@claudian-collab/protocol 3.3.0 → 3.3.2

package/README.md

@@ -37,7 +37,9 @@ fixed part of the detail so the whole detail stays within
 has one compatible final-serialization limit. Request comments and Ticket
 accepted relations also have shared authority-enforced total limits; summary
 counts let complete consumers reject partial or cross-snapshot assembly.
-Cloud binding v2 adds the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v6 includes the additive Cloud Project-membership operation family while preserving every existing operation contract. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export retain wire-visible coordination format v1, while the pre-production offline backup contract is directly replaced by format v3. Backup v3 adds Project invitations, protected invitation and transferred-claim override envelopes, manager-responsibility offers, membership recovery journals, and secret-replay tombstones to the existing continuity records. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Domain-separated canonical UTF-8 inputs define protected-claim AEAD associated data and bind every declared field of transferred-membership redemption receipts and authority-relinquishment proofs before consumer-owned Ed25519 signing or verification. Existing LAN v9 Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds these shared payloads without creating another shared operation registry.
+Cloud binding v2 adds the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v6 includes the Cloud Project-membership operation family. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export use wire-visible coordination format v1, and offline backup uses format v3. Backup v3 adds Project invitations, protected invitation and transferred-claim override envelopes, manager-responsibility offers, membership recovery journals, secret-replay tombstones, and compacted Manager-responsibility idempotency tombstones to the existing continuity records. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Domain-separated canonical UTF-8 inputs define protected-claim AEAD associated data and bind every declared field of transferred-membership redemption receipts and authority-relinquishment proofs before consumer-owned Ed25519 signing or verification. Existing LAN v9 Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds these shared payloads without creating another shared operation registry.
+
+Backup coordination artifacts are limited to 256 MiB of actual UTF-8 bytes, including the final newline. The decoder, encoder, and consistency checker apply this same inclusive limit without rewriting principals into an intermediate format. Valid current-format artifacts at the limit are accepted; an additional byte is rejected.
 
 ## Usage
 
@@ -62,28 +64,14 @@ part of the public surface.
 
 Package SemVer, canonical wire version, and Cloud binding version are independent concepts.
 
-- **Package version** (this `package.json`): `3.3.0`. Patch releases preserve
-  every existing public declaration and runtime behavior baseline. Minor
-  releases may add backward-compatible API. Removing or changing an existing
-  declaration, export, runtime behavior, codec, error, limit, ref rule,
-  operation, or compatibility rule requires a major release. An independently
-  proven additive control operation may use a package minor release without a
-  wire-version increase; existing operation declarations and fixtures must stay
-  exact. Package 3 and wire 6 support exact transfer-claim batches and a
-  source-pinned target receipt verifier. Package 3.3 adds the Cloud Project-membership
-  operation family and capability tokens and directly replaces the pre-production
-  offline backup contract with coordination format v3, without changing
-  authority-transfer/export format v1, canonical wire v6, or Cloud binding v2.
-  Backup v2 has no supported decoder or migration path. The package version never
-  signals wire compatibility by itself.
+- **Package version** (this `package.json`): `3.3.2`. Behavior-preserving implementation refactors and reviewed compatible defect corrections may use a patch release when public declarations, runtime exports, and accepted wire/binding semantics remain unchanged. Minor releases may add backward-compatible API. Removing or incompatibly changing an existing declaration, export, runtime behavior, codec, error, limit, ref rule, operation, or compatibility rule requires a major release. Package API SemVer is classified independently from the wire and Cloud binding contracts, but a compatible package addition cannot exempt a changed wire contract from a wire-version increase or a changed Cloud binding contract from a binding-version increase. The package version never signals wire compatibility by itself.
 - **Wire version** (`COLLAB_PROTOCOL_VERSION`): currently `6`. The supported
   range is exactly `[6, 6]`. This is independent from Cloud binding version `2` and the existing application
   LAN control version `9`. Any change to an existing envelope, DTO, operation
-  payload shape, or operation definition is wire-breaking and requires a new
-  wire-protocol version. A strictly additive operation may remain on the
-  current wire version when the compatibility classifier proves that every
-  existing operation contract is unchanged.
-- **Cloud binding version** (`COLLAB_CLOUD_BINDING_VERSION`): currently `2`. It versions Cloud routes, bounded transfer streams, and capabilities independently from package and wire versions. Binding v1 and wire versions before v6 are unsupported rather than translated or dual-interpreted.
+  payload shape, or operation definition requires a new wire-protocol version.
+  This includes additive operations: every wire-contract change increases the
+  canonical wire version.
+- **Cloud binding version** (`COLLAB_CLOUD_BINDING_VERSION`): currently `2`. It versions Cloud routes, bounded transfer streams, and capabilities independently from package and wire versions. Every Cloud binding-contract change increases this version. Binding v1 and wire versions before v6 are unsupported rather than translated or dual-interpreted.
 
 ### Compatibility behavior
 
@@ -102,14 +90,18 @@ Compatibility is tested with executable fixtures in this package
 (`tests/`), and cross-repository contract fixtures pin client and server to
 the same behavior.
 
+The compatibility snapshot also fingerprints implementation tokens. Those fingerprints detect edits but cannot establish whether behavior changed. A reviewed implementation-only refactor or approved compatible defect correction uses `compatibility-review.json`, generated with `npm run check:compatibility -- --base <base-sha> --record-implementation-only-review "<reviewed reason>"` after updating the generated snapshot and characterizing the public seams. The reason distinguishes preserved behavior from any approved correction and its executable evidence. The record binds the exact base and candidate snapshots; the classifier independently rejects any changed public declaration, export, or wire/binding semantic fact. Missing or stale evidence cannot authorize an implementation change, and the record never applies to another version or later edit merely because an earlier change was accepted. This review requirement is general, not a prelaunch or one-release compatibility exception, and it is not an automated proof of behavioral equivalence.
+
 ## Development
 
 ```bash
 npm run build        # compile src/ -> dist/ (CommonJS + declarations)
 npm test             # package unit tests
 npm run check:compatibility
-npm run verify:pack  # pack the artifact and smoke-test a clean consumer
+npm run release:candidate # build and verify the reviewed release artifact
+npm run verify:pack  # smoke-test that exact artifact in a clean consumer
 ```
 
 `dist/` is generated output and is never committed. The packed artifact is
 reproducible from source: `npm pack` rebuilds via `prepack`.
+The full verification gate constructs one release candidate and uses those same reviewed tarball bytes for clean-consumer smoke tests and publication.

