@claudian-collab/protocol 4.1.3 → 4.2.0

package/README.md

@@ -20,7 +20,7 @@ or compatibility rules.
 - Shared limits that client and server must agree on (`COLLAB_LIMITS`)
 - Protocol-version negotiation (`COLLAB_PROTOCOL_VERSION`, envelope decoding)
 - Canonical Project checkpoint profiles, logical records, authority-generation transfer, exact membership claims, target-signed redemption receipts, offline backup operational continuity, and Project retirement contracts
-- Cloud binding v4 route construction/matching, bounded checkpoint streams, capability negotiation, strict success/error envelopes, private-development bootstrap, Project snapshot, and redacted event contracts
+- Cloud binding v5 route construction/matching, bounded checkpoint streams, capability negotiation, strict success/error envelopes, private-development bootstrap, Project snapshot, and redacted event contracts
 - Markdown-derived Ticket-reference and Member-mention semantics shared by
   client rendering and authority derivation
 
@@ -37,7 +37,7 @@ fixed part of the detail so the whole detail stays within
 has one compatible final-serialization limit. Request comments and Ticket
 accepted relations also have shared authority-enforced total limits; summary
 counts let complete consumers reject partial or cross-snapshot assembly.
-Cloud binding v4 retains the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v8 adds target-confirmed Cloud-to-LAN invalidation and cleanup to the existing authority-transfer contract. Its domain-separated Ed25519 proof binds the exact target Member, source and target generations, checkpoint, stage, current claim batch when present, and cleanup digest; Manager cancellation, timeout, disconnect, or target absence does not prove cleanup. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export use wire-visible coordination format v1, and offline backup uses format v3. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Existing LAN Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds shared payloads without creating another shared operation registry.
+Cloud binding v5 retains the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v9 retains target-confirmed Cloud-to-LAN invalidation and cleanup to the existing authority-transfer contract. Its domain-separated Ed25519 proof binds the exact target Member, source and target generations, checkpoint, stage, current claim batch when present, and cleanup digest; Manager cancellation, timeout, disconnect, or target absence does not prove cleanup. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export use wire-visible coordination format v1, and offline backup uses format v3. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Existing LAN Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds shared payloads without creating another shared operation registry.
 
 Backup coordination artifacts are limited to 256 MiB of actual UTF-8 bytes, including the final newline. The decoder, encoder, and consistency checker apply this same inclusive limit without rewriting principals into an intermediate format. Valid current-format artifacts at the limit are accepted; an additional byte is rejected.
 
@@ -64,12 +64,13 @@ part of the public surface.
 
 Package SemVer, canonical wire version, and Cloud binding version are independent concepts.
 
-- **Package version** (this `package.json`): `4.1.3`. Behavior-preserving implementation refactors and reviewed compatible defect corrections may use a patch release when public declarations, runtime exports, and accepted wire/binding semantics remain unchanged. Minor releases may add backward-compatible API. Removing or incompatibly changing an existing declaration, export, runtime behavior, codec, error, limit, ref rule, operation, or compatibility rule requires a major release. Package API SemVer is classified independently from the wire and Cloud binding contracts, but a compatible package addition cannot exempt a changed wire contract from a wire-version increase or a changed Cloud binding contract from a binding-version increase. The package version never signals wire compatibility by itself.
-- **Wire version** (`COLLAB_PROTOCOL_VERSION`): currently `8`. The supported range is exactly `[8, 8]`. This is independent from Cloud binding version `4` and the application-owned LAN bindings. Any change to an existing envelope, DTO, operation payload shape, or operation definition requires a new wire-protocol version. This includes additive operations: every wire-contract change increases the canonical wire version.
-- **Cloud binding version** (`COLLAB_CLOUD_BINDING_VERSION`): currently `4`. It versions Cloud routes, bounded transfer streams, and capabilities independently from package and wire versions. Every Cloud binding-contract change increases this version. Bindings before v4 and wire versions before v8 are unsupported rather than translated or dual-interpreted.
+- **Package version** (this `package.json`): `4.2.0`. Behavior-preserving implementation refactors and reviewed compatible defect corrections may use a patch release when public declarations, runtime exports, and accepted wire/binding semantics remain unchanged. Minor releases may add backward-compatible API. Removing or incompatibly changing an existing declaration, export, runtime behavior, codec, error, limit, ref rule, operation, or compatibility rule requires a major release. Package API SemVer is classified independently from the wire and Cloud binding contracts, but a compatible package addition cannot exempt a changed wire contract from a wire-version increase or a changed Cloud binding contract from a binding-version increase. The package version never signals wire compatibility by itself.
+- **Wire version** (`COLLAB_PROTOCOL_VERSION`): currently `9`. The supported range is exactly `[9, 9]`. This is independent from Cloud binding version `5` and the application-owned LAN bindings. Any change to an existing envelope, DTO, operation payload shape, or operation definition requires a new wire-protocol version. This includes additive operations: every wire-contract change increases the canonical wire version.
+- **Cloud binding version** (`COLLAB_CLOUD_BINDING_VERSION`): currently `5`. It versions Cloud routes, bounded transfer streams, and capabilities independently from package and wire versions. Every Cloud binding-contract change increases this version. Bindings before v5 and wire versions before v9 are unsupported rather than translated or dual-interpreted.
 
