@danceiny/gotry 0.0.1-rc.18 → 0.0.1-rc.19

package/dist/src/booking-surface/runtime.js

@@ -1,130 +1,887 @@
 import { createHash, randomUUID } from 'node:crypto';
-import './contracts.js';
-import { validateBookingCopilotTurnV1, validateActionReceiptV1, validateBookingReadActionV1, validateBookingSurfaceEventV1 } from './validation.js';
+import { BOOKING_READ_ACTION_KINDS, BOOKING_COPILOT_MAX_OPERATIONS } from './contracts.js';
+import { validateApprovalAgainstBlocker, validateCriterionBlocker, validateBookingReadAction, validateBookingSurfaceEvent, validateBookingSurface, isBookingDateTime, isSafeBookingRequestKey } from './validation.js';
+import { assertWorkspaceLoadedOfferRefsUnique, canIssueOfferCheck, createAvailabilityPolicy, reduceAvailabilityAction, reduceAvailabilityReceipt, validateOffersReceiptWorkspace, availabilityPolicyResult, validateAvailabilityPolicy } from './availability-policy.js';
 import { normalizeBookingErrorCode, safeBookingErrorMessage } from './error-codes.js';
-const LEDGER_SCHEMA = 'booking.copilot.ledger.v1';
-const LEDGER_ACTOR = 'system:booking-copilot';
-const TASK_STARTED = 'booking.copilot.task.started';
-const USER_TURN_OBSERVED = 'booking.copilot.user.turn.observed';
-const ACTION_ISSUED = 'booking.copilot.action.issued';
-const RECEIPT_OBSERVED = 'booking.copilot.receipt.observed';
-const EVENT_EMITTED = 'booking.copilot.event.emitted';
-function stableValue(value) {
-    if (Array.isArray(value)) return value.map(stableValue);
-    if (typeof value !== 'object' || value === null) return value;
-    const source = value;
-    const target = {};
-    for (const key of Object.keys(source).sort())target[key] = stableValue(source[key]);
-    return target;
-}
-function digest(value) {
-    return createHash('sha256').update(JSON.stringify(stableValue(value))).digest('hex');
+const LEDGER_SCHEMA = 'booking.copilot.ledger';
+const ACTOR = 'system:booking-copilot';
+const STARTED = 'booking.copilot.task.started';
+const TURN = 'booking.copilot.user.turn.observed';
+const ACTION = 'booking.copilot.action.issued';
+const RECEIPT = 'booking.copilot.receipt.observed';
+const EVENT = 'booking.copilot.event.emitted';
+const APPROVAL_GRANTED = 'booking.copilot.approval.granted';
+const APPROVAL_OFFERED = 'booking.copilot.approval.option.offered';
+const APPROVAL_CONSUMED = 'booking.copilot.approval.consumed';
+const DECISION_BATCH = 'booking.copilot.decision.batch';
+const REQUEST_BINDING = 'booking.copilot.request.binding';
+function stable(value) {
+    if (Array.isArray(value)) return value.map(stable);
+    if (!value || typeof value !== 'object') return value;
+    const out = {};
+    for (const key of Object.keys(value).sort())out[key] = stable(value[key]);
+    return out;
+}
+export function bookingDigest(value) {
+    return createHash('sha256').update(JSON.stringify(stable(value))).digest('hex');
+}
+export function bookingWorkspaceDigest(workspace) {
+    const { contextRef: _contextRef, ...contextBoundWorkspace } = workspace;
+    return bookingDigest(contextBoundWorkspace);
+}
+function bookingWorkspaceSemanticDigest(workspace) {
+    const { contextRef: _contextRef, revision: _revision, ...semanticWorkspace } = workspace;
+    return bookingDigest(semanticWorkspace);
+}
+export function bookingTurnDigest(turn) {
+    return bookingDigest(turn);
+}
+function canonicalReceiptDigest(value) {
+    return bookingDigest(value);
+}
+function replayDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingDigest(raw) || recordedDigest === bookingDigest(normalized));
+}
+function replayWorkspaceDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingWorkspaceDigest(raw) || recordedDigest === bookingWorkspaceDigest(normalized));
+}
+function replayWorkspaceSemanticDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingWorkspaceSemanticDigest(raw) || recordedDigest === bookingWorkspaceSemanticDigest(normalized));
+}
+function rememberReplayWorkspaceDigest(digests, recordedDigest, raw, normalized) {
+    const normalizedDigest = bookingWorkspaceDigest(normalized);
+    digests.set(bookingWorkspaceDigest(raw), normalizedDigest);
+    if (typeof recordedDigest === 'string') digests.set(recordedDigest, normalizedDigest);
+}
+function legacyOfferVersionRef(contextRef, offer) {
+    return `legacy-offer-version:${bookingDigest({
+        contextRef,
+        offerRef: offer.offerRef,
+        hotelRef: offer.hotelRef,
+        evidenceLevel: offer.evidenceLevel,
+        factRefs: Array.isArray(offer.factRefs) ? offer.factRefs : []
+    }).slice(0, 40)}`;
+}
+function normalizeWorkspaceForReplay(raw) {
+    const candidate = raw;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !Array.isArray(candidate.loadedOffers) || typeof candidate.contextRef !== 'string') throw new Error('booking_malformed_workspace');
+    const workspace = structuredClone(raw);
+    workspace.loadedOffers = workspace.loadedOffers.map((offer)=>offer.offerVersionRef ? offer : {
+            ...offer,
+            offerVersionRef: legacyOfferVersionRef(workspace.contextRef, offer)
+        });
+    delete workspace.verifiedOfferRef;
+    return workspace;
+}
+function resolveReplayOfferVersion(offerRef, workspace, action, actionId, priorAvailability) {
+    const priorAttempt = actionId ? priorAvailability?.attempts.find((attempt)=>attempt.actionId === actionId) : undefined;
+    if (priorAttempt?.offerVersionRef) return priorAttempt.offerVersionRef;
+    if (action?.kind === 'offer.check' && action.actionId === actionId && action.input.offerRef === offerRef && typeof action.input.offerVersionRef === 'string') return action.input.offerVersionRef;
+    const match = workspace?.loadedOffers.find((offer)=>offer.offerRef === offerRef);
+    if (match?.offerVersionRef) return match.offerVersionRef;
+    throw new Error('booking_replan_required:offer_version_unbound');
+}
+function normalizeAvailabilityPolicyForReplay(raw, workspace, action, priorAvailability, workspaceDigestMap = new Map(), receipt) {
+    const normalized = structuredClone(raw);
+    if (normalized.hotels && typeof normalized.hotels === 'object') {
+        for (const [hotelRef, hotel] of Object.entries(normalized.hotels)){
+            const rawHotel = raw.hotels?.[hotelRef];
+            const priorHotel = priorAvailability?.hotels[hotelRef];
+            if (!Array.isArray(hotel.tombstonedOfferRefs)) hotel.tombstonedOfferRefs = priorHotel ? [
+                ...priorHotel.tombstonedOfferRefs
+            ] : [];
+            if (!Array.isArray(hotel.tombstonedOfferVersionRefs)) hotel.tombstonedOfferVersionRefs = priorHotel ? [
+                ...priorHotel.tombstonedOfferVersionRefs
+            ] : [];
+            if (rawHotel && Array.isArray(rawHotel.tombstonedOfferRefs) && priorHotel) {
+                for (const ref of priorHotel.tombstonedOfferRefs)if (!hotel.tombstonedOfferRefs.includes(ref)) throw new Error('booking_replan_required:tombstone_regression');
+            }
+            if (rawHotel && Array.isArray(rawHotel.tombstonedOfferVersionRefs) && priorHotel) {
+                for (const ref of priorHotel.tombstonedOfferVersionRefs)if (!hotel.tombstonedOfferVersionRefs.includes(ref)) throw new Error('booking_replan_required:tombstone_regression');
+            }
+            const source = hotel.currentGeneration?.source;
+            if (source?.kind === 'workspace_snapshot') {
+                const mappedDigest = workspaceDigestMap.get(source.workspaceDigest);
+                if (mappedDigest) source.workspaceDigest = mappedDigest;
+            }
+        }
+    }
+    if (Array.isArray(normalized.attempts)) {
+        normalized.attempts = normalized.attempts.map((attempt)=>attempt.offerVersionRef ? attempt : {
+                ...attempt,
+                offerVersionRef: resolveReplayOfferVersion(attempt.offerRef, workspace, action, attempt.actionId, priorAvailability)
+            });
+    }
+    const availability = receipt?.observation.kind === 'offer.availability' ? receipt.observation : undefined;
+    if (receipt && action?.kind === 'offer.check' && availability && availability.offerRef === action.input.offerRef && availability.checkedOfferVersionRef === action.input.offerVersionRef) {
+        const attempt = normalized.attempts.find((candidate)=>candidate.actionId === action.actionId);
+        const hotel = attempt ? normalized.hotels[attempt.hotelRef] : undefined;
+        if (hotel) {
+            if (receipt.status === 'changed' && availability.available === true && availability.currentOfferVersionRef && availability.currentOfferVersionRef !== action.input.offerVersionRef) {
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef)) hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+            }
+            const completeNegative = (receipt.status === 'unavailable' || receipt.status === 'no_match') && receipt.resultContract.outcome === 'empty' && receipt.resultContract.gapCodes.length === 0 && receipt.resultContract.blockers.length === 0 && availability.available === false && !availability.currentOfferVersionRef && !availability.verifiedOfferRef && !availability.gapCodes?.length;
+            if (completeNegative) {
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef)) hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+                if (!hotel.tombstonedOfferRefs.includes(action.input.offerRef)) hotel.tombstonedOfferRefs.push(action.input.offerRef);
+            }
+        }
+    }
+    return normalized;
+}
+function normalizeActionCheckpointForReplay(raw, workspace) {
+    if (![
+        'offer.select',
+        'offer.check',
+        'checkout.prepare'
+    ].includes(raw.kind) || typeof raw.input.offerVersionRef === 'string') return raw;
+    if (typeof raw.input.offerRef !== 'string') throw new Error('booking_replan_required:offer_version_unbound');
+    const offerVersionRef = resolveReplayOfferVersion(raw.input.offerRef, workspace, undefined, raw.actionId);
+    const input = {
+        ...raw.input,
+        offerVersionRef
+    };
+    if (raw.kind === 'checkout.prepare' && (!workspace?.verifiedOffer || workspace.verifiedOffer.offerRef !== input.offerRef || workspace.verifiedOffer.offerVersionRef !== offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== input.verifiedOfferRef)) throw new Error('booking_replan_required:legacy_checkout_unverified');
+    const { actionDigest: _rawActionDigest, ...rawBase } = raw;
+    const normalizedBase = {
+        ...rawBase,
+        input,
+        inputDigest: bookingDigest(input)
+    };
+    return {
+        ...normalizedBase,
+        actionDigest: checkpointDigest(normalizedBase)
+    };
+}
+function checkpointDigestMatchesForReplay(raw, normalized) {
+    const { actionDigest: _rawDigest, ...rawBase } = raw;
+    const { actionDigest: _normalizedDigest, ...normalizedBase } = normalized;
+    return raw.actionDigest === checkpointDigest(rawBase) || raw.actionDigest === checkpointDigest(normalizedBase);
+}
+function replanAfterReplayUpgradeGap(state, workspace = state.workspaceSnapshot, revision = workspace?.revision) {
+    if (!workspace) return {
+        ...state,
+        phase: 'error',
+        pendingAction: undefined
+    };
+    const safeRevision = typeof revision === 'number' && Number.isSafeInteger(revision) ? revision : state.revision;
+    return {
+        ...state,
+        revision: safeRevision,
+        phase: 'planning',
+        pendingAction: undefined,
+        awaitingApproval: undefined,
+        workspaceDigest: bookingWorkspaceDigest(workspace),
+        workspaceSemanticDigest: bookingWorkspaceSemanticDigest(workspace),
+        workspaceSnapshot: workspace,
+        availability: createAvailabilityPolicy(workspace),
+        replayUpgradeRequired: true
+    };
+}
+function assertReplayUpgradeReanchored(state) {
+    if (state.replayUpgradeRequired) throw new Error('reanchor_turn_required');
+}
+function consumedIdentityKey(eventId, sequence) {
+    return `${eventId}\0${sequence}`;
+}
+function clearPendingBatch(consumed) {
+    consumed.pendingBatchKeys.clear();
+    consumed.pendingBatchOpen = false;
+}
+function rememberPendingBatchKey(consumed, key) {
+    consumed.pendingBatchKeys.add(key);
+}
+function rememberConsumedEventIdentity(consumed, payload) {
+    if (payload.eventKind === 'status' && (payload.status === 'submitted' || payload.status === 'working') && !consumed.pendingBatchOpen) {
+        clearPendingBatch(consumed);
+        consumed.pendingBatchOpen = true;
+    }
+    const key = consumedIdentityKey(payload.eventId, payload.sequence);
+    consumed.events.set(key, payload);
+    rememberPendingBatchKey(consumed, key);
+}
+function rememberConsumedActionIdentity(consumed, action) {
+    const key = consumedIdentityKey(action.eventId, action.sequence);
+    consumed.actions.set(key, action);
+    rememberPendingBatchKey(consumed, key);
+}
+function consumeSkippedActionOrdinal(state, payload, consumed) {
+    const action = payload.action;
+    const operationCount = payload.operationCount ?? state.operationCount + 1;
+    if (!action || typeof action !== 'object') throw new Error('skip_action_invalid');
+    const { actionDigest: _actionDigest, ...actionBase } = action;
+    if (action.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(action.sequence) || action.sequence <= state.lastSequence) throw new Error('skip_action_invalid');
+    state.operationCount = operationCount;
+    state.lastSequence = action.sequence;
+    if (consumed) {
+        rememberConsumedActionIdentity(consumed, action);
+    }
+}
+function eventDraftDigest(event) {
+    if (event.kind === 'status') return bookingDigest({
+        kind: event.kind,
+        status: event.status
+    });
+    if (event.kind === 'question') return bookingDigest({
+        kind: event.kind,
+        question: event.question
+    });
+    if (event.kind === 'explanation') return bookingDigest({
+        kind: event.kind,
+        explanation: event.explanation
+    });
+    if (event.kind === 'terminal') return bookingDigest({
+        kind: event.kind,
+        terminal: event.terminal
+    });
+    return bookingDigest({
+        kind: event.kind,
+        error: event.error
+    });
+}
+function eventPayloadMatchesEvent(payload, event) {
+    const expectedDigest = eventDraftDigest(event);
+    const legacyTerminalDigest = event.kind === 'terminal' ? bookingDigest(event.terminal) : undefined;
+    return payload.eventId === event.eventId && payload.sequence === event.sequence && payload.emittedAt === event.emittedAt && payload.contextRef === event.contextRef && payload.eventKind === event.kind && (event.kind !== 'status' || payload.status === event.status) && (payload.contentDigest === expectedDigest || payload.contentDigest === legacyTerminalDigest);
+}
+function actionFromOperationEventForReplay(event, checkpoint) {
+    const action = event.action;
+    if ((action.kind === 'offer.select' || action.kind === 'offer.check' || action.kind === 'checkout.prepare') && typeof action.input.offerRef === 'string' && typeof action.input.offerVersionRef !== 'string' && typeof checkpoint.input.offerVersionRef === 'string') {
+        return {
+            ...action,
+            input: {