package/dist/CollabProjectBackupCheckpoint.d.ts

@@ -5,7 +5,7 @@ import { type CollabManagerResponsibilityOfferState, type CollabManagerResponsib
 import type { CollabIsoTimestamp, CollabMemberId, CollabProjectId } from './types';
 export declare const COLLAB_PROJECT_BACKUP_COMPATIBILITY_STAGE: "pre-production-replaceable";
 export declare const COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION: 3;
-export declare const COLLAB_PROJECT_BACKUP_RECORD_KINDS: readonly ["project", "member", "request", "request-comment", "ticket", "ticket-comment", "ticket-relation", "ticket-mention", "cloud-event", "cloud-event-cursor", "idempotency-result", "principal-binding", "repository-placement", "lifecycle-journal", "authority-transfer-recovery", "transferred-membership-claim", "transfer-receipt-key", "transfer-claim-batch-receipt", "transfer-redemption-receipt", "terminal-principal", "terminal-responder-replay", "leave-former-principal-replay", "project-invitation", "protected-invitation-envelope", "transferred-membership-claim-override", "protected-claim-override-envelope", "manager-responsibility-offer", "project-membership-recovery", "secret-replay-tombstone", "terminal-responder", "protected-claim-envelope", "tombstone", "schema-catalog", "server-compatibility", "authority-volume-pair"];
+export declare const COLLAB_PROJECT_BACKUP_RECORD_KINDS: readonly ["project", "member", "request", "request-comment", "ticket", "ticket-comment", "ticket-relation", "ticket-mention", "cloud-event", "cloud-event-cursor", "idempotency-result", "principal-binding", "repository-placement", "lifecycle-journal", "authority-transfer-recovery", "transferred-membership-claim", "transfer-receipt-key", "transfer-claim-batch-receipt", "transfer-redemption-receipt", "terminal-principal", "terminal-responder-replay", "leave-former-principal-replay", "project-invitation", "protected-invitation-envelope", "transferred-membership-claim-override", "protected-claim-override-envelope", "manager-responsibility-offer", "membership-idempotency-tombstone", "project-membership-recovery", "secret-replay-tombstone", "terminal-responder", "protected-claim-envelope", "tombstone", "schema-catalog", "server-compatibility", "authority-volume-pair"];
 export type CollabProjectBackupRecordKind = typeof COLLAB_PROJECT_BACKUP_RECORD_KINDS[number];
 interface BackupRecordBase<Kind extends string, Value> {
     readonly kind: Kind;
@@ -208,6 +208,15 @@ export type CollabProjectBackupManagerResponsibilityOfferRecord = BackupRecordBa
     readonly targetMembershipRevisionAtOffer: number;
     readonly terminalAt: CollabIsoTimestamp | null;
 }>;
+type CollabProjectBackupCompactedMembershipOperation = Extract<CollabProjectMembershipOperation, 'createManagerResponsibilityOffer' | 'acknowledgeManagerResponsibility' | 'declineManagerResponsibility' | 'cancelManagerResponsibilityOffer' | 'promoteManager'>;
+export type CollabProjectBackupMembershipIdempotencyTombstoneRecord = BackupRecordBase<'membership-idempotency-tombstone', {
+    readonly actorMemberId: CollabMemberId;
+    readonly compactedAt: CollabIsoTimestamp;
+    readonly idempotencyKey: string;
+    readonly operation: CollabProjectBackupCompactedMembershipOperation;
+    readonly projectId: CollabProjectId;
+    readonly requestFingerprint: string;
+}>;
 export type CollabProjectBackupMembershipRecoveryRecord = BackupRecordBase<'project-membership-recovery', {
     readonly expectedMainOid: string;
     readonly expectedPersonalRefOid: string;
@@ -229,7 +238,7 @@ export type CollabProjectBackupSecretReplayTombstoneRecord = BackupRecordBase<'s
     readonly projectId: CollabProjectId;
     readonly requestFingerprint: string;
 }>;
-export type CollabProjectBackupContinuityRecord = CollabProjectBackupLifecycleJournalRecord | CollabProjectBackupAuthorityTransferRecoveryRecord | CollabProjectBackupTransferredMembershipClaimRecord | CollabProjectBackupTransferReceiptKeyRecord | CollabProjectBackupTransferClaimBatchReceiptRecord | CollabProjectBackupTransferRedemptionReceiptRecord | CollabProjectBackupTerminalPrincipalRecord | CollabProjectBackupTerminalResponderReplayRecord | CollabProjectBackupLeaveFormerPrincipalReplayRecord | CollabProjectBackupInvitationRecord | CollabProjectBackupProtectedInvitationEnvelopeRecord | CollabProjectBackupTransferredMembershipClaimOverrideRecord | CollabProjectBackupProtectedClaimOverrideEnvelopeRecord | CollabProjectBackupManagerResponsibilityOfferRecord | CollabProjectBackupMembershipRecoveryRecord | CollabProjectBackupSecretReplayTombstoneRecord;
+export type CollabProjectBackupContinuityRecord = CollabProjectBackupLifecycleJournalRecord | CollabProjectBackupAuthorityTransferRecoveryRecord | CollabProjectBackupTransferredMembershipClaimRecord | CollabProjectBackupTransferReceiptKeyRecord | CollabProjectBackupTransferClaimBatchReceiptRecord | CollabProjectBackupTransferRedemptionReceiptRecord | CollabProjectBackupTerminalPrincipalRecord | CollabProjectBackupTerminalResponderReplayRecord | CollabProjectBackupLeaveFormerPrincipalReplayRecord | CollabProjectBackupInvitationRecord | CollabProjectBackupProtectedInvitationEnvelopeRecord | CollabProjectBackupTransferredMembershipClaimOverrideRecord | CollabProjectBackupProtectedClaimOverrideEnvelopeRecord | CollabProjectBackupManagerResponsibilityOfferRecord | CollabProjectBackupMembershipIdempotencyTombstoneRecord | CollabProjectBackupMembershipRecoveryRecord | CollabProjectBackupSecretReplayTombstoneRecord;
 type CollabProjectBackupBaseRecord = Exclude<CollabCheckpointBackupRecord, {
     readonly kind: 'lifecycle-state';
 }>;