 ### Compatibility behavior
 
+- A Cloud error envelope may carry `mutationOutcome: 'rejected'` only when the authority has checked the exact request's retained result and nonterminal journal under its Project write lane and durable state prevents that request from ever applying. A persisted rejection fence or a strictly advanced monotone expected-state value can establish that guarantee; a later snapshot, missing row, ordinary rejection code, timeout, or diagnostic reason cannot. The envelope's request ID binds the proof to the submitted operation and request. Without this property, clients must preserve ambiguous mutation recovery. The authority must preserve the facts establishing this guarantee in backup/restore and delayed-duplicate handling.
 - Envelope decoders reject unknown fields (`protocol-payload-invalid`).
   Operation request and response compatibility is
   decoder-defined and pinned by package fixtures; decoded DTOs are reconstructed

package/dist/CollabCloudBinding.d.ts

@@ -2,7 +2,7 @@ import { COLLAB_PROTOCOL_VERSION } from './CollabConstants';
 import { CollabError, type CollabDiagnosticContext, type CollabErrorCode, type CollabRecoveryAction } from './CollabError';
 import { COLLAB_PROJECT_CHECKPOINT_ARTIFACTS } from './CollabProjectCheckpoint';
 import type { CollabIsoTimestamp, CollabProjectId } from './types';
-export declare const COLLAB_CLOUD_BINDING_VERSION: 4;
+export declare const COLLAB_CLOUD_BINDING_VERSION: 5;
 export declare const COLLAB_CLOUD_CAPABILITY_DOCUMENT_SCHEMA_VERSION: 2;
 export declare const COLLAB_CLOUD_CAPABILITIES: readonly ["accept", "authority-transfer", "cloud-imported-membership-claims", "cloud-project-create", "cloud-project-invitations", "cloud-project-join", "cloud-project-leave", "cloud-project-manager-responsibility", "cloud-project-membership", "development-bootstrap", "git-receive-pack-personal-ref", "git-upload-pack", "project-checkpoint-export", "project-events", "project-retirement", "project-snapshot", "requests", "tickets"];
 export type CollabCloudCapability = typeof COLLAB_CLOUD_CAPABILITIES[number];
@@ -122,6 +122,12 @@ export interface CollabCloudWireError {
 }
 export interface CollabCloudErrorEnvelope {
     readonly error: CollabCloudWireError;
+    /**
+     * Exact request-correlated proof of no retained success or nonterminal journal,
+     * and durable authority state preventing this request from applying later.
+     * Omission leaves the mutation outcome unknown, regardless of the error code.
+     */
+    readonly mutationOutcome?: 'rejected';
     readonly protocolVersion: typeof COLLAB_PROTOCOL_VERSION;
     readonly requestId: string;
 }
@@ -142,5 +148,5 @@ export declare function collabCloudCapabilityDocument(capabilities: readonly Col
 export declare function collabCloudCapabilitySupported(document: CollabCloudCapabilityDocument, capability: CollabCloudCapability): boolean;
 export declare function collabCloudSuccessEnvelope<T>(requestId: string, data: T): CollabCloudSuccessEnvelope<T>;
 export declare function decodeCollabCloudSuccessEnvelope<T = unknown>(value: unknown): CollabCloudSuccessEnvelope<T>;
-export declare function collabCloudErrorEnvelope(requestId: string, error: CollabError): CollabCloudErrorEnvelope;
+export declare function collabCloudErrorEnvelope(requestId: string, error: CollabError, mutationOutcome?: CollabCloudErrorEnvelope['mutationOutcome']): CollabCloudErrorEnvelope;
 export declare function decodeCollabCloudErrorEnvelope(value: unknown): CollabCloudErrorEnvelope;

