@cassiomc1/forgeloop 1.13.0 → 2.0.0-rc.2

package/src/core/events.js

@@ -1,6 +1,10 @@
+import { ledgerRelationMap, ledgerRelationSet } from "./ledger-relations.js";
+import { ledgerEventAt, ledgerEventsOfTypes } from "./ledger-event-collection.js";
+import { needsExistingProjectScope, withExistingProjectScope, isOperationalArtifactPath } from "../storage/existing-project-scope.js";
 
-import { appendFile, mkdir, open, readFile, stat } from "node:fs/promises";
-import path from "node:path";
+import { open, readFile, stat } from "node:fs/promises";
+import { closeSync, lstatSync, openSync, readSync } from "node:fs";
+import { createHash } from "node:crypto";
 
 import { assertSafePath, ensureWithin, fileExists } from "./filesystem.js";
 import { ARTIFACT_PATHS, canonicalFingerprint } from "./artifacts.js";
@@ -9,9 +13,19 @@ import { assertSchema, readSchema } from "./schema-validation.js";
 import { assertSecretFree } from "./receipt.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
 import { isRecoverableCompletionEvidenceCode } from "./completion-recovery.js";
+import {
+  CONTRACT_BOOTSTRAP_REPAIR_EVENT,
+  ROUTE_CHECKPOINT_BOUND_EVENT,
+  assertContractBootstrapRepairDetails,
+  assertContractBootstrapRepairMigrationDetails,
+  isLegacyContractBootstrapRepairMarkerShape,
+  validateContractBootstrapRepairMigrations,
+  repairMarkerErrors,
+} from "./contract-bootstrap-recovery.js";
 
 import { taskArtifactPath } from "./task-paths.js";
 import { getTaskTransaction, withTaskTransaction } from "./transaction.js";
+import { getOperationalStore } from "../storage/operational-context.js";
 
 import { assertDiagnosisDetails } from "./diagnosis-model.js";
 import {
@@ -33,6 +47,32 @@ import {
   isLegacyRecoveryEventShape,
   legacyRecoveryMigrationId,
 } from "./task-recovery-migration.js";
+import {
+  CHECKPOINT_REVALIDATED_EVENT,
+  assertCheckpointRevalidatedDetails,
+  validateCheckpointRevalidationCurrentBinding,
+  validateCheckpointRevalidationEventBindings,
+} from "./checkpoint-revalidation.js";
+import {
+  CONTRACT_REVISED_EVENT,
+  assertContractRevisedDetails,
+  validateContractRevisionCurrentBinding,
+  validateContractRevisionEventBindings,
+} from "./contract-revision.js";
+import {
+  GATE_SATISFIED_EVENT,
+  GATE_REVALIDATED_EVENT,
+  assertGateSatisfiedDetails,
+  assertGateRevalidatedDetails,
+  hasCurrentGateEvidence,
+  validateGateSatisfactionBindings,
+} from "./gate-provenance.js";
+import {
+  assertSemanticDecisionDetails,
+  validateSemanticDecisionArtifactBindings,
+  validateSemanticDecisionEventBindings,
+} from "./decision/events.js";
+import { SEMANTIC_DECISION_RECORDED_EVENT, SEMANTIC_DECISION_SUPERSEDED_EVENT } from "./decision/constants.js";
 
 const EVENT_SCHEMA_VERSION = 1;
 export const LIFECYCLE_MILESTONES = Object.freeze([
@@ -60,19 +100,45 @@ const REPEATABLE_MILESTONES = new Set([
   "PREFLIGHT_READY",
 ]);
 
-function eventIndexPath(eventsPath) {
-  return `${eventsPath}.index.json`;
+export function isRevisionEpochPlanRepeat(events = [], index = 0, event = null) {
+  if (event?.event !== "PLAN_RECORDED") return false;
+  const previousPlan = events.slice(0, index).findLast((candidate) => candidate.event === "PLAN_RECORDED");
+  const revision = events.slice(0, index).findLast((candidate) => candidate.event === CONTRACT_REVISED_EVENT);
+  return Boolean(previousPlan && revision && previousPlan.seq < revision.seq);
 }
 
-function parseEventIndex(text, relativePath) {
-  if (typeof text !== "string") return null;
-  try {
-    const value = JSON.parse(text);
-    if (!value || value.schemaVersion !== 1 || !Number.isInteger(value.seq) || value.seq < 0
-      || (value.lastHash !== null && !/^[a-f0-9]{64}$/.test(value.lastHash))) return null;
-    return value;
-  } catch {
-    return null;
+function validateMilestoneChronology(events, index, event, milestoneCounts, lastMilestone, errors) {
+  const milestoneIndex = LIFECYCLE_MILESTONES.indexOf(event.event);
+  if (milestoneIndex < 0) return lastMilestone;
+  const count = (milestoneCounts.get(event.event) ?? 0) + 1;
+  milestoneCounts.set(event.event, count);
+  const revisionPlanRepeat = isRevisionEpochPlanRepeat(events, index, event);
+  if (count > 1 && !REPEATABLE_MILESTONES.has(event.event) && !revisionPlanRepeat) {
+    errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `lifecycle milestone must not repeat: ${event.event}` });
+  }
+  if (milestoneIndex > lastMilestone + 1) {
+    errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `${event.event} is missing prerequisite milestone: ${LIFECYCLE_MILESTONES[lastMilestone + 1]}` });
+  } else if (milestoneIndex < lastMilestone && event.event !== "VERIFICATION_STARTED" && event.event !== "PREFLIGHT_READY") {
+    errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `${event.event} is out of lifecycle order` });
+  } else if (milestoneIndex === lastMilestone && !REPEATABLE_MILESTONES.has(event.event) && !revisionPlanRepeat) {
+    errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `lifecycle milestone must not repeat: ${event.event}` });
+  }
+  if (milestoneIndex > lastMilestone) return milestoneIndex;
+  return lastMilestone;
+}
+
+function validateExecutionGateChronology(events, index, seen, errors) {
+  if (!seen.has("ROUTE_VALIDATED")) errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before route validation" });
+  if (!seen.has("CONTRACT_VALIDATED")) errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before contract validation" });
+  if (!seen.has("PREFLIGHT_READY")) errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before preflight readiness" });
+  const preflight = events.slice(0, index).findLast((candidate) => candidate.event === "PREFLIGHT_READY");
+  const requiredGates = preflight?.details?.requiredGates ?? [];
+  const latestContractRevisionSeq = events.slice(0, index).findLast((candidate) => candidate.event === CONTRACT_REVISED_EVENT)?.seq ?? 0;
+  const beforeExecution = events.slice(0, index);
+  for (const gate of requiredGates) {
+    if (!hasCurrentGateEvidence(beforeExecution, ledgerEventAt(events, index)?.taskId, gate, latestContractRevisionSeq)) {
+      errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `execution started before gate satisfaction: ${gate}` });
+    }
   }
 }
 
