@bitkyc08/opencodex 2.18.2 → 2.20.0

package/src/images/loop.ts

@@ -247,6 +247,8 @@ export interface ImageBridgeDeps {
   stallTimeoutSec?: number;
   /** Provider-specific fetch (e.g. xAI transport wrapper). Falls back to global fetch. */
   fetchImpl?: typeof globalThis.fetch;
+  /** Reserve the routed provider's next request-start slot before each adapter dispatch. */
+  waitForRequestSlot?: (signal?: AbortSignal) => Promise<void>;
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
   /**
@@ -380,6 +382,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
     // expose buildRequest/fetchResponse/parseStream to the bridge, so collect their events through
     // an AdapterEventQueue and wrap them in a pseudo-response whose parseStream replays them.
     if (adapter.runTurn) {
+      await deps.waitForRequestSlot?.(signal);
       const queue = createAdapterEventQueue({
         onBacklogExceeded: () => internalAbort.abort("runTurn backlog exceeded"),
       });
@@ -457,6 +460,11 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
     }
 
     let headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    const paceThenResetHeaderDeadline = async (): Promise<void> => {
+      headerDeadline.clear();
+      await deps.waitForRequestSlot?.(signal);
+      headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    };
     try {
       /**
        * Build and fetch one image-bridge iteration on the given adapter, under the iteration
@@ -487,6 +495,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
+            await paceThenResetHeaderDeadline();
             deps.onAttemptSend?.(recovery);
             response = await requestAdapter.fetchResponse(request, {
               abortSignal: headerDeadline.signal,
@@ -496,7 +505,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             });
           } else {
             response = await fetchWithResetRetry(
-              (retryRecovery) => {
+              async (retryRecovery) => {
+                await paceThenResetHeaderDeadline();
                 // Record every helper-driven send (the callback runs for the first attempt and
                 // each connection-reset replay); preserve the caller's recovery kind
                 // (rate-limit-429 / key-429) when the retry layer supplies none.

package/src/integrations/registry.ts

@@ -20,6 +20,8 @@ import {
   hermesHomeDir,
   kimiConfigPath,
   kimiHomeDir,
+  mcodeConfigPath,
+  mcodeHomeDir,
   ompAgentDir,
   ompModelsConfigPath,
   opencodeGlobalConfigPath,
@@ -112,6 +114,11 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
     sourcePreservingYaml: { path: ["llm-pi-ai", "providers", "opencodex"] },
     writerLock: { suffix: ".lock" },
   },
+  mcode: {
+    id: "mcode",
+    configPath: (env = process.env, home = homedir()) => mcodeConfigPath(env, home),
+    detectDir: (env = process.env, home = homedir()) => mcodeHomeDir(env, home),
+  },
 };
 
 export const INTEGRATION_CLIENT_IDS: readonly IntegrationClientId[] =

package/src/lab/conformance/jcs.ts

@@ -1,5 +1,40 @@
 /** RFC 8785 JSON Canonicalization Scheme (JCS) for deterministic equality. */
 
+function assertValidUnicodeScalarString(value: string): void {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) {
+        throw new TypeError("jcsStringify: lone UTF-16 surrogate is not valid Unicode");
+      }
+      index += 1;
+      continue;
+    }
+    if (code >= 0xdc00 && code <= 0xdfff) {
+      throw new TypeError("jcsStringify: lone UTF-16 surrogate is not valid Unicode");
+    }
+  }
+}
+
+function stringifyJcsString(value: string): string {
+  assertValidUnicodeScalarString(value);
+  return JSON.stringify(value);
+}
+
+function assertDenseJsonArray(value: readonly unknown[]): void {
+  for (let index = 0; index < value.length; index += 1) {
+    if (!Object.prototype.hasOwnProperty.call(value, index)) {
+      throw new TypeError("jcsStringify: sparse arrays / array holes are not representable in JCS");
+    }
+  }
+  for (const key of Object.keys(value)) {
+    if (!/^(?:0|[1-9]\d*)$/.test(key) || Number(key) >= value.length) {
+      throw new TypeError("jcsStringify: arrays with extra enumerable properties are not representable in JCS");
+    }
+  }
+}
+
 export function jcsStringify(value: unknown): string {
   if (value === undefined) throw new TypeError("jcsStringify: undefined is not representable in JCS");
   if (value === null || typeof value === "boolean") return JSON.stringify(value);
@@ -7,14 +42,19 @@ export function jcsStringify(value: unknown): string {
     if (!Number.isFinite(value)) throw new TypeError("jcsStringify: non-finite numbers are not representable in JCS");
     return JSON.stringify(value);
   }
-  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "string") return stringifyJcsString(value);
   if (Array.isArray(value)) {
+    assertDenseJsonArray(value);
     return `[${value.map(jcsStringify).join(",")}]`;
   }
   if (typeof value === "object") {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError("jcsStringify: only plain JSON objects are representable in JCS");
+    }
     const obj = value as Record<string, unknown>;
     const keys = Object.keys(obj).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${jcsStringify(obj[k])}`).join(",")}}`;
+    return `{${keys.map((key) => `${stringifyJcsString(key)}:${jcsStringify(obj[key])}`).join(",")}}`;
   }
   throw new TypeError(`jcsStringify: unsupported value type ${typeof value}`);
 }

