${accepted.transactionObjectId}:renew-scratch-cleanup`,
-                        run: async () => abortDetachedRenewChain({ cwd: input.cwd, scratchName: continuation.scratch.scratchName }),
-                    });
-                }
                 await persistRenewResponse(context.journal, value, input.persistResponse);
                 return { kind: "committed", commit: replayed, entryKind: "renew", value };
             }
@@ -140,7 +139,7 @@ async function executeRenew(input, continuation) {
                 if (!admission.business.amendment) {
                     const transactionObjectId = admission.replay.state === "verb-committed"
                         ? admission.replay.transaction.transactionObjectId
-                        : admission.ledgerHead;
+                        : admission.replay.transactionObjectId;
                     const replayed = await context.replayCommitted({ transactionObjectId });
                     const accepted = replayed.transaction.entries.at(-1);
                     if (!accepted)
@@ -166,7 +165,7 @@ async function executeRenew(input, continuation) {
                 const published = await context.publishAuthoritative({
                     verb: "renew",
                     admittedLedgerHead: admission.ledgerHead,
-                    acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId,
+                    acceptedLifecycleTail: context.session.lifecycle.contractHead,
                     entries: [admission.business.amendment],
                 });
                 if (published.status === "refused-before-effects")
@@ -203,15 +202,19 @@ async function executeRenew(input, continuation) {
             const published = await context.publishAuthoritative({
                 verb: "renew",
                 admittedLedgerHead: admission.ledgerHead,
-                acceptedLifecycleTail: context.session.lifecycle.history.at(-1).objectId,
+                acceptedLifecycleTail: context.session.lifecycle.contractHead,
                 entries,
+                target: {
+                    ref: admission.business.targetRef,
+                    expectedOid: prepared.entry.data.newBase,
+                },
                 delivery: {
                     ref: admission.business.deliveryRef,
                     expectedOid: prepared.entry.data.oldHead,
                 },
             });
             if (published.status === "refused-before-effects")
-                return { kind: "refused-before-effects", authoritativeHead: admission.ledgerHead, refusal: { code: "CONCURRENT_MODIFICATION", message: "repository ledger or delivery ref changed before renew transaction" } };
+                return { kind: "refused-before-effects", authoritativeHead: admission.ledgerHead, refusal: { code: "CONCURRENT_MODIFICATION", message: "repository target, ledger, or delivery ref changed before renew transaction" } };
             if (published.status === "indeterminate")
                 return { kind: "precommit-effects-only", authoritativeHead: admission.ledgerHead };
             const sealIndex = published.transaction.entries.findIndex((entry) => entry.kind === "seal");
@@ -239,13 +242,6 @@ async function executeRenew(input, continuation) {
                 carrier: published.carrier,
                 targetRoot: admission.business.targetRoot,
             };
-            if (continuation) {
-                await context.journal.run({
-                    effect: "renew-scratch-cleanup",
-                    idempotencyKey: `${input.contractId}:${published.head}:renew-scratch-cleanup`,
-                    run: async () => abortDetachedRenewChain({ cwd: input.cwd, scratchName: continuation.scratch.scratchName }),
-                });
-            }
             await persistRenewResponse(context.journal, value, input.persistResponse);
             return { kind: "committed", commit: published, entryKind: "renew", value };
         },
@@ -261,19 +257,7 @@ export async function renewContract(input) {
 }
 export async function continueRenewContract(input) {
     const scratchName = renewScratchName(input.contractId);
-    let scratch;
-    try {
-        scratch = await readDetachedRenewScratch({ cwd: input.cwd, scratchName });
-    }
-    catch (error) {
-        throw new FlowError("RENEW_SCRATCH_NOT_FOUND", `no renew conflict scratch is open for ${input.contractId}`, { cause: error });
-    }
-    return executeRenew(input, { scratch, resolution: input.resolution ?? { kind: "scratch-files" } });
-}
-export async function abortRenewContract(input) {
-    checkCancellation(input.signal);
-    return withContractCarrierSession({ cwd: input.cwd, contractId: input.contractId, mode: "observe-only", signal: input.signal }, async (session) => {
-        const scratchName = renewScratchName(input.contractId);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
         let scratch;
         try {
             scratch = await readDetachedRenewScratch({ cwd: input.cwd, scratchName });
@@ -281,17 +265,37 @@ export async function abortRenewContract(input) {
         catch (error) {
             throw new FlowError("RENEW_SCRATCH_NOT_FOUND", `no renew conflict scratch is open for ${input.contractId}`, { cause: error });
         }
+        const result = await executeRenew(input, { scratch, resolution: input.resolution ?? { kind: "scratch-files" } });
+        const code = result.family === "refused-before-effects" ? result.failedInvariant.code : null;
+        if (attempt === 0 && (code === "LIFECYCLE_COORDINATES_CHANGED"
+            || code === "LIFECYCLE_REPLAY_COORDINATES_CHANGED"
+            || code === "RENEW_COORDINATES_CHANGED"
+            || code === "CONCURRENT_MODIFICATION"))
+            continue;
+        if (isCompleteLifecycleOutcome(result)) {
+            await abortDetachedRenewChain({ cwd: input.cwd, scratchName: scratch.scratchName });
+        }
+        return result;
+    }
+    throw new FlowError("INTERNAL_STATE", "bounded renew continuation retry exhausted unexpectedly");
+}
+export async function abortRenewContract(input) {
+    checkCancellation(input.signal);
+    return withContractCarrierSession({ cwd: input.cwd, contractId: input.contractId, mode: "observe-only", signal: input.signal }, async (session) => {
+        const scratchName = renewScratchName(input.contractId);
         checkCancellation(input.signal);
         const cleanup = await abortDetachedRenewChain({ cwd: input.cwd, scratchName });
+        if (cleanup.status === "absent") {
+            throw new FlowError("RENEW_SCRATCH_NOT_FOUND", `no renew conflict scratch is open for ${input.contractId}`);
+        }
         return {
             ...derivedCleanupFacts({
                 contractId: input.contractId,
-                authoritativeHead: session.lifecycle.observedLedgerHead,
+                authoritativeHead: session.pins.repositoryLedgerHead,
                 effect: "renew-conflict-scratch-cleanup",
-                receipt: { status: cleanup.status, scratchName, oldHead: scratch.oldHead },
+                receipt: { status: cleanup.status, scratchName },
             }),
             contractId: input.contractId,
-            oldHead: scratch.oldHead,
             scratchName,
             carrier: session.initialCarrier,
         };

