@danceiny/gotry 0.0.1-rc.21 → 0.0.1-rc.24

package/dist/src/booking-surface/runtime.js

@@ -1,7 +1,8 @@
+/** Durable, task-scoped runtime for the embedded Booking Copilot. */
 import { createHash, randomUUID } from 'node:crypto';
-import { BOOKING_READ_ACTION_KINDS, BOOKING_COPILOT_MAX_OPERATIONS } from './contracts.js';
-import { validateApprovalAgainstBlocker, validateCriterionBlocker, validateBookingReadAction, validateBookingSurfaceEvent, validateBookingSurface, isBookingDateTime, isSafeBookingRequestKey } from './validation.js';
-import { assertWorkspaceLoadedOfferRefsUnique, canIssueOfferCheck, createAvailabilityPolicy, reduceAvailabilityAction, reduceAvailabilityReceipt, validateOffersReceiptWorkspace, availabilityPolicyResult, validateAvailabilityPolicy } from './availability-policy.js';
+import { BOOKING_COPILOT_MAX_OPERATIONS, } from './contracts.js';
+import { validateApprovalAgainstBlocker, validateCriterionBlocker, validateBookingReadAction, validateBookingSurfaceEvent, validateBookingSurface, isBookingDateTime, isSafeBookingRequestKey, } from './validation.js';
+import { assertWorkspaceLoadedOfferRefsUnique, canIssueOfferCheck, createAvailabilityPolicy, reduceAvailabilityAction, reduceAvailabilityReceipt, validateOffersReceiptWorkspace, availabilityPolicyResult, validateAvailabilityPolicy, } from './availability-policy.js';
 import { normalizeBookingErrorCode, safeBookingErrorMessage } from './error-codes.js';
 const LEDGER_SCHEMA = 'booking.copilot.ledger';
 const ACTOR = 'system:booking-copilot';
@@ -16,10 +17,13 @@ const APPROVAL_CONSUMED = 'booking.copilot.approval.consumed';
 const DECISION_BATCH = 'booking.copilot.decision.batch';
 const REQUEST_BINDING = 'booking.copilot.request.binding';
 function stable(value) {
-    if (Array.isArray(value)) return value.map(stable);
-    if (!value || typeof value !== 'object') return value;
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (!value || typeof value !== 'object')
+        return value;
     const out = {};
-    for (const key of Object.keys(value).sort())out[key] = stable(value[key]);
+    for (const key of Object.keys(value).sort())
+        out[key] = stable(value[key]);
     return out;
 }
 export function bookingDigest(value) {
@@ -36,9 +40,7 @@ function bookingWorkspaceSemanticDigest(workspace) {
 export function bookingTurnDigest(turn) {
     return bookingDigest(turn);
 }
-function canonicalReceiptDigest(value) {
-    return bookingDigest(value);
-}
+function canonicalReceiptDigest(value) { return bookingDigest(value); }
 function replayDigestMatches(recordedDigest, raw, normalized) {
     return typeof recordedDigest === 'string' && (recordedDigest === bookingDigest(raw) || recordedDigest === bookingDigest(normalized));
 }
@@ -51,7 +53,8 @@ function replayWorkspaceSemanticDigestMatches(recordedDigest, raw, normalized) {
 function rememberReplayWorkspaceDigest(digests, recordedDigest, raw, normalized) {
     const normalizedDigest = bookingWorkspaceDigest(normalized);
     digests.set(bookingWorkspaceDigest(raw), normalizedDigest);
-    if (typeof recordedDigest === 'string') digests.set(recordedDigest, normalizedDigest);
+    if (typeof recordedDigest === 'string')
+        digests.set(recordedDigest, normalizedDigest);
 }
 function legacyOfferVersionRef(contextRef, offer) {
     return `legacy-offer-version:${bookingDigest({
@@ -59,99 +62,99 @@ function legacyOfferVersionRef(contextRef, offer) {
         offerRef: offer.offerRef,
         hotelRef: offer.hotelRef,
         evidenceLevel: offer.evidenceLevel,
-        factRefs: Array.isArray(offer.factRefs) ? offer.factRefs : []
+        factRefs: Array.isArray(offer.factRefs) ? offer.factRefs : [],
     }).slice(0, 40)}`;
 }
 function normalizeWorkspaceForReplay(raw) {
     const candidate = raw;
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !Array.isArray(candidate.loadedOffers) || typeof candidate.contextRef !== 'string') throw new Error('booking_malformed_workspace');
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !Array.isArray(candidate.loadedOffers) || typeof candidate.contextRef !== 'string')
+        throw new Error('booking_malformed_workspace');
     const workspace = structuredClone(raw);
-    workspace.loadedOffers = workspace.loadedOffers.map((offer)=>offer.offerVersionRef ? offer : {
-            ...offer,
-            offerVersionRef: legacyOfferVersionRef(workspace.contextRef, offer)