+                ...action.input,
+                offerVersionRef: checkpoint.input.offerVersionRef
+            }
+        };
+    }
+    return action;
+}
+function operationEventMatchesAction(event, checkpoint) {
+    return event.eventId === checkpoint.eventId && event.sequence === checkpoint.sequence && event.emittedAt === checkpoint.emittedAt && event.contextRef === checkpoint.contextRef && matchesCheckpoint(actionFromOperationEventForReplay(event, checkpoint), checkpoint);
+}
+function normalizeDecisionBatchEnvelopeForReplay(payload, consumed, requireSchemaValid = false) {
+    if (typeof payload.requestKey !== 'string' || !payload.requestKey || !payload.events.length) throw new Error('skip_decision_batch_invalid');
+    let lastBatchSequence = -1;
+    const seen = new Set();
+    const normalizedEvents = [];
+    for (const event of payload.events){
+        if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence) throw new Error('skip_decision_batch_invalid');
+        lastBatchSequence = event.sequence;
+        const key = consumedIdentityKey(event.eventId, event.sequence);
+        if (seen.has(key)) throw new Error('skip_decision_batch_invalid');
+        seen.add(key);
+        if (event.kind === 'operation') {
+            const checkpoint = consumed.actions.get(key);
+            if (!checkpoint || !operationEventMatchesAction(event, checkpoint)) throw new Error('skip_decision_batch_invalid');
+            const normalized = {
+                ...event,
+                action: actionFromOperationEventForReplay(event, checkpoint)
+            };
+            if (requireSchemaValid && !validateBookingSurfaceEvent(normalized).ok) throw new Error('skip_decision_batch_invalid');
+            normalizedEvents.push(normalized);
+        } else {
+            const recorded = consumed.events.get(key);
+            if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event)) throw new Error('skip_decision_batch_invalid');
+            normalizedEvents.push(event);
+        }
+        if (!consumed.pendingBatchKeys.has(key)) throw new Error('skip_decision_batch_invalid');
+    }
+    if (seen.size !== consumed.pendingBatchKeys.size) throw new Error('skip_decision_batch_invalid');
+    for (const key of consumed.pendingBatchKeys)if (!seen.has(key)) throw new Error('skip_decision_batch_invalid');
+    clearPendingBatch(consumed);
+    return normalizedEvents;
+}
+function consumeSkippedEventSequence(state, payload, consumed) {
+    if (!payload || typeof payload !== 'object') throw new Error('skip_event_invalid');
+    if ('sequence' in payload) {
+        const eventPayload = payload;
+        if (typeof eventPayload.eventId !== 'string' || !eventPayload.eventId || ![
+            'status',
+            'question',
+            'explanation',
+            'terminal',
+            'error'
+        ].includes(String(eventPayload.eventKind)) || typeof eventPayload.contentDigest !== 'string' || !/^[0-9a-f]{64}$/.test(eventPayload.contentDigest) || typeof eventPayload.sequence !== 'number' || !Number.isSafeInteger(eventPayload.sequence) || eventPayload.sequence <= state.lastSequence) throw new Error('skip_event_invalid');
+        state.lastSequence = eventPayload.sequence;
+        rememberConsumedEventIdentity(consumed, eventPayload);
+    } else if ('events' in payload && Array.isArray(payload.events)) {
+        normalizeDecisionBatchEnvelopeForReplay(payload, consumed);
+    }
+}
+function normalizeReceiptForReplay(raw, action, workspace) {
+    const receipt = structuredClone(raw);
+    if (action.kind === 'offer.select' && receipt.observation.kind === 'offer.selection' && receipt.observation.offerRef === action.input.offerRef && !receipt.observation.offerVersionRef) {
+        receipt.observation.offerVersionRef = action.input.offerVersionRef;
+    }
+    if (action.kind === 'checkout.prepare' && receipt.observation.kind === 'checkout.handoff' && receipt.observation.offerRef === action.input.offerRef && !receipt.observation.offerVersionRef) {
+        if (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== action.input.verifiedOfferRef) throw new Error('booking_replan_required:legacy_checkout_unverified');
+        receipt.observation.offerVersionRef = action.input.offerVersionRef;
+    }
+    if (action.kind === 'offer.check' && receipt.observation.kind === 'offer.availability' && receipt.observation.offerRef === action.input.offerRef) {
+        if (!receipt.observation.checkedOfferVersionRef) receipt.observation.checkedOfferVersionRef = action.input.offerVersionRef;
+        if (receipt.status === 'applied' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef) receipt.observation.currentOfferVersionRef = action.input.offerVersionRef;
+        if (receipt.status === 'changed' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef) {
+            const current = workspace.loadedOffers.find((offer)=>offer.offerRef === action.input.offerRef && offer.offerVersionRef !== action.input.offerVersionRef);
+            if (!current) throw new Error('booking_replan_required:changed_version_unbound');
+            receipt.observation.currentOfferVersionRef = current.offerVersionRef;
+        }
+        if (receipt.status === 'applied' && receipt.observation.verifiedOfferRef && (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== receipt.observation.verifiedOfferRef)) throw new Error('booking_replan_required:legacy_verified_scalar');
+    }
+    if (receipt.resultContract.blockers.length && bookingDigest(raw) !== bookingDigest(receipt)) throw new Error('booking_replan_required:legacy_blocker_digest');
+    return receipt;
+}
+function errorText(result) {
+    return result.ok ? '' : result.errors.join('; ');
+}
+function assertTaskId(taskId) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(taskId)) throw new Error('invalid_task_id');
+}
+function assertSafeRef(value) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value)) throw new Error('unsafe_opaque_ref');
+}
+function safeIdentity(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value);
+}
+function sameActions(a, b) {
+    return a.length === b.length && [
+        ...a
+    ].sort().every((x, i)=>x === [
+            ...b
+        ].sort()[i]);
+}
+function availabilityPolicyTerminal(state) {
+    return availabilityPolicyResult(state);
+}
+function taskHasTerminalBudget(state) {
+    return state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS || Boolean(state.availability.terminal);
+}
+function assertRequestKey(requestKey) {
+    if (!isSafeBookingRequestKey(requestKey)) throw new Error('unsafe_request_key');
+}
+function assertInternalDecisionKey(requestKey) {
+    if (typeof requestKey !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,2047}$/.test(requestKey)) throw new Error('unsafe_internal_decision_key');
+}
+function assertDecisionBatchFinality(decisions) {
+    let finalSeen = false;
+    for (const decision of decisions){
+        const isFinal = decision.kind === 'terminal' || decision.kind === 'error';
+        if (finalSeen) throw new Error('decision_batch_finality');
+        if (isFinal) finalSeen = true;
+    }
+}
+function assertPrincipal(principal) {
+    if (!principal || typeof principal.subject !== 'string' || !principal.subject || principal.subject.length > 256 || typeof principal.scope !== 'string' || !principal.scope || principal.scope.length > 256) throw new Error('trusted_principal_required');
+}
+function assertAvailabilityLiveness(state, decisions) {
+    if (!state.availability.recoveryStarted || state.awaitingApproval) return;
+    const operations = decisions.filter((decision)=>decision.kind === 'operation');
+    if (operations.length !== 1 || !state.workspaceSnapshot) throw new Error('availability_operation_required');
+    const action = operations[0].action;
+    const activeHotelRef = state.availability.hotelRefs[state.availability.activeHotelOrdinal];
+    if (!activeHotelRef) throw new Error('availability_active_hotel_missing');
+    if (state.availability.availabilityPhase === 'need_offers') {
+        if (action.kind !== 'offers.query' || action.input.hotelRefs.length !== 1 || action.input.hotelRefs[0] !== activeHotelRef) throw new Error('availability_operation_incompatible');
+    } else if (state.availability.availabilityPhase === 'need_check') {
+        if (action.kind !== 'offer.check' || action.input.offerRef === undefined || action.input.offerVersionRef === undefined || !state.availability.hotels[activeHotelRef]?.currentOfferRefs.includes(action.input.offerRef) || !canIssueOfferCheck(state.availability, state.workspaceSnapshot, action.input.offerRef, action.input.offerVersionRef).ok) throw new Error('availability_operation_incompatible');
+    } else {
+        throw new Error('availability_operation_incompatible');
+    }
 }
 function checkpointDigest(action) {
-    return digest({
+    return bookingDigest(action);
+}
+function checkpointFor(action, eventId, sequence, emittedAt, sourceTurnId) {
+    const base = {
         actionId: action.actionId,
         kind: action.kind,
         contextRef: action.contextRef,
         expectedRevision: action.expectedRevision,
-        factRefs: action.factRefs,
-        reasonDigest: action.reasonDigest,
-        inputDigest: action.inputDigest,
-        eventId: action.eventId,
-        sequence: action.sequence,
-        emittedAt: action.emittedAt
-    });
+        factRefs: [
+            ...action.factRefs
+        ],
+        reasonDigest: bookingDigest(action.reason),
+        inputDigest: bookingDigest(action.input),
+        input: action.input,
+        eventId,
+        sequence,
+        emittedAt,
+        sourceTurnId,
+        ...action.relaxationApprovalRef ? {
+            relaxationApprovalRef: action.relaxationApprovalRef
+        } : {}
+    };
+    return {
+        ...base,
+        actionDigest: checkpointDigest(base)
+    };
 }
-function actionMatchesCheckpoint(action, checkpoint) {
-    return checkpoint.actionDigest === checkpointDigest({
-        actionId: checkpoint.actionId,
-        kind: action.kind,
-        contextRef: action.contextRef,
-        expectedRevision: action.expectedRevision,
-        factRefs: action.factRefs,
-        reasonDigest: digest(action.reason),
-        inputDigest: digest(action.input),
-        eventId: checkpoint.eventId,
-        sequence: checkpoint.sequence,
-        emittedAt: checkpoint.emittedAt
-    });
+function matchesCheckpoint(action, checkpoint) {
+    const candidate = checkpointFor(action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : {
+        ...action,
+        relaxationApprovalRef: checkpoint.relaxationApprovalRef
+    }, checkpoint.eventId, checkpoint.sequence, checkpoint.emittedAt, checkpoint.sourceTurnId);
+    const { actionDigest: _ignored, ...candidateBase } = candidate;
+    return checkpoint.actionDigest === checkpointDigest(candidateBase);
 }
-function assertSafeFactRefs(action) {
-    const opaque = (ref)=>/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(ref) && !/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/i.test(ref);
-    if (!opaque(action.actionId)) throw new Error('unsafe_action_id');
-    if (action.factRefs.some((ref)=>!opaque(ref))) throw new Error('unsafe_fact_ref');
+function receiptSourceDigest(receipt) {
+    return bookingDigest({
+        ...receipt,
+        resultContract: {
+            ...receipt.resultContract,
+            blockers: receipt.resultContract.blockers.map(({ sourceReceiptDigest: _ignored, ...blocker })=>blocker)
+        }
+    });
 }
-function validationMessage(result) {
-    return result.ok ? '' : result.errors.join('; ');
+function assertCanonicalReceipt(receipt) {
+    const expected = receiptSourceDigest(receipt);
+    if (receipt.resultContract.blockers.some((blocker)=>blocker.sourceReceiptDigest !== expected)) throw new Error('receipt_source_digest_mismatch');
 }
-function assertTaskId(taskId) {
-    if (!taskId) throw new Error('invalid_task_id');
+function receiptObservationMatchesAction(observation, action) {
+    if (observation === 'gap') return true;
+    const expected = {
+        'search.patch': 'search.state',
+        'search.run': 'search.state',
+        'results.view.patch': 'results.state',
+        'hotel.focus': 'hotel.focus',
+        'hotel.select': 'hotel.selection',
+        'offers.query': 'offers.state',
+        'offers.view.patch': 'offers.state',
+        'offers.compare': 'offers.state',
+        'offer.select': 'offer.selection',
+        'offer.check': 'offer.availability',
+        'checkout.prepare': 'checkout.handoff',
+        'order.observe': 'order.state'
+    };
+    return expected[action] === observation;
 }
-function sameActionAllowlist(left, right) {
-    return left.length === right.length && [
-        ...left
-    ].sort().every((kind, index)=>kind === [
-            ...right
+function sameRefSet(a, b) {
+    return a.length === b.length && [
+        ...a
+    ].sort().every((value, index)=>value === [
+            ...b
         ].sort()[index]);
 }
+function receiptTargetMatchesAction(receipt, action) {
+    const observation = receipt.observation;
+    const input = action.input;
+    if (action.kind === 'hotel.focus' && observation.kind === 'hotel.focus') return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'hotel.select' && observation.kind === 'hotel.selection') return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'offer.select' && observation.kind === 'offer.selection') return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef;
+    if (action.kind === 'offer.check' && observation.kind === 'offer.availability') return observation.offerRef === input.offerRef && observation.checkedOfferVersionRef === input.offerVersionRef;
+    if (action.kind === 'checkout.prepare' && observation.kind === 'checkout.handoff') return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef && observation.verifiedOfferRef === input.verifiedOfferRef;
+    if (action.kind === 'offers.query' && observation.kind === 'offers.state') return sameRefSet(observation.hotelRefs, input.hotelRefs);
+    if (action.kind === 'offers.view.patch' && observation.kind === 'offers.state') return observation.hotelRefs.includes(input.hotelRef);
+    if (action.kind === 'offers.compare' && observation.kind === 'offers.state') return input.offerRefs.every((offerRef)=>observation.offerRefs.includes(offerRef));
+    if (action.kind === 'order.observe' && observation.kind === 'order.state') return observation.orderRef === input.orderRef;
+    return observation.kind === 'gap' || action.kind === 'search.patch' || action.kind === 'search.run' || action.kind === 'results.view.patch';
+}
+function workspaceBoundaryMatches(a, b) {
+    return a.locale === b.locale && a.currency === b.currency && a.surface === b.surface && a.contextRef === b.contextRef && a.capabilities.surface === b.capabilities.surface && sameActions(a.capabilities.allowedActions, b.capabilities.allowedActions);
+}
+function workspaceHasOfferVersion(workspace, offerRef, offerVersionRef) {
+    return workspace.loadedOffers.some((offer)=>offer.offerRef === offerRef && offer.offerVersionRef === offerVersionRef);
+}
+function verifiedOfferMatches(workspace, input) {