package/src/lab/conformance/negative-controls.ts

@@ -50,11 +50,15 @@ export const NEGATIVE_CONTROL_FIXTURES: Array<{
   },
   {
     id: "negative.tool-result-order",
-    defect: "invalid tool-result ordering",
+    defect: "invalid tool-result correlation after chat-history repair",
     mutate: (c) => ({
       ...c,
       id: "negative.tool-result-order",
-      assertions: [{ id: "result", operator: "tool_result_correlates", selector: "/upstream/requests", expected: { call: "/client/response/toolCalls/0/id", result: "/upstream/requests/1/json/messages/1/tool_call_id" }, required: true }],
+      // Chat history hardening closes the unmatched call with a synthetic result, then
+      // re-emits the orphan result behind a synthetic assistant call. Inspect the actual
+      // supplied result at the end of that repaired pair rather than the synthetic close,
+      // otherwise the negative control accidentally validates the repair and passes.
+      assertions: [{ id: "result", operator: "tool_result_correlates", selector: "/upstream/requests", expected: { call: "/client/response/toolCalls/0/id", result: "/upstream/requests/1/json/messages/3/tool_call_id" }, required: true }],
       fixture: {
         ...c.fixture,
         bytesUtf8: JSON.stringify({

package/src/lab/conformance/runner.ts

@@ -1,7 +1,7 @@
 import { discoverScenarios, loadCaseAuthority } from "./manifest";
 import { runScenario } from "./executor";
-import { buildNegativeControls } from "./negative-controls";
-import type { ScenarioRunResult } from "./types";
+import { baseCaseForNegativeControl, buildNegativeControls } from "./negative-controls";
+import type { CaseRecord, ScenarioRunResult } from "./types";
 import { CL01_SUITES } from "./types";
 
 export interface ConformanceRunSummary {
@@ -19,6 +19,8 @@ export interface NegativeControlRunSummary extends ConformanceRunSummary {
   rejected: number;
 }
 
+type ScenarioRunner = (caseRecord: CaseRecord) => Promise<ScenarioRunResult>;
+
 export async function runConformanceSuite(
   suites: readonly string[] = CL01_SUITES,
 ): Promise<ConformanceRunSummary> {
@@ -33,15 +35,24 @@ export async function runConformanceSuite(
   return { total: results.length, passed, failed: results.length - passed, results };
 }
 
-export async function runNegativeControls(): Promise<NegativeControlRunSummary> {
+export async function runNegativeControls(
+  execute: ScenarioRunner = runScenario,
+): Promise<NegativeControlRunSummary> {
   const authority = loadCaseAuthority();
   const scenarios = buildNegativeControls(discoverScenarios(authority));
   if (scenarios.length === 0) throw new Error("harness_failure: no negative controls discovered");
   const results: ScenarioRunResult[] = [];
   for (const scenario of scenarios) {
-    results.push(await runScenario(scenario));
+    const baseCase = baseCaseForNegativeControl(scenario.id, authority.cases);
+    const executionScenario = baseCase ? { ...scenario, id: baseCase.id } : scenario;
+    const result = await execute(executionScenario);
+    results.push({ ...result, scenarioId: scenario.id });
   }
-  const rejected = results.filter((r) => !r.passed).length;
+  const rejected = results.filter((r) => (
+    !r.passed
+    && r.classification === "protocol_failure"
+    && r.secondaryCode === "deterministic_assertion"
+  )).length;
   return {
     total: results.length,
     passed: rejected,