package/build/core/repository-ledger/accepted-fold-read.js

@@ -1,15 +1,18 @@
 import { resolveLocalBranchHead } from "../../git/refs.js";
 import { foldRepositoryLedger } from "./fold-repository.js";
 import { REPOSITORY_LEDGER_REF } from "./codec.js";
+import { repositoryLedgerHead } from "./identity.js";
 import { traverseRepositoryLedger } from "./traversal.js";
 export async function observeRepositoryLedgerHead(cwd) {
-    return (await resolveLocalBranchHead(cwd, REPOSITORY_LEDGER_REF))?.head ?? null;
+    const head = (await resolveLocalBranchHead(cwd, REPOSITORY_LEDGER_REF))?.head;
+    return head === undefined ? null : repositoryLedgerHead(head);
 }
 /** The shared current-head typed traversal and fold used by full and targeted reads. */
 export async function readAcceptedRepositoryFold(cwd, options = {}) {
-    const observedLedgerHead = await (options.observeHead ?? observeRepositoryLedgerHead)(cwd);
-    if (observedLedgerHead === null)
+    const observed = await (options.observeHead ?? observeRepositoryLedgerHead)(cwd);
+    if (observed === null)
         return { observedLedgerHead: null, traversed: null, folded: null };
+    const observedLedgerHead = repositoryLedgerHead(observed);
     const traversed = await traverseRepositoryLedger(cwd, observedLedgerHead, options.signal, { historicalSemanticEvidence: false });
     return {
         observedLedgerHead,