+    return workspace.verifiedOffer?.offerRef === input.offerRef && workspace.verifiedOffer.offerVersionRef === input.offerVersionRef && workspace.verifiedOffer.verifiedOfferRef === input.verifiedOfferRef;
+}
+function verifiedOfferUnexpired(workspace, now) {
+    return Boolean(workspace.verifiedOffer && isBookingDateTime(workspace.verifiedOffer.expiresAt) && Date.parse(workspace.verifiedOffer.expiresAt) > Date.parse(now));
+}
+function actionHitsCurrentOfferVersion(workspace, action, now) {
+    if (action.kind === 'offer.select' || action.kind === 'offer.check') return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef);
+    if (action.kind === 'checkout.prepare') return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef) && verifiedOfferMatches(workspace, action.input) && (now === undefined || verifiedOfferUnexpired(workspace, now));
+    return true;
+}
+function shortlistAfterCheckedOffer(previous, current, checkedOfferRef) {
+    if (sameActions(previous, current)) return true;
+    const removedChecked = previous.filter((ref)=>ref !== checkedOfferRef);
+    return removedChecked.length === previous.length - 1 && sameActions(removedChecked, current);
+}
+function loadedOffersUnchanged(previous, current) {
+    return sameActions(previous.loadedOffers.map((offer)=>bookingDigest(offer)), current.loadedOffers.map((offer)=>bookingDigest(offer)));
+}
+function changedFactRefsMatch(previousFactRefs, currentFactRefs, changedFactRefs) {
+    if (!changedFactRefs.length) return false;
+    const before = new Set(previousFactRefs);
+    const after = new Set(currentFactRefs);
+    const diff = [
+        ...previousFactRefs.filter((ref)=>!after.has(ref)),
+        ...currentFactRefs.filter((ref)=>!before.has(ref))
+    ];
+    return sameActions(diff, changedFactRefs);
+}
+function loadedOffersChangedVersionOnly(previous, current, offerRef, currentOfferVersionRef, changedFactRefs) {
+    if (previous.loadedOffers.length !== current.loadedOffers.length) return false;
+    const previousChecked = previous.loadedOffers.find((offer)=>offer.offerRef === offerRef);
+    const currentChecked = current.loadedOffers.find((offer)=>offer.offerRef === offerRef);
+    if (!previousChecked || !currentChecked || previousChecked.hotelRef !== currentChecked.hotelRef || currentChecked.offerVersionRef !== currentOfferVersionRef || previousChecked.offerVersionRef === currentChecked.offerVersionRef) return false;
+    if (previousChecked.evidenceLevel !== currentChecked.evidenceLevel) return false;
+    if (!changedFactRefsMatch(previousChecked.factRefs, currentChecked.factRefs, changedFactRefs)) return false;
+    const previousOther = previous.loadedOffers.filter((offer)=>offer.offerRef !== offerRef).map((offer)=>bookingDigest(offer));
+    const currentOther = current.loadedOffers.filter((offer)=>offer.offerRef !== offerRef).map((offer)=>bookingDigest(offer));
+    return sameActions(previousOther, currentOther);
+}
+function availabilityReceiptIsComplete(receipt) {
+    return receipt.resultContract.outcome === 'complete' && receipt.resultContract.hardCriteriaMet && receipt.resultContract.gapCodes.length === 0 && receipt.resultContract.blockers.length === 0;
+}
+function offerCheckPostActionMatches(previous, current, action, receipt) {
+    const checkedOfferRef = action.input.offerRef;
+    const checkedOfferVersionRef = action.input.offerVersionRef;
+    const observation = receipt.observation.kind === 'offer.availability' ? receipt.observation : undefined;
+    const negative = receipt.status === 'unavailable' || receipt.status === 'no_match';
+    if ([
+        'applied',
+        'changed',
+        'unavailable',
+        'no_match'
+    ].includes(receipt.status) && !observation) return false;
+    if (receipt.status === 'applied' && observation?.available && observation.verifiedOfferRef) {
+        if (!availabilityReceiptIsComplete(receipt) || observation.gapCodes?.length) return false;
+        if (!loadedOffersUnchanged(previous, current)) return false;
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef !== checkedOfferVersionRef) return false;
+        if (current.selectedOfferRef !== checkedOfferRef) return false;
+        if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs)) return false;
+        if (!current.verifiedOffer || current.verifiedOffer.offerRef !== checkedOfferRef || current.verifiedOffer.offerVersionRef !== checkedOfferVersionRef || current.verifiedOffer.verifiedOfferRef !== observation.verifiedOfferRef || Number.isNaN(Date.parse(current.verifiedOffer.expiresAt))) return false;
+        return true;
+    }
+    if (receipt.status === 'changed' && observation?.available && observation.currentOfferVersionRef) {
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef === checkedOfferVersionRef || observation.verifiedOfferRef || !observation.changedFactRefs.length) return false;
+        if (!loadedOffersChangedVersionOnly(previous, current, checkedOfferRef, observation.currentOfferVersionRef, observation.changedFactRefs)) return false;
+        if (current.selectedOfferRef !== checkedOfferRef || current.verifiedOffer !== undefined) return false;
+        return sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs);
+    }
+    if (!loadedOffersUnchanged(previous, current)) return false;
+    if (negative) {
+        if (current.selectedOfferRef !== undefined || current.verifiedOffer !== undefined) return false;
+        if (!shortlistAfterCheckedOffer(previous.shortlistedOfferRefs, current.shortlistedOfferRefs, checkedOfferRef)) return false;
+        return !current.shortlistedOfferRefs.includes(checkedOfferRef);
+    }
+    if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs)) return false;
+    if (previous.selectedOfferRef !== current.selectedOfferRef) return false;
+    if (bookingDigest(previous.verifiedOffer ?? null) !== bookingDigest(current.verifiedOffer ?? null)) return false;
+    return true;
+}
+function offerSelectPostActionMatches(previous, current, action, receipt) {
+    if (receipt.status !== 'applied') return current.selectedOfferRef === previous.selectedOfferRef && loadedOffersUnchanged(previous, current);
+    if (receipt.observation.kind !== 'offer.selection' || receipt.observation.offerRef !== action.input.offerRef || receipt.observation.offerVersionRef !== action.input.offerVersionRef) return false;
+    if (current.selectedOfferRef !== action.input.offerRef) return false;
+    return loadedOffersUnchanged(previous, current);
+}
+function workspacePostActionMatches(previous, current, action, receipt) {
+    if (!workspaceBoundaryMatches(previous, current)) return false;
+    const mutable = {
+        'search.patch': [
+            'searchDraft'
+        ],
+        'search.run': [
+            'results',
+            'visibleHotels'
+        ],
+        'results.view.patch': [
+            'results'
+        ],
+        'hotel.focus': [
+            'focusedHotelRef'
+        ],
+        'hotel.select': [
+            'focusedHotelRef'
+        ],
+        'offers.query': [
+            'loadedOffers'
+        ],
+        'offers.view.patch': [
+            'loadedOffers'
+        ],
+        'offer.select': [
+            'selectedOfferRef'
+        ],
+        'offer.check': [
+            'selectedOfferRef',
+            'shortlistedOfferRefs',
+            'verifiedOffer',
+            'loadedOffers'
+        ]
+    };
+    if (action.kind === 'offer.select' && !offerSelectPostActionMatches(previous, current, {
+        kind: 'offer.select',
+        input: {
+            offerRef: action.input.offerRef,
+            offerVersionRef: action.input.offerVersionRef
+        }
+    }, receipt)) return false;
+    if (action.kind === 'offer.check' && !offerCheckPostActionMatches(previous, current, {
+        kind: 'offer.check',
+        input: {
+            offerRef: action.input.offerRef,
+            offerVersionRef: action.input.offerVersionRef
+        }
+    }, receipt)) return false;
+    const allowed = new Set([
+        'revision',
+        ...mutable[action.kind] ?? []
+    ]);
+    const keys = new Set([
+        ...Object.keys(previous),
+        ...Object.keys(current)
+    ]);
+    for (const key of keys){
+        if (allowed.has(key)) continue;
+        if (bookingDigest(previous[key]) !== bookingDigest(current[key])) return false;
+    }
+    return true;
+}
+function approvalOption(taskId, contextRef, sourceTurnId, presentationRequestKey, blocker, to, deliveryNonce) {
+    const base = {
+        taskId,
+        contextRef,
+        sourceTurnId,
+        presentationRequestKey,
+        approvalId: `approval-${blocker.blockerId}-${to}`,
+        deliveryNonce,
+        blockerId: blocker.blockerId,
+        sourceActionId: blocker.sourceActionId,
+        sourceReceiptDigest: blocker.sourceReceiptDigest,
+        scope: blocker.scope,
+        code: blocker.code,
+        criterionPath: blocker.criterionPath,
+        valueDigest: blocker.valueDigest,
+        from: 'must',
+        to,
+        approved: true
+    };
+    return {
+        ...base,
+        optionDigest: bookingDigest(base)
+    };
+}
+function approvalOptionDigest(approval) {
+    const { optionDigest: _optionDigest, ...base } = approval;
+    return bookingDigest(base);
+}
+function presentationKey(taskId, sourceTurnId, actionId, receiptDigest) {
+    return `approval:${taskId}:${sourceTurnId}:${actionId}:${receiptDigest}`;
+}
+function assertApprovalRef(ref, state, action) {
+    const approval = state.awaitingApproval?.approval;
+    const blocker = state.awaitingApproval?.blocker;
+    if (!approval || !blocker || ref.approvalId !== approval.approvalId || ref.blockerId !== blocker.blockerId || ref.contextRef !== state.contextRef || ref.sourceTurnId !== state.awaitingApproval?.sourceTurnId || ref.presentationRequestKey !== state.awaitingApproval?.presentationRequestKey || ref.sourceActionId !== blocker.sourceActionId || ref.targetActionId !== action.actionId || ref.sourceRevision !== action.expectedRevision || ref.targetActionKind !== action.kind || ref.to !== approval.to || ref.expiresAt !== state.awaitingApproval?.expiresAt || ref.nonce !== state.awaitingApproval?.nonce || ref.sourceReceiptDigest !== blocker.sourceReceiptDigest || ref.scope !== blocker.scope || ref.code !== blocker.code || ref.criterionPath !== blocker.criterionPath || ref.valueDigest !== blocker.valueDigest) throw new Error('ledger_corrupt:approval_ref');
+}
 export class BookingCopilotTaskRuntime {
     ledger;
     idFactory;
+    contextRefFactory;
     now;
+    approvalTtlMs;
     constructor(ledger, options = {}){
         this.ledger = ledger;
         this.idFactory = options.idFactory ?? ((prefix)=>`${prefix}-${randomUUID()}`);
+        this.contextRefFactory = options.contextRefFactory ?? (()=>this.idFactory('context'));
         this.now = options.now ?? (()=>new Date().toISOString());
+        this.approvalTtlMs = options.approvalTtlMs ?? 120_000;
+    }
+    assertRequestBinding(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        if (input.requestKey !== requestKey) throw new Error('request_conflict');
+        const existing = this.requestBinding(requestKey);
+        if (!existing) return;
+        const candidate = this.requestBindingPayload(requestKey, turn, input);
+        if (existing.requestDigest !== candidate.requestDigest || existing.turnId !== candidate.turnId || existing.workspaceDigest !== candidate.workspaceDigest || existing.workspaceSemanticDigest !== candidate.workspaceSemanticDigest || existing.surface !== candidate.surface || existing.capabilityDigest !== candidate.capabilityDigest || existing.contextRef !== turn.workspace.contextRef || existing.principalDigest !== candidate.principalDigest || existing.scopeDigest !== candidate.scopeDigest || existing.taskHandle !== candidate.taskHandle) throw new Error('request_conflict');
+    }
+    assertTurnBinding(taskId, turn) {
+        assertTaskId(taskId);
+        const row = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, taskId, TURN);
+        const observed = row.map(({ payload })=>JSON.parse(payload)).find((candidate)=>candidate.turnId === turn.turnId);
+        if (!observed || observed.requestDigest !== bookingTurnDigest(turn) || observed.workspaceDigest !== bookingWorkspaceDigest(turn.workspace) || observed.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turn.workspace) || observed.contextRef !== turn.workspace.contextRef) throw new Error('turn_conflict');
+    }
+    assertApprovalNotConsumed(taskId, approval) {
+        assertTaskId(taskId);
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
+        for (const row of rows){
+            const consumed = JSON.parse(row.payload);
+            if (consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval)) throw new Error('approval_replayed');
+        }
+    }
+    persistRequestBinding(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        if (input.requestKey !== requestKey) throw new Error('request_conflict');
+        const run = this.ledger.db.transaction(()=>{
+            const state = this.requireTask(turn.taskId);
+            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+            assertReplayUpgradeReanchored(state);
+            this.appendRequestBindingInTransaction(requestKey, turn, input);
+        });
+        run.immediate();
+    }
+    bindIngressTurn(turn, task, turnId) {
+        assertSafeRef(turnId);
+        const approval = turn.request.approval;
+        if (approval && (approval.taskId !== task.taskId || approval.contextRef !== task.contextRef)) {
+            throw new Error('invalid_ingress_approval_authority');
+        }
+        return {
+            schemaVersion: 'booking.surface',
+            kind: 'user.turn',
+            taskId: task.taskId,
+            turnId,
+            workspace: {
+                ...turn.workspace,
+                schemaVersion: 'booking.surface',
+                contextRef: task.contextRef,
+                surface: task.surface,
+                capabilities: {
+                    surface: task.surface,
+                    allowedActions: [
+                        ...task.allowedActions
+                    ]
+                }
+            },
+            request: approval ? {
+                text: turn.request.text,
+                approval: {
+                    ...approval
+                }
+            } : {
+                text: turn.request.text
+            }
+        };
     }
-    startTask(turn) {
-        const validation = validateBookingCopilotTurnV1(turn);
-        if (!validation.ok || turn.kind !== 'user.turn') throw new Error(`invalid_planner_turn:${validationMessage(validation)}`);
-        const taskId = turn.taskId ?? this.idFactory('task');
+    startTask(turn, requestBinding) {
+        const validation = validateBookingSurface(turn);
+        if (!validation.ok) throw new Error(`invalid_planner_turn:${errorText(validation)}`);
+        if (turn.kind === 'user.turn.ingress') throw new Error('ingress_binding_required');
+        if (turn.kind === 'action.receipt.continuation') throw new Error('receipt_continuation_requires_continue');
+        const userTurn = turn;