package/dist/CollabCloudBinding.js

@@ -23,7 +23,7 @@ const CollabControlOperationCodecs_1 = require("./CollabControlOperationCodecs")
 const CollabError_1 = require("./CollabError");
 const CollabValidation_1 = require("./CollabValidation");
 const CollabProjectCheckpoint_1 = require("./CollabProjectCheckpoint");
-exports.COLLAB_CLOUD_BINDING_VERSION = 4;
+exports.COLLAB_CLOUD_BINDING_VERSION = 5;
 exports.COLLAB_CLOUD_CAPABILITY_DOCUMENT_SCHEMA_VERSION = 2;
 exports.COLLAB_CLOUD_CAPABILITIES = Object.freeze([
     'accept',
@@ -188,7 +188,7 @@ function collabCloudProjectOperationRoute(projectId, operation) {
     assertProjectId(projectId);
     if (!isCloudJsonOperation(operation))
         invalidRoute();
-    return route('POST', `/v4/projects/${projectId}/operations/${operation}`, {
+    return route('POST', `/v5/projects/${projectId}/operations/${operation}`, {
         kind: 'project-operation',
         operation,
         projectId,
@@ -198,7 +198,7 @@ function collabCloudProjectEventsRoute(projectId, afterSequence) {
     assertProjectId(projectId);
     if (!Number.isSafeInteger(afterSequence) || afterSequence < 0)
         invalidRoute();
-    return route('GET', `/v4/projects/${projectId}/events?afterSequence=${afterSequence}`, {
+    return route('GET', `/v5/projects/${projectId}/events?afterSequence=${afterSequence}`, {
         afterSequence,
         kind: 'project-events',
         projectId,
@@ -209,11 +209,11 @@ function collabCloudGitRoute(projectId, routeKind, service) {
     if (routeKind === 'info-refs') {
         if (service !== 'git-upload-pack' && service !== 'git-receive-pack')
             invalidRoute();
-        return route('GET', `/v4/projects/${projectId}/repository.git/info/refs?service=${service}`, { kind: 'git-info-refs', projectId, service });
+        return route('GET', `/v5/projects/${projectId}/repository.git/info/refs?service=${service}`, { kind: 'git-info-refs', projectId, service });
     }
     if (service !== undefined)
         invalidRoute();
-    return route('POST', `/v4/projects/${projectId}/repository.git/${routeKind}`, {
+    return route('POST', `/v5/projects/${projectId}/repository.git/${routeKind}`, {
         kind: routeKind,
         projectId,
     });
@@ -224,7 +224,7 @@ function collabCloudAuthorityTransferArtifactRoute(projectId, transferId, direct
     if (direction !== 'download' && direction !== 'upload'
         || !COLLAB_PROJECT_CHECKPOINT_ARTIFACTS_SET.has(artifact))
         invalidRoute();
-    return route(direction === 'upload' ? 'PUT' : 'GET', `/v4/projects/${projectId}/authority-transfers/${transferId}/checkpoint/${artifact}`, {
+    return route(direction === 'upload' ? 'PUT' : 'GET', `/v5/projects/${projectId}/authority-transfers/${transferId}/checkpoint/${artifact}`, {
         artifact,
         direction,
         kind: 'authority-transfer-artifact',
@@ -237,7 +237,7 @@ function collabCloudProjectCheckpointExportArtifactRoute(projectId, exportId, ar
     assertAttemptId(exportId);
     if (!COLLAB_PROJECT_CHECKPOINT_ARTIFACTS_SET.has(artifact))
         invalidRoute();
-    return route('GET', `/v4/projects/${projectId}/checkpoint-exports/${exportId}/checkpoint/${artifact}`, {
+    return route('GET', `/v5/projects/${projectId}/checkpoint-exports/${exportId}/checkpoint/${artifact}`, {
         artifact,
         exportId,
         kind: 'project-checkpoint-export-artifact',
@@ -249,7 +249,7 @@ function collabCloudProjectCheckpointExportRoute(projectId, exportId, operation)
     assertAttemptId(exportId);
     if (operation !== 'begin' && operation !== 'status')