-        });
+    workspace.loadedOffers = workspace.loadedOffers.map((offer) => offer.offerVersionRef ? offer : { ...offer, offerVersionRef: legacyOfferVersionRef(workspace.contextRef, offer) });
     delete workspace.verifiedOfferRef;
     return workspace;
 }
 function resolveReplayOfferVersion(offerRef, workspace, action, actionId, priorAvailability) {
-    const priorAttempt = actionId ? priorAvailability?.attempts.find((attempt)=>attempt.actionId === actionId) : undefined;
-    if (priorAttempt?.offerVersionRef) return priorAttempt.offerVersionRef;
-    if (action?.kind === 'offer.check' && action.actionId === actionId && action.input.offerRef === offerRef && typeof action.input.offerVersionRef === 'string') return action.input.offerVersionRef;
-    const match = workspace?.loadedOffers.find((offer)=>offer.offerRef === offerRef);
-    if (match?.offerVersionRef) return match.offerVersionRef;
+    const priorAttempt = actionId ? priorAvailability?.attempts.find((attempt) => attempt.actionId === actionId) : undefined;
+    if (priorAttempt?.offerVersionRef)
+        return priorAttempt.offerVersionRef;
+    if (action?.kind === 'offer.check' && action.actionId === actionId && action.input.offerRef === offerRef && typeof action.input.offerVersionRef === 'string')
+        return action.input.offerVersionRef;
+    const match = workspace?.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    if (match?.offerVersionRef)
+        return match.offerVersionRef;
     throw new Error('booking_replan_required:offer_version_unbound');
 }
 function normalizeAvailabilityPolicyForReplay(raw, workspace, action, priorAvailability, workspaceDigestMap = new Map(), receipt) {
     const normalized = structuredClone(raw);
     if (normalized.hotels && typeof normalized.hotels === 'object') {
-        for (const [hotelRef, hotel] of Object.entries(normalized.hotels)){
+        for (const [hotelRef, hotel] of Object.entries(normalized.hotels)) {
             const rawHotel = raw.hotels?.[hotelRef];
             const priorHotel = priorAvailability?.hotels[hotelRef];
-            if (!Array.isArray(hotel.tombstonedOfferRefs)) hotel.tombstonedOfferRefs = priorHotel ? [
-                ...priorHotel.tombstonedOfferRefs
-            ] : [];
-            if (!Array.isArray(hotel.tombstonedOfferVersionRefs)) hotel.tombstonedOfferVersionRefs = priorHotel ? [
-                ...priorHotel.tombstonedOfferVersionRefs
-            ] : [];
+            if (!Array.isArray(hotel.tombstonedOfferRefs))
+                hotel.tombstonedOfferRefs = priorHotel ? [...priorHotel.tombstonedOfferRefs] : [];
+            if (!Array.isArray(hotel.tombstonedOfferVersionRefs))
+                hotel.tombstonedOfferVersionRefs = priorHotel ? [...priorHotel.tombstonedOfferVersionRefs] : [];
             if (rawHotel && Array.isArray(rawHotel.tombstonedOfferRefs) && priorHotel) {
-                for (const ref of priorHotel.tombstonedOfferRefs)if (!hotel.tombstonedOfferRefs.includes(ref)) throw new Error('booking_replan_required:tombstone_regression');
+                for (const ref of priorHotel.tombstonedOfferRefs)
+                    if (!hotel.tombstonedOfferRefs.includes(ref))
+                        throw new Error('booking_replan_required:tombstone_regression');
             }
             if (rawHotel && Array.isArray(rawHotel.tombstonedOfferVersionRefs) && priorHotel) {
-                for (const ref of priorHotel.tombstonedOfferVersionRefs)if (!hotel.tombstonedOfferVersionRefs.includes(ref)) throw new Error('booking_replan_required:tombstone_regression');
+                for (const ref of priorHotel.tombstonedOfferVersionRefs)
+                    if (!hotel.tombstonedOfferVersionRefs.includes(ref))
+                        throw new Error('booking_replan_required:tombstone_regression');
             }
             const source = hotel.currentGeneration?.source;
             if (source?.kind === 'workspace_snapshot') {
                 const mappedDigest = workspaceDigestMap.get(source.workspaceDigest);
-                if (mappedDigest) source.workspaceDigest = mappedDigest;
+                if (mappedDigest)
+                    source.workspaceDigest = mappedDigest;
             }
         }
     }
     if (Array.isArray(normalized.attempts)) {
-        normalized.attempts = normalized.attempts.map((attempt)=>attempt.offerVersionRef ? attempt : {
-                ...attempt,