+        if (!userTurn.taskId) throw new Error('invalid_planner_turn:task_id_required');
+        const taskId = userTurn.taskId;
         assertTaskId(taskId);
-        const requestDigest = digest(turn.request.text);
-        const apply = this.ledger.db.transaction(()=>{
+        const turnId = userTurn.turnId;
+        if (!turnId) throw new Error('invalid_planner_turn:turn_id_required');
+        assertSafeRef(turnId);
+        const contextRef = userTurn.workspace.contextRef;
+        const surface = userTurn.workspace.surface;
+        const revision = userTurn.workspace.revision;
+        const allowedActions = [
+            ...userTurn.workspace.capabilities.allowedActions
+        ];
+        const requestDigest = bookingTurnDigest(turn);
+        const boundWorkspace = userTurn.workspace;
+        assertWorkspaceLoadedOfferRefsUnique(boundWorkspace);
+        const workspaceDigest = bookingWorkspaceDigest(boundWorkspace);
+        const workspaceSemanticDigest = bookingWorkspaceSemanticDigest(boundWorkspace);
+        const availability = createAvailabilityPolicy(boundWorkspace);
+        const run = this.ledger.db.transaction(()=>{
             const existing = this.resumeTask(taskId);
             if (existing) {
-                if (existing.contextRef !== turn.workspace.contextRef) throw new Error('task_conflict:context_mismatch');
-                if (existing.surface !== turn.workspace.surface) throw new Error('task_conflict:surface_mismatch');
-                if (existing.revision !== turn.workspace.revision) throw new Error('task_conflict:revision_mismatch');
-                if (!sameActionAllowlist(existing.allowedActions, turn.workspace.capabilities.allowedActions)) {
-                    throw new Error('task_conflict:capability_mismatch');
+                if (existing.contextRef !== contextRef) throw new Error('task_conflict:context_mismatch');
+                if (existing.surface !== surface) throw new Error('task_conflict:surface_mismatch');
+                if (existing.revision !== revision && existing.phase !== 'waiting_receipt' && !existing.replayUpgradeRequired) throw new Error('task_conflict:revision_mismatch');
+                if (!sameActions(existing.allowedActions, allowedActions)) throw new Error('task_conflict:capability_mismatch');
+                if (existing.phase === 'terminal' || existing.phase === 'error') throw new Error('task_terminal');
+                if (turnId && existing.lastTurnId === turnId) {
+                    this.assertTurnBinding(taskId, userTurn);
+                    if (requestBinding) {
+                        assertReplayUpgradeReanchored(existing);
+                        this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+                    }
+                    return existing;
                 }
                 if (existing.phase === 'waiting_receipt') throw new Error('receipt_required');
-                this.observeUserTurn(taskId, existing.contextRef, requestDigest, existing.userTurnCount + 1);
+                const approval = userTurn && 'approval' in userTurn.request ? userTurn.request.approval : undefined;
+                let approvalState;
+                if (approval) {
+                    assertReplayUpgradeReanchored(existing);
+                    const awaiting = existing.awaitingApproval;
+                    if (!awaiting) throw new Error('approval_not_awaiting');
+                    if (!awaiting.optionsEmitted) throw new Error('approval_not_presented');
+                    if (Date.parse(awaiting.expiresAt) <= Date.parse(this.now())) throw new Error('approval_expired');
+                    const checked = validateApprovalAgainstBlocker(approval, awaiting.blocker);
+                    const option = awaiting.options.find((candidate)=>candidate.optionDigest === approval.optionDigest && bookingDigest(candidate) === bookingDigest(approval));
+                    if (!checked.ok || !option || approval.taskId !== existing.taskId || approval.contextRef !== existing.contextRef || approval.sourceTurnId !== awaiting.sourceTurnId || approval.presentationRequestKey !== awaiting.presentationRequestKey || approval.optionDigest !== approvalOptionDigest(approval) || awaiting.approval && bookingDigest(approval) !== bookingDigest(awaiting.approval)) throw new Error('approval_mismatch');
+                    if (awaiting.approval && bookingDigest(awaiting.approval) === bookingDigest(approval)) {
+                        throw new Error('approval_replayed');
+                    }
+                    approvalState = {
+                        ...awaiting,
+                        approval
+                    };
+                    this.appendApproval(taskId, existing.contextRef, approvalState);
+                } else if (existing.awaitingApproval) {
+                    throw new Error('approval_required');
+                }
+                this.appendTurn(taskId, existing.contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, existing.userTurnCount + 1, turnId, boundWorkspace);
+                if (requestBinding) this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
                 return this.requireTask(taskId);
             }
-            const foreign = this.ledger.db.prepare("SELECT 1 AS present FROM events WHERE tenant_id = ? AND run_id = ? AND kind LIKE 'booking.copilot.v2.%' LIMIT 1").get(this.ledger.tenant, taskId);
-            if (foreign) throw new Error('task_conflict:protocol_version');
-            const payload = {
+            if (userTurn?.request.approval) throw new Error('approval_not_awaiting');
+            const started = {
                 schema: LEDGER_SCHEMA,
                 taskId,
-                contextRef: turn.workspace.contextRef,
-                surface: turn.workspace.surface,
-                revision: turn.workspace.revision,
-                allowedActions: [
-                    ...turn.workspace.capabilities.allowedActions
-                ]
+                contextRef,
+                surface,
+                revision,
+                allowedActions,
+                workspaceDigest,
+                workspaceSemanticDigest,
+                workspace: boundWorkspace,
+                availability,
+                availabilityDigest: bookingDigest(availability)
             };
-            this.appendLedgerEvent(TASK_STARTED, taskId, payload, `booking-copilot:task:${taskId}`);
-            this.observeUserTurn(taskId, turn.workspace.contextRef, requestDigest, 1);
+            this.append(STARTED, taskId, started, `booking-copilot:task:${taskId}`);
+            this.appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, 1, turnId, boundWorkspace);
+            if (requestBinding) this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
             return this.requireTask(taskId);
         });
-        return apply.immediate();
+        return run.immediate();
     }
     resumeTask(taskId) {
         assertTaskId(taskId);
-        const rows = this.readTaskRows(taskId);
-        if (rows.length === 0) return null;
+        const rows = this.rows(taskId);
+        if (!rows.length) return null;
         let state = null;
+        let skipLegacyUpgradeTail = false;
+        const replayWorkspaceDigests = new Map();
+        const consumed = {
+            events: new Map(),
+            actions: new Map(),
+            pendingBatchKeys: new Set(),
+            pendingBatchOpen: false
+        };
+        const suppressedDecisionRequestKeys = new Set();
+        const suppressedRequestBindingKeys = new Set();
+        const suppressedReceiptActionIds = new Set();
+        const suppressedApprovalTargetActionIds = new Set();
         for (const row of rows){
             const payload = JSON.parse(row.payload);
             if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId) throw new Error(`ledger_corrupt:${taskId}:seq=${row.seq}`);
-            if (row.kind === TASK_STARTED) {
-                const started = payload;
+            if (row.kind === STARTED) {
+                skipLegacyUpgradeTail = false;
                 if (state) throw new Error(`ledger_corrupt:${taskId}:duplicate_start`);
+                const started = payload;
+                let startedWorkspace;
+                try {
+                    startedWorkspace = normalizeWorkspaceForReplay(started.workspace);
+                } catch  {
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                }
+                let initialAvailability;
+                try {
+                    initialAvailability = createAvailabilityPolicy(startedWorkspace);
+                } catch  {
+                    throw new Error(`ledger_corrupt:${taskId}:start_availability`);
+                }
+                try {
+                    assertWorkspaceLoadedOfferRefsUnique(startedWorkspace);
+                } catch  {
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                }
+                rememberReplayWorkspaceDigest(replayWorkspaceDigests, started.workspaceDigest, started.workspace, startedWorkspace);
+                const startedAvailability = normalizeAvailabilityPolicyForReplay(started.availability, startedWorkspace, undefined, undefined, replayWorkspaceDigests);
+                if (!started.workspaceDigest || !started.workspaceSemanticDigest || !started.workspace || !started.availability || !started.availabilityDigest || !validateAvailabilityPolicy(startedAvailability) || !replayDigestMatches(started.availabilityDigest, started.availability, startedAvailability) || bookingDigest(initialAvailability) !== bookingDigest(startedAvailability) || !replayWorkspaceDigestMatches(started.workspaceDigest, started.workspace, startedWorkspace) || !replayWorkspaceSemanticDigestMatches(started.workspaceSemanticDigest, started.workspace, startedWorkspace)) throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
                 state = {
-                    schemaVersion: 'booking.surface.v1',
+                    schemaVersion: 'booking.surface',
                     taskId,
                     contextRef: started.contextRef,
                     surface: started.surface,
@@ -133,217 +890,895 @@ export class BookingCopilotTaskRuntime {
                         ...started.allowedActions
                     ],
                     userTurnCount: 0,
-                    phase: 'planning',
-                    lastSequence: 0
+                    operationCount: 0,
+                    phase: startedAvailability.terminal ? 'terminal' : 'planning',
+                    lastSequence: 0,
+                    workspaceDigest: bookingWorkspaceDigest(startedWorkspace),
+                    workspaceSemanticDigest: bookingWorkspaceSemanticDigest(startedWorkspace),
+                    workspaceSnapshot: startedWorkspace,
+                    availability: startedAvailability
                 };
-                continue;
-            }
-            if (!state) throw new Error(`ledger_corrupt:${taskId}:event_before_start`);
-            if (payload.contextRef !== state.contextRef) throw new Error(`ledger_corrupt:${taskId}:context_drift`);
-            if (row.kind === USER_TURN_OBSERVED) {
-                const observed = payload;
-                state.userTurnCount += 1;
-                state.lastUserTurnDigest = observed.requestDigest;
-            } else if (row.kind === ACTION_ISSUED) {
-                const issued = payload;
-                if (issued.action.actionDigest !== checkpointDigest(issued.action)) throw new Error(`ledger_corrupt:${taskId}:action`);
-                if (state.pendingAction) throw new Error(`ledger_corrupt:${taskId}:parallel_actions`);
-                state.pendingAction = issued.action;
-                state.phase = 'waiting_receipt';
-                state.lastSequence = Math.max(state.lastSequence, issued.action.sequence);
-            } else if (row.kind === RECEIPT_OBSERVED) {
-                const observed = payload;
-                if (observed.receiptDigest !== digest(observed.receipt) || !validateActionReceiptV1(observed.receipt).ok) {
-                    throw new Error(`ledger_corrupt:${taskId}:receipt`);
-                }
-                if (!state.pendingAction || state.pendingAction.actionId !== observed.receipt.actionId) {
-                    throw new Error(`ledger_corrupt:${taskId}:orphan_receipt`);
+            } else {
+                if (!state) throw new Error(`ledger_corrupt:${taskId}:event_before_start`);
+                if (payload.contextRef !== state.contextRef) throw new Error(`ledger_corrupt:${taskId}:context_drift`);
+                if (row.kind === REQUEST_BINDING) {
+                    if (skipLegacyUpgradeTail) {
+                        const binding = payload;
+                        if (typeof binding.requestKey === 'string') suppressedRequestBindingKeys.add(binding.requestKey);
+                        continue;
+                    }
+                    const binding = payload;
+                    const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, TURN);
+                    const rawBoundTurn = turnRows.map(({ payload })=>JSON.parse(payload)).find((candidate)=>candidate.turnId === binding.turnId);
+                    let boundTurn;
+                    try {
+                        boundTurn = rawBoundTurn ? {
+                            ...rawBoundTurn,
+                            workspace: normalizeWorkspaceForReplay(rawBoundTurn.workspace)
+                        } : undefined;
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:request_binding`);
+                    }
+                    if (!isSafeBookingRequestKey(binding.requestKey) || !safeIdentity(binding.turnId) || !safeIdentity(binding.contextRef) || binding.taskHandle !== undefined && !safeIdentity(binding.taskHandle) || !/^[0-9a-f]{64}$/.test(binding.requestDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceSemanticDigest) || !/^[0-9a-f]{64}$/.test(binding.capabilityDigest) || !/^[0-9a-f]{64}$/.test(binding.principalDigest) || !/^[0-9a-f]{64}$/.test(binding.scopeDigest) || ![
+                        'tenant',
+                        'customer_portal',
+                        'storefront',
+                        'payment_link'
+                    ].includes(binding.surface) || !boundTurn || boundTurn.requestDigest !== binding.requestDigest || boundTurn.workspaceDigest !== binding.workspaceDigest || boundTurn.workspaceSemanticDigest !== binding.workspaceSemanticDigest || bookingDigest(boundTurn.workspace.capabilities) !== binding.capabilityDigest || boundTurn.workspace.surface !== binding.surface) throw new Error(`ledger_corrupt:${taskId}:request_binding`);
+                } else if (row.kind === TURN) {
+                    skipLegacyUpgradeTail = false;
+                    const t = payload;
+                    if (Object.prototype.hasOwnProperty.call(payload, 'approval')) throw new Error(`ledger_corrupt:${taskId}:turn_approval`);
+                    let turnWorkspace;
+                    try {
+                        turnWorkspace = normalizeWorkspaceForReplay(t.workspace);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    }
+                    try {