         invalidRoute();
-    return route(operation === 'begin' ? 'POST' : 'GET', `/v4/projects/${projectId}/checkpoint-exports/${exportId}`, { exportId, kind: 'project-checkpoint-export', operation, projectId });
+    return route(operation === 'begin' ? 'POST' : 'GET', `/v5/projects/${projectId}/checkpoint-exports/${exportId}`, { exportId, kind: 'project-checkpoint-export', operation, projectId });
 }
 function decodeCollabCloudProjectCheckpointExportStatus(value) {
     const source = exactRecord(value, 'checkpointExport', [
@@ -287,7 +287,7 @@ function decodeCollabCloudProjectCheckpointExportStatus(value) {
     });
 }
 function collabDevelopmentBootstrapRoute(operation, attemptId) {
-    const base = '/v4/development/bootstrap/attempts';
+    const base = '/v5/development/bootstrap/attempts';
     if (operation === 'beginDevelopmentBootstrap') {
         if (attemptId !== undefined)
             invalidRoute();
@@ -346,7 +346,7 @@ function matchCollabCloudRoute(method, target) {
         && url.pathname === '/collab/capabilities'
         && exactQuery(url, []))
         return { kind: 'capabilities' };
-    if (segments[0] === 'v4'
+    if (segments[0] === 'v5'
         && segments[1] === 'projects'
         && (0, CollabValidation_1.isCollabProjectId)(segments[2])) {
         const projectId = segments[2];
@@ -425,7 +425,7 @@ function matchCollabCloudRoute(method, target) {
             && exactQuery(url, []))
             return { kind: segments[4], projectId };
     }
-    if (segments[0] !== 'v4'
+    if (segments[0] !== 'v5'
         || segments[1] !== 'development'
         || segments[2] !== 'bootstrap'
         || segments[3] !== 'attempts'
@@ -533,21 +533,32 @@ function decodeCollabCloudSuccessEnvelope(value) {
         requestId: source.requestId,
     });
 }
-function collabCloudErrorEnvelope(requestId, error) {
+function collabCloudErrorEnvelope(requestId, error, mutationOutcome) {
     if (!(0, CollabValidation_1.isCollabOpaqueId)(requestId))
         throw invalidPayload('requestId');
+    if (mutationOutcome !== undefined && mutationOutcome !== 'rejected') {
+        throw invalidPayload('mutationOutcome');
+    }
     return Object.freeze({
         error: Object.freeze({
             code: error.code,
             recoveryActions: Object.freeze([...error.recoveryActions]),
             safeContext: error.safeContext,
         }),
+        ...(mutationOutcome === undefined ? {} : { mutationOutcome }),
         protocolVersion: CollabConstants_1.COLLAB_PROTOCOL_VERSION,
         requestId,
     });
 }
 function decodeCollabCloudErrorEnvelope(value) {
-    const source = exactRecord(value, 'envelope', ['error', 'protocolVersion', 'requestId']);
+    const source = record(value, 'envelope');
+    const hasOutcome = Object.hasOwn(source, 'mutationOutcome');
+    if (!hasExactKeys(source, hasOutcome
+        ? ['error', 'mutationOutcome', 'protocolVersion', 'requestId']
+        : ['error', 'protocolVersion', 'requestId']))
+        throw invalidPayload('envelope');
+    if (hasOutcome && source.mutationOutcome !== 'rejected')
+        throw invalidPayload('mutationOutcome');
     const wireError = exactRecord(source.error, 'error', [
         'code',
         'recoveryActions',
@@ -573,6 +584,7 @@ function decodeCollabCloudErrorEnvelope(value) {
             ]),
             safeContext,
         }),
+        ...(hasOutcome ? { mutationOutcome: 'rejected' } : {}),
         protocolVersion: CollabConstants_1.COLLAB_PROTOCOL_VERSION,
         requestId: source.requestId,
     });