package/build/core/repository-ledger/codec.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { verificationDeclarationSchema } from "../verification-declaration.js";
 export const REPOSITORY_LEDGER_REF = "refs/heads/keiyaku-ledger";
 export const REPOSITORY_DELIVERY_REF_PREFIX = "refs/heads/keiyaku/";
 export function repositoryDeliveryRef(contract) {
@@ -61,7 +62,7 @@ function buildLifecycleEntrySchema(format) {
         design: nonblank,
         scope: z.array(nonblank).min(1),
         criteria: z.array(nonblank),
-        verification: z.array(nonblank),
+        verification: z.array(verificationDeclarationSchema),
         extensions: z.array(extension),
         base: oid,
         target: fullBranchRefSchema,
@@ -103,7 +104,7 @@ function buildLifecycleEntrySchema(format) {
         }
     });
     return z.discriminatedUnion("kind", [
-        lifecycleEnvelope("bind", 2, bindData),
+        lifecycleEnvelope("bind", 3, bindData),
         lifecycleEnvelope("bootstrap", 1, bootstrapData),
         lifecycleEnvelope("arc", 1, z.object({
             arc: safePositiveInteger,
@@ -124,10 +125,15 @@ function buildLifecycleEntrySchema(format) {
             }).strict(),
             scopeAudit: z.object({ violations: z.array(nonblank) }).strict(),
         }).strict()),
-        lifecycleEnvelope("amend", 1, z.object({
-            amendment: nonblank,
+        lifecycleEnvelope("amend", 2, z.object({
+            amendment: z.string(),
             scopeDelta: z.object({ add: z.array(nonblank).min(1) }).strict().optional(),
-        }).strict()),
+            verificationDelta: z.object({ replace: z.array(verificationDeclarationSchema) }).strict().optional(),
+        }).strict().superRefine((value, context) => {
+            if (!value.amendment.trim() && !value.scopeDelta && !value.verificationDelta) {
+                context.addIssue({ code: "custom", message: "amend requires prose, a scope delta, or a verification delta" });
+            }
+        })),
         lifecycleEnvelope("renew", 1, z.object({
             oldBase: oid,
             newBase: oid,