+                        assertWorkspaceLoadedOfferRefsUnique(turnWorkspace);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    }
+                    if (!t.workspaceDigest || !t.workspaceSemanticDigest || !t.workspace || !replayWorkspaceDigestMatches(t.workspaceDigest, t.workspace, turnWorkspace) || !replayWorkspaceSemanticDigestMatches(t.workspaceSemanticDigest, t.workspace, turnWorkspace)) throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    rememberReplayWorkspaceDigest(replayWorkspaceDigests, t.workspaceDigest, t.workspace, turnWorkspace);
+                    state.userTurnCount++;
+                    state.lastTurnId = t.turnId;
+                    state.workspaceDigest = bookingWorkspaceDigest(turnWorkspace);
+                    state.workspaceSemanticDigest = bookingWorkspaceSemanticDigest(turnWorkspace);
+                    state.workspaceSnapshot = turnWorkspace;
+                    state.revision = turnWorkspace.revision;
+                    delete state.replayUpgradeRequired;
+                } else if (row.kind === APPROVAL_GRANTED) {
+                    if (skipLegacyUpgradeTail) continue;
+                    const granted = payload;
+                    if (!granted.approval || granted.approvalDigest !== bookingDigest(granted.approval) || !granted.approval.sourceTurnId || !granted.approval.presentationRequestKey || !validateCriterionBlocker(granted.approval.blocker).ok || !granted.approval.options?.length || granted.approval.options.some((option)=>!validateApprovalAgainstBlocker(option, granted.approval.blocker).ok || option.taskId !== taskId || option.contextRef !== state.contextRef || option.sourceTurnId !== granted.approval.sourceTurnId || option.presentationRequestKey !== granted.approval.presentationRequestKey || option.optionDigest !== approvalOptionDigest(option)) || granted.approval.approval && !granted.approval.options.some((option)=>bookingDigest(option) === bookingDigest(granted.approval.approval))) throw new Error(`ledger_corrupt:${taskId}:approval_granted`);
+                    state.awaitingApproval = granted.approval;
+                    state.phase = 'input_required';
+                } else if (row.kind === APPROVAL_OFFERED) {
+                    if (skipLegacyUpgradeTail) continue;
+                    const offered = payload;
+                    if (!offered.approval || offered.approvalDigest !== bookingDigest(offered.approval) || !state.awaitingApproval || bookingDigest(offered.approval) !== bookingDigest(state.awaitingApproval)) throw new Error(`ledger_corrupt:${taskId}:approval_offered`);
+                    state.phase = 'input_required';
+                } else if (row.kind === ACTION) {
+                    const actionPayload = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                        } catch  {
+                            throw new Error(`ledger_corrupt:${taskId}:action`);
+                        }
+                        continue;
+                    }
+                    const rawAction = actionPayload.action;
+                    const operationCount = actionPayload.operationCount ?? state.operationCount + 1;
+                    const { actionDigest: _rawActionDigest, ...rawActionBase } = rawAction;
+                    if (rawAction.actionDigest !== checkpointDigest(rawActionBase) || rawAction.contextRef !== state.contextRef || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(rawAction.sequence) || rawAction.sequence <= state.lastSequence) throw new Error(`ledger_corrupt:${taskId}:action`);
+                    let a;
+                    try {
+                        a = normalizeActionCheckpointForReplay(rawAction, state.workspaceSnapshot);
+                    } catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            state = replanAfterReplayUpgradeGap(state);
+                            try {
+                                consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                            } catch  {
+                                throw new Error(`ledger_corrupt:${taskId}:action`);
+                            }
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    const { actionDigest: _actionDigest, ...actionBase } = a;
+                    if (!actionPayload.availability || actionPayload.availabilityDigest !== bookingDigest(actionPayload.availability)) throw new Error(`ledger_corrupt:${taskId}:action`);
+                    let actionAvailability;
+                    try {
+                        actionAvailability = normalizeAvailabilityPolicyForReplay(actionPayload.availability, state.workspaceSnapshot, a, state.availability, replayWorkspaceDigests);
+                    } catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            state = replanAfterReplayUpgradeGap(state);
+                            try {
+                                consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                            } catch  {
+                                throw new Error(`ledger_corrupt:${taskId}:action`);
+                            }
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    if (!checkpointDigestMatchesForReplay(rawAction, a) || a.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !validateAvailabilityPolicy(actionAvailability) || !replayDigestMatches(actionPayload.availabilityDigest, actionPayload.availability, actionAvailability) || !state.workspaceSnapshot) throw new Error(`ledger_corrupt:${taskId}:action`);
+                    if (a.relaxationApprovalRef) assertApprovalRef(a.relaxationApprovalRef, state, a);
+                    if (state.pendingAction) throw new Error(`ledger_corrupt:${taskId}:parallel_actions`);
+                    let expectedAvailability;
+                    try {
+                        expectedAvailability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, a);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:action_transition`);
+                    }
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(actionAvailability)) throw new Error(`ledger_corrupt:${taskId}:action_transition`);
+                    state.operationCount = operationCount;
+                    state.availability = actionAvailability;
+                    state.pendingAction = a;
+                    state.phase = 'waiting_receipt';
+                    state.lastSequence = Math.max(state.lastSequence, a.sequence);
+                    {
+                        rememberConsumedActionIdentity(consumed, a);
+                    }
+                    delete state.awaitingApproval;
+                } else if (row.kind === RECEIPT) {
+                    if (skipLegacyUpgradeTail) {
+                        const r = payload;
+                        if (typeof r.receipt?.actionId === 'string') suppressedReceiptActionIds.add(r.receipt.actionId);
+                        continue;
+                    }
+                    const r = payload;
+                    const operationCount = r.operationCount ?? state.operationCount;
+                    if (!state.pendingAction || state.pendingAction.actionId !== r.receipt.actionId) throw new Error(`ledger_corrupt:${taskId}:orphan_receipt`);
+                    let receiptWorkspace;
+                    try {
+                        receiptWorkspace = normalizeWorkspaceForReplay(r.workspace);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    }
+                    try {
+                        assertWorkspaceLoadedOfferRefsUnique(receiptWorkspace);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    }
+                    if (!r.workspaceDigest || !r.workspaceSemanticDigest || !r.workspace || !replayWorkspaceDigestMatches(r.workspaceDigest, r.workspace, receiptWorkspace) || !replayWorkspaceSemanticDigestMatches(r.workspaceSemanticDigest, r.workspace, receiptWorkspace)) throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    rememberReplayWorkspaceDigest(replayWorkspaceDigests, r.workspaceDigest, r.workspace, receiptWorkspace);
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, r.receipt) || r.receipt.contextRef !== state.contextRef || r.receipt.actionId !== state.pendingAction.actionId || !Number.isSafeInteger(r.receipt.revision) || r.receipt.revision < state.pendingAction.expectedRevision || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount) throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (!r.availability || r.availabilityDigest !== bookingDigest(r.availability)) throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    let receipt;
+                    try {
+                        receipt = normalizeReceiptForReplay(r.receipt, state.pendingAction, receiptWorkspace);
+                    } catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            clearPendingBatch(consumed);
+                            state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    let receiptAvailability;
+                    try {
+                        receiptAvailability = normalizeAvailabilityPolicyForReplay(r.availability, receiptWorkspace, state.pendingAction, state.availability, replayWorkspaceDigests, receipt);
+                    } catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            clearPendingBatch(consumed);
+                            state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, receipt) || !validateBookingSurface(receipt).ok || !r.availability || !r.availabilityDigest || !validateAvailabilityPolicy(receiptAvailability) || !replayDigestMatches(r.availabilityDigest, r.availability, receiptAvailability)) throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (Boolean(r.availabilityTerminal) !== Boolean(receiptAvailability.terminal) || r.availabilityTerminal && receiptAvailability.terminal && bookingDigest(r.availabilityTerminal) !== bookingDigest(receiptAvailability.terminal)) throw new Error(`ledger_corrupt:${taskId}:availability_terminal`);
+                    assertCanonicalReceipt(receipt);
+                    if (!state.workspaceSnapshot || !workspacePostActionMatches(state.workspaceSnapshot, receiptWorkspace, state.pendingAction, receipt) || !receiptObservationMatchesAction(receipt.observation.kind, state.pendingAction.kind) || !receiptTargetMatchesAction(receipt, state.pendingAction)) throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    let expectedAvailability;
+                    try {
+                        expectedAvailability = reduceAvailabilityReceipt(state.availability, receiptWorkspace, receipt, state.pendingAction);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    }
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(receiptAvailability)) throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    state.lastReceipt = receipt;
+                    state.revision = receipt.revision;
+                    state.workspaceDigest = bookingWorkspaceDigest(receiptWorkspace);
+                    state.workspaceSemanticDigest = bookingWorkspaceSemanticDigest(receiptWorkspace);
+                    state.workspaceSnapshot = receiptWorkspace;
+                    state.availability = receiptAvailability;
+                    delete state.pendingAction;
+                    state.phase = receiptAvailability.terminal || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS ? 'terminal' : 'planning';
+                    clearPendingBatch(consumed);
+                    delete state.awaitingApproval;
+                } else if (row.kind === APPROVAL_CONSUMED) {
+                    if (skipLegacyUpgradeTail) {
+                        const consumed = payload;
+                        if (typeof consumed.ref?.targetActionId === 'string') suppressedApprovalTargetActionIds.add(consumed.ref.targetActionId);
+                        continue;
+                    }
+                    const consumed = payload;
+                    if (!consumed.ref || consumed.approvalDigest !== bookingDigest(consumed.ref) || !consumed.approval?.approval || !consumed.approval.options?.some((option)=>bookingDigest(option) === bookingDigest(consumed.approval.approval)) || !state.awaitingApproval || bookingDigest(consumed.approval) !== bookingDigest(state.awaitingApproval) || consumed.ref.approvalId !== consumed.approval.approval.approvalId || consumed.ref.blockerId !== consumed.approval.blocker.blockerId || consumed.ref.contextRef !== state.contextRef || consumed.ref.sourceTurnId !== consumed.approval.sourceTurnId || consumed.ref.presentationRequestKey !== consumed.approval.presentationRequestKey || consumed.ref.sourceActionId !== consumed.approval.blocker.sourceActionId || consumed.ref.targetActionId === '' || consumed.ref.sourceReceiptDigest !== consumed.approval.blocker.sourceReceiptDigest || consumed.ref.nonce !== consumed.approval.nonce || consumed.ref.nonce !== consumed.approval.approval.deliveryNonce || consumed.ref.to !== consumed.approval.approval.to || consumed.ref.scope !== consumed.approval.blocker.scope || consumed.ref.code !== consumed.approval.blocker.code || consumed.ref.criterionPath !== consumed.approval.blocker.criterionPath || consumed.ref.valueDigest !== consumed.approval.blocker.valueDigest) throw new Error(`ledger_corrupt:${taskId}:approval`);
+                } else if (row.kind === DECISION_BATCH) {
+                    const batch = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedEventSequence(state, batch, consumed);
+                        } catch  {
+                            throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                        }
+                        if (typeof batch.requestKey === 'string') suppressedDecisionRequestKeys.add(batch.requestKey);
+                        continue;
+                    }
+                    if (!batch.requestKey || !Array.isArray(batch.events) || batch.events.some((event)=>event.taskId !== taskId)) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                    let batchEvents;
+                    try {
+                        batchEvents = normalizeDecisionBatchEnvelopeForReplay(batch, consumed, true);
+                    } catch  {
+                        throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                    }
+                    for (const event of batchEvents){
+                        if (event.kind !== 'question') continue;
+                        const awaiting = state.awaitingApproval;
+                        if (!awaiting || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>bookingDigest(option) === bookingDigest(approval)))) throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+                        awaiting.optionsEmitted = true;
+                        state.phase = 'input_required';
+                    }
+                } else if (row.kind === EVENT) {
+                    const event = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedEventSequence(state, event, consumed);
+                        } catch  {
+                            throw new Error(`ledger_corrupt:${taskId}:event`);
+                        }
+                        continue;
+                    }
+                    state.lastSequence = Math.max(state.lastSequence, event.sequence);
+                    {