package/dist/CollabConstants.d.ts

@@ -1,4 +1,4 @@
-export declare const COLLAB_PROTOCOL_VERSION: 8;
+export declare const COLLAB_PROTOCOL_VERSION: 9;
 export declare const COLLAB_MAIN_REF: "refs/heads/main";
 export declare const COLLAB_MEMBER_REF_PREFIX: "refs/heads/members/";
 export declare const COLLAB_LIMITS: Readonly<{

package/dist/CollabConstants.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COLLAB_LIMITS = exports.COLLAB_MEMBER_REF_PREFIX = exports.COLLAB_MAIN_REF = exports.COLLAB_PROTOCOL_VERSION = void 0;
-exports.COLLAB_PROTOCOL_VERSION = 8;
+exports.COLLAB_PROTOCOL_VERSION = 9;
 exports.COLLAB_MAIN_REF = 'refs/heads/main';
 exports.COLLAB_MEMBER_REF_PREFIX = 'refs/heads/members/';
 exports.COLLAB_LIMITS = Object.freeze({

package/dist/CollabProjectBackupCheckpoint.js

@@ -1520,7 +1520,10 @@ function validateContinuity(records) {
         const recoveryEvidenceInvalid = direction === null
             || (direction === 'lan-to-cloud' && recovery.value.sourceEvidence === null)
             || (targetEvidenceRequired && recovery.value.targetEvidence === null)
-            || (!isCancellation && (stageRequired !== (recovery.value.stageSha256 !== null)))
+            || (isCancellation
+                ? (lifecycle.value.batchRevision !== null)
+                    !== (recovery.value.stageSha256 !== null)
+                : stageRequired !== (recovery.value.stageSha256 !== null))
             || (direction === 'lan-to-cloud'
                 && recovery.value.stageSha256 !== null
                 && recovery.value.stageSha256 !== lifecycle.value.checkpointSha256)
@@ -1543,33 +1546,51 @@ function validateContinuity(records) {
         if (projectAuthorityGeneration !== expectedProjectAuthorityGeneration) {
             throw invalidPayload('records');
         }
+        const hostMemberId = direction === 'lan-to-cloud'
+            ? recovery.value.sourceHostMemberId
+            : recovery.value.targetHostMemberId;
+        const transferMemberIds = [...memberRecords.values()]
+            .filter(item => (item.value.status === 'active'
+            && item.value.memberId !== hostMemberId
+            && Date.parse(item.value.createdAt) <= Date.parse(recovery.value.createdAt)))
+            .map(item => item.value.memberId);
         if (!isCancellation) {
-            const hostMemberId = direction === 'lan-to-cloud'
-                ? recovery.value.sourceHostMemberId
-                : recovery.value.targetHostMemberId;
-            const eligibleMemberIds = [...memberRecords.values()]
-                .filter(item => item.value.status === 'active' && item.value.memberId !== hostMemberId)
-                .map(item => item.value.memberId);
-            const memberCustodyRequired = normalPhaseIndex >= 3;
             const batchReceiptRequired = direction === 'cloud-to-lan'
                 ? normalPhaseIndex >= 3
                 : normalPhaseIndex >= 4;
             if ((batchReceipt !== undefined) !== batchReceiptRequired) {
                 throw invalidPayload('records');
             }
-            for (const memberId of eligibleMemberIds) {
-                const identity = `${recovery.value.transferId}:${memberId}`;
-                const claimPresent = claims.has(identity);
-                const envelopePresent = protectedEnvelopes.has(identity);
-                const redemptionPresent = redemptionReceipts.has(identity);
-                const exactMemberCustody = direction === 'lan-to-cloud'
+        }
+        const memberCustody = transferMemberIds.map((memberId) => {
+            const identity = `${recovery.value.transferId}:${memberId}`;
+            const claimPresent = claims.has(identity);
+            const envelopePresent = protectedEnvelopes.has(identity);
+            const redemptionPresent = redemptionReceipts.has(identity);
+            return {
+                absent: !claimPresent && !envelopePresent && !redemptionPresent,
+                exact: direction === 'lan-to-cloud'
                     ? claimPresent && !envelopePresent
-                    : !claimPresent && envelopePresent !== redemptionPresent;
-                if (memberCustodyRequired !== exactMemberCustody) {
-                    throw invalidPayload('records');
-                }
+                    : !claimPresent && envelopePresent !== redemptionPresent,
+            };
+        });
+        const cleanupInProgress = isCancellation
+            && cancellationIndex === 1
+            && lifecycle.value.batchRevision !== null;
+        if (cleanupInProgress) {
+            const allAbsent = memberCustody.every(item => item.absent);
+            const allExact = memberCustody.every(item => item.exact);
+            if (!allAbsent && !allExact) {
+                throw invalidPayload('records');
             }
         }
+        else {
+            const memberCustodyRequired = isCancellation
+                ? !cleanupCompleted && lifecycle.value.batchRevision !== null
+                : normalPhaseIndex >= 3;
+            if (memberCustody.some(item => (memberCustodyRequired ? !item.exact : !item.absent)))
+                throw invalidPayload('records');
+        }
         if (recovery.value.targetEvidence !== null && (recovery.value.targetHostMemberId === null
             || principalBindings.get(recovery.value.targetHostMemberId)
                 !== recovery.value.targetEvidence.principalId))
@@ -1585,6 +1606,7 @@ function validateContinuity(records) {
                 ? 'cloud-to-lan'
                 : 'lan-to-cloud')
             || lifecycle.value.expectedAuthorityGeneration !== recovery.value.sourceAuthority.generation
+            || lifecycle.value.createdAt !== recovery.value.createdAt
             || lifecycle.value.scheduledAt !== recovery.value.expiresAt
             || (recovery.value.sourceHostMemberId !== null
                 && !members.has(recovery.value.sourceHostMemberId))
@@ -1640,6 +1662,7 @@ function validateContinuity(records) {
     for (const claim of claims.values()) {
         const lifecycle = lifecycles.get(claim.value.transferId);
         const recovery = recoveries.get(claim.value.transferId);
+        const member = memberRecords.get(claim.value.memberId);
         const redemptionReceipt = redemptionReceipts.get(`${claim.value.transferId}:${claim.value.memberId}`);
         const redeemedOverride = redemptionReceipt === undefined
             ? undefined
@@ -1648,8 +1671,9 @@ function validateContinuity(records) {
                 && item.value.state === 'redeemed'
                 && item.value.claimSha256 === redemptionReceipt.value.receipt.claimSha256
                 && item.value.redemptionReceiptId === redemptionReceipt.value.receipt.receiptId));
-        if (memberRecords.get(claim.value.memberId)?.value.status !== 'active'
+        if (member?.value.status !== 'active'
             || recovery === undefined
+            || Date.parse(member.value.createdAt) > Date.parse(recovery.value.createdAt)
             || recovery.value.sourceAuthority.kind !== 'lan'
             || claim.value.memberId === recovery.value.sourceHostMemberId
             || lifecycle?.value.batchRevision !== claim.value.batchRevision
@@ -1832,10 +1856,12 @@ function validateContinuity(records) {
             const identity = `${item.value.transferId}:${item.value.memberId}`;
             const recovery = recoveries.get(item.value.transferId);
             const lifecycle = lifecycles.get(item.value.transferId);
+            const member = memberRecords.get(item.value.memberId);
             if (item.recordId !== identity
                 || recovery === undefined
                 || lifecycle === undefined
-                || memberRecords.get(item.value.memberId)?.value.status !== 'active'
+                || member?.value.status !== 'active'
+                || Date.parse(member.value.createdAt) > Date.parse(recovery.value.createdAt)
                 || item.value.memberId === recovery.value.targetHostMemberId
                 || item.value.associatedData.authorityGeneration
                     !== recovery.value.sourceAuthority.generation