-                offerVersionRef: resolveReplayOfferVersion(attempt.offerRef, workspace, action, attempt.actionId, priorAvailability)
-            });
+        normalized.attempts = normalized.attempts.map((attempt) => attempt.offerVersionRef ? attempt : { ...attempt, offerVersionRef: resolveReplayOfferVersion(attempt.offerRef, workspace, action, attempt.actionId, priorAvailability) });
     }
     const availability = receipt?.observation.kind === 'offer.availability' ? receipt.observation : undefined;
     if (receipt && action?.kind === 'offer.check' && availability && availability.offerRef === action.input.offerRef && availability.checkedOfferVersionRef === action.input.offerVersionRef) {
-        const attempt = normalized.attempts.find((candidate)=>candidate.actionId === action.actionId);
+        const attempt = normalized.attempts.find((candidate) => candidate.actionId === action.actionId);
         const hotel = attempt ? normalized.hotels[attempt.hotelRef] : undefined;
         if (hotel) {
             if (receipt.status === 'changed' && availability.available === true && availability.currentOfferVersionRef && availability.currentOfferVersionRef !== action.input.offerVersionRef) {
-                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef)) hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef))
+                    hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
             }
-            const completeNegative = (receipt.status === 'unavailable' || receipt.status === 'no_match') && receipt.resultContract.outcome === 'empty' && receipt.resultContract.gapCodes.length === 0 && receipt.resultContract.blockers.length === 0 && availability.available === false && !availability.currentOfferVersionRef && !availability.verifiedOfferRef && !availability.gapCodes?.length;
+            const completeNegative = (receipt.status === 'unavailable' || receipt.status === 'no_match')
+                && receipt.resultContract.outcome === 'empty'
+                && receipt.resultContract.gapCodes.length === 0
+                && receipt.resultContract.blockers.length === 0
+                && availability.available === false
+                && !availability.currentOfferVersionRef
+                && !availability.verifiedOfferRef
+                && !availability.gapCodes?.length;
             if (completeNegative) {
-                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef)) hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
-                if (!hotel.tombstonedOfferRefs.includes(action.input.offerRef)) hotel.tombstonedOfferRefs.push(action.input.offerRef);
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef))
+                    hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+                if (!hotel.tombstonedOfferRefs.includes(action.input.offerRef))
+                    hotel.tombstonedOfferRefs.push(action.input.offerRef);
             }
         }
     }
     return normalized;
 }
 function normalizeActionCheckpointForReplay(raw, workspace) {
-    if (![
-        'offer.select',
-        'offer.check',
-        'checkout.prepare'
-    ].includes(raw.kind) || typeof raw.input.offerVersionRef === 'string') return raw;
-    if (typeof raw.input.offerRef !== 'string') throw new Error('booking_replan_required:offer_version_unbound');
+    if (!['offer.select', 'offer.check', 'checkout.prepare'].includes(raw.kind) || typeof raw.input.offerVersionRef === 'string')
+        return raw;
+    if (typeof raw.input.offerRef !== 'string')
+        throw new Error('booking_replan_required:offer_version_unbound');
     const offerVersionRef = resolveReplayOfferVersion(raw.input.offerRef, workspace, undefined, raw.actionId);
-    const input = {
-        ...raw.input,
-        offerVersionRef
-    };
-    if (raw.kind === 'checkout.prepare' && (!workspace?.verifiedOffer || workspace.verifiedOffer.offerRef !== input.offerRef || workspace.verifiedOffer.offerVersionRef !== offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== input.verifiedOfferRef)) throw new Error('booking_replan_required:legacy_checkout_unverified');
+    const input = { ...raw.input, offerVersionRef };
+    if (raw.kind === 'checkout.prepare' && (!workspace?.verifiedOffer || workspace.verifiedOffer.offerRef !== input.offerRef || workspace.verifiedOffer.offerVersionRef !== offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== input.verifiedOfferRef))