+                        rememberConsumedEventIdentity(consumed, event);
+                    }
+                    if (event.eventKind === 'status') state.phase = event.status === 'submitted' ? 'submitted' : event.status === 'working' ? 'working' : event.status === 'waiting_receipt' ? 'waiting_receipt' : 'input_required';
+                    else if (event.eventKind === 'question') state.phase = 'input_required';
+                    else if (event.eventKind === 'terminal') state.phase = 'terminal';
+                    else if (event.eventKind === 'error') state.phase = 'error';
                 }
-                state.lastReceipt = observed.receipt;
-                state.revision = observed.receipt.revision;
-                delete state.pendingAction;
-                state.phase = 'planning';
-            } else if (row.kind === EVENT_EMITTED) {
-                const emitted = payload;
-                state.lastSequence = Math.max(state.lastSequence, emitted.sequence);
             }
         }
+        if (state) {
+            if (suppressedDecisionRequestKeys.size) state.legacySuppressedDecisionRequestKeys = [
+                ...suppressedDecisionRequestKeys
+            ];
+            if (suppressedRequestBindingKeys.size) state.legacySuppressedRequestBindingKeys = [
+                ...suppressedRequestBindingKeys
+            ];
+            if (suppressedReceiptActionIds.size) state.legacySuppressedReceiptActionIds = [
+                ...suppressedReceiptActionIds
+            ];
+            if (suppressedApprovalTargetActionIds.size) state.legacySuppressedApprovalTargetActionIds = [
+                ...suppressedApprovalTargetActionIds
+            ];
+        }
         return state;
     }
-    issueOperation(taskId, action) {
-        const validation = validateBookingReadActionV1(action);
-        if (!validation.ok) throw new Error(`invalid_action:${validation.errors.join('; ')}`);
-        assertSafeFactRefs(action);
-        const apply = this.ledger.db.transaction(()=>{
+    withReceiptDigest(receipt) {
+        const sourceDigest = receiptSourceDigest(receipt);
+        return {
+            ...receipt,
+            resultContract: {
+                ...receipt.resultContract,
+                blockers: receipt.resultContract.blockers.map((b)=>({
+                        ...b,
+                        sourceReceiptDigest: sourceDigest
+                    }))
+            }
+        };
+    }
+    receiptDigest(receipt) {
+        return canonicalReceiptDigest(receipt);
+    }
+    approvalQuestion(taskId) {
+        const task = this.requireTask(taskId);
+        const awaiting = task.awaitingApproval;
+        if (!awaiting) throw new Error('approval_not_awaiting');
+        return {
+            kind: 'question',
+            question: {
+                questionId: `question-${awaiting.blocker.blockerId}`,
+                prompt: `Relax required criterion ${awaiting.blocker.criterionPath}?`,
+                missingFields: [
+                    awaiting.blocker.criterionPath
+                ],
+                type: 'relaxation_approval_required',
+                blocker: awaiting.blocker,
+                approvalOptions: awaiting.options.map((approval)=>({
+                        approval
+                    }))
+            }
+        };
+    }
+    approvalPresentationRequestKey(taskId) {
+        const task = this.requireTask(taskId);
+        const awaiting = task.awaitingApproval;
+        if (!awaiting) throw new Error('approval_not_awaiting');
+        return awaiting.presentationRequestKey;
+    }
+    commitDecisionBatch(taskId, requestKey, decisions) {
+        return this.applyDecisionBatch(taskId, requestKey, decisions);
+    }
+    readDecisionBatch(taskId, requestKey) {
+        const state = this.requireTask(taskId);
+        if (state.legacySuppressedDecisionRequestKeys?.includes(requestKey)) throw new Error('request_key_invalidated');
+        const rows = this.ledger.db.prepare('SELECT seq, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC').all(this.ledger.tenant, taskId, DECISION_BATCH);
+        for (const row of rows){
+            const payload = JSON.parse(row.payload);
+            if (payload.requestKey !== requestKey) continue;
+            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId || payload.contextRef !== state.contextRef || !Array.isArray(payload.events) || payload.events.some((event)=>event.taskId !== taskId || event.contextRef !== state.contextRef)) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            const events = this.normalizeDecisionBatchFromDurableRows(taskId, payload.events, row.seq);
+            if (!events) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            for (const event of events){
+                if (event.kind !== 'question') continue;
+                const awaiting = state.awaitingApproval;
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval)))) throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+            }
+            return events;
+        }
+        return null;
+    }
+    terminalDecisionBatch(taskId, requestKey) {
+        assertInternalDecisionKey(requestKey);
+        const prior = this.readDecisionBatch(taskId, requestKey);
+        if (prior) return prior;
+        const state = this.requireTask(taskId);
+        if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(state);
+        const run = this.ledger.db.transaction(()=>{
             const state = this.requireTask(taskId);
-            const reasonDigest = digest(action.reason);
-            const inputDigest = digest(action.input);
-            if (state.pendingAction) {
-                if (state.pendingAction.actionId !== action.actionId) throw new Error('receipt_required');
-                if (!actionMatchesCheckpoint(action, state.pendingAction)) throw new Error('action_conflict');
-                return {
-                    schemaVersion: 'booking.surface.v1',
-                    eventId: state.pendingAction.eventId,
-                    taskId,
-                    contextRef: state.pendingAction.contextRef,
-                    sequence: state.pendingAction.sequence,
-                    emittedAt: state.pendingAction.emittedAt,
-                    kind: 'operation',
-                    action
-                };
+            if (!taskHasTerminalBudget(state) || state.phase !== 'terminal') throw new Error('task_not_terminal');
+            assertReplayUpgradeReanchored(state);
+            const event = this.terminalEvent(state);
+            this.appendTerminalEvent(taskId, event);
+            this.append(DECISION_BATCH, taskId, {
+                schema: LEDGER_SCHEMA,
+                taskId,
+                contextRef: state.contextRef,
+                requestKey,
+                events: [
+                    event
+                ]
+            }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            return [
+                event
+            ];
+        });
+        return run.immediate();
+    }
+    applyDecisionBatch(taskId, requestKey, decisions, includeSubmitted = false) {
+        assertInternalDecisionKey(requestKey);
+        const prior = this.readDecisionBatch(taskId, requestKey);
+        if (prior) return prior;
+        const current = this.requireTask(taskId);
+        if (current.phase === 'terminal' || current.phase === 'error') throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(current);
+        assertDecisionBatchFinality(decisions);
+        assertAvailabilityLiveness(current, decisions);
+        if (current.availability.recoveryStarted && !current.availability.terminal && decisions.some((decision)=>decision.kind === 'terminal' || decision.kind === 'error')) throw new Error('availability_terminal_policy_owned');
+        for (const decision of decisions){
+            if (decision.kind === 'operation') {
+                const checked = validateBookingReadAction(decision.action);
+                if (!checked.ok) throw new Error(`invalid_action:${errorText(checked)}`);
+            }
+        }
+        const run = this.ledger.db.transaction(()=>{
+            const events = [];
+            const before = this.requireTask(taskId);
+            assertReplayUpgradeReanchored(before);
+            assertAvailabilityLiveness(before, decisions);
+            if (before.availability.recoveryStarted && !before.availability.terminal && decisions.some((decision)=>decision.kind === 'terminal' || decision.kind === 'error')) throw new Error('availability_terminal_policy_owned');
+            for (const decision of decisions){
+                if (decision.kind !== 'question') continue;
+                const awaiting = before.awaitingApproval;
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(decision.question.blocker) !== bookingDigest(awaiting.blocker) || decision.question.approvalOptions.length !== awaiting.options.length || decision.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval)))) throw new Error('approval_presentation_key_mismatch');
+                this.ensureApprovalOffered(taskId, before.contextRef, awaiting, requestKey);
+            }
+            if (includeSubmitted) events.push(this.emitEventInTransaction(taskId, {
+                kind: 'status',
+                status: 'submitted'
+            }));
+            events.push(this.emitEventInTransaction(taskId, {
+                kind: 'status',
+                status: 'working'
+            }));
+            for (const decision of decisions){
+                if (decision.kind === 'operation') {
+                    events.push(this.issueOperationInTransaction(taskId, decision.action));
+                    events.push(this.emitEventInTransaction(taskId, {
+                        kind: 'status',
+                        status: 'waiting_receipt'
+                    }));
+                } else events.push(this.emitEventInTransaction(taskId, decision));
             }
-            const historicalReceipt = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, RECEIPT_OBSERVED);
-            if (historicalReceipt.some((row)=>JSON.parse(row.payload).receipt?.actionId === action.actionId)) throw new Error('action_already_receipted');
-            if (state.lastReceipt?.actionId === action.actionId) throw new Error('action_already_receipted');
-            if (action.contextRef !== state.contextRef) throw new Error('context_mismatch');
-            if (!new Set(state.allowedActions).has(action.kind)) throw new Error('unsupported_action');
-            if (action.expectedRevision !== state.revision) throw new Error('stale_revision');
-            const event = {
-                schemaVersion: 'booking.surface.v1',
-                eventId: this.idFactory('event'),
+            const state = this.requireTask(taskId);
+            this.append(DECISION_BATCH, taskId, {
+                schema: LEDGER_SCHEMA,
                 taskId,
                 contextRef: state.contextRef,
-                sequence: state.lastSequence + 1,
-                emittedAt: this.now(),
-                kind: 'operation',
-                action
-            };
-            const eventValidation = validateBookingSurfaceEventV1(event);
-            if (!eventValidation.ok) throw new Error(`invalid_operation_event:${eventValidation.errors.join('; ')}`);
-            const checkpointBase = {
-                actionId: action.actionId,
-                kind: action.kind,
-                contextRef: action.contextRef,
-                expectedRevision: action.expectedRevision,
-                factRefs: [
-                    ...action.factRefs
-                ],
-                reasonDigest,
-                inputDigest,
-                eventId: event.eventId,
-                sequence: event.sequence,
-                emittedAt: event.emittedAt
+                requestKey,
+                events
+            }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            return events;
+        });
+        return run.immediate();
+    }
+    issueOperation(taskId, candidate) {
+        const validation = validateBookingReadAction(candidate);
+        if (!validation.ok) throw new Error(`invalid_action:${errorText(validation)}`);
+        assertTaskId(taskId);
+        assertSafeRef(candidate.actionId);
+        candidate.factRefs.forEach(assertSafeRef);
+        return this.ledger.db.transaction(()=>this.issueOperationInTransaction(taskId, candidate)).immediate();
+    }
+    issueOperationInTransaction(taskId, candidate) {
+        assertSafeRef(candidate.actionId);
+        candidate.factRefs.forEach(assertSafeRef);
+        const state = this.requireTask(taskId);
+        if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(state);
+        if (state.pendingAction) {
+            if (state.pendingAction.actionId !== candidate.actionId) throw new Error('receipt_required');
+            if (!matchesCheckpoint(candidate, state.pendingAction)) throw new Error('action_conflict');
+            return this.operationEvent(taskId, state.pendingAction, candidate);
+        }
+        if (candidate.contextRef !== state.contextRef) throw new Error('context_mismatch');
+        if (!state.allowedActions.includes(candidate.kind)) throw new Error('unsupported_action');
+        if (candidate.expectedRevision !== state.revision) throw new Error('stale_revision');
+        if (state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS) throw new Error('operation_limit_reached');
+        if (candidate.relaxationApprovalRef) throw new Error('approval_ref_planner_owned_forbidden');
+        if (!state.workspaceSnapshot) throw new Error(`ledger_corrupt:${taskId}:workspace_missing`);
+        if (!actionHitsCurrentOfferVersion(state.workspaceSnapshot, candidate, this.now())) throw new Error('offer_version_not_loaded');
+        let action = candidate;
+        const availability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, candidate);
+        if (state.awaitingApproval) {
+            const approval = state.awaitingApproval;
+            if (!approval.approval || Date.parse(approval.expiresAt) <= Date.parse(this.now())) throw new Error('approval_expired');
+            const ref = {
+                approvalId: approval.approval.approvalId,
+                blockerId: approval.blocker.blockerId,
+                contextRef: state.contextRef,
+                sourceTurnId: approval.sourceTurnId,
+                presentationRequestKey: approval.presentationRequestKey,
+                sourceActionId: approval.blocker.sourceActionId,
+                targetActionId: candidate.actionId,
+                sourceRevision: candidate.expectedRevision,
+                targetActionKind: candidate.kind,
+                to: approval.approval.to,
+                expiresAt: approval.expiresAt,
+                nonce: approval.nonce,
+                sourceReceiptDigest: approval.blocker.sourceReceiptDigest,
+                scope: approval.blocker.scope,
+                code: approval.blocker.code,
+                criterionPath: approval.blocker.criterionPath,
+                valueDigest: approval.blocker.valueDigest
             };
-            const checkpoint = {