@@ -89,17 +155,7 @@ async function readEventCheckpoint(target, packageRoot, relPath, options, transa
   if (!transaction.eventCheckpoints) transaction.eventCheckpoints = new Map();
   const cached = transaction.eventCheckpoints.get(relPath);
   if (cached) return cached;
-
-  const indexPath = eventIndexPath(relPath);
-  const indexed = parseEventIndex(await transaction.readText(indexPath), indexPath);
-  const tail = await readEventTail(target, packageRoot, { ...options, eventsPath: relPath, limit: 1 });
-  const last = tail.at(-1) ?? null;
-  let checkpoint;
-  if (indexed && indexed.seq === (last?.seq ?? 0) && indexed.lastHash === (last?.hash ?? null)) {
-    checkpoint = indexed;
-  } else {
-    checkpoint = checkpointFromEvents(await readEvents(target, packageRoot, { ...options, eventsPath: relPath }));
-  }
+  const checkpoint = checkpointFromEvents(await readEventTail(target, packageRoot, { ...options, eventsPath: relPath, limit: 1 }));
   transaction.eventCheckpoints.set(relPath, checkpoint);
   return checkpoint;
 }
@@ -125,6 +181,22 @@ export function validateKnownEventDetails(event) {
     case "CHECKPOINT_RECONCILED":
       assertReconcileClosureDetails(event.details);
       return;
+    case CHECKPOINT_REVALIDATED_EVENT:
+      assertCheckpointRevalidatedDetails(event.details);
+      return;
+    case CONTRACT_REVISED_EVENT:
+      assertContractRevisedDetails(event.details);
+      return;
+    case GATE_SATISFIED_EVENT:
+      assertGateSatisfiedDetails(event.details);
+      return;
+    case GATE_REVALIDATED_EVENT:
+      assertGateRevalidatedDetails(event.details);
+      return;
+    case SEMANTIC_DECISION_RECORDED_EVENT:
+    case SEMANTIC_DECISION_SUPERSEDED_EVENT:
+      assertSemanticDecisionDetails(event.details, event.event);
+      return;
     case "TASK_RECOVERY_RECORDED":
       assertRecoveryRecordedDetails(event.details);
       return;
@@ -135,18 +207,27 @@ export function validateKnownEventDetails(event) {
       if (!event.details?.recoveryId && isLegacyRecoveryDetailsShape(event.details)) return;
       assertRecoveryRecordedDetails(event.details);
       return;
+    case "TASK_ABANDONED":
+      assertTaskAbandonedDetails(event.details);
+      return;
     case "LEGACY_RECOVERY_MIGRATION_RECORDED":
       assertLegacyMigrationDetails(event.details);
       return;
+    case CONTRACT_BOOTSTRAP_REPAIR_EVENT:
+    case "CONTRACT_BOOTSTRAP_REPAIR_MIGRATION_RECORDED":
+      validateKnownContractBootstrapEvent(event);
+      return;
+    case "ROUTE_REBOUND":
+      assertRouteReboundDetails(event.details);
+      return;
+    case ROUTE_CHECKPOINT_BOUND_EVENT:
+      assertRouteCheckpointBoundDetails(event.details);
+      return;
     case "TASK_RECOVERY_RESUMED":
       assertRecoveryResumedDetails(event.details);
       return;
     case "TRAJECTORY_EVALUATED":
-      if (!event.details || !/^eval-[A-Za-z0-9_-]+$/.test(event.details.evaluationId ?? "")
-        || typeof event.details.scenarioId !== "string" || !/^[a-f0-9]{64}$/.test(event.details.evaluationFingerprint ?? "")
-        || event.fingerprint !== event.details.evaluationFingerprint) {
-        throw protocolError("E_EVENT_INVALID", "TRAJECTORY_EVALUATED requires a bound evaluationId, scenarioId, and fingerprint");
-      }
+      assertTrajectoryEvaluatedDetails(event);
       return;
     case "WORKSPACE_BOUND":
       assertStructuredArtifactEvent(event, ["workspaceFingerprint"], "WORKSPACE_BOUND");
@@ -161,14 +242,7 @@ export function validateKnownEventDetails(event) {
       assertFingerprint(event.details.digest, "HANDOFF_CREATED details.digest");
       return;
     case "HANDOFF_ACCEPTED":
-      if (!event.details || typeof event.details !== "object" || Array.isArray(event.details)
-        || typeof event.details.handoffId !== "string" || !/^handoff-[A-Za-z0-9_-]+$/.test(event.details.handoffId)
-        || typeof event.details.handoffDigest !== "string"
-        || typeof event.details.consumerId !== "string" || !event.details.consumerId.trim()
-        || (event.details.harness !== undefined && (typeof event.details.harness !== "string" || !event.details.harness.trim()))) {
-        throw protocolError("E_EVENT_INVALID", "HANDOFF_ACCEPTED requires a valid handoffId, handoffDigest, and consumerId");
-      }
-      assertFingerprint(event.details.handoffDigest, "HANDOFF_ACCEPTED details.handoffDigest");
+      assertHandoffAcceptedDetails(event);
       return;
     case "RESPONSIBILITY_SET":
       assertStructuredArtifactEvent(event, ["responsibilityFingerprint"], "RESPONSIBILITY_SET");
@@ -207,6 +281,34 @@ export function validateKnownEventDetails(event) {
   }
 }
 