package/src/lab/fabric/observe.ts

@@ -8,11 +8,11 @@ import {
   OUTCOMES,
 } from "../constants";
 import { FAILURE_CLASSIFICATIONS } from "../conformance/types";
-import { fixtureDigest, isSha256Hex, jcsStringify } from "../digest";
+import { fixtureDigest, isSha256Hex, jcsStringify, subjectIdForSubject } from "../digest";
 import type { ObservationEvent, RouteSubjectV1, TaskSubjectV1 } from "../events/types";
 import { LabValidationError } from "../events/errors";
 import { assignEventId, validateSubject } from "../events/validate";
-import { appendLabEventIfAbsent } from "../ledger/store";
+import { withLedgerMutation } from "../ledger/store";
 import { ensureLabDirs } from "../paths";
 import {
   FABRIC_EVIDENCE_LAYER,
@@ -172,6 +172,11 @@ function validateFabricVerifier(raw: Record<string, unknown>): void {
 
 /** Validate non-negative usage counters on a producer outcome. */
 function validateFabricUsage(raw: Record<string, unknown>): void {
+  for (const key of Object.keys(raw)) {
+    if (!(USAGE_KEYS as readonly string[]).includes(key)) {
+      throw new FabricTaskError(`unknown usage field ${key}`, "malformed_producer_outcome", "harness");
+    }
+  }
   for (const key of USAGE_KEYS) {
     assertNonNegativeIntegerField(raw, key);
   }
@@ -179,6 +184,11 @@ function validateFabricUsage(raw: Record<string, unknown>): void {
 
 /** Validate non-negative limit fields on a producer outcome. */
 function validateFabricLimits(raw: Record<string, unknown>): void {
+  for (const key of Object.keys(raw)) {
+    if (!(LIMIT_KEYS as readonly string[]).includes(key)) {
+      throw new FabricTaskError(`unknown limit field ${key}`, "malformed_producer_outcome", "harness");
+    }
+  }
   for (const key of LIMIT_KEYS) {
     assertNonNegativeIntegerField(raw, key);
   }
@@ -262,12 +272,18 @@ export function assertFabricOutcomeV1(raw: unknown): FabricTaskOutcomeV1 {
   } catch (error) {
     wrapValidationError(error);
   }
+  if (jcsStringify(taskSubjectObj) !== jcsStringify(taskSubject)) {
+    throw new FabricTaskError("taskSubject contains undeclared fields", "malformed_producer_outcome", "harness");
+  }
+  if (jcsStringify(routeSubjectObj) !== jcsStringify(routeSubject)) {
+    throw new FabricTaskError("routeSubject contains undeclared fields", "malformed_producer_outcome", "harness");
+  }
   if (!routeSubjectsMatch(routeSubject, taskSubject.routeSubject)) {
     throw new FabricTaskError("contradictory route subjects", "layer_subject_mismatch", "harness");
   }
 