package/dist/CollabProjectBackupCheckpoint.js

@@ -32,6 +32,7 @@ const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'transferred-membership-claim-override',
     'protected-claim-override-envelope',
     'manager-responsibility-offer',
+    'membership-idempotency-tombstone',
     'project-membership-recovery',
     'secret-replay-tombstone',
 ]);
@@ -207,65 +208,19 @@ function absoluteTargetUrl(source) {
 function principal(source, field) {
     return token(source, field, value => (typeof value === 'string' && PRINCIPAL_PATTERN.test(value)));
 }
-function sanitizeBackupBasePrincipalRecord(item) {
-    const source = record(item, 'record');
-    const value = record(source.value, 'value');
-    if (source.kind === 'principal-binding') {
-        return {
-            ...source,
-            value: { ...value, principalId: `principal_${String(value.memberId)}` },
-        };
-    }
-    if (source.kind === 'terminal-responder' && Array.isArray(value.acknowledgements)) {
-        return {
-            ...source,
-            value: {
-                ...value,
-                acknowledgements: value.acknowledgements.map(item => ({
-                    ...record(item, 'acknowledgement'),
-                    principalId: `principal_${String(record(item, 'acknowledgement').memberId)}`,
-                })),
-            },
-        };
-    }
-    return item;
-}
-function restoreBackupBasePrincipals(source, base) {
-    if (base.kind === 'principal-binding') {
-        const value = exactRecord(source.value, 'value', [
-            'boundAt', 'memberId', 'principalId', 'projectId',
-        ]);
-        return {
-            ...base,
-            value: { ...base.value, principalId: principal(value, 'principalId') },
-        };
-    }
+function validateBackupBasePrincipals(base) {
+    if (base.kind === 'principal-binding')
+        principal(base.value, 'principalId');
     if (base.kind === 'terminal-responder') {
-        const value = exactRecord(source.value, 'value', [
-            'acknowledgements',
-            'eligibleMemberIds',
-            'expiresAt',
-            'operation',
-            'operationId',
-            'projectId',
-            'responseJson',
-        ]);
-        const sourceAcknowledgements = value.acknowledgements;
-        if (!Array.isArray(sourceAcknowledgements)
-            || sourceAcknowledgements.length !== base.value.acknowledgements.length)
-            throw invalidPayload('acknowledgements');
-        const acknowledgements = base.value.acknowledgements.map((item, index) => {
-            const original = exactRecord(sourceAcknowledgements[index], 'acknowledgement', [
-                'acknowledgedAt', 'memberId', 'principalId',
-            ]);
-            return { ...item, principalId: principal(original, 'principalId') };
-        });
-        if (new Set(acknowledgements.map(item => item.principalId)).size !== acknowledgements.length) {
-            throw invalidPayload('acknowledgements');
+        for (const acknowledgement of base.value.acknowledgements) {
+            if (acknowledgement.principalId === undefined)
+                throw invalidPayload('acknowledgement');
+            principal(acknowledgement, 'principalId');
         }
-        return { ...base, value: { ...base.value, acknowledgements } };
+        if (new Set(base.value.acknowledgements.map(item => item.principalId)).size
+            !== base.value.acknowledgements.length)
+            throw invalidPayload('acknowledgements');
     }
-    return base;
 }
 function repositoryPublicationRef(value) {
     const source = exactRecord(value, 'ref', ['name', 'oid']);
@@ -1183,6 +1138,41 @@ function membershipRecoveryRecord(source, recordId, revision) {
         },
     };
 }
+function membershipIdempotencyTombstoneRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'actorMemberId',
+        'compactedAt',
+        'idempotencyKey',
+        'operation',
+        'projectId',
+        'requestFingerprint',
+    ]);
+    const actorMemberId = token(value, 'actorMemberId', CollabValidation_1.isCollabMemberId);
+    const idempotencyKey = token(value, 'idempotencyKey');
+    const operation = literal(value, 'operation', [
+        'createManagerResponsibilityOffer',
+        'acknowledgeManagerResponsibility',
+        'declineManagerResponsibility',
+        'cancelManagerResponsibilityOffer',
+        'promoteManager',
+    ]);
+    if (recordId !== `${operation}:${actorMemberId}:${idempotencyKey}`) {
+        throw invalidPayload('recordId');
+    }
+    return {
+        kind: 'membership-idempotency-tombstone',
+        recordId,
+        revision,
+        value: {
+            actorMemberId,
+            compactedAt: timestamp(value, 'compactedAt'),
+            idempotencyKey,
+            operation,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
 function secretReplayTombstoneRecord(source, recordId, revision) {
     const value = exactRecord(source.value, 'value', [
         'actorMemberId',
@@ -1240,6 +1230,8 @@ function decodeContinuityRecord(kind, source, recordId, revision) {
             return protectedClaimOverrideEnvelopeRecord(source, recordId, revision);
         case 'manager-responsibility-offer':
             return managerResponsibilityOfferRecord(source, recordId, revision);
+        case 'membership-idempotency-tombstone':
+            return membershipIdempotencyTombstoneRecord(source, recordId, revision);
         case 'project-membership-recovery':
             return membershipRecoveryRecord(source, recordId, revision);
         case 'secret-replay-tombstone':
@@ -1409,6 +1401,7 @@ function validateContinuity(records) {
         item,
     ]));
     const managerOffers = records.filter((item) => (item.kind === 'manager-responsibility-offer'));
+    const membershipIdempotencyTombstones = records.filter((item) => (item.kind === 'membership-idempotency-tombstone'));
     const membershipRecoveries = new Map(records
         .filter((item) => (item.kind === 'project-membership-recovery'))
         .map(item => [item.value.operationId, item]));
@@ -1792,6 +1785,18 @@ function validateContinuity(records) {
             throw invalidPayload('records');
         }
     }
+    for (const tombstone of membershipIdempotencyTombstones) {
+        const exactResult = records.some(item => (item.kind === 'idempotency-result'
+            && item.value.memberId === tombstone.value.actorMemberId
+            && item.value.operation === tombstone.value.operation
+            && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        const exactOffer = tombstone.value.operation === 'createManagerResponsibilityOffer'
+            && managerOffers.some(item => (item.value.sourceManagerMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        if (!members.has(tombstone.value.actorMemberId) || exactResult || exactOffer) {
+            throw invalidPayload('records');
+        }
+    }
     for (const item of records) {
         if (item.kind === 'idempotency-result' && !members.has(item.value.memberId)) {
             throw invalidPayload('records');
@@ -1959,55 +1964,18 @@ function validateContinuity(records) {
         }
     }
 }
-function manifestWithFormatOne(value) {
+function decodeCollabProjectBackupCheckpointManifest(value) {
     const source = record(value, 'manifest');
     if (source.profile !== 'backup'
         || source.coordinationFormatVersion !== exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION)
         throw invalidPayload('manifest');
-    return (0, CollabProjectCheckpoint_1.decodeCollabProjectCheckpointManifest)({
-        ...source,
-        coordinationFormatVersion: CollabProjectCheckpoint_1.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
-    });
-}
-function decodeCollabProjectBackupCheckpointManifest(value) {
-    const decoded = manifestWithFormatOne(value);
-    return {
-        artifacts: decoded.artifacts,
-        coordinationFormatVersion: exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION,
-        createdAt: decoded.createdAt,
-        expectedMainOid: decoded.expectedMainOid,
-        gitObjectFormat: decoded.gitObjectFormat,
-        manifestSchemaVersion: decoded.manifestSchemaVersion,
-        manifestSha256: decoded.manifestSha256,
-        operationId: decoded.operationId,
-        profile: 'backup',
-        projectId: decoded.projectId,
-        protocolVersion: decoded.protocolVersion,
-        refs: decoded.refs,
-        sourceAuthority: decoded.sourceAuthority,
-        targetAuthority: decoded.targetAuthority,
-    };
+    return (0, CollabProjectCheckpoint_1.decodeCheckpointManifestFields)(source, exports.COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION);
 }
 function encodeCollabProjectBackupCheckpointManifestCanonicalJson(manifest) {
     return JSON.stringify(decodeCollabProjectBackupCheckpointManifest(manifest));
 }
 function encodeCollabProjectBackupCheckpointManifestDigestInput(manifest) {
-    const decoded = decodeCollabProjectBackupCheckpointManifest(manifest);
-    return JSON.stringify({
-        artifacts: decoded.artifacts,
-        coordinationFormatVersion: decoded.coordinationFormatVersion,
-        createdAt: decoded.createdAt,
-        expectedMainOid: decoded.expectedMainOid,
-        gitObjectFormat: decoded.gitObjectFormat,
-        manifestSchemaVersion: decoded.manifestSchemaVersion,
-        operationId: decoded.operationId,
-        profile: decoded.profile,
-        projectId: decoded.projectId,
-        protocolVersion: decoded.protocolVersion,
-        refs: decoded.refs,
-        sourceAuthority: decoded.sourceAuthority,
-        targetAuthority: decoded.targetAuthority,
-    });
+    return (0, CollabProjectCheckpoint_1.encodeCheckpointManifestDigestInput)(decodeCollabProjectBackupCheckpointManifest(manifest));
 }
 function decodeCollabProjectBackupCheckpointCoordinationNdjson(value) {
     if (typeof value !== 'string'
@@ -2027,22 +1995,43 @@ function decodeCollabProjectBackupCheckpointCoordinationNdjson(value) {
         }
         if (JSON.stringify(item) !== line)
             throw invalidPayload('coordination');
-        return { envelope: recordEnvelope(item), item };
+        return {
+            envelope: recordEnvelope(item),
+            item,
+            base: undefined,
+        };
     });
     const baseItems = parsed.filter(({ envelope }) => (!CONTINUITY_KIND_SET.has(envelope.kind) && envelope.kind !== 'idempotency-result'));
-    const baseDecoded = (0, CollabProjectCheckpoint_1.decodeCollabProjectCheckpointCoordinationNdjson)(baseItems.map(({ item }) => JSON.stringify(sanitizeBackupBasePrincipalRecord(item))).join('\n') + '\n', 'backup');
-    const baseByIdentity = new Map(baseDecoded.map(item => [`${item.kind}\0${item.recordId}`, item]));
-    const decoded = parsed.map(({ envelope }) => {
+    for (const { envelope } of baseItems) {
+        const value = record(envelope.source.value, 'value');
+        if (envelope.kind === 'terminal-responder' && Array.isArray(value.acknowledgements)) {
+            for (const acknowledgement of value.acknowledgements)
+                record(acknowledgement, 'acknowledgement');
+        }
+    }
+    const baseRecords = [];
+    for (const entry of baseItems) {
+        entry.base = (0, CollabProjectCheckpoint_1.decodeCheckpointRecord)(entry.item, 'deferred');
+        if (JSON.stringify(entry.base) !== JSON.stringify(entry.item)
+            || (entry.base.kind === 'principal-binding' && entry.base.value.principalId === undefined)) {
+            throw invalidPayload('coordination');
+        }
+        baseRecords.push(entry.base);
+    }
+    if (baseRecords.length === 0)
+        throw invalidPayload('coordination');
+    (0, CollabProjectCheckpoint_1.validateCheckpointRecordSequence)(baseRecords, 'backup', 'member');
+    const decoded = parsed.map(({ envelope, base }) => {
         if (envelope.kind === 'idempotency-result') {
             return idempotencyResultRecord(envelope.source, envelope.recordId, envelope.revision);
         }
         if (CONTINUITY_KIND_SET.has(envelope.kind)) {
             return decodeContinuityRecord(envelope.kind, envelope.source, envelope.recordId, envelope.revision);
         }
-        const base = baseByIdentity.get(`${envelope.kind}\0${envelope.recordId}`);
         if (base === undefined)
             throw invalidPayload('records');
-        return restoreBackupBasePrincipals(envelope.source, base);
+        validateBackupBasePrincipals(base);
+        return base;
     });
     if (decoded.some((item, index) => JSON.stringify(item) !== lines[index])) {
         throw invalidPayload('coordination');
@@ -2069,6 +2058,9 @@ function validateCollabProjectBackupCheckpointConsistency(manifest, records) {
         if (item.kind === 'secret-replay-tombstone') {
             return Date.parse(item.value.expiredAt) > captureTime;
         }
+        if (item.kind === 'membership-idempotency-tombstone') {
+            return Date.parse(item.value.compactedAt) > captureTime;
+        }
         if (item.kind === 'project-invitation') {
             return captureTime < Date.parse(item.value.createdAt)
                 || (captureTime < Date.parse(item.value.secretReplayExpiresAt))
@@ -2103,9 +2095,7 @@ function validateCollabProjectBackupCheckpointConsistency(manifest, records) {
     }))
         throw invalidPayload('records');
     const baseRecords = decodedRecords.filter(item => (!CONTINUITY_KIND_SET.has(item.kind) && item.kind !== 'idempotency-result'));
-    (0, CollabProjectCheckpoint_1.validateCollabProjectCheckpointConsistency)((0, CollabProjectCheckpoint_1.decodeCollabProjectCheckpointManifest)({
-        ...decodedManifest,
-        coordinationFormatVersion: CollabProjectCheckpoint_1.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
-    }), baseRecords);
+    (0, CollabProjectCheckpoint_1.validateCheckpointRecordSequence)(baseRecords, 'backup');
+    (0, CollabProjectCheckpoint_1.validateCheckpointManifestConsistency)(decodedManifest, baseRecords);
     return records;
 }