+function validateKnownContractBootstrapEvent(event) {
+  if (event.event === CONTRACT_BOOTSTRAP_REPAIR_EVENT) {
+    if (isLegacyContractBootstrapRepairMarkerShape(event)) return;
+    assertContractBootstrapRepairDetails(event.details);
+    return;
+  }
+  assertContractBootstrapRepairMigrationDetails(event.details);
+}
+
+function assertTrajectoryEvaluatedDetails(event) {
+  if (!event.details || !/^eval-[A-Za-z0-9_-]+$/.test(event.details.evaluationId ?? "")
+    || typeof event.details.scenarioId !== "string" || !/^[a-f0-9]{64}$/.test(event.details.evaluationFingerprint ?? "")
+    || event.fingerprint !== event.details.evaluationFingerprint) {
+    throw protocolError("E_EVENT_INVALID", "TRAJECTORY_EVALUATED requires a bound evaluationId, scenarioId, and fingerprint");
+  }
+}
+
+function assertHandoffAcceptedDetails(event) {
+  if (!event.details || typeof event.details !== "object" || Array.isArray(event.details)
+    || typeof event.details.handoffId !== "string" || !/^handoff-[A-Za-z0-9_-]+$/.test(event.details.handoffId)
+    || typeof event.details.handoffDigest !== "string"
+    || typeof event.details.consumerId !== "string" || !event.details.consumerId.trim()
+    || (event.details.harness !== undefined && (typeof event.details.harness !== "string" || !event.details.harness.trim()))) {
+    throw protocolError("E_EVENT_INVALID", "HANDOFF_ACCEPTED requires a valid handoffId, handoffDigest, and consumerId");
+  }
+  assertFingerprint(event.details.handoffDigest, "HANDOFF_ACCEPTED details.handoffDigest");
+}
+
 function assertStringList(value, label) {
   if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item)) {
     throw protocolError("E_EVENT_INVALID", `${label} must be an array of non-empty strings`);
@@ -234,6 +336,35 @@ function assertStructuredArtifactEvent(event, requiredDetails, label) {
   }
 }
 
+function assertRouteReboundDetails(details) {
+  const keys = ["routeFingerprint", "contractFingerprint", "previousRouteFingerprint"];
+  if (!details || typeof details !== "object" || Array.isArray(details)
+    || Object.keys(details).length !== keys.length
+    || keys.some((key) => !Object.prototype.hasOwnProperty.call(details, key))) {
+    throw protocolError("E_EVENT_INVALID", "ROUTE_REBOUND requires exactly route, contract, and previous route fingerprints");
+  }
+  assertFingerprint(details.routeFingerprint, "ROUTE_REBOUND details.routeFingerprint");
+  assertFingerprint(details.contractFingerprint, "ROUTE_REBOUND details.contractFingerprint");
+  if (details.previousRouteFingerprint !== null) {
+    assertFingerprint(details.previousRouteFingerprint, "ROUTE_REBOUND details.previousRouteFingerprint");
+  }
+}
+
+function assertRouteCheckpointBoundDetails(details) {
+  const keys = ["routeFingerprint", "contractFingerprint", "selectedGuides"];
+  if (!details || typeof details !== "object" || Array.isArray(details)
+    || Object.keys(details).length !== keys.length
+    || keys.some((key) => !Object.prototype.hasOwnProperty.call(details, key))) {
+    throw protocolError("E_EVENT_INVALID", "ROUTE_CHECKPOINT_BOUND requires exactly route, contract, and selected guide identity");
+  }
+  assertFingerprint(details.routeFingerprint, "ROUTE_CHECKPOINT_BOUND details.routeFingerprint");
+  assertFingerprint(details.contractFingerprint, "ROUTE_CHECKPOINT_BOUND details.contractFingerprint");
+  assertStringList(details.selectedGuides, "ROUTE_CHECKPOINT_BOUND details.selectedGuides");
+  if (new Set(details.selectedGuides).size !== details.selectedGuides.length) {
+    throw protocolError("E_EVENT_INVALID", "ROUTE_CHECKPOINT_BOUND details.selectedGuides must not contain duplicates");
+  }
+}
+
 function assertRecoveryRecordedDetails(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)) {
     throw protocolError("E_EVENT_INVALID", "recovery event requires structured details");
@@ -256,6 +387,44 @@ function assertRecoveryRecordedDetails(details) {
   assertStringList(details.releasedClaims, "recovery event details.releasedClaims");
 }
 
+function assertTaskAbandonedDetails(details) {
+  const keys = [
+    "recoveryId", "classification", "reasonCodes", "previousPhase", "previousRevision",
+    "previousHead", "previousBranch", "currentHead", "currentBranch",
+    "releasedClaims", "authorityKind",
+  ];
+  if (!details || typeof details !== "object" || Array.isArray(details)
+    || Object.keys(details).length !== keys.length
+    || keys.some((key) => !Object.prototype.hasOwnProperty.call(details, key))) {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED requires the exact abandonment boundary details");
+  }
+  if (typeof details.recoveryId !== "string" || details.recoveryId.length === 0) {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.recoveryId must be a non-empty string");
+  }
+  if (details.classification !== "ABANDONED") {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.classification must be ABANDONED");
+  }
+  assertStringList(details.reasonCodes, "TASK_ABANDONED details.reasonCodes");
+  if (details.reasonCodes.length !== 1 || details.reasonCodes[0] !== "CALLER_ABANDONED") {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.reasonCodes must be [CALLER_ABANDONED]");
+  }
+  if (typeof details.previousPhase !== "string" || details.previousPhase.length === 0) {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.previousPhase must be a non-empty string");
+  }
+  if (!Number.isInteger(details.previousRevision) || details.previousRevision < 0) {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.previousRevision must be a non-negative integer");
+  }
+  for (const key of ["previousHead", "previousBranch", "currentHead", "currentBranch"]) {
+    if (typeof details[key] !== "string" && details[key] !== null) {
+      throw protocolError("E_EVENT_INVALID", `TASK_ABANDONED details.${key} must be a string or null`);
+    }
+  }
+  assertStringList(details.releasedClaims, "TASK_ABANDONED details.releasedClaims");
+  if (details.authorityKind !== "CALLER_ACKNOWLEDGED") {
+    throw protocolError("E_EVENT_INVALID", "TASK_ABANDONED details.authorityKind must be CALLER_ACKNOWLEDGED");
+  }
+}
+
 function assertRecoveryResumedDetails(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)
     || typeof details.recoveryId !== "string" || !details.recoveryId) {
@@ -334,35 +503,79 @@ function protocolError(code, message, artifacts = [ARTIFACT_PATHS.events]) {
 }
 