+        throw new Error('booking_replan_required:legacy_checkout_unverified');
     const { actionDigest: _rawActionDigest, ...rawBase } = raw;
-    const normalizedBase = {
-        ...rawBase,
-        input,
-        inputDigest: bookingDigest(input)
-    };
-    return {
-        ...normalizedBase,
-        actionDigest: checkpointDigest(normalizedBase)
-    };
+    const normalizedBase = { ...rawBase, input, inputDigest: bookingDigest(input) };
+    return { ...normalizedBase, actionDigest: checkpointDigest(normalizedBase) };
 }
 function checkpointDigestMatchesForReplay(raw, normalized) {
     const { actionDigest: _rawDigest, ...rawBase } = raw;
@@ -159,11 +162,8 @@ function checkpointDigestMatchesForReplay(raw, normalized) {
     return raw.actionDigest === checkpointDigest(rawBase) || raw.actionDigest === checkpointDigest(normalizedBase);
 }
 function replanAfterReplayUpgradeGap(state, workspace = state.workspaceSnapshot, revision = workspace?.revision) {
-    if (!workspace) return {
-        ...state,
-        phase: 'error',
-        pendingAction: undefined
-    };
+    if (!workspace)
+        return { ...state, phase: 'error', pendingAction: undefined };
     const safeRevision = typeof revision === 'number' && Number.isSafeInteger(revision) ? revision : state.revision;
     return {
         ...state,
@@ -175,15 +175,14 @@ function replanAfterReplayUpgradeGap(state, workspace = state.workspaceSnapshot,
         workspaceSemanticDigest: bookingWorkspaceSemanticDigest(workspace),
         workspaceSnapshot: workspace,
         availability: createAvailabilityPolicy(workspace),
-        replayUpgradeRequired: true
+        replayUpgradeRequired: true,
     };
 }
 function assertReplayUpgradeReanchored(state) {
-    if (state.replayUpgradeRequired) throw new Error('reanchor_turn_required');
-}
-function consumedIdentityKey(eventId, sequence) {
-    return `${eventId}\0${sequence}`;
+    if (state.replayUpgradeRequired)
+        throw new Error('reanchor_turn_required');
 }
+function consumedIdentityKey(eventId, sequence) { return `${eventId}\0${sequence}`; }
 function clearPendingBatch(consumed) {
     consumed.pendingBatchKeys.clear();
     consumed.pendingBatchOpen = false;
@@ -208,9 +207,11 @@ function rememberConsumedActionIdentity(consumed, action) {
 function consumeSkippedActionOrdinal(state, payload, consumed) {
     const action = payload.action;
     const operationCount = payload.operationCount ?? state.operationCount + 1;
-    if (!action || typeof action !== 'object') throw new Error('skip_action_invalid');
+    if (!action || typeof action !== 'object')
+        throw new Error('skip_action_invalid');
     const { actionDigest: _actionDigest, ...actionBase } = action;
-    if (action.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(action.sequence) || action.sequence <= state.lastSequence) throw new Error('skip_action_invalid');
+    if (action.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(action.sequence) || action.sequence <= state.lastSequence)
+        throw new Error('skip_action_invalid');
     state.operationCount = operationCount;
     state.lastSequence = action.sequence;
     if (consumed) {
@@ -218,94 +219,92 @@ function consumeSkippedActionOrdinal(state, payload, consumed) {
     }
 }
 function eventDraftDigest(event) {
-    if (event.kind === 'status') return bookingDigest({
-        kind: event.kind,
-        status: event.status
-    });
-    if (event.kind === 'question') return bookingDigest({
-        kind: event.kind,
-        question: event.question
-    });
-    if (event.kind === 'explanation') return bookingDigest({
-        kind: event.kind,
-        explanation: event.explanation
-    });
-    if (event.kind === 'terminal') return bookingDigest({
-        kind: event.kind,
-        terminal: event.terminal
-    });
-    return bookingDigest({
-        kind: event.kind,
-        error: event.error
-    });
+    if (event.kind === 'status')
+        return bookingDigest({ kind: event.kind, status: event.status });
+    if (event.kind === 'question')
+        return bookingDigest({ kind: event.kind, question: event.question });
+    if (event.kind === 'explanation')
+        return bookingDigest({ kind: event.kind, explanation: event.explanation });
+    if (event.kind === 'terminal')
+        return bookingDigest({ kind: event.kind, terminal: event.terminal });