package/dist/CollabProjectCheckpoint.d.ts

@@ -265,11 +265,36 @@ export type CollabCheckpointAuthorityVolumePairRecord = CollabCheckpointRecordBa
 }>;
 export type CollabCheckpointPortableRecord = CollabCheckpointProjectRecord | CollabCheckpointMemberRecord | CollabCheckpointRequestRecord | CollabCheckpointRequestCommentRecord | CollabCheckpointTicketRecord | CollabCheckpointTicketCommentRecord | CollabCheckpointTicketRelationRecord | CollabCheckpointTicketMentionRecord;
 export type CollabCheckpointBackupRecord = CollabCheckpointPortableRecord | CollabCheckpointCloudEventRecord | CollabCheckpointCloudEventCursorRecord | CollabCheckpointIdempotencyResultRecord | CollabCheckpointPrincipalBindingRecord | CollabCheckpointRepositoryPlacementRecord | CollabCheckpointLifecycleStateRecord | CollabCheckpointTerminalResponderRecord | CollabCheckpointProtectedClaimEnvelopeRecord | CollabCheckpointTombstoneRecord | CollabCheckpointSchemaCatalogRecord | CollabCheckpointServerCompatibilityRecord | CollabCheckpointAuthorityVolumePairRecord;
+type ParsedCheckpointPrincipalBindingRecord = CollabCheckpointRecordBase<'principal-binding', Omit<CollabCheckpointPrincipalBindingRecord['value'], 'principalId'> & {
+    readonly principalId: unknown;
+}>;
+type ParsedCheckpointTerminalResponderRecord = CollabCheckpointRecordBase<'terminal-responder', Omit<CollabCheckpointTerminalResponderRecord['value'], 'acknowledgements'> & {
+    readonly acknowledgements: readonly (Omit<CollabCheckpointTerminalAcknowledgement, 'principalId'> & {
+        readonly principalId: unknown;
+    })[];
+}>;
+/** @internal Format v3 validates principal fields after the shared base-record phase. */
+export type ParsedCheckpointRecord = Exclude<CollabCheckpointBackupRecord, CollabCheckpointPrincipalBindingRecord | CollabCheckpointTerminalResponderRecord> | ParsedCheckpointPrincipalBindingRecord | ParsedCheckpointTerminalResponderRecord;
+type CheckpointManifestFields<CoordinationVersion extends number> = Omit<CollabProjectCheckpointManifest, 'coordinationFormatVersion'> & {
+    readonly coordinationFormatVersion: CoordinationVersion;
+};
+/** @internal Shared field validation; public entry points select their own format. */
+export declare function decodeCheckpointManifestFields<CoordinationVersion extends number>(value: unknown, coordinationFormatVersion: CoordinationVersion): CheckpointManifestFields<CoordinationVersion>;
 export declare function decodeCollabProjectCheckpointManifest(value: unknown): CollabProjectCheckpointManifest;
 export declare function encodeCollabProjectCheckpointManifestCanonicalJson(manifest: CollabProjectCheckpointManifest): string;
 export declare function encodeCollabProjectCheckpointManifestDigestInput(manifest: CollabProjectCheckpointManifest): string;
+/** @internal Encode already validated fields without changing their format. */
+export declare function encodeCheckpointManifestDigestInput(decoded: CheckpointManifestFields<number>): string;
 export declare function encodeCollabProtectedClaimAssociatedData(associatedData: CollabProtectedClaimAssociatedData): string;
+/** @internal Public v1 decoding validates principals in each record. */
+export declare function decodeCheckpointRecord(value: unknown): CollabCheckpointBackupRecord;
+/** @internal Offline v3 decoding validates principals after the base-record sequence. */
+export declare function decodeCheckpointRecord(value: unknown, principalPhase: 'deferred'): ParsedCheckpointRecord;
+/** @internal V3 decoding checks terminal principals separately; consistency binds current principals. */
+export declare function validateCheckpointRecordSequence(records: readonly ParsedCheckpointRecord[], profile: CollabCheckpointProfile, acknowledgementBinding?: 'current-principal' | 'member'): void;
 export declare function decodeCollabProjectCheckpointCoordinationNdjson(value: string, profile: CollabCheckpointProfile): readonly CollabCheckpointBackupRecord[];
 export declare function encodeCollabProjectCheckpointCoordinationNdjson(records: readonly CollabCheckpointBackupRecord[], profile: CollabCheckpointProfile): string;
 export declare function validateCollabProjectCheckpointConsistency(manifest: CollabProjectCheckpointManifest, records: readonly CollabCheckpointBackupRecord[]): readonly CollabCheckpointBackupRecord[];
+/** @internal Cross-artifact checks operate on validated fields, not another format. */
+export declare function validateCheckpointManifestConsistency(decodedManifest: CheckpointManifestFields<number>, records: readonly CollabCheckpointBackupRecord[]): readonly CollabCheckpointBackupRecord[];
 export {};