 export async function readEvents(target, packageRoot, options = {}) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => readEvents(target, packageRoot, options), { readOnly: true });
+  }
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
-  await assertSafePath(target, relPath);
-  const eventsPath = ensureWithin(target, relPath);
-  const transaction = (await getTaskTransaction(target));
-  if (transaction) {
-    const stagedText = await transaction.readText(relPath);
-    if (stagedText !== null) return parseEventsText(stagedText, relPath, packageRoot);
+  const store = getOperationalStore(target);
+  if (store?.recognizes(relPath)) {
+    const schema = await readSchema("event", packageRoot);
+    const events = [];
+    // Array callers consume the synchronous cursor directly. Streaming callers
+    // retain iterateEvents; both paths validate and fully bind observed rows.
+    for (const event of store.iterateEvents(relPath)) {
+      validateStoredEvent(event, schema, `${relPath}[${events.length}]`);
+      events.push(event);
+    }
+    return events;
   }
-  if (!(await fileExists(eventsPath))) return [];
-  const text = await readFile(eventsPath, "utf8");
-  return parseEventsText(text, relPath, packageRoot);
+  if (await assertOperationalLedgerAbsent(target, relPath)) return [];
+  return readPortableEvents(target, packageRoot, { ...options, eventsPath: relPath });
+}
+
+async function assertOperationalLedgerAbsent(target, relativePath) {
+  await assertSafePath(target, relativePath);
+  if (isOperationalArtifactPath(relativePath) && await fileExists(ensureWithin(target, relativePath))) {
+    throw protocolError("E_STORAGE_MIGRATION_REQUIRED", "Operational ledger reads require canonical SQLite; inspect legacy exports explicitly", [relativePath]);
+  }
+  return isOperationalArtifactPath(relativePath);
+}
+
+/** Explicit read-only inspection of an import/export ledger; never selects native authority. */
+export async function readPortableEvents(target, packageRoot, options = {}) {
+  const relPath = options.eventsPath ?? options.relativePath ?? (options.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  const filename = await assertSafePath(target, relPath);
+  if (!(await fileExists(filename))) return [];
+  return parseEventsText(await readFile(filename, "utf8"), relPath, packageRoot);
+}
+
+/** Stream schema-validated canonical rows within the captured operational scope. */
+export function iterateEvents(target, packageRoot, options = {}) {
+  const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  const store = getOperationalStore(target);
+  return (async function* validatedEvents() {
+    if (!store?.recognizes(relPath)) { yield* await readEvents(target, packageRoot, options); return; }
+    const schema = await readSchema("event", packageRoot);
+    let index = 0;
+    for (const event of store.iterateEvents(relPath)) {
+      validateStoredEvent(event, schema, `${relPath}[${index}]`);
+      index += 1;
+      yield event;
+    }
+  })();
 }
 
 export async function readEventTail(target, packageRoot, options = {}) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => readEventTail(target, packageRoot, options), { readOnly: true });
+  }
   const limit = options.limit ?? 50;
   if (!Number.isInteger(limit) || limit < 1) {
     throw protocolError("E_EVENT_INVALID", "ledger tail limit must be a positive integer");
   }
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
-  await assertSafePath(target, relPath);
-  const eventsPath = ensureWithin(target, relPath);
-  const transaction = (await getTaskTransaction(target));
-  if (transaction) {
-    const stagedText = await transaction.readText(relPath);
-    if (stagedText !== null) {
-      const lines = stagedText.split(/\r?\n/).filter((line) => line.trim() !== "");
-      return parseEventsText(lines.slice(-limit).join("\n"), relPath, packageRoot);
-    }
-  }
+  const store = getOperationalStore(target);
+  if (store?.recognizes(relPath)) return validateStoredEvents(store.readEvents(relPath, limit), relPath, packageRoot);
+  if (await assertOperationalLedgerAbsent(target, relPath)) return [];
+  return readPortableEventTail(target, packageRoot, { ...options, eventsPath: relPath });
+}
+
+/** Bounded tail inspection for explicit legacy/import/export tooling. */
+export async function readPortableEventTail(target, packageRoot, options = {}) {
+  const limit = options.limit ?? 50;
+  if (!Number.isInteger(limit) || limit < 1) throw protocolError("E_EVENT_INVALID", "ledger tail limit must be a positive integer");
+  const relPath = options.eventsPath ?? options.relativePath ?? (options.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  const eventsPath = await assertSafePath(target, relPath);
   if (!(await fileExists(eventsPath))) return [];
   const size = (await stat(eventsPath)).size;
   let window = Math.min(size, 64 * 1024);
@@ -410,18 +623,41 @@ async function parseEventsText(text, relPath, packageRoot) {
   });
 }
 