+    return bookingDigest({ kind: event.kind, error: event.error });
 }
 function eventPayloadMatchesEvent(payload, event) {
     const expectedDigest = eventDraftDigest(event);
     const legacyTerminalDigest = event.kind === 'terminal' ? bookingDigest(event.terminal) : undefined;
-    return payload.eventId === event.eventId && payload.sequence === event.sequence && payload.emittedAt === event.emittedAt && payload.contextRef === event.contextRef && payload.eventKind === event.kind && (event.kind !== 'status' || payload.status === event.status) && (payload.contentDigest === expectedDigest || payload.contentDigest === legacyTerminalDigest);
+    return payload.eventId === event.eventId
+        && payload.sequence === event.sequence
+        && payload.emittedAt === event.emittedAt
+        && payload.contextRef === event.contextRef
+        && payload.eventKind === event.kind
+        && (event.kind !== 'status' || payload.status === event.status)
+        && (payload.contentDigest === expectedDigest || payload.contentDigest === legacyTerminalDigest);
 }
 function actionFromOperationEventForReplay(event, checkpoint) {
     const action = event.action;
     if ((action.kind === 'offer.select' || action.kind === 'offer.check' || action.kind === 'checkout.prepare') && typeof action.input.offerRef === 'string' && typeof action.input.offerVersionRef !== 'string' && typeof checkpoint.input.offerVersionRef === 'string') {
-        return {
-            ...action,
-            input: {
-                ...action.input,
-                offerVersionRef: checkpoint.input.offerVersionRef
-            }
-        };
+        return { ...action, input: { ...action.input, offerVersionRef: checkpoint.input.offerVersionRef } };
     }
     return action;
 }
 function operationEventMatchesAction(event, checkpoint) {
-    return event.eventId === checkpoint.eventId && event.sequence === checkpoint.sequence && event.emittedAt === checkpoint.emittedAt && event.contextRef === checkpoint.contextRef && matchesCheckpoint(actionFromOperationEventForReplay(event, checkpoint), checkpoint);
+    return event.eventId === checkpoint.eventId
+        && event.sequence === checkpoint.sequence
+        && event.emittedAt === checkpoint.emittedAt
+        && event.contextRef === checkpoint.contextRef
+        && matchesCheckpoint(actionFromOperationEventForReplay(event, checkpoint), checkpoint);
 }
 function normalizeDecisionBatchEnvelopeForReplay(payload, consumed, requireSchemaValid = false) {
-    if (typeof payload.requestKey !== 'string' || !payload.requestKey || !payload.events.length) throw new Error('skip_decision_batch_invalid');
+    if (typeof payload.requestKey !== 'string' || !payload.requestKey || !payload.events.length)
+        throw new Error('skip_decision_batch_invalid');
     let lastBatchSequence = -1;
     const seen = new Set();
     const normalizedEvents = [];
-    for (const event of payload.events){
-        if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence) throw new Error('skip_decision_batch_invalid');
+    for (const event of payload.events) {
+        if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence)
+            throw new Error('skip_decision_batch_invalid');
         lastBatchSequence = event.sequence;
         const key = consumedIdentityKey(event.eventId, event.sequence);
-        if (seen.has(key)) throw new Error('skip_decision_batch_invalid');
+        if (seen.has(key))
+            throw new Error('skip_decision_batch_invalid');
         seen.add(key);
         if (event.kind === 'operation') {
             const checkpoint = consumed.actions.get(key);
-            if (!checkpoint || !operationEventMatchesAction(event, checkpoint)) throw new Error('skip_decision_batch_invalid');
-            const normalized = {
-                ...event,
-                action: actionFromOperationEventForReplay(event, checkpoint)
-            };
-            if (requireSchemaValid && !validateBookingSurfaceEvent(normalized).ok) throw new Error('skip_decision_batch_invalid');
+            if (!checkpoint || !operationEventMatchesAction(event, checkpoint))
+                throw new Error('skip_decision_batch_invalid');
+            const normalized = { ...event, action: actionFromOperationEventForReplay(event, checkpoint) };
+            if (requireSchemaValid && !validateBookingSurfaceEvent(normalized).ok)
+                throw new Error('skip_decision_batch_invalid');