package/dist/esm/CollabCloudBinding.mjs

@@ -3,7 +3,7 @@ import { COLLAB_CONTROL_OPERATION_CODECS, } from './CollabControlOperationCodecs
 import { COLLAB_ERROR_CODES, CollabError, sanitizeCollabDiagnosticContext, } from './CollabError.mjs';
 import { isCollabOpaqueId, isCollabProjectId, } from './CollabValidation.mjs';
 import { COLLAB_CHECKPOINT_ARTIFACT_LIMITS, COLLAB_PROJECT_CHECKPOINT_ARTIFACTS, } from './CollabProjectCheckpoint.mjs';
-export const COLLAB_CLOUD_BINDING_VERSION = 4;
+export const COLLAB_CLOUD_BINDING_VERSION = 5;
 export const COLLAB_CLOUD_CAPABILITY_DOCUMENT_SCHEMA_VERSION = 2;
 export const COLLAB_CLOUD_CAPABILITIES = Object.freeze([
     'accept',
@@ -168,7 +168,7 @@ export function collabCloudProjectOperationRoute(projectId, operation) {
     assertProjectId(projectId);
     if (!isCloudJsonOperation(operation))
         invalidRoute();
-    return route('POST', `/v4/projects/${projectId}/operations/${operation}`, {
+    return route('POST', `/v5/projects/${projectId}/operations/${operation}`, {
         kind: 'project-operation',
         operation,
         projectId,
@@ -178,7 +178,7 @@ export function collabCloudProjectEventsRoute(projectId, afterSequence) {
     assertProjectId(projectId);
     if (!Number.isSafeInteger(afterSequence) || afterSequence < 0)
         invalidRoute();
-    return route('GET', `/v4/projects/${projectId}/events?afterSequence=${afterSequence}`, {
+    return route('GET', `/v5/projects/${projectId}/events?afterSequence=${afterSequence}`, {
         afterSequence,
         kind: 'project-events',
         projectId,
@@ -189,11 +189,11 @@ export function collabCloudGitRoute(projectId, routeKind, service) {
     if (routeKind === 'info-refs') {
         if (service !== 'git-upload-pack' && service !== 'git-receive-pack')
             invalidRoute();
-        return route('GET', `/v4/projects/${projectId}/repository.git/info/refs?service=${service}`, { kind: 'git-info-refs', projectId, service });
+        return route('GET', `/v5/projects/${projectId}/repository.git/info/refs?service=${service}`, { kind: 'git-info-refs', projectId, service });
     }
     if (service !== undefined)
         invalidRoute();
-    return route('POST', `/v4/projects/${projectId}/repository.git/${routeKind}`, {
+    return route('POST', `/v5/projects/${projectId}/repository.git/${routeKind}`, {
         kind: routeKind,
         projectId,
     });
@@ -204,7 +204,7 @@ export function collabCloudAuthorityTransferArtifactRoute(projectId, transferId,
     if (direction !== 'download' && direction !== 'upload'
         || !COLLAB_PROJECT_CHECKPOINT_ARTIFACTS_SET.has(artifact))
         invalidRoute();
-    return route(direction === 'upload' ? 'PUT' : 'GET', `/v4/projects/${projectId}/authority-transfers/${transferId}/checkpoint/${artifact}`, {
+    return route(direction === 'upload' ? 'PUT' : 'GET', `/v5/projects/${projectId}/authority-transfers/${transferId}/checkpoint/${artifact}`, {
         artifact,
         direction,
         kind: 'authority-transfer-artifact',
@@ -217,7 +217,7 @@ export function collabCloudProjectCheckpointExportArtifactRoute(projectId, expor
     assertAttemptId(exportId);
     if (!COLLAB_PROJECT_CHECKPOINT_ARTIFACTS_SET.has(artifact))
         invalidRoute();
-    return route('GET', `/v4/projects/${projectId}/checkpoint-exports/${exportId}/checkpoint/${artifact}`, {
+    return route('GET', `/v5/projects/${projectId}/checkpoint-exports/${exportId}/checkpoint/${artifact}`, {
         artifact,
         exportId,
         kind: 'project-checkpoint-export-artifact',
@@ -229,7 +229,7 @@ export function collabCloudProjectCheckpointExportRoute(projectId, exportId, ope