-  assertStringField(obj, "taskClassId");
-  assertStringField(obj, "taskClassVersion");
+  const taskClassId = assertStringField(obj, "taskClassId");
+  const taskClassVersion = assertStringField(obj, "taskClassVersion");
   const subjectId = assertStringField(obj, "subjectId");
   if (!isSha256Hex(subjectId)) {
     throw new FabricTaskError("malformed producer outcome: subjectId", "malformed_producer_outcome", "harness");
@@ -277,16 +293,36 @@ export function assertFabricOutcomeV1(raw: unknown): FabricTaskOutcomeV1 {
   if (!isSha256Hex(taskFixtureDigest) || !isSha256Hex(verifierManifestDigest)) {
     throw new FabricTaskError("malformed producer outcome: digest field", "malformed_producer_outcome", "harness");
   }
-  assertStringField(obj, "fabricCompatibilityVersion");
+  const fabricCompatibilityVersion = assertStringField(obj, "fabricCompatibilityVersion");
   const sandboxProfileDigest = assertStringField(obj, "sandboxProfileDigest");
   if (!isSha256Hex(sandboxProfileDigest)) {
     throw new FabricTaskError("malformed producer outcome: sandboxProfileDigest", "malformed_producer_outcome", "harness");
   }
-  assertIntegerField(obj, "startedAt");
-  assertIntegerField(obj, "completedAt");
+  if (subjectId !== subjectIdForSubject(taskSubject)) {
+    throw new FabricTaskError("subjectId does not match taskSubject", "malformed_producer_outcome", "harness");
+  }
+  if (
+    taskClassId !== taskSubject.taskClassId
+    || taskClassVersion !== taskSubject.taskClassVersion
+    || taskFixtureDigest !== taskSubject.taskFixtureDigest
+    || verifierManifestDigest !== taskSubject.verifierManifestDigest
+    || fabricCompatibilityVersion !== taskSubject.fabricCompatibilityVersion
+    || sandboxProfileDigest !== taskSubject.sandboxProfileDigest
+  ) {
+    throw new FabricTaskError("task identity fields do not match taskSubject", "malformed_producer_outcome", "harness");
+  }
+  const startedAt = assertNonNegativeIntegerField(obj, "startedAt");
+  const completedAt = assertNonNegativeIntegerField(obj, "completedAt");
+  if (completedAt < startedAt) {
+    throw new FabricTaskError("invalid execution timestamps", "malformed_producer_outcome", "harness");
+  }
   validateFabricLimits(assertPlainObject(obj.limits, "limits"));
   validateFabricUsage(assertPlainObject(obj.usage, "usage"));
-  validateFabricVerifier(assertPlainObject(obj.verifier, "verifier"));
+  const verifier = assertPlainObject(obj.verifier, "verifier");
+  validateFabricVerifier(verifier);
+  if (verifier.manifestDigest !== verifierManifestDigest) {
+    throw new FabricTaskError("verifier manifest digest does not match outcome", "malformed_producer_outcome", "harness");
+  }
   if (!OUTCOMES.includes(obj.outcome as typeof OUTCOMES[number])) {
     throw new FabricTaskError("malformed producer outcome: outcome", "malformed_producer_outcome", "harness");
   }
@@ -324,9 +360,6 @@ export function observationFromFabricOutcome(
   if (routeSubject.subjectKind !== "route") {
     throw new FabricTaskError("nested route subject required", "layer_subject_mismatch", "harness");
   }
-  if (!Number.isInteger(outcome.startedAt) || !Number.isInteger(outcome.completedAt) || outcome.completedAt < outcome.startedAt) {
-    throw new FabricTaskError("invalid execution timestamps", "malformed_producer_outcome", "harness");
-  }
 
   const paths = ensureLabDirs(opts.configDir);
   const ownsStore = !opts.artifactStore;
@@ -430,9 +463,11 @@ function persistFabricOutcome(
   const ownsStore = !opts.artifactStore;
   const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
   try {
-    const { event } = observationFromFabricOutcome(outcome, { ...opts, artifactStore: store });
-    appendLabEventIfAbsent(paths.ledgerPath, event);
-    return { event, ledgerPath: paths.ledgerPath };
+    return withLedgerMutation(paths.ledgerPath, (ledger) => {
+      const { event } = observationFromFabricOutcome(outcome, { ...opts, artifactStore: store });
+      ledger.appendIfAbsent(event);
+      return { event, ledgerPath: paths.ledgerPath };
+    });
   } finally {
     if (ownsStore) store.close();
   }

package/src/lab/index.ts

@@ -36,3 +36,19 @@ export * from "./subject/installation-salt";
 export { CL03_LIVE_SUITES } from "./conformance/types";
 export * from "./query";
 export * from "./automation";
+export * from "./public/types";
+export {
+  exportLocalPublicEvidence,
+  importCommunityEvidenceFile,
+  importCommunityEvidenceValue,
+  listCommunityEvidenceContext,
+  previewLocalPublicEvidence,
+  summarizePublicEvidenceVerification,
+  verifyPublicEvidenceFile,
+  type LocalPublicExportV1,
+  type LocalPublicPreviewV1,
+  type PublicOperatorExclusionReason,
+  type PublicOperatorExclusionV1,
+  type PublicVerificationSummaryV1,
+} from "./public/operator";
+export { PublicEvidenceValidationError } from "./public/validate";