+async function validateStoredEvents(events, relativePath, packageRoot) {
+  const schema = await readSchema("event", packageRoot);
+  for (const [index, event] of events.entries()) {
+    validateStoredEvent(event, schema, `${relativePath}[${index}]`);
+  }
+  return events;
+}
+
+function validateStoredEvent(event, schema, label) {
+  assertJsonBytes(JSON.stringify(event), label);
+  assertJsonLimits(event, label);
+  assertSchema(event, schema, label);
+  validateKnownEventDetails(event);
+}
+
 export async function appendProtocolEvent(target, input, packageRoot, options = {}) {
   const activeTransaction = (await getTaskTransaction(target));
   if (typeof input?.taskId !== "string" || !input.taskId) throw protocolError("E_EVENT_INVALID", "event taskId is required");
   if (typeof input?.event !== "string" || !input.event) throw protocolError("E_EVENT_INVALID", "event type is required");
   const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
   if (!activeTransaction) {
-    return withTaskTransaction({
-      target,
-      taskId: options.taskId ?? input.taskId,
-      lockTaskId: relPath === ARTIFACT_PATHS.events ? "__legacy-events__" : (options.taskId ?? input.taskId),
-      operation: "append-event",
-    }, async () => appendProtocolEvent(target, input, packageRoot, options));
+    // Only a standalone append is replayable: nested domain mutations and
+    // external observations never enter this retry boundary.
+    const capturedInput = structuredClone(input);
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        return await withTaskTransaction({
+          target,
+          taskId: options.taskId ?? capturedInput.taskId,
+          operation: "append-event",
+        }, () => appendProtocolEvent(target, capturedInput, packageRoot, options));
+      } catch (error) {
+        if (error.code !== "E_STATE_REVISION_CONFLICT" || attempt >= 2) throw error;
+      }
+    }
   }
   const checkpoint = await readEventCheckpoint(target, packageRoot, relPath, options, activeTransaction);
   const event = buildProtocolEvent(input, { checkpoint });
@@ -429,16 +665,8 @@ export async function appendProtocolEvent(target, input, packageRoot, options =
   assertSchema(event, schema, relPath);
   event.hash = eventHash(event);
   if (!options.dryRun) {
-    if (activeTransaction) {
-      await activeTransaction.appendText(relPath, `${JSON.stringify(event)}\n`);
-      const nextCheckpoint = { schemaVersion: 1, seq: event.seq, lastHash: event.hash };
-      await activeTransaction.stageText(eventIndexPath(relPath), `${JSON.stringify(nextCheckpoint)}\n`);
-      activeTransaction.eventCheckpoints.set(relPath, nextCheckpoint);
-    } else {
-      const eventsPath = ensureWithin(target, relPath);
-      await mkdir(path.dirname(eventsPath), { recursive: true });
-      await appendFile(eventsPath, `${JSON.stringify(event)}\n`, { encoding: "utf8" });
-    }
+    activeTransaction.appendEvent(event);
+    activeTransaction.eventCheckpoints.set(relPath, { schemaVersion: 1, seq: event.seq, lastHash: event.hash });
   }
   return event;
 }
@@ -450,8 +678,8 @@ export async function appendProtocolEvent(target, input, packageRoot, options =
  * before appending the migration events.
  */
 function validateLegacyRecoveryMigrations(events, errors, { allowUnmigratedLegacyRecoveryEvents = false } = {}) {
-  const migrationBySeq = new Map();
-  for (const event of events) {
+  const migrationBySeq = ledgerRelationMap();
+  for (const event of ledgerEventsOfTypes(events, [LEGACY_RECOVERY_MIGRATION_EVENT])) {
     if (event.event !== LEGACY_RECOVERY_MIGRATION_EVENT) continue;
     try {
       assertLegacyMigrationDetails(event.details);
@@ -466,11 +694,12 @@ function validateLegacyRecoveryMigrations(events, errors, { allowUnmigratedLegac
       });
       continue;
     }
-    migrationBySeq.set(event.details.legacyEventSeq, event);
+    migrationBySeq.set(event.details.legacyEventSeq, events.indexOf(event));
   }
-  for (const event of events) {
+  for (const event of ledgerEventsOfTypes(events, ["OPERATOR_RECOVERY_RECORDED"])) {
     if (!isLegacyRecoveryEventShape(event)) continue;
-    const migration = migrationBySeq.get(event.seq);
+    const migrationPosition = migrationBySeq.get(event.seq);
+    const migration = migrationPosition === undefined ? undefined : ledgerEventAt(events, migrationPosition);
     if (!migration) {
       if (!allowUnmigratedLegacyRecoveryEvents) {
         errors.push({
@@ -502,7 +731,8 @@ function validateLegacyRecoveryMigrations(events, errors, { allowUnmigratedLegac
       });
     }
   }
-  for (const [legacySeq, migration] of migrationBySeq) {
+  for (const [legacySeq, position] of migrationBySeq) {
+    const migration = ledgerEventAt(events, position);
     errors.push({
       code: "E_EVENT_INVALID",
       message: `migration event ${migration.seq} references unknown legacy recovery event seq ${legacySeq}`,
@@ -510,30 +740,37 @@ function validateLegacyRecoveryMigrations(events, errors, { allowUnmigratedLegac
   }
 }
 