     assertAttemptId(exportId);
     if (operation !== 'begin' && operation !== 'status')
         invalidRoute();
-    return route(operation === 'begin' ? 'POST' : 'GET', `/v4/projects/${projectId}/checkpoint-exports/${exportId}`, { exportId, kind: 'project-checkpoint-export', operation, projectId });
+    return route(operation === 'begin' ? 'POST' : 'GET', `/v5/projects/${projectId}/checkpoint-exports/${exportId}`, { exportId, kind: 'project-checkpoint-export', operation, projectId });
 }
 export function decodeCollabCloudProjectCheckpointExportStatus(value) {
     const source = exactRecord(value, 'checkpointExport', [
@@ -267,7 +267,7 @@ export function decodeCollabCloudProjectCheckpointExportStatus(value) {
     });
 }
 export function collabDevelopmentBootstrapRoute(operation, attemptId) {
-    const base = '/v4/development/bootstrap/attempts';
+    const base = '/v5/development/bootstrap/attempts';
     if (operation === 'beginDevelopmentBootstrap') {
         if (attemptId !== undefined)
             invalidRoute();
@@ -326,7 +326,7 @@ export function matchCollabCloudRoute(method, target) {
         && url.pathname === '/collab/capabilities'
         && exactQuery(url, []))
         return { kind: 'capabilities' };
-    if (segments[0] === 'v4'
+    if (segments[0] === 'v5'
         && segments[1] === 'projects'
         && isCollabProjectId(segments[2])) {
         const projectId = segments[2];
@@ -405,7 +405,7 @@ export function matchCollabCloudRoute(method, target) {
             && exactQuery(url, []))
             return { kind: segments[4], projectId };
     }
-    if (segments[0] !== 'v4'
+    if (segments[0] !== 'v5'
         || segments[1] !== 'development'
         || segments[2] !== 'bootstrap'
         || segments[3] !== 'attempts'
@@ -513,21 +513,32 @@ export function decodeCollabCloudSuccessEnvelope(value) {
         requestId: source.requestId,
     });
 }
-export function collabCloudErrorEnvelope(requestId, error) {
+export function collabCloudErrorEnvelope(requestId, error, mutationOutcome) {
     if (!isCollabOpaqueId(requestId))
         throw invalidPayload('requestId');
+    if (mutationOutcome !== undefined && mutationOutcome !== 'rejected') {
+        throw invalidPayload('mutationOutcome');
+    }
     return Object.freeze({
         error: Object.freeze({
             code: error.code,
             recoveryActions: Object.freeze([...error.recoveryActions]),
             safeContext: error.safeContext,
         }),
+        ...(mutationOutcome === undefined ? {} : { mutationOutcome }),
         protocolVersion: COLLAB_PROTOCOL_VERSION,
         requestId,
     });
 }
 export function decodeCollabCloudErrorEnvelope(value) {
-    const source = exactRecord(value, 'envelope', ['error', 'protocolVersion', 'requestId']);
+    const source = record(value, 'envelope');
+    const hasOutcome = Object.hasOwn(source, 'mutationOutcome');
+    if (!hasExactKeys(source, hasOutcome
+        ? ['error', 'mutationOutcome', 'protocolVersion', 'requestId']
+        : ['error', 'protocolVersion', 'requestId']))
+        throw invalidPayload('envelope');
+    if (hasOutcome && source.mutationOutcome !== 'rejected')
+        throw invalidPayload('mutationOutcome');
     const wireError = exactRecord(source.error, 'error', [
         'code',
         'recoveryActions',
@@ -553,6 +564,7 @@ export function decodeCollabCloudErrorEnvelope(value) {
             ]),
             safeContext,
         }),
+        ...(hasOutcome ? { mutationOutcome: 'rejected' } : {}),
         protocolVersion: COLLAB_PROTOCOL_VERSION,
         requestId: source.requestId,
     });