package/build/core/repository-ledger/current-state-store.js

@@ -3,10 +3,11 @@ import * as path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { DatabaseSync } from "node:sqlite";
 import { runGitProcess } from "../../git/core.js";
-import { acquireSqliteProcessLifetimeLock } from "../sqlite-process-lifetime-lock.js";
+import { acquireSqliteProcessLifetimeLock } from "../run-control/sqlite-process-lifetime-lock.js";
 import { applyFoldEntry } from "./fold.js";
 import { createLifecycleEntrySchema, evidenceObjectId, repositoryDeliveryRef } from "./codec.js";
-export const REPOSITORY_CURRENT_STATE_VERSION = 3;
+import { repositoryLedgerHead } from "./identity.js";
+export const REPOSITORY_CURRENT_STATE_VERSION = 4;
 export const REPOSITORY_CURRENT_STATE_PREFIX = "keiyaku-current-state-";
 export const REPOSITORY_CURRENT_STATE_SUFFIX = ".sqlite";
 const SNAPSHOT_READER_BUSY_MS = 5_000;
@@ -67,7 +68,7 @@ function exactRows(database, sql, ...params) {
     return database.prepare(sql).all(...params);
 }
 function pinDigest(pin) {
-    return digest(["keiyaku-current-state-v3", REPOSITORY_CURRENT_STATE_VERSION, pin.head, pin.objectFormat, pin.emptyTree]);
+    return digest(["keiyaku-current-state-v4", REPOSITORY_CURRENT_STATE_VERSION, pin.head, pin.objectFormat, pin.emptyTree]);
 }
 function repositoryDigest(database) {
     return digest(["repository", exactRows(database, "SELECT singleton, diagnostics_json FROM snapshot_repository ORDER BY singleton")]);
@@ -335,8 +336,8 @@ function parseCurrent(text, contract) {
     const value = JSON.parse(text);
     if (!isRecord(value))
         throw new Error("snapshot current facts are not an object");
-    assertClosedKeys(value, ["observedLedgerHead", "contract", "phase", "intent", "receiptSegments", "seal", "bootstrapReplay", "petition", "verdict", "pins", "effectiveScope", "causal", "resources"], "snapshot current facts");
-    if (value.contract !== contract || typeof value.observedLedgerHead !== "string" || !isRecord(value.resources)) {
+    assertClosedKeys(value, ["contractHead", "contract", "phase", "intent", "receiptSegments", "seal", "bootstrapReplay", "petition", "verdict", "pins", "effectiveScope", "causal", "resources"], "snapshot current facts");
+    if (value.contract !== contract || typeof value.contractHead !== "string" || !isRecord(value.resources)) {
         throw new Error("snapshot current facts disagree with their row key");
     }
     return value;
@@ -387,11 +388,8 @@ function validateContractConsistency(database, input, pin, summaryOnly = false)
     const diagnostics = parseDiagnostics(diagnosticRow.diagnosticsJson, input.contract);
     if ((input.status === "healthy") !== (diagnostics.length === 0))
         throw new Error("snapshot status disagrees with diagnostics");
-    if (summaryOnly) {
-        if (model.observedLedgerHead !== pin.head)
-            throw new Error("snapshot current summary disagrees with pin");
+    if (summaryOnly)
         return model;
-    }
     const fold = JSON.parse(input.foldJson);
     if (!isRecord(fold) || fold.contract !== input.contract || !Array.isArray(fold.entryObjectIds))
         throw new Error("snapshot fold is invalid");
@@ -399,7 +397,7 @@ function validateContractConsistency(database, input, pin, summaryOnly = false)
     if (fold.entryObjectIds.length !== objectIds.length || fold.entryObjectIds.some((oid, index) => oid !== objectIds[index])) {
         throw new Error("snapshot fold and lifecycle history disagree");
     }
-    if (model.observedLedgerHead !== pin.head || model.phase !== fold.phase || model.pins.base !== fold.bind?.data?.base) {
+    if (model.contractHead !== objectIds.at(-1) || model.phase !== fold.phase || model.pins.base !== fold.bind?.data?.base) {
         throw new Error("snapshot current facts disagree with fold or pin");
     }
     const typedFold = fold;
@@ -472,8 +470,8 @@ function storedContract(database, contract) {
         diagnostics: parseDiagnostics(row.diagnosticsJson, contract),
     };
 }
-function atPin(model, head) {
-    return model.observedLedgerHead === head ? model : { ...model, observedLedgerHead: head };
+function atPin(model, _head) {
+    return model;
 }
 export async function readPinnedCurrentContract(cwd, observedHead, contract, signal) {
     const databasePath = await repositoryCurrentStateSnapshotPath(cwd, observedHead, signal);
@@ -633,7 +631,7 @@ export async function readPinnedRepositoryLifecycle(cwd, observedHead, signal, o
         validatePinReceipt(database, pin);
         validateRepositoryReceipts(database, rows.map((row) => row.contract), options.summaryOnly === true, options.includeTopology !== false);
         return {
-            observedLedgerHead: pin.head,
+            observedLedgerHead: pin.head === null ? null : repositoryLedgerHead(pin.head),
             objectFormat: pin.objectFormat,
             emptyTree: pin.emptyTree,
             contracts: rows.flatMap((row) => {
@@ -855,14 +853,14 @@ export async function advanceRepositoryCurrentState(cwd, pinnedHead, observedHea
                                 const prerequisite = database.prepare("SELECT status, fold_json AS foldJson FROM snapshot_contracts WHERE contract = ?").get(dependency);
                                 if (!prerequisite || prerequisite.status !== "healthy" || prerequisite.foldJson === null)
                                     return true;
-                                return parseJson(prerequisite.foldJson).terminalObjectId === null;
+                                return false;
                             });
                             if (unavailable.length > 0) {
                                 const diagnostic = {
                                     objectId: first.objectId,
                                     code: "causal-prerequisite",
                                     contract,
-                                    detail: `after prerequisites are not admitted terminal contracts: ${unavailable.join(", ")}`,
+                                    detail: `after prerequisites are not admitted healthy contracts: ${unavailable.join(", ")}`,
                                 };
                                 database.prepare(`
                 INSERT INTO snapshot_contracts(contract, status, current_json, fold_json, diagnostics_json)
@@ -944,7 +942,6 @@ export async function advanceRepositoryCurrentState(cwd, pinnedHead, observedHea
                 database.exec("ROLLBACK");
                 return false;
             }
-            database.prepare("UPDATE snapshot_contracts SET current_json = json_set(current_json, '$.observedLedgerHead', ?) WHERE current_json IS NOT NULL").run(observedHead);
             database.prepare("UPDATE snapshot_pin SET ledger_head = ? WHERE singleton = 1").run(observedHead);
             writeIntegrityReceipts(database);
             database.exec("COMMIT");