-export async function validateEventLedger(target, packageRoot, options = {}) {
-  const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
-  let events;
-  try {
-    events = await readEvents(target, packageRoot, { ...options, eventsPath: relPath });
-  } catch (error) {
-    return { valid: false, events: [], errors: [{ code: error.code ?? "E_EVENT_INVALID", message: error.message, artifacts: [relPath] }] };
-  }
+/**
+ * Pure ledger validation over an already-loaded event array.
+ *
+ * This is the smallest reusable seam between the filesystem path and a
+ * database-backed reader: every rule below is computed from the events alone,
+ * with no filesystem access. `validateEventLedger` keeps its existing signature
+ * and delegates here after reading events, so behavior is unchanged for every
+ * existing caller.
+ *
+ * Callers that already hold events (for example a database reader) can obtain
+ * exactly the same guarantees without materializing files first.
+ */
+export function validateLedgerEvents(events, options = {}) {
   const errors = [];
   let taskId = null;
+  let previousHash = null;
   const seen = new Set();
   let lastMilestone = -1;
   const milestoneCounts = new Map();
-  const createdHandoffs = new Map();
-  const acceptedHandoffs = new Set();
+  const createdHandoffs = ledgerRelationMap();
+  const acceptedHandoffs = ledgerRelationSet();
   for (const [index, event] of events.entries()) {
     if (event.seq !== index + 1) {
       errors.push({ code: "E_EVENT_INVALID", message: `event sequence must be ${index + 1}` });
     }
     if (taskId === null) taskId = event.taskId;
     if (event.taskId !== taskId) errors.push({ code: "E_EVENT_INVALID", message: "event task IDs must remain stable" });
-    if (event.previousHash !== (index === 0 ? null : events[index - 1].hash)) {
+    if (event.previousHash !== previousHash) {
       errors.push({ code: "E_LEDGER_HASH_INVALID", message: `event ${event.seq} previousHash does not match` });
     }
+    previousHash = event.hash;
     if (event.hash !== eventHash(event)) {
       errors.push({ code: "E_LEDGER_HASH_INVALID", message: `event ${event.seq} hash does not match its content` });
     }
@@ -542,50 +779,10 @@ export async function validateEventLedger(target, packageRoot, options = {}) {
     } catch (err) {
       errors.push({ code: err.code ?? "E_EVENT_INVALID", message: `event ${event.seq} (${event.event}): ${err.message}` });
     }
-    const milestoneIndex = LIFECYCLE_MILESTONES.indexOf(event.event);
-    if (milestoneIndex >= 0) {
-      const count = (milestoneCounts.get(event.event) ?? 0) + 1;
-      milestoneCounts.set(event.event, count);
-      if (count > 1 && !REPEATABLE_MILESTONES.has(event.event)) {
-        errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `lifecycle milestone must not repeat: ${event.event}` });
-      }
-      if (milestoneIndex > lastMilestone + 1) {
-        errors.push({
-          code: "E_PHASE_CHRONOLOGY_INVALID",
-          message: `${event.event} is missing prerequisite milestone: ${LIFECYCLE_MILESTONES[lastMilestone + 1]}`,
-        });
-      } else if (milestoneIndex < lastMilestone && event.event !== "VERIFICATION_STARTED"
-        && event.event !== "PREFLIGHT_READY") {
-        // VERIFICATION_STARTED re-enters per verification cycle; PREFLIGHT_READY
-        // may be refreshed mid-lifecycle (policy/contract evolution) after its
-        // prerequisites were already satisfied by the earlier occurrence.
-        errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `${event.event} is out of lifecycle order` });
-      } else if (milestoneIndex === lastMilestone && !REPEATABLE_MILESTONES.has(event.event)) {
-        errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `lifecycle milestone must not repeat: ${event.event}` });
-      }
-      if (milestoneIndex > lastMilestone) lastMilestone = milestoneIndex;
-    }
+    lastMilestone = validateMilestoneChronology(events, index, event, milestoneCounts, lastMilestone, errors);
     seen.add(event.event);
-    if (event.event === "EXECUTION_STARTED" && !seen.has("ROUTE_VALIDATED")) {
-      errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before route validation" });
-    }
-    if (event.event === "EXECUTION_STARTED" && !seen.has("CONTRACT_VALIDATED")) {
-      errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before contract validation" });
-    }
-    if (event.event === "EXECUTION_STARTED" && !seen.has("PREFLIGHT_READY")) {
-      errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "execution started before preflight readiness" });
-    }
     if (event.event === "EXECUTION_STARTED") {
-      const preflight = events.slice(0, index).findLast((candidate) => candidate.event === "PREFLIGHT_READY");
-      const requiredGates = preflight?.details?.requiredGates ?? [];
-      const satisfiedGates = new Set(events.slice(0, index)
-        .filter((candidate) => candidate.event === "GATE_SATISFIED")
-        .map((candidate) => candidate.details?.gate));
-      for (const gate of requiredGates) {
-        if (!satisfiedGates.has(gate)) {
-          errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: `execution started before gate satisfaction: ${gate}` });
-        }
-      }
+      validateExecutionGateChronology(events, index, seen, errors);
     }
     if (event.event === "VERIFICATION_RECORDED" && !seen.has("VERIFICATION_STARTED")) {
       errors.push({ code: "E_PHASE_CHRONOLOGY_INVALID", message: "verification evidence recorded before verification started" });
@@ -620,16 +817,216 @@ export async function validateEventLedger(target, packageRoot, options = {}) {
   validateLegacyRecoveryMigrations(events, errors, {
     allowUnmigratedLegacyRecoveryEvents: options?.allowUnmigratedLegacyRecoveryEvents === true,
   });
-  return { valid: errors.length === 0, events, errors };
+  errors.push(...validateCheckpointRevalidationEventBindings(events));
+  errors.push(...validateContractRevisionEventBindings(events));
+  errors.push(...validateGateSatisfactionBindings(events));
+  errors.push(...validateSemanticDecisionEventBindings(events));
+  const repairedErrors = validateContractBootstrapRepairLedger(events, errors, options);
+  return { valid: repairedErrors.length === 0, events, errors: repairedErrors };
+}
+
+/** Validate canonical native or non-operational interchange ledger with all domain bindings. */
+export async function validateEventLedger(target, packageRoot, options = {}) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => validateEventLedger(target, packageRoot, options), { readOnly: true });
+  }
+  return validateReadLedger(target, packageRoot, options, readEvents);
+}
+
+/** Explicit legacy source validation; never makes the source writable authority. */
+export async function validatePortableEventLedger(target, packageRoot, options = {}) {
+  return validateReadLedger(target, packageRoot, options, readPortableEvents);
+}
+
+async function validateReadLedger(target, packageRoot, options, reader) {
+  const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  let events;
+  try {
+    events = await reader(target, packageRoot, { ...options, eventsPath: relPath });
+  } catch (error) {
+    // A concurrent commit can invalidate a preparation read between statements;
+    // that is the standard retryable revision conflict, not ledger evidence.
+    // Converting it into an invalid-ledger result would let classification
+    // surface a transient contention loser as permanent ownership
+    // inconsistency, so a conflict keeps its own domain error here.
+    if (error?.code === "E_STATE_REVISION_CONFLICT") throw error;
+    return { valid: false, events: [], errors: [{ code: error.code ?? "E_EVENT_INVALID", message: error.message, artifacts: [relPath] }] };
+  }
+  const result = validateLedgerEvents(events, options);
+  const bindingErrors = await validateSemanticDecisionArtifactBindings(target, packageRoot, events);
+  if (bindingErrors.length === 0) return result;
+  return { valid: false, events, errors: [...result.errors, ...bindingErrors] };
+}
+
+// Proof reuse is minted only for one owned read-only backup callback. Public
+// collections and caller-supplied auditSource metadata cannot opt into it.
+const ownedLedgerProofs = new WeakMap();
+
+function ownedSnapshotFileIdentity(filename) {