             normalizedEvents.push(normalized);
-        } else {
+        }
+        else {
             const recorded = consumed.events.get(key);
-            if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event)) throw new Error('skip_decision_batch_invalid');
+            if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event))
+                throw new Error('skip_decision_batch_invalid');
             normalizedEvents.push(event);
         }
-        if (!consumed.pendingBatchKeys.has(key)) throw new Error('skip_decision_batch_invalid');
+        if (!consumed.pendingBatchKeys.has(key))
+            throw new Error('skip_decision_batch_invalid');
     }
-    if (seen.size !== consumed.pendingBatchKeys.size) throw new Error('skip_decision_batch_invalid');
-    for (const key of consumed.pendingBatchKeys)if (!seen.has(key)) throw new Error('skip_decision_batch_invalid');
+    if (seen.size !== consumed.pendingBatchKeys.size)
+        throw new Error('skip_decision_batch_invalid');
+    for (const key of consumed.pendingBatchKeys)
+        if (!seen.has(key))
+            throw new Error('skip_decision_batch_invalid');
     clearPendingBatch(consumed);
     return normalizedEvents;
 }
 function consumeSkippedEventSequence(state, payload, consumed) {
-    if (!payload || typeof payload !== 'object') throw new Error('skip_event_invalid');
+    if (!payload || typeof payload !== 'object')
+        throw new Error('skip_event_invalid');
     if ('sequence' in payload) {
         const eventPayload = payload;
-        if (typeof eventPayload.eventId !== 'string' || !eventPayload.eventId || ![
-            'status',
-            'question',
-            'explanation',
-            'terminal',
-            'error'
-        ].includes(String(eventPayload.eventKind)) || typeof eventPayload.contentDigest !== 'string' || !/^[0-9a-f]{64}$/.test(eventPayload.contentDigest) || typeof eventPayload.sequence !== 'number' || !Number.isSafeInteger(eventPayload.sequence) || eventPayload.sequence <= state.lastSequence) throw new Error('skip_event_invalid');
+        if (typeof eventPayload.eventId !== 'string' || !eventPayload.eventId || !['status', 'question', 'explanation', 'terminal', 'error'].includes(String(eventPayload.eventKind)) || typeof eventPayload.contentDigest !== 'string' || !/^[0-9a-f]{64}$/.test(eventPayload.contentDigest) || typeof eventPayload.sequence !== 'number' || !Number.isSafeInteger(eventPayload.sequence) || eventPayload.sequence <= state.lastSequence)
+            throw new Error('skip_event_invalid');
         state.lastSequence = eventPayload.sequence;
         rememberConsumedEventIdentity(consumed, eventPayload);
-    } else if ('events' in payload && Array.isArray(payload.events)) {
+    }
+    else if ('events' in payload && Array.isArray(payload.events)) {
         normalizeDecisionBatchEnvelopeForReplay(payload, consumed);
     }
 }
@@ -315,76 +314,81 @@ function normalizeReceiptForReplay(raw, action, workspace) {
         receipt.observation.offerVersionRef = action.input.offerVersionRef;
     }
     if (action.kind === 'checkout.prepare' && receipt.observation.kind === 'checkout.handoff' && receipt.observation.offerRef === action.input.offerRef && !receipt.observation.offerVersionRef) {
-        if (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== action.input.verifiedOfferRef) throw new Error('booking_replan_required:legacy_checkout_unverified');
+        if (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== action.input.verifiedOfferRef)
+            throw new Error('booking_replan_required:legacy_checkout_unverified');
         receipt.observation.offerVersionRef = action.input.offerVersionRef;
     }
     if (action.kind === 'offer.check' && receipt.observation.kind === 'offer.availability' && receipt.observation.offerRef === action.input.offerRef) {
-        if (!receipt.observation.checkedOfferVersionRef) receipt.observation.checkedOfferVersionRef = action.input.offerVersionRef;
-        if (receipt.status === 'applied' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef) receipt.observation.currentOfferVersionRef = action.input.offerVersionRef;
+        if (!receipt.observation.checkedOfferVersionRef)
+            receipt.observation.checkedOfferVersionRef = action.input.offerVersionRef;
+        if (receipt.status === 'applied' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef)