package/build/core/repository-ledger/fold-repository.js

@@ -216,15 +216,14 @@ function validateAfterPrerequisites(ledger, contracts, isolatedContracts, diseas
             const bindTransaction = containingTransactions.get(bindObjectId);
             const ready = state.bind.data.after.every((dependency) => {
                 const prerequisite = contracts.get(dependency);
-                const terminalTransaction = prerequisite?.terminalObjectId === null
+                const prerequisiteBindTransaction = prerequisite === undefined
                     ? undefined
-                    : containingTransactions.get(prerequisite?.terminalObjectId ?? "");
+                    : containingTransactions.get(prerequisite.entryObjectIds[0]);
                 return prerequisite !== undefined &&
                     valid.has(dependency) &&
-                    prerequisite.terminalObjectId !== null &&
-                    terminalTransaction !== undefined &&
+                    prerequisiteBindTransaction !== undefined &&
                     bindTransaction !== undefined &&
-                    isTypedLedgerAncestor(ledger, terminalTransaction, bindTransaction);
+                    isTypedLedgerAncestor(ledger, prerequisiteBindTransaction, bindTransaction);
             });
             if (ready) {
                 valid.add(contract);
@@ -240,7 +239,7 @@ function validateAfterPrerequisites(ledger, contracts, isolatedContracts, diseas
             objectId: bindObjectId,
             code: "causal-prerequisite",
             contract,
-            detail: `after prerequisites were not terminal in typed ancestry: ${state.bind.data.after.join(", ")}`,
+            detail: `after prerequisite binds were not in typed ancestry: ${state.bind.data.after.join(", ")}`,
         });
         contracts.delete(contract);
         isolatedContracts.add(contract);

package/build/core/repository-ledger/identity.js

@@ -0,0 +1,60 @@
+export function repositoryLedgerHead(value) {
+    return value;
+}
+export function lifecycleTransactionId(value) {
+    return value;
+}
+export function contractHead(value) {
+    return value;
+}
+export function carrierDigest(value) {
+    if (!/^[0-9a-f]{64}$/.test(value)) {
+        throw new Error("carrier digest must be a lowercase SHA-256 hex value");
+    }
+    return value;
+}
+export function carrierInputIdentity(input) {
+    return {
+        surface: "carrier",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+        bodyDigest: input.bodyDigest,
+    };
+}
+export function carrierRetirementInputIdentity(input) {
+    return { surface: "carrier-retirement", ...input };
+}
+export function worktreeInputIdentity(input) {
+    return {
+        surface: "worktree",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+        deliveryHead: input.deliveryHead,
+    };
+}
+export function contractViewInputIdentity(input) {
+    return {
+        surface: "contract-view",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+    };
+}
+export function narrowIgnoreInputIdentity(input) {
+    return { surface: "narrow-ignore", ...input };
+}
+export function renewDeliveryInputIdentity(input) {
+    return { surface: "renew-delivery", ...input };
+}
+export function taskBoardInputIdentity(input) {
+    return { surface: "task-board", ...input };
+}
+export function deliveryRefInputIdentity(input) {
+    return { surface: "delivery-ref", ...input };
+}
+export function targetWorktreeInputIdentity(input) {
+    return { surface: "target-worktree", ...input };
+}
+/** Structural equality keeps surface comparisons independent of process-local receipts. */
+export function sameInputIdentity(left, right) {
+    return left !== null && JSON.stringify(left) === JSON.stringify(right);
+}