package/dist/CollabProjectCheckpoint.js

@@ -1,13 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COLLAB_CHECKPOINT_BACKUP_RECORD_KINDS = exports.COLLAB_CHECKPOINT_PORTABLE_RECORD_KINDS = exports.COLLAB_CHECKPOINT_ARTIFACT_LIMITS = exports.COLLAB_PROJECT_CHECKPOINT_ARTIFACTS = exports.COLLAB_CHECKPOINT_PROFILES = exports.COLLAB_PROTECTED_CLAIM_ENVELOPE_LIMITS = exports.COLLAB_PROTECTED_CLAIM_ENVELOPE_VERSION = exports.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION = exports.COLLAB_PROJECT_CHECKPOINT_MANIFEST_SCHEMA_VERSION = void 0;
+exports.decodeCheckpointManifestFields = decodeCheckpointManifestFields;
 exports.decodeCollabProjectCheckpointManifest = decodeCollabProjectCheckpointManifest;
 exports.encodeCollabProjectCheckpointManifestCanonicalJson = encodeCollabProjectCheckpointManifestCanonicalJson;
 exports.encodeCollabProjectCheckpointManifestDigestInput = encodeCollabProjectCheckpointManifestDigestInput;
+exports.encodeCheckpointManifestDigestInput = encodeCheckpointManifestDigestInput;
 exports.encodeCollabProtectedClaimAssociatedData = encodeCollabProtectedClaimAssociatedData;
+exports.decodeCheckpointRecord = decodeCheckpointRecord;
+exports.validateCheckpointRecordSequence = validateCheckpointRecordSequence;
 exports.decodeCollabProjectCheckpointCoordinationNdjson = decodeCollabProjectCheckpointCoordinationNdjson;
 exports.encodeCollabProjectCheckpointCoordinationNdjson = encodeCollabProjectCheckpointCoordinationNdjson;
 exports.validateCollabProjectCheckpointConsistency = validateCollabProjectCheckpointConsistency;
+exports.validateCheckpointManifestConsistency = validateCheckpointManifestConsistency;
 const CollabAuthorityTransfer_1 = require("./CollabAuthorityTransfer");
 const CollabCloudProjectEvent_1 = require("./CollabCloudProjectEvent");
 const CollabConstants_1 = require("./CollabConstants");
@@ -237,7 +242,7 @@ function gitRefs(value, expectedMainOid) {
         throw invalidPayload('refs');
     return Object.freeze(decoded);
 }
-function manifestObject(source, includeManifestSha256) {
+function manifestObject(source, coordinationFormatVersion) {
     const profile = literal(source, 'profile', exports.COLLAB_CHECKPOINT_PROFILES);
     const expectedMainOid = token(source, 'expectedMainOid', CollabValidation_1.isCollabGitOid);
     const gitObjectFormat = literal(source, 'gitObjectFormat', ['sha1', 'sha256']);
@@ -273,15 +278,13 @@ function manifestObject(source, includeManifestSha256) {
         sourceAuthority,
         targetAuthority,
     };
-    if (common.coordinationFormatVersion !== exports.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION
+    if (common.coordinationFormatVersion !== coordinationFormatVersion
         || common.manifestSchemaVersion !== exports.COLLAB_PROJECT_CHECKPOINT_MANIFEST_SCHEMA_VERSION
         || common.protocolVersion !== CollabConstants_1.COLLAB_PROTOCOL_VERSION)
         throw invalidPayload('manifest');
-    if (!includeManifestSha256)
-        return common;
     return {
         artifacts: common.artifacts,
-        coordinationFormatVersion: exports.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
+        coordinationFormatVersion,
         createdAt: common.createdAt,
         expectedMainOid: common.expectedMainOid,
         gitObjectFormat: common.gitObjectFormat,
@@ -296,7 +299,8 @@ function manifestObject(source, includeManifestSha256) {
         targetAuthority: common.targetAuthority,
     };
 }
-function decodeCollabProjectCheckpointManifest(value) {
+/** @internal Shared field validation; public entry points select their own format. */
+function decodeCheckpointManifestFields(value, coordinationFormatVersion) {
     const source = exactRecord(value, 'manifest', [
         'artifacts',
         'coordinationFormatVersion',
@@ -313,18 +317,24 @@ function decodeCollabProjectCheckpointManifest(value) {
         'sourceAuthority',
         'targetAuthority',
     ]);
-    const decoded = manifestObject(source, true);
+    const decoded = manifestObject(source, coordinationFormatVersion);
     const encoded = JSON.stringify(decoded);
     if (!(0, CollabValidation_1.hasUtf8ByteLengthAtMost)(encoded, exports.COLLAB_CHECKPOINT_ARTIFACT_LIMITS.maxManifestBytes)) {
         throw invalidPayload('manifest');
     }
     return decoded;
 }
+function decodeCollabProjectCheckpointManifest(value) {
+    return decodeCheckpointManifestFields(value, exports.COLLAB_PROJECT_COORDINATION_FORMAT_VERSION);
+}
 function encodeCollabProjectCheckpointManifestCanonicalJson(manifest) {
     return JSON.stringify(decodeCollabProjectCheckpointManifest(manifest));
 }
 function encodeCollabProjectCheckpointManifestDigestInput(manifest) {
-    const decoded = decodeCollabProjectCheckpointManifest(manifest);
+    return encodeCheckpointManifestDigestInput(decodeCollabProjectCheckpointManifest(manifest));
+}
+/** @internal Encode already validated fields without changing their format. */
+function encodeCheckpointManifestDigestInput(decoded) {
     const source = {
         artifacts: decoded.artifacts,
         coordinationFormatVersion: decoded.coordinationFormatVersion,
@@ -707,13 +717,13 @@ function idempotencyResultRecord(source, recordId, revision) {
         },
     };
 }
-function principalBindingRecord(source, recordId, revision) {
-    const value = exactRecord(source.value, 'value', [
+function principalBindingRecord(source, recordId, revision, deferPrincipals) {
+    const value = principalRecord(source.value, 'value', [
         'boundAt',
         'memberId',
         'principalId',
         'projectId',
-    ]);
+    ], deferPrincipals);
     const memberId = token(value, 'memberId', CollabValidation_1.isCollabMemberId);
     if (recordId !== memberId)
         throw invalidPayload('recordId');
@@ -724,7 +734,7 @@ function principalBindingRecord(source, recordId, revision) {
         value: {
             boundAt: timestamp(value, 'boundAt'),
             memberId,
-            principalId: token(value, 'principalId'),
+            principalId: deferPrincipals ? value.principalId : token(value, 'principalId'),
             projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
         },
     };
@@ -858,7 +868,13 @@ function lifecycleStateRecord(source, recordId, revision) {
         value: internalState,
     };
 }
-function terminalResponderRecord(source, recordId, revision) {
+function principalRecord(value, field, keys, deferPrincipals) {
+    const source = record(value, field);
+    return exactRecord(source, field, deferPrincipals && !Object.hasOwn(source, 'principalId')
+        ? keys.filter(key => key !== 'principalId')
+        : keys);
+}
+function terminalResponderRecord(source, recordId, revision, deferPrincipals) {
     const value = exactRecord(source.value, 'value', [
         'acknowledgements',
         'eligibleMemberIds',
@@ -910,22 +926,24 @@ function terminalResponderRecord(source, recordId, revision) {
     if (!Array.isArray(value.acknowledgements))
         throw invalidPayload('acknowledgements');
     const acknowledgements = value.acknowledgements.map((item) => {
-        const acknowledgement = exactRecord(item, 'acknowledgement', [
+        const acknowledgement = principalRecord(item, 'acknowledgement', [
             'acknowledgedAt',
             'memberId',
             'principalId',
-        ]);
+        ], deferPrincipals);
         return {
             acknowledgedAt: timestamp(acknowledgement, 'acknowledgedAt'),
             memberId: token(acknowledgement, 'memberId', CollabValidation_1.isCollabMemberId),
-            principalId: token(acknowledgement, 'principalId'),
+            principalId: deferPrincipals
+                ? acknowledgement.principalId
+                : token(acknowledgement, 'principalId'),
         };
     });
     const acknowledgementPrincipals = new Set();
     acknowledgements.forEach((item, index) => {
         if (!eligibleMemberIds.includes(item.memberId)
             || (index > 0 && acknowledgements[index - 1].memberId.localeCompare(item.memberId, 'en-US') >= 0)
-            || acknowledgementPrincipals.has(item.principalId))
+            || (!deferPrincipals && acknowledgementPrincipals.has(item.principalId)))
             throw invalidPayload('acknowledgements');
         acknowledgementPrincipals.add(item.principalId);
     });
@@ -934,7 +952,7 @@ function terminalResponderRecord(source, recordId, revision) {
         recordId,
         revision,
         value: {
-            acknowledgements: Object.freeze(acknowledgements),
+            acknowledgements,
             eligibleMemberIds: Object.freeze(eligibleMemberIds),
             expiresAt,
             operation,
@@ -1107,8 +1125,9 @@ function authorityVolumePairRecord(source, recordId, revision) {
         },
     };
 }
-function decodeCheckpointRecord(value) {
+function decodeCheckpointRecord(value, principalPhase) {
     const { kind, recordId, revision, source } = recordEnvelope(value);
+    const deferPrincipals = principalPhase === 'deferred';
     switch (kind) {
         case 'project': return projectRecord(source, recordId, revision);
         case 'member': return memberRecord(source, recordId, revision);
@@ -1121,10 +1140,12 @@ function decodeCheckpointRecord(value) {
         case 'cloud-event': return cloudEventRecord(source, recordId, revision);
         case 'cloud-event-cursor': return cloudEventCursorRecord(source, recordId, revision);
         case 'idempotency-result': return idempotencyResultRecord(source, recordId, revision);
-        case 'principal-binding': return principalBindingRecord(source, recordId, revision);
+        case 'principal-binding':
+            return principalBindingRecord(source, recordId, revision, deferPrincipals);
         case 'repository-placement': return repositoryPlacementRecord(source, recordId, revision);
         case 'lifecycle-state': return lifecycleStateRecord(source, recordId, revision);
-        case 'terminal-responder': return terminalResponderRecord(source, recordId, revision);
+        case 'terminal-responder':
+            return terminalResponderRecord(source, recordId, revision, deferPrincipals);
         case 'protected-claim-envelope':
             return protectedClaimEnvelopeRecord(source, recordId, revision);
         case 'tombstone': return tombstoneRecord(source, recordId, revision);
@@ -1140,7 +1161,8 @@ function compareRecords(left, right) {
     const kindOrder = recordKindOrder(left.kind) - recordKindOrder(right.kind);
     return kindOrder !== 0 ? kindOrder : left.recordId.localeCompare(right.recordId, 'en-US');
 }
-function validateRecordSequence(records, profile) {
+/** @internal V3 decoding checks terminal principals separately; consistency binds current principals. */
+function validateCheckpointRecordSequence(records, profile, acknowledgementBinding = 'current-principal') {
     if (records.length === 0 || records[0].kind !== 'project')
         throw invalidPayload('records');
     const projectId = records[0].recordId;
@@ -1243,7 +1265,9 @@ function validateRecordSequence(records, profile) {
             throw invalidPayload('records');
         }
         if (item.kind === 'terminal-responder' && (item.value.eligibleMemberIds.some(memberId => !members.has(memberId))
-            || item.value.acknowledgements.some(acknowledgement => (principalBindings.get(acknowledgement.memberId) !== acknowledgement.principalId))))
+            || item.value.acknowledgements.some(acknowledgement => (acknowledgementBinding === 'current-principal'
+                ? principalBindings.get(acknowledgement.memberId) !== acknowledgement.principalId
+                : !principalBindings.has(acknowledgement.memberId)))))
             throw invalidPayload('records');
     }
     if (profile === 'backup') {
@@ -1270,11 +1294,13 @@ function decodeCollabProjectCheckpointCoordinationNdjson(value, profile) {
             throw invalidPayload('coordination');
         }
         const result = decodeCheckpointRecord(parsed);
+        if (result.kind === 'terminal-responder')
+            Object.freeze(result.value.acknowledgements);
         if (JSON.stringify(result) !== line)
             throw invalidPayload('coordination');
         return result;
     });
-    validateRecordSequence(decoded, profile);
+    validateCheckpointRecordSequence(decoded, profile);
     return Object.freeze(decoded);
 }
 function encodeCollabProjectCheckpointCoordinationNdjson(records, profile) {
@@ -1306,7 +1332,11 @@ function checkpointRecordGitOids(checkpointRecord) {
 }
 function validateCollabProjectCheckpointConsistency(manifest, records) {
     const decodedManifest = decodeCollabProjectCheckpointManifest(manifest);
-    validateRecordSequence(records, decodedManifest.profile);
+    validateCheckpointRecordSequence(records, decodedManifest.profile);
+    return validateCheckpointManifestConsistency(decodedManifest, records);
+}
+/** @internal Cross-artifact checks operate on validated fields, not another format. */
+function validateCheckpointManifestConsistency(decodedManifest, records) {
     const project = records[0];
     if (project.kind !== 'project'
         || project.value.projectId !== decodedManifest.projectId