package/src/lab/ledger/purge.ts

@@ -18,10 +18,11 @@ import {
   expandSensitiveArtifactEventTargets,
 } from "./artifact-refs";
 import { buildInvalidationIndex } from "./invalidation";
-import { appendLabEvent, replayLabLedger } from "./store";
+import { withLedgerMutation } from "./store";
 import { ensureLabDirs } from "../paths";
 import { rebuildLabProjection } from "../projection/rebuild";
 import { jcsStringify } from "../digest";
+import { purgeLocalPublicEvidenceCopies } from "../public/purge";
 import {
   closeSync,
   existsSync,
@@ -34,7 +35,7 @@ import {
   writeSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-
+ 
 export class PurgeError extends Error {
   readonly code: string;
   readonly completedActions: string[];
@@ -45,7 +46,7 @@ export class PurgeError extends Error {
     this.completedActions = [...completedActions];
   }
 }
-
+ 
 export interface SensitivePurgeRequest {
   configDir?: string;
   targetEventIds?: string[];
@@ -54,7 +55,7 @@ export interface SensitivePurgeRequest {
   recordedAt?: number;
   producerVersion?: string;
 }
-
+ 
 function writeAll(fd: number, bytes: Uint8Array): void {
   let offset = 0;
   while (offset < bytes.byteLength) {
@@ -63,7 +64,7 @@ function writeAll(fd: number, bytes: Uint8Array): void {
     offset += n;
   }
 }
-
+ 
 function atomicRewriteLedger(ledgerPath: string, events: LabEvent[]): void {
   const body = events.map((e) => jcsStringify(e)).join("\n") + (events.length ? "\n" : "");
   const bytes = new TextEncoder().encode(body);
@@ -90,7 +91,7 @@ function atomicRewriteLedger(ledgerPath: string, events: LabEvent[]): void {
     }
     throw err;
   }
-
+ 
   if (process.platform !== "win32") {
     try {
       const dirFd = openSync(parent, "r");
@@ -100,8 +101,6 @@ function atomicRewriteLedger(ledgerPath: string, events: LabEvent[]): void {
         closeSync(dirFd);
       }
     } catch (err) {
-      // The rename is already committed and visible. Report durability failure
-      // without pretending the ledger action can be rolled back.
       throw new PurgeError(
         "ledger_durability_failed",
         `ledger rewrite committed but directory fsync failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -110,7 +109,7 @@ function atomicRewriteLedger(ledgerPath: string, events: LabEvent[]): void {
     }
   }
 }
-
+ 
 function deleteArtifactsFailClosed(dir: TrustedArtifactDir, digests: string[]): void {
   const errors: string[] = [];
   for (const digest of digests) {
@@ -125,7 +124,7 @@ function deleteArtifactsFailClosed(dir: TrustedArtifactDir, digests: string[]):
     throw new PurgeError("artifact_delete_failed", errors.join("; "));
   }
 }
-
+ 
 function purgeBoundedDirectory(dirPath: string): void {
   if (!existsSync(dirPath)) return;
   const entries = readdirSync(dirPath, { withFileTypes: true });
@@ -141,7 +140,41 @@ function purgeBoundedDirectory(dirPath: string): void {
     }
   }
 }
-
+ 
+function normalizePurgeError(err: unknown, completed: readonly string[]): PurgeError {
+  if (err instanceof PurgeError) {
+    return new PurgeError(
+      err.code,
+      err.message,
+      [...new Set([...completed, ...err.completedActions])],
+    );
+  }
+  return new PurgeError(
+    "purge_failed",
+    err instanceof Error ? err.message : String(err),
+    [...completed],
+  );
+}
+ 
+function buildPurgeTombstone(
+  req: SensitivePurgeRequest,
+  removeIds: ReadonlySet<string>,
+  targetArtifactDigests: string[],
+  purgeActions: Array<(typeof PURGE_ACTIONS)[number]>,
+): PurgeTombstoneEvent {
+  return validateLabEvent(assignEventId({
+    schemaVersion: LAB_EVENT_SCHEMA_VERSION,
+    eventKind: "purge_tombstone" as const,
+    recordedAt: req.recordedAt ?? Date.now(),
+    producer: LAB_PRODUCER,
+    producerVersion: req.producerVersion ?? LAB_PRODUCER_VERSION,
+    targetEventIds: [...removeIds].sort(),
+    targetArtifactDigests,
+    reason: "sensitive_evidence" as const,
+    purgeActions,