package/build/core/repository-ledger/inventory.js

@@ -295,12 +295,12 @@ export function activeWorkspaceHereContracts(read) {
 }
 /** Runtime ignore projection for one worktree from a single typed repository fold. */
 export function inventoryIgnorePatternsForWorktree(read, targetLifecycle) {
-    if (read.observedLedgerHead !== targetLifecycle.observedLedgerHead) {
-        throw new Error("narrow-ignore inventory requires one repository-ledger observation");
-    }
     const acceptedTarget = read.contracts.find(({ contract }) => contract === targetLifecycle.contract);
     if (!acceptedTarget)
         throw new Error(`contract ${targetLifecycle.contract} is absent from narrow-ignore inventory`);
+    if (acceptedTarget.contractHead !== targetLifecycle.contractHead) {
+        throw new Error("narrow-ignore inventory requires the current contract semantic head");
+    }
     const target = foldedWorktreeCoordinate(acceptedTarget);
     const required = target.workspace === "here"
         ? activeWorkspaceHereContracts(read).length > 0

package/build/core/repository-ledger/read-model.js

@@ -1,9 +1,11 @@
 import { openTaskAdmissionEvidenceReader, readTaskAdmissionEvidenceAtCommit, } from "../task/settlement-git.js";
 import { repositoryDeliveryRef, } from "./codec.js";
+import { bindEffectiveScope } from "./fold.js";
 import { observeRepositoryLedgerHead, readAcceptedRepositoryFold } from "./accepted-fold-read.js";
 import { advanceRepositoryCurrentState, publishRepositoryCurrentState, readPinnedCurrentContract, readPinnedRepositoryLifecycle, readRepositoryCurrentStateNodeIds, readRepositoryCurrentStatePin, readRepositoryCurrentStatePredecessor } from "./current-state-store.js";
 import { IncrementalLedgerValidationError, readIncrementalRepositorySegment } from "./incremental-read.js";
 import { RepositoryObjectError } from "./git-object-store.js";
+import { contractHead, repositoryLedgerHead } from "./identity.js";
 /** Public lifecycle state derived only from the accepted repository-ledger fold. */
 export function currentLifecycleState(model) {
     switch (model.phase) {
@@ -22,6 +24,50 @@ export function currentLifecycleState(model) {
             return { state: "forfeited" };
     }
 }
+/** Purely advance an admitted repository snapshot with its just-committed bind. */
+export function advanceRepositorySnapshotWithBind(input) {
+    const { repository, ledgerHead, entryObjectId, entry } = input;
+    const bootstrap = entry.data.workspace === "worktree" ? entry.data.bootstrap : undefined;
+    const model = deepFreeze({
+        contractHead: contractHead(entryObjectId),
+        contract: entry.contract,
+        phase: "active",
+        intent: { arc: 0, openedBy: entry.actor, title: entry.data.title, objective: entry.data.objective, brief: null },
+        receiptSegments: [],
+        seal: null,
+        bootstrapReplay: bootstrap
+            ? { state: "pending", plan: { command: [...bootstrap.command], timeoutMs: bootstrap.timeoutMs } }
+            : { state: "not-planned" },
+        petition: { state: "none" },
+        verdict: null,
+        pins: { base: entry.data.base, delivery: entry.data.base, target: { ref: entry.data.target, approvedHead: null } },
+        effectiveScope: bindEffectiveScope(entry),
+        causal: { after: [...(entry.data.after ?? [])], needs: null },
+        resources: {
+            deliveryRef: repositoryDeliveryRef(entry.contract),
+            worktree: entry.data.workspace === "worktree" ? { place: entry.data.place, state: "held" } : null,
+            tasks: [...(entry.data.taskIds ?? [])].map((taskId) => ({ taskId, state: "held" })),
+        },
+        history: [{ objectId: entryObjectId, entry: structuredClone(entry) }],
+    });
+    return deepFreeze({
+        ...structuredClone(repository),