package/dist/esm/CollabProjectBackupCheckpoint.mjs

@@ -2,7 +2,7 @@ import { COLLAB_AUTHORITY_TRANSFER_CANCELLATION_PHASES, COLLAB_CLOUD_TO_LAN_TRAN
 import { COLLAB_MAIN_REF, COLLAB_MEMBER_REF_PREFIX, } from './CollabConstants.mjs';
 import { collabControlOperationCodec, } from './CollabControlOperationCodecs.mjs';
 import { CollabError } from './CollabError.mjs';
-import { COLLAB_CHECKPOINT_ARTIFACT_LIMITS, COLLAB_CHECKPOINT_PORTABLE_RECORD_KINDS, COLLAB_PROJECT_COORDINATION_FORMAT_VERSION, decodeCollabProjectCheckpointCoordinationNdjson, decodeCollabProjectCheckpointManifest, validateCollabProjectCheckpointConsistency, } from './CollabProjectCheckpoint.mjs';
+import { COLLAB_CHECKPOINT_ARTIFACT_LIMITS, COLLAB_CHECKPOINT_PORTABLE_RECORD_KINDS, decodeCheckpointManifestFields, decodeCheckpointRecord, encodeCheckpointManifestDigestInput, validateCheckpointManifestConsistency, validateCheckpointRecordSequence, } from './CollabProjectCheckpoint.mjs';
 import { COLLAB_PROJECT_MEMBERSHIP_LIMITS, } from './CollabProjectMembership.mjs';
 import { hasUtf8ByteLengthAtMost, isCollabGitOid, isCollabMemberId, isCollabOpaqueId, isCollabProjectId, } from './CollabValidation.mjs';
 export const COLLAB_PROJECT_BACKUP_COMPATIBILITY_STAGE = 'pre-production-replaceable';
@@ -22,6 +22,7 @@ const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'transferred-membership-claim-override',
     'protected-claim-override-envelope',
     'manager-responsibility-offer',
+    'membership-idempotency-tombstone',
     'project-membership-recovery',
     'secret-replay-tombstone',
 ]);
@@ -197,65 +198,19 @@ function absoluteTargetUrl(source) {
 function principal(source, field) {
     return token(source, field, value => (typeof value === 'string' && PRINCIPAL_PATTERN.test(value)));
 }
-function sanitizeBackupBasePrincipalRecord(item) {
-    const source = record(item, 'record');
-    const value = record(source.value, 'value');
-    if (source.kind === 'principal-binding') {
-        return {
-            ...source,
-            value: { ...value, principalId: `principal_${String(value.memberId)}` },
-        };
-    }
-    if (source.kind === 'terminal-responder' && Array.isArray(value.acknowledgements)) {
-        return {
-            ...source,
-            value: {
-                ...value,
-                acknowledgements: value.acknowledgements.map(item => ({
-                    ...record(item, 'acknowledgement'),
-                    principalId: `principal_${String(record(item, 'acknowledgement').memberId)}`,
-                })),
-            },
-        };
-    }
-    return item;
-}
-function restoreBackupBasePrincipals(source, base) {
-    if (base.kind === 'principal-binding') {
-        const value = exactRecord(source.value, 'value', [
-            'boundAt', 'memberId', 'principalId', 'projectId',
-        ]);
-        return {
-            ...base,
-            value: { ...base.value, principalId: principal(value, 'principalId') },
-        };
-    }
+function validateBackupBasePrincipals(base) {
+    if (base.kind === 'principal-binding')
+        principal(base.value, 'principalId');
     if (base.kind === 'terminal-responder') {
-        const value = exactRecord(source.value, 'value', [
-            'acknowledgements',
-            'eligibleMemberIds',
-            'expiresAt',
-            'operation',
-            'operationId',
-            'projectId',
-            'responseJson',
-        ]);
-        const sourceAcknowledgements = value.acknowledgements;
-        if (!Array.isArray(sourceAcknowledgements)
-            || sourceAcknowledgements.length !== base.value.acknowledgements.length)
-            throw invalidPayload('acknowledgements');
-        const acknowledgements = base.value.acknowledgements.map((item, index) => {
-            const original = exactRecord(sourceAcknowledgements[index], 'acknowledgement', [
-                'acknowledgedAt', 'memberId', 'principalId',
-            ]);
-            return { ...item, principalId: principal(original, 'principalId') };
-        });
-        if (new Set(acknowledgements.map(item => item.principalId)).size !== acknowledgements.length) {
-            throw invalidPayload('acknowledgements');
+        for (const acknowledgement of base.value.acknowledgements) {
+            if (acknowledgement.principalId === undefined)
+                throw invalidPayload('acknowledgement');
+            principal(acknowledgement, 'principalId');
         }
-        return { ...base, value: { ...base.value, acknowledgements } };
+        if (new Set(base.value.acknowledgements.map(item => item.principalId)).size
+            !== base.value.acknowledgements.length)
+            throw invalidPayload('acknowledgements');
     }
-    return base;
 }
 function repositoryPublicationRef(value) {
     const source = exactRecord(value, 'ref', ['name', 'oid']);
@@ -1173,6 +1128,41 @@ function membershipRecoveryRecord(source, recordId, revision) {
         },
     };
 }
+function membershipIdempotencyTombstoneRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'actorMemberId',
+        'compactedAt',
+        'idempotencyKey',
+        'operation',
+        'projectId',
+        'requestFingerprint',
+    ]);
+    const actorMemberId = token(value, 'actorMemberId', isCollabMemberId);
+    const idempotencyKey = token(value, 'idempotencyKey');
+    const operation = literal(value, 'operation', [
+        'createManagerResponsibilityOffer',
+        'acknowledgeManagerResponsibility',
+        'declineManagerResponsibility',
+        'cancelManagerResponsibilityOffer',
+        'promoteManager',
+    ]);
+    if (recordId !== `${operation}:${actorMemberId}:${idempotencyKey}`) {
+        throw invalidPayload('recordId');
+    }
+    return {
+        kind: 'membership-idempotency-tombstone',
+        recordId,
+        revision,
+        value: {
+            actorMemberId,
+            compactedAt: timestamp(value, 'compactedAt'),
+            idempotencyKey,
+            operation,
+            projectId: token(value, 'projectId', isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
 function secretReplayTombstoneRecord(source, recordId, revision) {
     const value = exactRecord(source.value, 'value', [
         'actorMemberId',
@@ -1230,6 +1220,8 @@ function decodeContinuityRecord(kind, source, recordId, revision) {
             return protectedClaimOverrideEnvelopeRecord(source, recordId, revision);
         case 'manager-responsibility-offer':
             return managerResponsibilityOfferRecord(source, recordId, revision);
+        case 'membership-idempotency-tombstone':
+            return membershipIdempotencyTombstoneRecord(source, recordId, revision);
         case 'project-membership-recovery':
             return membershipRecoveryRecord(source, recordId, revision);
         case 'secret-replay-tombstone':
@@ -1399,6 +1391,7 @@ function validateContinuity(records) {
         item,
     ]));
     const managerOffers = records.filter((item) => (item.kind === 'manager-responsibility-offer'));
+    const membershipIdempotencyTombstones = records.filter((item) => (item.kind === 'membership-idempotency-tombstone'));
     const membershipRecoveries = new Map(records
         .filter((item) => (item.kind === 'project-membership-recovery'))
         .map(item => [item.value.operationId, item]));
@@ -1782,6 +1775,18 @@ function validateContinuity(records) {
             throw invalidPayload('records');
         }
     }