-                ...checkpointBase,
-                actionDigest: checkpointDigest(checkpointBase)
+            action = {
+                ...candidate,
+                relaxationApprovalRef: ref
             };
-            const payload = {
+            this.append(APPROVAL_CONSUMED, taskId, {
                 schema: LEDGER_SCHEMA,
                 taskId,
                 contextRef: state.contextRef,
-                action: checkpoint
-            };
-            this.appendActionIssued(taskId, payload, `booking-copilot:action:${taskId.length}:${taskId}:${action.actionId.length}:${action.actionId}`);
-            return event;
-        });
-        return apply.immediate();
+                approval,
+                ref,
+                approvalDigest: bookingDigest(ref)
+            }, `booking-copilot:approval-consumed:${taskId}:${approval.approval.approvalId}:${approval.nonce}`);
+        }
+        const eventId = this.idFactory('event');
+        const emittedAt = this.now();
+        const sequence = state.lastSequence + 1;
+        const event = {
+            schemaVersion: 'booking.surface',
+            eventId,
+            taskId,
+            contextRef: state.contextRef,
+            sequence,
+            emittedAt,
+            kind: 'operation',
+            action
+        };
+        const eventValidation = validateBookingSurfaceEvent(event);
+        if (!eventValidation.ok) throw new Error(`invalid_operation_event:${errorText(eventValidation)}`);
+        if (!state.lastTurnId) throw new Error(`ledger_corrupt:${taskId}:turn_id`);
+        this.appendAction(taskId, state.contextRef, checkpointFor(action, eventId, sequence, emittedAt, state.lastTurnId), state.operationCount + 1, availability);
+        return event;
     }
     continueWithReceipt(turn) {
-        const validation = validateBookingCopilotTurnV1(turn);
-        if (!validation.ok || turn.kind !== 'action.receipt.continuation') {
-            throw new Error(`invalid_receipt_continuation:${validationMessage(validation)}`);
-        }
-        const receiptDigest = digest(turn.receipt);
-        const apply = this.ledger.db.transaction(()=>{
+        const validation = validateBookingSurface(turn);
+        if (!validation.ok) throw new Error(`invalid_receipt_continuation:${errorText(validation)}`);
+        assertWorkspaceLoadedOfferRefsUnique(turn.workspace);
+        assertCanonicalReceipt(turn.receipt);
+        const run = this.ledger.db.transaction(()=>{
             const state = this.requireTask(turn.taskId);
+            assertReplayUpgradeReanchored(state);
             if (turn.workspace.contextRef !== state.contextRef || turn.receipt.contextRef !== state.contextRef) throw new Error('context_mismatch');
-            const history = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq`).all(this.ledger.tenant, turn.taskId, RECEIPT_OBSERVED);
-            for (const row of history){
+            const receiptWorkspace = bookingWorkspaceDigest(turn.workspace);
+            const receiptWorkspaceSemantic = bookingWorkspaceSemanticDigest(turn.workspace);
+            if (!state.workspaceSnapshot || !workspaceBoundaryMatches(state.workspaceSnapshot, turn.workspace)) throw new Error('workspace_mismatch');
+            const existing = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq`).all(this.ledger.tenant, turn.taskId, RECEIPT);
+            const receiptDigest = canonicalReceiptDigest(turn.receipt);
+            if (state.legacySuppressedReceiptActionIds?.includes(turn.receipt.actionId)) throw new Error('request_key_invalidated');
+            for (const row of existing){
                 const prior = JSON.parse(row.payload);
-                if (prior.receipt?.actionId !== turn.receipt.actionId) continue;
-                if (prior.schema !== LEDGER_SCHEMA || prior.taskId !== turn.taskId || prior.contextRef !== state.contextRef || prior.receiptDigest !== digest(prior.receipt) || !validateActionReceiptV1(prior.receipt).ok) throw new Error('ledger_corrupt:receipt');
+                if (prior.receipt.actionId !== turn.receipt.actionId) continue;
                 if (prior.receiptDigest !== receiptDigest) throw new Error('receipt_conflict');
+                if (prior.workspaceDigest !== receiptWorkspace) throw new Error('workspace_mismatch');
                 return state;
             }
+            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
             if (!state.pendingAction) throw new Error('unexpected_receipt');
             if (state.pendingAction.actionId !== turn.receipt.actionId) throw new Error('receipt_action_mismatch');
             if (turn.receipt.revision < state.pendingAction.expectedRevision) throw new Error('revision_regression');
-            const payload = {
+            if (turn.receipt.resultContract.blockers.some((blocker)=>blocker.sourceActionId !== state.pendingAction.actionId)) throw new Error('receipt_source_action_mismatch');
+            if (!workspacePostActionMatches(state.workspaceSnapshot, turn.workspace, state.pendingAction, turn.receipt)) throw new Error('workspace_mismatch');
+            if (!receiptObservationMatchesAction(turn.receipt.observation.kind, state.pendingAction.kind)) throw new Error('receipt_observation_action_mismatch');
+            if (!receiptTargetMatchesAction(turn.receipt, state.pendingAction)) throw new Error('receipt_target_mismatch');
+            if (state.pendingAction.kind === 'offer.check' && turn.receipt.status === 'applied' && !verifiedOfferUnexpired(turn.workspace, this.now())) throw new Error('receipt_verified_offer_expired');
+            if (state.pendingAction.kind === 'offers.query' && turn.receipt.observation.kind === 'offers.state') validateOffersReceiptWorkspace(turn.receipt, turn.workspace, state.pendingAction.input.hotelRefs);
+            if (turn.receipt.resultContract.relaxationsApplied.some((approval)=>!this.approvalWasConsumed(turn.taskId, approval, state.pendingAction.actionId))) throw new Error('receipt_relaxation_unauthorized');
+            const pending = state.pendingAction;
+            if (turn.receipt.revision !== turn.workspace.revision) throw new Error('revision_mismatch');
+            const availability = reduceAvailabilityReceipt(state.availability, turn.workspace, turn.receipt, pending);
+            const availabilityTerminal = availabilityPolicyTerminal(availability);
+            this.append(RECEIPT, turn.taskId, {
                 schema: LEDGER_SCHEMA,
                 taskId: turn.taskId,
                 contextRef: state.contextRef,
                 receipt: turn.receipt,
-                receiptDigest
-            };
-            const idemKey = `booking-copilot:receipt:${turn.taskId.length}:${turn.taskId}:${turn.receipt.actionId.length}:${turn.receipt.actionId}`;
-            const info = this.ledger.db.prepare(`INSERT INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), LEDGER_ACTOR, RECEIPT_OBSERVED, turn.taskId, JSON.stringify(payload), idemKey, turn.taskId);
-            if (info.changes !== 1) throw new Error('ledger_write_failed:receipt');
+                receiptDigest,
+                operationCount: state.operationCount,
+                workspaceDigest: receiptWorkspace,
+                workspaceSemanticDigest: receiptWorkspaceSemantic,
+                workspace: turn.workspace,
+                availability,
+                availabilityDigest: bookingDigest(availability),
+                ...availabilityTerminal ? {
+                    availabilityTerminal
+                } : {}
+            }, `booking-copilot:receipt:${turn.taskId}:${turn.receipt.actionId}`);
+            if (availabilityTerminal || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS) {
+                const terminalState = this.requireTask(turn.taskId);
+                const terminalEvent = this.terminalEvent(terminalState);
+                this.appendTerminalEvent(turn.taskId, terminalEvent);
+                this.append(DECISION_BATCH, turn.taskId, {
+                    schema: LEDGER_SCHEMA,
+                    taskId: turn.taskId,
+                    contextRef: state.contextRef,
+                    requestKey: `receipt:${turn.receipt.actionId}:${receiptDigest}`,
+                    events: [
+                        terminalEvent
+                    ]
+                }, `booking-copilot:decision-batch:${turn.taskId}:receipt:${turn.receipt.actionId}:${receiptDigest}`);
+                return terminalState;
+            }
+            const blocker = turn.receipt.resultContract.blockers[0];
+            if (blocker) {
+                const nonce = randomUUID();
+                const sourceTurnId = state.pendingAction?.sourceTurnId ?? state.lastTurnId ?? `ordinal:${state.userTurnCount}`;
+                const requestKey = presentationKey(turn.taskId, sourceTurnId, turn.receipt.actionId, receiptDigest);
+                const approval = {
+                    blocker,
+                    options: [
+                        approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'prefer', nonce),
+                        approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'drop', nonce)
+                    ],
+                    optionsEmitted: false,
+                    approval: undefined,
+                    nonce,
+                    expiresAt: new Date(Date.parse(this.now()) + this.approvalTtlMs).toISOString(),
+                    sourceTurnId,
+                    presentationRequestKey: requestKey
+                };
+                this.append(APPROVAL_GRANTED, turn.taskId, {
+                    schema: LEDGER_SCHEMA,
+                    taskId: turn.taskId,
+                    contextRef: state.contextRef,
+                    approval,
+                    approvalDigest: bookingDigest(approval)
+                }, `booking-copilot:approval-awaiting:${turn.taskId}:${turn.receipt.actionId}`);
+            }
             return this.requireTask(turn.taskId);
         });
-        return apply.immediate();
+        return run.immediate();
     }
     emitEvent(taskId, draft) {
-        const apply = this.ledger.db.transaction(()=>{
+        return this.ledger.db.transaction(()=>{
             const state = this.requireTask(taskId);
-            const safeDraft = draft.kind === 'error' ? {
-                ...draft,
-                error: {
-                    ...draft.error,
-                    code: normalizeBookingErrorCode(draft.error.code),
-                    message: safeBookingErrorMessage(normalizeBookingErrorCode(draft.error.code))
-                }
-            } : draft;
-            const event = {
-                schemaVersion: 'booking.surface.v1',
-                eventId: this.idFactory('event'),
-                taskId,
-                contextRef: state.contextRef,
-                sequence: state.lastSequence + 1,
-                emittedAt: this.now(),
-                ...safeDraft
-            };
-            const validation = validateBookingSurfaceEventV1(event);
-            if (!validation.ok) throw new Error(`invalid_event:${validation.errors.join('; ')}`);
-            const payload = {
-                schema: LEDGER_SCHEMA,
-                taskId,
-                contextRef: state.contextRef,
-                eventId: event.eventId,
-                sequence: event.sequence,
-                emittedAt: event.emittedAt,
-                eventKind: event.kind,
-                contentDigest: digest(safeDraft)
-            };
-            this.appendLedgerEvent(EVENT_EMITTED, taskId, payload, `booking-copilot:event:${taskId}:${event.eventId}`);
-            return event;
-        });
-        return apply.immediate();
+            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+            assertReplayUpgradeReanchored(state);
+            return this.emitEventInTransaction(taskId, draft);
+        }).immediate();
+    }
+    emitEventInTransaction(taskId, draft) {
+        const state = this.requireTask(taskId);
+        assertReplayUpgradeReanchored(state);
+        const safeDraft = draft.kind === 'error' ? {
+            ...draft,
+            error: {
+                ...draft.error,
+                code: normalizeBookingErrorCode(draft.error.code),
+                message: safeBookingErrorMessage(normalizeBookingErrorCode(draft.error.code))
+            }
+        } : draft;
+        const event = {
+            schemaVersion: 'booking.surface',
+            eventId: this.idFactory('event'),
+            taskId,
+            contextRef: state.contextRef,
+            sequence: state.lastSequence + 1,
+            emittedAt: this.now(),
+            ...safeDraft
+        };
+        const checked = validateBookingSurfaceEvent(event);
+        if (!checked.ok) throw new Error(`invalid_event:${errorText(checked)}`);
+        this.append(EVENT, taskId, {
+            schema: LEDGER_SCHEMA,
+            taskId,
+            contextRef: state.contextRef,
+            eventId: event.eventId,
+            sequence: event.sequence,
+            emittedAt: event.emittedAt,
+            eventKind: event.kind,
+            ...event.kind === 'status' ? {
+                status: event.status
+            } : {},
+            contentDigest: bookingDigest(safeDraft)
+        }, `booking-copilot:event:${taskId}:${event.eventId}`);
+        return event;
+    }
+    operationEvent(taskId, checkpoint, action) {
+        const replayAction = action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : {
+            ...action,
+            relaxationApprovalRef: checkpoint.relaxationApprovalRef
+        };
+        return {
+            schemaVersion: 'booking.surface',
+            eventId: checkpoint.eventId,
+            taskId,
+            contextRef: checkpoint.contextRef,
+            sequence: checkpoint.sequence,
+            emittedAt: checkpoint.emittedAt,
+            kind: 'operation',
+            action: replayAction
+        };
+    }
+    terminalEvent(state) {
+        if (!taskHasTerminalBudget(state)) throw new Error('task_not_terminal');
+        const terminalCode = state.availability.terminal?.code ?? 'operation_limit_reached';
+        const event = {
+            schemaVersion: 'booking.surface',
+            eventId: `terminal-${state.taskId}-${state.operationCount}`,
+            taskId: state.taskId,
+            contextRef: state.contextRef,
+            sequence: state.lastSequence + 1,
+            emittedAt: this.now(),
+            kind: 'terminal',
+            terminal: {
+                status: state.availability.terminal?.code === 'availability_confirmed' ? 'completed' : 'stopped',
+                summary: terminalCode,
+                factRefs: []
+            }
+        };
+        const checked = validateBookingSurfaceEvent(event);
+        if (!checked.ok) throw new Error(`invalid_terminal_event:${errorText(checked)}`);
+        return event;
     }
     requireTask(taskId) {
         const state = this.resumeTask(taskId);
         if (!state) throw new Error('task_not_found');
         return state;
     }
-    readTaskRows(taskId) {
-        return this.ledger.db.prepare(`SELECT seq, kind, payload FROM events
-       WHERE tenant_id = ? AND run_id = ?