+  // The WAL is durable database content that can change while a read cursor
+  // pins the main file. The SHM sidecar only carries transient lock/index
+  // state, so it is intentionally excluded from the byte identity.
+  const paths = [filename, `${filename}-wal`];
+  const files = paths.map(current => {
+    try {
+      const file = lstatSync(current, { bigint: true });
+      if (!file.isFile()) throw protocolError("E_STATE_REVISION_CONFLICT", "Owned ledger snapshot file changed during its audit");
+      return file;
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+  });
+  const identity = files.map(file => file
+    ? [file.dev, file.ino, file.size, file.mtimeNs, file.ctimeNs].join(":")
+    : "missing").join("|");
+  if (process.platform !== "win32") return identity;
+  // Windows may defer file timestamps until SQLite's open handle closes.
+  // Hash readable bytes with bounded memory so raw writes cannot reuse a proof.
+  const hash = createHash("sha256");
+  const buffer = Buffer.allocUnsafe(64 * 1024);
+  for (const [index, current] of paths.entries()) {
+    hash.update(`${index}:`);
+    if (!files[index]) continue;
+    const fd = openSync(current, "r");
+    try {
+      let count;
+      while ((count = readSync(fd, buffer, 0, buffer.length, null)) !== 0) hash.update(buffer.subarray(0, count));
+    } finally { closeSync(fd); }
+  }
+  return `${identity}:${hash.digest("hex")}`;
+}
+
+function assertOwnedLedgerUnchanged(events) {
+  const owned = ownedLedgerProofs.get(events);
+  if (owned && (owned.versionStatement.get().data_version !== owned.version
+    || ownedSnapshotFileIdentity(owned.filename) !== owned.fileIdentity)) {
+    throw protocolError("E_STATE_REVISION_CONFLICT", "Owned ledger snapshot changed during its audit");
+  }
+  return owned;
+}
+
+function validateOwnedLedgerEvents(events, options) {
+  const owned = assertOwnedLedgerUnchanged(events);
+  if (!owned) return validateLedgerEvents(events, options);
+  const flags = {
+    allowUnmigratedLegacyRecoveryEvents: options?.allowUnmigratedLegacyRecoveryEvents === true,
+    allowUnmigratedLegacyContractBootstrapRepairMarkers: options?.allowUnmigratedLegacyContractBootstrapRepairMarkers === true,
+  };
+  const key = JSON.stringify(flags);
+  if (owned.successes.has(key)) return { valid: true, events, errors: [] };
+  const result = validateLedgerEvents(events, flags);
+  assertOwnedLedgerUnchanged(events);
+  if (result.valid) owned.successes.add(key);
+  return result;
+}
+
+async function evaluateCallbackLedgerAudit(target, packageRoot, options, callback, events, relPath) {
+  let result;
+  try {
+    result = validateOwnedLedgerEvents(events, options);
+    const owned = assertOwnedLedgerUnchanged(events);
+    const sameScope = owned && owned.store === getOperationalStore(target)
+      && owned.db === owned.store.db && owned.packageRoot === packageRoot
+      && owned.relPath === relPath && owned.taskId === options?.taskId;
+    const bindingErrors = sameScope && owned.semanticValidated
+      ? [] : await validateSemanticDecisionArtifactBindings(target, packageRoot, events);
+    assertOwnedLedgerUnchanged(events);
+    if (sameScope && result.valid && bindingErrors.length === 0) owned.semanticValidated = true;
+    if (bindingErrors.length) result = { valid: false, events, errors: [...result.errors, ...bindingErrors] };
+  } catch (error) {
+    result = { valid: false, events: [], errors: [{ code: error.code ?? "E_EVENT_INVALID", message: error.message, artifacts: [relPath] }] };
+  }
+  const initiallyValid = result.valid;
+  const callbackResult = await callback(result);
+  // The caller may await other work or mutate its result object. Keep the
+  // private snapshot proof valid for the entire successful observation.
+  if (initiallyValid) assertOwnedLedgerUnchanged(events);
+  return callbackResult;
+}
+
+/** Internal callback audit: events remain owned by one immutable native snapshot. */
+export async function withEventLedgerAudit(target, packageRoot, options, callback) {
+  if (await needsExistingProjectScope(target)) {
+    return withExistingProjectScope(target, () => withEventLedgerAudit(target, packageRoot, options, callback), { readOnly: true });
+  }
+  const relPath = options?.eventsPath ?? options?.relativePath ?? (options?.taskId ? taskArtifactPath(options.taskId, "events") : ARTIFACT_PATHS.events);
+  const store = getOperationalStore(target);
+  // Prepared mutations retain their existing read-set/CAS and staged-overlay semantics.
+  if (!store?.recognizes(relPath) || !relPath.endsWith("/events.ndjson") || store.hasPreparedMutations()) {
+    return callback(await validateEventLedger(target, packageRoot, options));
+  }
+  const taskId = store.taskId({ taskKey: relPath.split("/")[2] });
+  if (!taskId) return callback(await validateEventLedger(target, packageRoot, options));
+  if (store.auditSource?.taskId === taskId && store.auditSource.packageRoot === packageRoot && store.auditSource.relPath === relPath) {
+    return evaluateCallbackLedgerAudit(target, packageRoot, options, callback, store.auditSource.events, relPath);
+  }
+  const schema = await readSchema("event", packageRoot);
+  const { withDetachedLedgerSnapshot } = await import("../storage/ledger-event-snapshot.js");
+  const { withOperationalReadSnapshot } = await import("../storage/unit-of-work.js");
+  let completeObservation;
+  return withDetachedLedgerSnapshot(store.db, taskId, (events, db) => withOperationalReadSnapshot({ db, target }, async snapshotStore => {
+    completeObservation = snapshotStore.beginEventSnapshotObservation(relPath);
+    snapshotStore.auditSource = { taskId, packageRoot, relPath, events };
+    const filename = db.prepare("PRAGMA database_list").all().find(row => row.name === "main").file;
+    const versionStatement = db.prepare("PRAGMA data_version");
+    ownedLedgerProofs.set(events, { db, filename, store: snapshotStore, taskId, packageRoot, relPath, semanticValidated: false, fileIdentity: ownedSnapshotFileIdentity(filename),
+      versionStatement, version: versionStatement.get().data_version, successes: new Set() });
+    try { return await evaluateCallbackLedgerAudit(target, packageRoot, options, callback, events, relPath); }
+    finally { ownedLedgerProofs.delete(events); }
+  }), {
+    validate(event, index) { validateStoredEvent(event, schema, `${relPath}[${index}]`); return event; },
+    onFullScan: store.captureObservations ? digest => completeObservation(digest) : null,
+    // Keep the private schema/index proof valid for every collection read,
+    // including a cursor resumed after the caller yielded an event. The guard
+    // deliberately uses the full owned snapshot identity check on all
+    // platforms; Windows may defer filesystem timestamps, so a cheap-only
+    // resume check would expose a raw-tampered payload before the outer audit
+    // boundary noticed it.
+    guard(_events, _phase) { assertOwnedLedgerUnchanged(_events); },
+  });
+}
+
+function validateContractBootstrapRepairLedger(events, errors, options) {
+  const allowUnmigrated = options?.allowUnmigratedLegacyContractBootstrapRepairMarkers === true;
+  validateContractBootstrapRepairMigrations(events, errors, {
+    allowUnmigratedLegacyContractBootstrapRepairMarkers: allowUnmigrated,
+  });
+  return repairMarkerErrors(events, errors, {
+    allowUnmigratedLegacyContractBootstrapRepairMarkers: allowUnmigrated,
+  });
+}
+
+function summarizeStateEvents(state, events) {
+  const milestones = ["EXECUTION_STARTED", "VERIFICATION_STARTED", "REVIEW_STARTED", "COMPLETION_VALIDATED"];
+  const observed = new Set();
+  let supportsReviewEvents = false;
+  let latestVerification;
+  let latestReview;
+  let index = 0;
+  for (const event of ledgerEventsOfTypes(events, milestones)) {
+    if (event.taskId !== state.taskId) continue;
+    observed.add(event.event);
+    if (event.event === "VERIFICATION_STARTED") {
+      latestVerification = { event, index };
+      if (Number.isInteger(event.details?.verificationCycle)) supportsReviewEvents = true;
+    }
+    if (event.event === "REVIEW_STARTED") {
+      supportsReviewEvents = true;
+      latestReview = { event, index };
+    }
+    index += 1;
+  }
+  return { observed, supportsReviewEvents, latestVerification, latestReview };
 }
 