+    for (const tombstone of membershipIdempotencyTombstones) {
+        const exactResult = records.some(item => (item.kind === 'idempotency-result'
+            && item.value.memberId === tombstone.value.actorMemberId
+            && item.value.operation === tombstone.value.operation
+            && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        const exactOffer = tombstone.value.operation === 'createManagerResponsibilityOffer'
+            && managerOffers.some(item => (item.value.sourceManagerMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        if (!members.has(tombstone.value.actorMemberId) || exactResult || exactOffer) {
+            throw invalidPayload('records');
+        }
+    }
     for (const item of records) {
         if (item.kind === 'idempotency-result' && !members.has(item.value.memberId)) {
             throw invalidPayload('records');
@@ -1949,55 +1954,18 @@ function validateContinuity(records) {
         }
     }
 }
-function manifestWithFormatOne(value) {
+export function decodeCollabProjectBackupCheckpointManifest(value) {
     const source = record(value, 'manifest');
     if (source.profile !== 'backup'
         || source.coordinationFormatVersion !== COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION)
         throw invalidPayload('manifest');
-    return decodeCollabProjectCheckpointManifest({
-        ...source,
-        coordinationFormatVersion: COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
-    });
-}
-export function decodeCollabProjectBackupCheckpointManifest(value) {
-    const decoded = manifestWithFormatOne(value);
-    return {
-        artifacts: decoded.artifacts,
-        coordinationFormatVersion: COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION,
-        createdAt: decoded.createdAt,
-        expectedMainOid: decoded.expectedMainOid,
-        gitObjectFormat: decoded.gitObjectFormat,
-        manifestSchemaVersion: decoded.manifestSchemaVersion,
-        manifestSha256: decoded.manifestSha256,
-        operationId: decoded.operationId,
-        profile: 'backup',
-        projectId: decoded.projectId,
-        protocolVersion: decoded.protocolVersion,
-        refs: decoded.refs,
-        sourceAuthority: decoded.sourceAuthority,
-        targetAuthority: decoded.targetAuthority,
-    };
+    return decodeCheckpointManifestFields(source, COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION);
 }
 export function encodeCollabProjectBackupCheckpointManifestCanonicalJson(manifest) {
     return JSON.stringify(decodeCollabProjectBackupCheckpointManifest(manifest));
 }
 export function encodeCollabProjectBackupCheckpointManifestDigestInput(manifest) {
-    const decoded = decodeCollabProjectBackupCheckpointManifest(manifest);
-    return JSON.stringify({
-        artifacts: decoded.artifacts,
-        coordinationFormatVersion: decoded.coordinationFormatVersion,
-        createdAt: decoded.createdAt,
-        expectedMainOid: decoded.expectedMainOid,
-        gitObjectFormat: decoded.gitObjectFormat,
-        manifestSchemaVersion: decoded.manifestSchemaVersion,
-        operationId: decoded.operationId,
-        profile: decoded.profile,
-        projectId: decoded.projectId,
-        protocolVersion: decoded.protocolVersion,
-        refs: decoded.refs,
-        sourceAuthority: decoded.sourceAuthority,
-        targetAuthority: decoded.targetAuthority,
-    });
+    return encodeCheckpointManifestDigestInput(decodeCollabProjectBackupCheckpointManifest(manifest));
 }
 export function decodeCollabProjectBackupCheckpointCoordinationNdjson(value) {
     if (typeof value !== 'string'
@@ -2017,22 +1985,43 @@ export function decodeCollabProjectBackupCheckpointCoordinationNdjson(value) {
         }
         if (JSON.stringify(item) !== line)
             throw invalidPayload('coordination');
-        return { envelope: recordEnvelope(item), item };
+        return {
+            envelope: recordEnvelope(item),
+            item,
+            base: undefined,
+        };
     });
     const baseItems = parsed.filter(({ envelope }) => (!CONTINUITY_KIND_SET.has(envelope.kind) && envelope.kind !== 'idempotency-result'));
-    const baseDecoded = decodeCollabProjectCheckpointCoordinationNdjson(baseItems.map(({ item }) => JSON.stringify(sanitizeBackupBasePrincipalRecord(item))).join('\n') + '\n', 'backup');
-    const baseByIdentity = new Map(baseDecoded.map(item => [`${item.kind}\0${item.recordId}`, item]));
-    const decoded = parsed.map(({ envelope }) => {
+    for (const { envelope } of baseItems) {
+        const value = record(envelope.source.value, 'value');
+        if (envelope.kind === 'terminal-responder' && Array.isArray(value.acknowledgements)) {
+            for (const acknowledgement of value.acknowledgements)
+                record(acknowledgement, 'acknowledgement');
+        }
+    }
+    const baseRecords = [];
+    for (const entry of baseItems) {
+        entry.base = decodeCheckpointRecord(entry.item, 'deferred');
+        if (JSON.stringify(entry.base) !== JSON.stringify(entry.item)
+            || (entry.base.kind === 'principal-binding' && entry.base.value.principalId === undefined)) {
+            throw invalidPayload('coordination');
+        }
+        baseRecords.push(entry.base);
+    }
+    if (baseRecords.length === 0)
+        throw invalidPayload('coordination');
+    validateCheckpointRecordSequence(baseRecords, 'backup', 'member');
+    const decoded = parsed.map(({ envelope, base }) => {
         if (envelope.kind === 'idempotency-result') {
             return idempotencyResultRecord(envelope.source, envelope.recordId, envelope.revision);
         }
         if (CONTINUITY_KIND_SET.has(envelope.kind)) {
             return decodeContinuityRecord(envelope.kind, envelope.source, envelope.recordId, envelope.revision);
         }
-        const base = baseByIdentity.get(`${envelope.kind}\0${envelope.recordId}`);
         if (base === undefined)
             throw invalidPayload('records');
-        return restoreBackupBasePrincipals(envelope.source, base);
+        validateBackupBasePrincipals(base);
+        return base;
     });
     if (decoded.some((item, index) => JSON.stringify(item) !== lines[index])) {
         throw invalidPayload('coordination');
@@ -2059,6 +2048,9 @@ export function validateCollabProjectBackupCheckpointConsistency(manifest, recor
         if (item.kind === 'secret-replay-tombstone') {
             return Date.parse(item.value.expiredAt) > captureTime;
         }
+        if (item.kind === 'membership-idempotency-tombstone') {
+            return Date.parse(item.value.compactedAt) > captureTime;
+        }
         if (item.kind === 'project-invitation') {
             return captureTime < Date.parse(item.value.createdAt)
                 || (captureTime < Date.parse(item.value.secretReplayExpiresAt))
@@ -2093,9 +2085,7 @@ export function validateCollabProjectBackupCheckpointConsistency(manifest, recor
     }))
         throw invalidPayload('records');
     const baseRecords = decodedRecords.filter(item => (!CONTINUITY_KIND_SET.has(item.kind) && item.kind !== 'idempotency-result'));
-    validateCollabProjectCheckpointConsistency(decodeCollabProjectCheckpointManifest({
-        ...decodedManifest,
-        coordinationFormatVersion: COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
-    }), baseRecords);
+    validateCheckpointRecordSequence(baseRecords, 'backup');
+    validateCheckpointManifestConsistency(decodedManifest, baseRecords);
     return records;
 }