+        observedLedgerHead: ledgerHead,
+        contracts: [...repository.contracts, model].sort((left, right) => left.contract.localeCompare(right.contract)),
+        topology: {
+            head: ledgerHead,
+            nodes: [...repository.topology.nodes, {
+                    objectId: ledgerHead,
+                    type: "transaction",
+                    ledgerParents: repository.observedLedgerHead ? [repository.observedLedgerHead] : [],
+                    verb: "bind",
+                    contract: entry.contract,
+                    entryObjectIds: [entryObjectId],
+                    finalEntryObjectId: entryObjectId,
+                }],
+        },
+    });
+}
 function deepFreeze(value) {
     if (value === null || typeof value !== "object" || Object.isFrozen(value))
         return value;
@@ -199,14 +245,14 @@ function bootstrapReplay(state) {
     }
     throw new Error(`failed bootstrap for ${state.contract} has no folded replay disposition`);
 }
-function lifecycleModel(observedLedgerHead, state, nodes, taskAdmissionEvidence) {
+function lifecycleModel(_observedLedgerHead, state, nodes, taskAdmissionEvidence) {
     const history = acceptedHistory(state, nodes);
     const verdict = findLastRow(history, "verdict");
     const released = state.terminalObjectId !== null;
     const taskReleased = state.terminal?.kind === "forfeit";
     const selectedTasks = [...(state.bind.data.taskIds ?? [])];
     return deepFreeze({
-        observedLedgerHead,
+        contractHead: contractHead(state.entryObjectIds.at(-1)),
         contract: state.contract,
         phase: state.phase,
         intent: currentIntent(state, history),
@@ -359,7 +405,9 @@ async function recoverRepositoryLifecycle(cwd, options = {}) {
     });
 }
 export async function readRepositoryLifecycle(cwd, options = {}) {
-    const observe = options.observeHead ?? observeRepositoryLedgerHead;
+    const observe = options.observedHead !== undefined
+        ? async () => options.observedHead
+        : options.observeHead ?? observeRepositoryLedgerHead;
     const observedHead = await observe(cwd);
     const injected = options.observeHead !== undefined || options.readTaskAdmissionEvidence !== undefined;
     if (!injected) {
@@ -374,8 +422,8 @@ export async function readRepositoryLifecycle(cwd, options = {}) {
                 const segment = await readIncrementalRepositorySegment(cwd, priorHead, observedHead, options.signal, acceptedObjectIds ?? undefined);
                 if (segment && await advanceRepositoryCurrentState(cwd, priorHead, observedHead, segment, {
                     signal: options.signal,
-                    confirmHead: () => observeRepositoryLedgerHead(cwd),
-                    materialize: (state, history) => materializeIncrementalContract(cwd, observedHead, state, history),
+                    confirmHead: options.observedHead !== undefined ? async () => observedHead : () => observeRepositoryLedgerHead(cwd),
+                    materialize: (state, history) => materializeIncrementalContract(cwd, repositoryLedgerHead(observedHead), state, history),
                 })) {
                     const advanced = await readPinnedRepositoryLifecycle(cwd, observedHead, options.signal, { includeTopology: options.includeTopology });
                     if (advanced)
@@ -404,7 +452,7 @@ export async function readRepositoryLifecycle(cwd, options = {}) {
     if (!injected) {
         const published = await publishRepositoryCurrentState(cwd, recovered, {
             signal: options.signal,
-            confirmHead: () => observeRepositoryLedgerHead(cwd),
+            confirmHead: options.observedHead !== undefined ? async () => observedHead : () => observeRepositoryLedgerHead(cwd),
             fold: recoveredFold,
         });
         if (!published)