 export function validateStateLedgerCoherence(state, events) {
-  const errors = [];
+  const errors = [
+    ...validateCheckpointRevalidationCurrentBinding(state, events),
+    ...validateContractRevisionCurrentBinding(state, events),
+  ];
   if (!Number.isInteger(state.verificationCycle)) return errors;
-  const taskEvents = events.filter((event) => event.taskId === state.taskId);
-  const observed = new Set(taskEvents.map((event) => event.event));
-  const supportsReviewEvents = taskEvents.some((event) => event.event === "REVIEW_STARTED"
-    || (event.event === "VERIFICATION_STARTED" && Number.isInteger(event.details?.verificationCycle)));
+  const { observed, supportsReviewEvents, latestVerification, latestReview } = summarizeStateEvents(state, events);
   const phaseRequirements = {
     EXECUTING: ["EXECUTION_STARTED"],
     VERIFYING: ["EXECUTION_STARTED", "VERIFICATION_STARTED"],
@@ -647,21 +1044,12 @@ export function validateStateLedgerCoherence(state, events) {
     }
   }
   if (Number.isInteger(state.verificationCycle)) {
-    const verificationEvents = taskEvents
-      .map((event, index) => ({ event, index }))
-      .filter(({ event }) => event.event === "VERIFICATION_STARTED");
-    const cycles = verificationEvents.map(({ event }) => event.details?.verificationCycle ?? 1);
-    if (cycles.at(-1) !== state.verificationCycle) {
+    if ((latestVerification ? latestVerification.event.details?.verificationCycle ?? 1 : undefined) !== state.verificationCycle) {
       errors.push({
         code: "E_STATE_LEDGER_DIVERGENCE",
         message: "Work-state verification cycle does not match the lifecycle ledger",
       });
     }
-    const latestVerification = verificationEvents.at(-1);
-    const latestReview = taskEvents
-      .map((event, index) => ({ event, index }))
-      .filter(({ event }) => event.event === "REVIEW_STARTED")
-      .at(-1);
     const latestReviewCycle = latestReview?.event.details?.verificationCycle;
     if (state.phase === "VERIFYING"
       && latestReviewCycle === state.verificationCycle