-         AND kind IN (?, ?, ?, ?, ?)
-       ORDER BY seq`).all(this.ledger.tenant, taskId, TASK_STARTED, USER_TURN_OBSERVED, ACTION_ISSUED, RECEIPT_OBSERVED, EVENT_EMITTED);
+    requestBinding(requestKey) {
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, REQUEST_BINDING);
+        for (const row of rows){
+            const binding = JSON.parse(row.payload);
+            if (binding.requestKey === requestKey) {
+                const state = this.resumeTask(binding.taskId);
+                if (state?.legacySuppressedRequestBindingKeys?.includes(requestKey)) throw new Error('request_key_invalidated');
+                return binding;
+            }
+        }
+        return null;
     }
-    observeUserTurn(taskId, contextRef, requestDigest, ordinal) {
-        const payload = {
+    requestBindingPayload(requestKey, turn, input) {
+        assertPrincipal(input.principal);
+        assertRequestKey(requestKey);
+        if (input.taskHandle) assertSafeRef(input.taskHandle);
+        return {
+            requestKey,
+            requestDigest: bookingTurnDigest(turn),
+            turnId: turn.turnId,
+            workspaceDigest: bookingWorkspaceDigest(turn.workspace),
+            workspaceSemanticDigest: bookingWorkspaceSemanticDigest(turn.workspace),
+            surface: turn.workspace.surface,
+            capabilityDigest: bookingDigest(turn.workspace.capabilities),
+            principalDigest: bookingDigest({
+                subject: input.principal.subject
+            }),
+            scopeDigest: bookingDigest({
+                scope: input.principal.scope
+            }),
+            ...input.taskHandle ? {
+                taskHandle: input.taskHandle
+            } : {}
+        };
+    }
+    appendRequestBindingInTransaction(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        const payload = this.requestBindingPayload(requestKey, turn, input);
+        if (input.taskHandle) {
+            const prior = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ?`).all(this.ledger.tenant, REQUEST_BINDING);
+            for (const row of prior){
+                const binding = JSON.parse(row.payload);
+                if (binding.taskHandle !== input.taskHandle) continue;
+                if (binding.principalDigest !== payload.principalDigest || binding.scopeDigest !== payload.scopeDigest) throw new Error('principal_conflict');
+                if (binding.taskId !== turn.taskId || binding.contextRef !== turn.workspace.contextRef) throw new Error('task_handle_conflict');
+            }
+        }
+        const existing = this.requestBinding(requestKey);
+        if (existing) {
+            if (existing.taskId !== turn.taskId || existing.contextRef !== turn.workspace.contextRef || existing.requestDigest !== payload.requestDigest || existing.turnId !== payload.turnId || existing.workspaceDigest !== payload.workspaceDigest || existing.workspaceSemanticDigest !== payload.workspaceSemanticDigest || existing.surface !== payload.surface || existing.capabilityDigest !== payload.capabilityDigest || existing.principalDigest !== payload.principalDigest || existing.scopeDigest !== payload.scopeDigest || existing.taskHandle !== payload.taskHandle) throw new Error('request_conflict');
+            return;
+        }
+        this.append(REQUEST_BINDING, turn.taskId, {
+            schema: LEDGER_SCHEMA,
+            taskId: turn.taskId,
+            contextRef: turn.workspace.contextRef,
+            ...payload
+        }, `booking-copilot:request-binding:${requestKey}`);
+    }
+    normalizeDecisionBatchFromDurableRows(taskId, batchEvents, batchSeq) {
+        const individualRows = this.ledger.db.prepare(`SELECT kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND seq < ? AND kind IN (?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, batchSeq, EVENT, ACTION);
+        const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? AND seq < ?`).all(this.ledger.tenant, taskId, TURN, batchSeq);
+        const sourceWorkspaces = new Map();
+        for (const row of turnRows){
+            try {
+                const turn = JSON.parse(row.payload);
+                sourceWorkspaces.set(turn.turnId, normalizeWorkspaceForReplay(turn.workspace));
+            } catch  {
+                return null;
+            }
+        }
+        const recordedEvents = new Map();
+        const recordedActions = new Map();
+        for (const row of individualRows){
+            if (row.kind === EVENT) {
+                const payload = JSON.parse(row.payload);
+                const key = consumedIdentityKey(payload.eventId, payload.sequence);
+                if (recordedEvents.has(key) || recordedActions.has(key)) return null;
+                recordedEvents.set(key, payload);
+            } else if (row.kind === ACTION) {
+                const payload = JSON.parse(row.payload);
+                let action = payload.action;
+                try {
+                    action = normalizeActionCheckpointForReplay(action, sourceWorkspaces.get(action.sourceTurnId));
+                } catch  {
+                    return null;
+                }
+                const key = consumedIdentityKey(action.eventId, action.sequence);
+                if (recordedEvents.has(key) || recordedActions.has(key)) return null;
+                recordedActions.set(key, action);
+            }
+        }
+        let lastBatchSequence = -1;
+        const seen = new Set();
+        const normalizedEvents = [];
+        for (const event of batchEvents){
+            if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence) return null;
+            lastBatchSequence = event.sequence;
+            const key = consumedIdentityKey(event.eventId, event.sequence);
+            if (seen.has(key)) return null;
+            seen.add(key);
+            if (event.kind === 'operation') {
+                const checkpoint = recordedActions.get(key);
+                if (!checkpoint || !operationEventMatchesAction(event, checkpoint)) return null;
+                const normalized = {
+                    ...event,
+                    action: actionFromOperationEventForReplay(event, checkpoint)
+                };
+                if (!validateBookingSurfaceEvent(normalized).ok) return null;
+                normalizedEvents.push(normalized);
+            } else {
+                const recorded = recordedEvents.get(key);
+                if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event)) return null;
+                normalizedEvents.push(event);
+            }
+        }
+        return normalizedEvents;
+    }
+    rows(taskId) {
+        return this.ledger.db.prepare(`SELECT seq, kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, STARTED, TURN, ACTION, RECEIPT, EVENT, APPROVAL_GRANTED, APPROVAL_OFFERED, APPROVAL_CONSUMED, DECISION_BATCH, REQUEST_BINDING);
+    }
+    append(kind, taskId, payload, idemKey) {
+        const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, kind, taskId, JSON.stringify(payload), idemKey, taskId);
+        if (result.changes === 0) throw new Error(`ledger_write_failed:${kind}`);
+    }
+    appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, ordinal, turnId, workspace) {
+        if (!workspace) throw new Error('ledger_write_failed:turn_workspace');
+        this.append(TURN, taskId, {
+            schema: LEDGER_SCHEMA,
+            taskId,
+            contextRef,
+            requestDigest,
+            workspaceDigest,
+            workspaceSemanticDigest,
+            workspace,
+            turnId
+        }, `booking-copilot:turn:${taskId}:${turnId}`);
+    }
+    appendApproval(taskId, contextRef, approval) {
+        this.append(APPROVAL_GRANTED, taskId, {
             schema: LEDGER_SCHEMA,
             taskId,
             contextRef,
-            requestDigest
+            approval,
+            approvalDigest: bookingDigest(approval)
+        }, `booking-copilot:approval-granted:${taskId}:${approval.approval?.approvalId ?? 'pending'}:${approval.nonce}`);
+    }
+    appendAction(taskId, contextRef, action, operationCount, availability) {
+        this.append(ACTION, taskId, {
+            schema: LEDGER_SCHEMA,
+            taskId,
+            contextRef,
+            action,
+            operationCount,
+            availability,
+            availabilityDigest: bookingDigest(availability)
+        }, `booking-copilot:action:${taskId}:${action.actionId}`);
+    }
+    appendTerminalEvent(taskId, event) {
+        const payload = {
+            schema: LEDGER_SCHEMA,
+            taskId,
+            contextRef: event.contextRef,
+            eventId: event.eventId,
+            sequence: event.sequence,
+            emittedAt: event.emittedAt,
+            eventKind: 'terminal',
+            contentDigest: bookingDigest(event.terminal)
         };
-        this.appendLedgerEvent(USER_TURN_OBSERVED, taskId, payload, `booking-copilot:user-turn:${taskId}:${ordinal}`);
-    }
-    appendLedgerEvent(kind, taskId, payload, idemKey) {
-        const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events
-       (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), LEDGER_ACTOR, kind, taskId, JSON.stringify(payload), idemKey, taskId);
-        if (result.changes > 0) return Number(result.lastInsertRowid);
-        const existing = this.ledger.db.prepare('SELECT seq FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
-        if (!existing) throw new Error(`ledger_write_failed:${kind}`);
-        return existing.seq;
-    }
-    appendActionIssued(taskId, payload, idemKey) {
-        const result = this.ledger.db.prepare(`INSERT INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), LEDGER_ACTOR, ACTION_ISSUED, taskId, JSON.stringify(payload), idemKey, taskId);
-        if (result.changes !== 1) throw new Error('ledger_write_failed:action');
-        return Number(result.lastInsertRowid);
+        const idemKey = `booking-copilot:terminal-event:${taskId}`;
+        const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, EVENT, taskId, JSON.stringify(payload), idemKey, taskId);
+        if (result.changes === 0) {
+            const existing = this.ledger.db.prepare('SELECT payload FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
+            if (!existing || JSON.parse(existing.payload).contentDigest !== payload.contentDigest) throw new Error('ledger_write_failed:terminal_event');
+        }
+    }
+    ensureApprovalOffered(taskId, contextRef, approval, requestKey) {
+        if (requestKey !== approval.presentationRequestKey) throw new Error('approval_presentation_key_mismatch');
+        const idemKey = `booking-copilot:approval-offered:${taskId}:${requestKey}`;
+        const exists = this.ledger.db.prepare('SELECT 1 AS present FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
+        if (!exists) this.append(APPROVAL_OFFERED, taskId, {
+            schema: LEDGER_SCHEMA,
+            taskId,
+            contextRef,
+            approval,
+            approvalDigest: bookingDigest(approval)
+        }, idemKey);
+    }
+    approvalWasConsumed(taskId, approval, targetActionId) {
+        const state = this.resumeTask(taskId);
+        if (state?.legacySuppressedApprovalTargetActionIds?.includes(targetActionId)) return false;
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
+        return rows.some(({ payload })=>{
+            const consumed = JSON.parse(payload);
+            return consumed.ref?.targetActionId === targetActionId && consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval);
+        });
     }
 }