+  })) as PurgeTombstoneEvent;
+}
+ 
 /**
  * Exceptional sensitive-evidence purge:
  * physically remove targeted JSONL lines and artifacts, append purge_tombstone,
@@ -153,89 +186,125 @@ export function purgeSensitiveEvidence(req: SensitivePurgeRequest): PurgeTombsto
   const targetArtifactDigests = [...(req.targetArtifactDigests ?? [])].sort();
   const purgeActions = [...(req.purgeActions ?? PURGE_ACTIONS)].sort();
   const explicitSensitive = new Set(targetArtifactDigests);
-
-  const replay = replayLabLedger(paths.ledgerPath);
-  const index = buildInvalidationIndex(replay.events);
-  const removeIds = expandSensitiveArtifactEventTargets(
-    replay.events,
-    index,
-    new Set(targetEventIds),
-    explicitSensitive,
-  );
-
-  const tombstonePayload = {
-    schemaVersion: LAB_EVENT_SCHEMA_VERSION,
-    eventKind: "purge_tombstone" as const,
-    recordedAt: req.recordedAt ?? Date.now(),
-    producer: LAB_PRODUCER,
-    producerVersion: req.producerVersion ?? LAB_PRODUCER_VERSION,
-    targetEventIds: [...removeIds].sort(),
-    targetArtifactDigests,
-    reason: "sensitive_evidence" as const,
-    purgeActions,
-  };
-  const tombstone = validateLabEvent(assignEventId(tombstonePayload)) as PurgeTombstoneEvent;
-
-  const deletionPlan = purgeActions.includes("artifact")
-    ? artifactDeletionPlan(replay.events, index, removeIds, targetArtifactDigests)
-    : { deletable: [], retainedExplicit: [] };
-
-  if (deletionPlan.retainedExplicit.length > 0) {
-    throw new PurgeError(
-      "sensitive_bytes_retained",
-      `explicit sensitive artifacts remain required: ${deletionPlan.retainedExplicit.join(",")}`,
-    );
-  }
-
-  let dir: TrustedArtifactDir | null = null;
   const completed: string[] = [];
+  // Cell object: the mutation callback assigns through the property, which keeps
+  // the post-mutation read at the declared type (a closure-captured let would
+  // narrow to null and break the combined-error report below).
+  const deferredExport: { error: PurgeError | null } = { error: null };
+  let operationError: PurgeError | null = null;
+  let tombstone: PurgeTombstoneEvent | null = null;
+ 
   try {
-    if (purgeActions.includes("scratch")) {
-      purgeBoundedDirectory(paths.scratchDir);
-      completed.push("scratch");
-    }
-    if (purgeActions.includes("export")) {
-      purgeBoundedDirectory(paths.exportDir);
-      completed.push("export");
-    }
-
-    if (purgeActions.includes("artifact")) {
-      if (deletionPlan.deletable.length > 0) {
-        dir = openTrustedArtifactDir(paths.artifactsDir);
-        deleteArtifactsFailClosed(dir, deletionPlan.deletable);
+    tombstone = withLedgerMutation(paths.ledgerPath, (ledger) => {
+      // Replay and plan under the same lock as every append. Otherwise an event
+      // appended after this snapshot can be lost by the atomic rename or can
+      // start referencing an artifact after the deletion plan was calculated.
+      const replay = ledger.replay();
+      const index = buildInvalidationIndex(replay.events);
+      const removeIds = expandSensitiveArtifactEventTargets(
+        replay.events,
+        index,
+        new Set(targetEventIds),
+        explicitSensitive,
+      );
+ 
+      const deletionPlan = purgeActions.includes("artifact")
+        ? artifactDeletionPlan(replay.events, index, removeIds, targetArtifactDigests)
+        : { deletable: [], retainedExplicit: [] };
+ 
+      if (deletionPlan.retainedExplicit.length > 0) {
+        throw new PurgeError(
+          "sensitive_bytes_retained",
+          `explicit sensitive artifacts remain required: ${deletionPlan.retainedExplicit.join(",")}`,
+        );
       }
-      completed.push("artifact");
-    }
-
-    if (purgeActions.includes("ledger")) {
-      const kept: LabEvent[] = [];
-      for (const event of replay.events) {
-        if (removeIds.has(event.eventId)) continue;
-        kept.push(event);
+ 
+      if (purgeActions.includes("scratch")) {