package/dist/esm/CollabConstants.mjs

@@ -1,4 +1,4 @@
-export const COLLAB_PROTOCOL_VERSION = 8;
+export const COLLAB_PROTOCOL_VERSION = 9;
 export const COLLAB_MAIN_REF = 'refs/heads/main';
 export const COLLAB_MEMBER_REF_PREFIX = 'refs/heads/members/';
 export const COLLAB_LIMITS = Object.freeze({

package/dist/esm/CollabProjectBackupCheckpoint.mjs

@@ -1510,7 +1510,10 @@ function validateContinuity(records) {
         const recoveryEvidenceInvalid = direction === null
             || (direction === 'lan-to-cloud' && recovery.value.sourceEvidence === null)
             || (targetEvidenceRequired && recovery.value.targetEvidence === null)
-            || (!isCancellation && (stageRequired !== (recovery.value.stageSha256 !== null)))
+            || (isCancellation
+                ? (lifecycle.value.batchRevision !== null)
+                    !== (recovery.value.stageSha256 !== null)
+                : stageRequired !== (recovery.value.stageSha256 !== null))
             || (direction === 'lan-to-cloud'
                 && recovery.value.stageSha256 !== null
                 && recovery.value.stageSha256 !== lifecycle.value.checkpointSha256)
@@ -1533,33 +1536,51 @@ function validateContinuity(records) {
         if (projectAuthorityGeneration !== expectedProjectAuthorityGeneration) {
             throw invalidPayload('records');
         }
+        const hostMemberId = direction === 'lan-to-cloud'
+            ? recovery.value.sourceHostMemberId
+            : recovery.value.targetHostMemberId;
+        const transferMemberIds = [...memberRecords.values()]
+            .filter(item => (item.value.status === 'active'
+            && item.value.memberId !== hostMemberId
+            && Date.parse(item.value.createdAt) <= Date.parse(recovery.value.createdAt)))
+            .map(item => item.value.memberId);
         if (!isCancellation) {
-            const hostMemberId = direction === 'lan-to-cloud'
-                ? recovery.value.sourceHostMemberId
-                : recovery.value.targetHostMemberId;
-            const eligibleMemberIds = [...memberRecords.values()]
-                .filter(item => item.value.status === 'active' && item.value.memberId !== hostMemberId)
-                .map(item => item.value.memberId);
-            const memberCustodyRequired = normalPhaseIndex >= 3;
             const batchReceiptRequired = direction === 'cloud-to-lan'
                 ? normalPhaseIndex >= 3
                 : normalPhaseIndex >= 4;
             if ((batchReceipt !== undefined) !== batchReceiptRequired) {
                 throw invalidPayload('records');
             }
-            for (const memberId of eligibleMemberIds) {
-                const identity = `${recovery.value.transferId}:${memberId}`;
-                const claimPresent = claims.has(identity);
-                const envelopePresent = protectedEnvelopes.has(identity);
-                const redemptionPresent = redemptionReceipts.has(identity);
-                const exactMemberCustody = direction === 'lan-to-cloud'
+        }
+        const memberCustody = transferMemberIds.map((memberId) => {
+            const identity = `${recovery.value.transferId}:${memberId}`;
+            const claimPresent = claims.has(identity);
+            const envelopePresent = protectedEnvelopes.has(identity);
+            const redemptionPresent = redemptionReceipts.has(identity);
+            return {
+                absent: !claimPresent && !envelopePresent && !redemptionPresent,
+                exact: direction === 'lan-to-cloud'
                     ? claimPresent && !envelopePresent
-                    : !claimPresent && envelopePresent !== redemptionPresent;
-                if (memberCustodyRequired !== exactMemberCustody) {
-                    throw invalidPayload('records');
-                }
+                    : !claimPresent && envelopePresent !== redemptionPresent,
+            };
+        });
+        const cleanupInProgress = isCancellation
+            && cancellationIndex === 1
+            && lifecycle.value.batchRevision !== null;
+        if (cleanupInProgress) {
+            const allAbsent = memberCustody.every(item => item.absent);
+            const allExact = memberCustody.every(item => item.exact);
+            if (!allAbsent && !allExact) {
+                throw invalidPayload('records');
             }
         }
+        else {
+            const memberCustodyRequired = isCancellation
+                ? !cleanupCompleted && lifecycle.value.batchRevision !== null
+                : normalPhaseIndex >= 3;
+            if (memberCustody.some(item => (memberCustodyRequired ? !item.exact : !item.absent)))
+                throw invalidPayload('records');
+        }
         if (recovery.value.targetEvidence !== null && (recovery.value.targetHostMemberId === null
             || principalBindings.get(recovery.value.targetHostMemberId)
                 !== recovery.value.targetEvidence.principalId))
@@ -1575,6 +1596,7 @@ function validateContinuity(records) {
                 ? 'cloud-to-lan'
                 : 'lan-to-cloud')
             || lifecycle.value.expectedAuthorityGeneration !== recovery.value.sourceAuthority.generation
+            || lifecycle.value.createdAt !== recovery.value.createdAt
             || lifecycle.value.scheduledAt !== recovery.value.expiresAt
             || (recovery.value.sourceHostMemberId !== null
                 && !members.has(recovery.value.sourceHostMemberId))
@@ -1630,6 +1652,7 @@ function validateContinuity(records) {
     for (const claim of claims.values()) {
         const lifecycle = lifecycles.get(claim.value.transferId);
         const recovery = recoveries.get(claim.value.transferId);
+        const member = memberRecords.get(claim.value.memberId);
         const redemptionReceipt = redemptionReceipts.get(`${claim.value.transferId}:${claim.value.memberId}`);
         const redeemedOverride = redemptionReceipt === undefined
             ? undefined
@@ -1638,8 +1661,9 @@ function validateContinuity(records) {
                 && item.value.state === 'redeemed'
                 && item.value.claimSha256 === redemptionReceipt.value.receipt.claimSha256
                 && item.value.redemptionReceiptId === redemptionReceipt.value.receipt.receiptId));
-        if (memberRecords.get(claim.value.memberId)?.value.status !== 'active'
+        if (member?.value.status !== 'active'
             || recovery === undefined
+            || Date.parse(member.value.createdAt) > Date.parse(recovery.value.createdAt)
             || recovery.value.sourceAuthority.kind !== 'lan'
             || claim.value.memberId === recovery.value.sourceHostMemberId
             || lifecycle?.value.batchRevision !== claim.value.batchRevision
@@ -1822,10 +1846,12 @@ function validateContinuity(records) {
             const identity = `${item.value.transferId}:${item.value.memberId}`;
             const recovery = recoveries.get(item.value.transferId);
             const lifecycle = lifecycles.get(item.value.transferId);
+            const member = memberRecords.get(item.value.memberId);
             if (item.recordId !== identity
                 || recovery === undefined
                 || lifecycle === undefined
-                || memberRecords.get(item.value.memberId)?.value.status !== 'active'
+                || member?.value.status !== 'active'
+                || Date.parse(member.value.createdAt) > Date.parse(recovery.value.createdAt)
                 || item.value.memberId === recovery.value.targetHostMemberId
                 || item.value.associatedData.authorityGeneration
                     !== recovery.value.sourceAuthority.generation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudian-collab/protocol",
-  "version": "4.1.3",
+  "version": "4.2.0",
   "description": "Canonical Collab wire and Cloud binding contract for Claudian clients and servers.",
   "license": "MIT",
   "repository": {