package/dist/esm/CollabProjectCheckpoint.mjs

@@ -227,7 +227,7 @@ function gitRefs(value, expectedMainOid) {
         throw invalidPayload('refs');
     return Object.freeze(decoded);
 }
-function manifestObject(source, includeManifestSha256) {
+function manifestObject(source, coordinationFormatVersion) {
     const profile = literal(source, 'profile', COLLAB_CHECKPOINT_PROFILES);
     const expectedMainOid = token(source, 'expectedMainOid', isCollabGitOid);
     const gitObjectFormat = literal(source, 'gitObjectFormat', ['sha1', 'sha256']);
@@ -263,15 +263,13 @@ function manifestObject(source, includeManifestSha256) {
         sourceAuthority,
         targetAuthority,
     };
-    if (common.coordinationFormatVersion !== COLLAB_PROJECT_COORDINATION_FORMAT_VERSION
+    if (common.coordinationFormatVersion !== coordinationFormatVersion
         || common.manifestSchemaVersion !== COLLAB_PROJECT_CHECKPOINT_MANIFEST_SCHEMA_VERSION
         || common.protocolVersion !== COLLAB_PROTOCOL_VERSION)
         throw invalidPayload('manifest');
-    if (!includeManifestSha256)
-        return common;
     return {
         artifacts: common.artifacts,
-        coordinationFormatVersion: COLLAB_PROJECT_COORDINATION_FORMAT_VERSION,
+        coordinationFormatVersion,
         createdAt: common.createdAt,
         expectedMainOid: common.expectedMainOid,
         gitObjectFormat: common.gitObjectFormat,
@@ -286,7 +284,8 @@ function manifestObject(source, includeManifestSha256) {
         targetAuthority: common.targetAuthority,
     };
 }
-export function decodeCollabProjectCheckpointManifest(value) {
+/** @internal Shared field validation; public entry points select their own format. */
+export function decodeCheckpointManifestFields(value, coordinationFormatVersion) {
     const source = exactRecord(value, 'manifest', [
         'artifacts',
         'coordinationFormatVersion',
@@ -303,18 +302,24 @@ export function decodeCollabProjectCheckpointManifest(value) {
         'sourceAuthority',
         'targetAuthority',
     ]);
-    const decoded = manifestObject(source, true);
+    const decoded = manifestObject(source, coordinationFormatVersion);
     const encoded = JSON.stringify(decoded);
     if (!hasUtf8ByteLengthAtMost(encoded, COLLAB_CHECKPOINT_ARTIFACT_LIMITS.maxManifestBytes)) {
         throw invalidPayload('manifest');
     }
     return decoded;
 }
+export function decodeCollabProjectCheckpointManifest(value) {
+    return decodeCheckpointManifestFields(value, COLLAB_PROJECT_COORDINATION_FORMAT_VERSION);
+}
 export function encodeCollabProjectCheckpointManifestCanonicalJson(manifest) {
     return JSON.stringify(decodeCollabProjectCheckpointManifest(manifest));
 }
 export function encodeCollabProjectCheckpointManifestDigestInput(manifest) {
-    const decoded = decodeCollabProjectCheckpointManifest(manifest);
+    return encodeCheckpointManifestDigestInput(decodeCollabProjectCheckpointManifest(manifest));
+}
+/** @internal Encode already validated fields without changing their format. */
+export function encodeCheckpointManifestDigestInput(decoded) {
     const source = {
         artifacts: decoded.artifacts,
         coordinationFormatVersion: decoded.coordinationFormatVersion,
@@ -697,13 +702,13 @@ function idempotencyResultRecord(source, recordId, revision) {
         },
     };
 }
-function principalBindingRecord(source, recordId, revision) {
-    const value = exactRecord(source.value, 'value', [
+function principalBindingRecord(source, recordId, revision, deferPrincipals) {
+    const value = principalRecord(source.value, 'value', [
         'boundAt',
         'memberId',
         'principalId',
         'projectId',
-    ]);
+    ], deferPrincipals);
     const memberId = token(value, 'memberId', isCollabMemberId);
     if (recordId !== memberId)
         throw invalidPayload('recordId');
@@ -714,7 +719,7 @@ function principalBindingRecord(source, recordId, revision) {
         value: {
             boundAt: timestamp(value, 'boundAt'),
             memberId,
-            principalId: token(value, 'principalId'),
+            principalId: deferPrincipals ? value.principalId : token(value, 'principalId'),
             projectId: token(value, 'projectId', isCollabProjectId),
         },
     };
@@ -848,7 +853,13 @@ function lifecycleStateRecord(source, recordId, revision) {
         value: internalState,
     };
 }
-function terminalResponderRecord(source, recordId, revision) {
+function principalRecord(value, field, keys, deferPrincipals) {
+    const source = record(value, field);
+    return exactRecord(source, field, deferPrincipals && !Object.hasOwn(source, 'principalId')
+        ? keys.filter(key => key !== 'principalId')
+        : keys);
+}
+function terminalResponderRecord(source, recordId, revision, deferPrincipals) {
     const value = exactRecord(source.value, 'value', [
         'acknowledgements',
         'eligibleMemberIds',
@@ -900,22 +911,24 @@ function terminalResponderRecord(source, recordId, revision) {
     if (!Array.isArray(value.acknowledgements))
         throw invalidPayload('acknowledgements');
     const acknowledgements = value.acknowledgements.map((item) => {
-        const acknowledgement = exactRecord(item, 'acknowledgement', [
+        const acknowledgement = principalRecord(item, 'acknowledgement', [
             'acknowledgedAt',
             'memberId',
             'principalId',
-        ]);
+        ], deferPrincipals);
         return {
             acknowledgedAt: timestamp(acknowledgement, 'acknowledgedAt'),
             memberId: token(acknowledgement, 'memberId', isCollabMemberId),
-            principalId: token(acknowledgement, 'principalId'),
+            principalId: deferPrincipals
+                ? acknowledgement.principalId
+                : token(acknowledgement, 'principalId'),
         };
     });
     const acknowledgementPrincipals = new Set();
     acknowledgements.forEach((item, index) => {
         if (!eligibleMemberIds.includes(item.memberId)
             || (index > 0 && acknowledgements[index - 1].memberId.localeCompare(item.memberId, 'en-US') >= 0)
-            || acknowledgementPrincipals.has(item.principalId))
+            || (!deferPrincipals && acknowledgementPrincipals.has(item.principalId)))
             throw invalidPayload('acknowledgements');
         acknowledgementPrincipals.add(item.principalId);
     });
@@ -924,7 +937,7 @@ function terminalResponderRecord(source, recordId, revision) {
         recordId,
         revision,
         value: {
-            acknowledgements: Object.freeze(acknowledgements),
+            acknowledgements,
             eligibleMemberIds: Object.freeze(eligibleMemberIds),
             expiresAt,
             operation,
@@ -1097,8 +1110,9 @@ function authorityVolumePairRecord(source, recordId, revision) {
         },
     };
 }
-function decodeCheckpointRecord(value) {
+export function decodeCheckpointRecord(value, principalPhase) {
     const { kind, recordId, revision, source } = recordEnvelope(value);
+    const deferPrincipals = principalPhase === 'deferred';
     switch (kind) {
         case 'project': return projectRecord(source, recordId, revision);
         case 'member': return memberRecord(source, recordId, revision);
@@ -1111,10 +1125,12 @@ function decodeCheckpointRecord(value) {
         case 'cloud-event': return cloudEventRecord(source, recordId, revision);
         case 'cloud-event-cursor': return cloudEventCursorRecord(source, recordId, revision);
         case 'idempotency-result': return idempotencyResultRecord(source, recordId, revision);
-        case 'principal-binding': return principalBindingRecord(source, recordId, revision);
+        case 'principal-binding':
+            return principalBindingRecord(source, recordId, revision, deferPrincipals);
         case 'repository-placement': return repositoryPlacementRecord(source, recordId, revision);
         case 'lifecycle-state': return lifecycleStateRecord(source, recordId, revision);
-        case 'terminal-responder': return terminalResponderRecord(source, recordId, revision);
+        case 'terminal-responder':
+            return terminalResponderRecord(source, recordId, revision, deferPrincipals);
         case 'protected-claim-envelope':
             return protectedClaimEnvelopeRecord(source, recordId, revision);
         case 'tombstone': return tombstoneRecord(source, recordId, revision);
@@ -1130,7 +1146,8 @@ function compareRecords(left, right) {
     const kindOrder = recordKindOrder(left.kind) - recordKindOrder(right.kind);
     return kindOrder !== 0 ? kindOrder : left.recordId.localeCompare(right.recordId, 'en-US');
 }
-function validateRecordSequence(records, profile) {
+/** @internal V3 decoding checks terminal principals separately; consistency binds current principals. */
+export function validateCheckpointRecordSequence(records, profile, acknowledgementBinding = 'current-principal') {
     if (records.length === 0 || records[0].kind !== 'project')
         throw invalidPayload('records');
     const projectId = records[0].recordId;
@@ -1233,7 +1250,9 @@ function validateRecordSequence(records, profile) {
             throw invalidPayload('records');
         }
         if (item.kind === 'terminal-responder' && (item.value.eligibleMemberIds.some(memberId => !members.has(memberId))
-            || item.value.acknowledgements.some(acknowledgement => (principalBindings.get(acknowledgement.memberId) !== acknowledgement.principalId))))
+            || item.value.acknowledgements.some(acknowledgement => (acknowledgementBinding === 'current-principal'
+                ? principalBindings.get(acknowledgement.memberId) !== acknowledgement.principalId
+                : !principalBindings.has(acknowledgement.memberId)))))
             throw invalidPayload('records');
     }
     if (profile === 'backup') {
@@ -1260,11 +1279,13 @@ export function decodeCollabProjectCheckpointCoordinationNdjson(value, profile)
             throw invalidPayload('coordination');
         }
         const result = decodeCheckpointRecord(parsed);
+        if (result.kind === 'terminal-responder')
+            Object.freeze(result.value.acknowledgements);
         if (JSON.stringify(result) !== line)
             throw invalidPayload('coordination');
         return result;
     });
-    validateRecordSequence(decoded, profile);
+    validateCheckpointRecordSequence(decoded, profile);
     return Object.freeze(decoded);
 }
 export function encodeCollabProjectCheckpointCoordinationNdjson(records, profile) {
@@ -1296,7 +1317,11 @@ function checkpointRecordGitOids(checkpointRecord) {
 }
 export function validateCollabProjectCheckpointConsistency(manifest, records) {
     const decodedManifest = decodeCollabProjectCheckpointManifest(manifest);
-    validateRecordSequence(records, decodedManifest.profile);
+    validateCheckpointRecordSequence(records, decodedManifest.profile);
+    return validateCheckpointManifestConsistency(decodedManifest, records);
+}
+/** @internal Cross-artifact checks operate on validated fields, not another format. */
+export function validateCheckpointManifestConsistency(decodedManifest, records) {
     const project = records[0];
     if (project.kind !== 'project'
         || project.value.projectId !== decodedManifest.projectId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudian-collab/protocol",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "Canonical Collab wire and Cloud binding contract for Claudian clients and servers.",
   "license": "MIT",
   "repository": {
@@ -46,7 +46,7 @@
     "release:candidate": "node scripts/release-candidate.mjs --output .context/release",
     "test": "jest && node --test tests/*.test.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.jest.json",
-    "verify": "npm run lint && npm run typecheck && npm run build && npm run test && npm run check:compatibility && npm run check:migration-provenance && npm run verify:pack && npm run release:candidate",
+    "verify": "npm run lint && npm run typecheck && npm run release:candidate && npm run test && npm run check:compatibility && npm run check:migration-provenance && npm run verify:pack",
     "verify:pack": "node scripts/verify-pack.mjs"
   },
   "dependencies": {