+        purgeBoundedDirectory(paths.scratchDir);
+        completed.push("scratch");
       }
-      kept.push(tombstone);
-      atomicRewriteLedger(paths.ledgerPath, kept);
-    } else {
-      appendLabEvent(paths.ledgerPath, tombstone);
-    }
-    completed.push("ledger");
-
+      if (purgeActions.includes("export")) {
+        try {
+          purgeLocalPublicEvidenceCopies(req.configDir);
+          completed.push("export");
+        } catch (err) {
+          // Export deletion is independent from artifact/ledger/sqlite deletion. Keep
+          // deleting every other requested sensitive copy, then report this failure.
+          deferredExport.error = normalizePurgeError(err, completed);
+        }
+      }
+ 
+      let dir: TrustedArtifactDir | null = null;
+      try {
+        if (purgeActions.includes("artifact")) {
+          if (deletionPlan.deletable.length > 0) {
+            dir = openTrustedArtifactDir(paths.artifactsDir);
+            deleteArtifactsFailClosed(dir, deletionPlan.deletable);
+          }
+          completed.push("artifact");
+        }
+ 
+        // Never persist a tombstone claiming that export completed when the export
+        // purge failed. Other independent actions remain recordable and continue.
+        const tombstoneActions = deferredExport.error
+          ? purgeActions.filter((action) => action !== "export")
+          : purgeActions;
+        const hasTombstoneTarget = removeIds.size > 0
+          || targetArtifactDigests.length > 0
+          || tombstoneActions.includes("scratch")
+          || tombstoneActions.includes("export");
+ 
+        if (tombstoneActions.length > 0 && (hasTombstoneTarget || !deferredExport.error)) {
+          const mutationTombstone = buildPurgeTombstone(req, removeIds, targetArtifactDigests, tombstoneActions);
+          if (purgeActions.includes("ledger")) {
+            const kept: LabEvent[] = [];
+            for (const event of replay.events) {
+              if (removeIds.has(event.eventId)) continue;
+              kept.push(event);
+            }
+            kept.push(mutationTombstone);
+            atomicRewriteLedger(paths.ledgerPath, kept);
+            completed.push("ledger");
+          } else {
+            ledger.append(mutationTombstone);
+          }
+          return mutationTombstone;
+        }
+        return null;
+      } finally {
+        if (dir) closeTrustedArtifactDir(dir);
+      }
+    });
+ 
+    // SQLite is disposable and rebuildLabProjection replays the canonical
+    // ledger again, so it does not need to extend the mutation lock duration.
     if (purgeActions.includes("sqlite")) {
       rebuildLabProjection(req.configDir);
       completed.push("sqlite");
     }
-
-    return tombstone;
   } catch (err) {
-    if (err instanceof PurgeError) {
-      throw new PurgeError(err.code, err.message, [...completed, ...err.completedActions]);
-    }
+    operationError = normalizePurgeError(err, completed);
+  }
+ 
+  const deferredExportError = deferredExport.error;
+  if (operationError && deferredExportError) {
     throw new PurgeError(
       "purge_failed",
-      err instanceof Error ? err.message : String(err),
-      completed,
+      `export purge failed: ${deferredExportError.message}; subsequent purge failure (${operationError.code}): ${operationError.message}`,
+      [...new Set([...completed, ...deferredExportError.completedActions, ...operationError.completedActions])],
     );
-  } finally {
-    if (dir) closeTrustedArtifactDir(dir);
   }
+  if (operationError) throw operationError;
+  if (deferredExportError) {
+    throw new PurgeError(
+      deferredExportError.code,
+      deferredExportError.message,
+      [...new Set([...completed, ...deferredExportError.completedActions])],
+    );
+  }
+  if (!tombstone) {
+    throw new PurgeError("purge_failed", "purge completed without a durable tombstone", completed);
+  }
+  return tombstone;
 }
+