package/build/core/repository-ledger/write-transaction.js

@@ -1,7 +1,7 @@
 import { runGitProcess } from "../../git/core.js";
 import { commitRefTransaction, } from "../../git/refs.js";
 import { REPOSITORY_LEDGER_REF, evidenceObjectId, formatLifecycleEntry, formatLifecycleTransaction, repositoryDeliveryRef, } from "./codec.js";
-import { assertHostObjectId, assertReadableCommit, deriveHostGitCoordinates, } from "./git-object-store.js";
+import { assertHostObjectId, assertReadableCommit, assertReadableCommitClosure, deriveHostGitCoordinates, } from "./git-object-store.js";
 import { assertHonestClaimEvidence } from "./claim-evidence.js";
 import { transactionMembershipError } from "./transaction-membership.js";
 function replayFailure(effect, error) {
@@ -76,7 +76,7 @@ async function assertAuthoritativeCommitTipClosure(cwd, coordinates, operations)
         if (operation.kind !== "update" || operation.ref === REPOSITORY_LEDGER_REF || checked.has(operation.newOid))
             continue;
         assertHostObjectId(coordinates, operation.newOid);
-        await assertReadableCommit(cwd, coordinates, operation.newOid);
+        await assertReadableCommitClosure(cwd, operation.newOid);
         checked.add(operation.newOid);
     }
 }
@@ -248,6 +248,7 @@ async function publishLifecycleWrite(cwd, builtTransaction, final, ownedOperatio
         completion: replay.status,
         ledgerHead: builtTransaction.objectId,
         entry: final.entry,
+        entryObjectId: final.objectId,
         authoritativeOperations,
         authorityProof: transaction.proof,
         authorityObservations: transaction.observations,
@@ -280,6 +281,9 @@ export async function publishBindTransaction(input) {
         { kind: "update", ref: input.delivery.ref, newOid: input.delivery.head, expectedOldOid: null },
     ];
     if (input.taskBoard) {
+        if (input.taskBoard.ref !== input.entry.data.target) {
+            throw new Error("task-selected bind task-board ref must equal the entry target");
+        }
         operations.push({
             kind: "update",
             ref: input.taskBoard.ref,
@@ -313,11 +317,12 @@ export async function publishAuthoritativeTransaction(cwd, transaction, options
     const entry = final.entry;
     const operations = [];
     if (transaction.verb === "renew" && entry.kind === "renew") {
-        assertAuthority("delivery" in transaction, "renew transaction must pin its delivery ref");
+        assertAuthority("delivery" in transaction && "target" in transaction, "renew transaction must pin its target and delivery refs");
+        assertAuthority(transaction.target.expectedOid === entry.data.newBase, "renew target CAS must equal newBase");
         assertAuthority(transaction.delivery.ref === repositoryDeliveryRef(entry.contract), "renew delivery ref does not name its contract");
         assertAuthority(transaction.delivery.expectedOid === entry.data.oldHead, "renew delivery CAS must equal oldHead");
         assertAuthority(entry.data.oldHead !== entry.data.newHead, "renew must replace the delivery head");
-        operations.push({ kind: "update", ref: transaction.delivery.ref, expectedOldOid: transaction.delivery.expectedOid, newOid: entry.data.newHead });
+        operations.push({ kind: "verify", ref: transaction.target.ref, expectedOldOid: transaction.target.expectedOid }, { kind: "update", ref: transaction.delivery.ref, expectedOldOid: transaction.delivery.expectedOid, newOid: entry.data.newHead });
     }
     else if (transaction.verb === "forfeit") {
         assertAuthority(entry.kind === "forfeit", "forfeit transaction must end in a forfeit entry");

package/build/core/run-control/connection-bound-close.js

@@ -0,0 +1,41 @@
+export function beginConnectionBoundRunnerClose(database, lease) {
+    database.exec("BEGIN IMMEDIATE");
+    let open = true;
+    let leaseOwnership = "retained";
+    const rollback = () => {
+        open = false;
+        database.exec("ROLLBACK");
+    };
+    return {
+        get leaseOwnership() { return leaseOwnership; },
+        commit() {
+            if (!open)
+                throw new Error("connection-bound runner close is not open");
+            try {
+                lease.close();
+            }
+            catch (error) {
+                leaseOwnership = "unknown";
+                rollback();
+                throw error;
+            }
+            leaseOwnership = "consumed";
+            try {
+                database.exec("COMMIT");
+                open = false;
+            }
+            catch (error) {
+                rollback();
+                throw error;
+            }
+        },
+        rollback() {
+            if (leaseOwnership !== "retained") {
+                throw new Error(`connection-bound runner lease ownership is ${leaseOwnership}`);
+            }
+            if (!open)
+                throw new Error("connection-bound runner close is no longer open");
+            rollback();
+        },
+    };
+}