+            receipt.observation.currentOfferVersionRef = action.input.offerVersionRef;
         if (receipt.status === 'changed' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef) {
-            const current = workspace.loadedOffers.find((offer)=>offer.offerRef === action.input.offerRef && offer.offerVersionRef !== action.input.offerVersionRef);
-            if (!current) throw new Error('booking_replan_required:changed_version_unbound');
+            const current = workspace.loadedOffers.find((offer) => offer.offerRef === action.input.offerRef && offer.offerVersionRef !== action.input.offerVersionRef);
+            if (!current)
+                throw new Error('booking_replan_required:changed_version_unbound');
             receipt.observation.currentOfferVersionRef = current.offerVersionRef;
         }
-        if (receipt.status === 'applied' && receipt.observation.verifiedOfferRef && (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== receipt.observation.verifiedOfferRef)) throw new Error('booking_replan_required:legacy_verified_scalar');
+        if (receipt.status === 'applied' && receipt.observation.verifiedOfferRef && (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== receipt.observation.verifiedOfferRef))
+            throw new Error('booking_replan_required:legacy_verified_scalar');
     }
-    if (receipt.resultContract.blockers.length && bookingDigest(raw) !== bookingDigest(receipt)) throw new Error('booking_replan_required:legacy_blocker_digest');
+    if (receipt.resultContract.blockers.length && bookingDigest(raw) !== bookingDigest(receipt))
+        throw new Error('booking_replan_required:legacy_blocker_digest');
     return receipt;
 }
-function errorText(result) {
-    return result.ok ? '' : result.errors.join('; ');
-}
-function assertTaskId(taskId) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(taskId)) throw new Error('invalid_task_id');
-}
-function assertSafeRef(value) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value)) throw new Error('unsafe_opaque_ref');
-}
-function safeIdentity(value) {
-    return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value);
-}
-function sameActions(a, b) {
-    return a.length === b.length && [
-        ...a
-    ].sort().every((x, i)=>x === [
-            ...b
-        ].sort()[i]);
-}
-function availabilityPolicyTerminal(state) {
-    return availabilityPolicyResult(state);
-}
+function errorText(result) { return result.ok ? '' : result.errors.join('; '); }
+function assertTaskId(taskId) { if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(taskId))
+    throw new Error('invalid_task_id'); }
+function assertSafeRef(value) { if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value))
+    throw new Error('unsafe_opaque_ref'); }
+function safeIdentity(value) { return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value); }
+function sameActions(a, b) { return a.length === b.length && [...a].sort().every((x, i) => x === [...b].sort()[i]); }
+function availabilityPolicyTerminal(state) { return availabilityPolicyResult(state); }
 function taskHasTerminalBudget(state) {
     return state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS || Boolean(state.availability.terminal);
 }
 function assertRequestKey(requestKey) {
-    if (!isSafeBookingRequestKey(requestKey)) throw new Error('unsafe_request_key');
+    if (!isSafeBookingRequestKey(requestKey))
+        throw new Error('unsafe_request_key');
 }
+/** Decision batches are runtime-owned and may contain long task/turn/action refs. */
 function assertInternalDecisionKey(requestKey) {
-    if (typeof requestKey !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,2047}$/.test(requestKey)) throw new Error('unsafe_internal_decision_key');
+    if (typeof requestKey !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,2047}$/.test(requestKey))
+        throw new Error('unsafe_internal_decision_key');
 }
 function assertDecisionBatchFinality(decisions) {
     let finalSeen = false;
-    for (const decision of decisions){
+    for (const decision of decisions) {
         const isFinal = decision.kind === 'terminal' || decision.kind === 'error';
-        if (finalSeen) throw new Error('decision_batch_finality');
-        if (isFinal) finalSeen = true;
+        if (finalSeen)
+            throw new Error('decision_batch_finality');
+        if (isFinal)
+            finalSeen = true;
     }
 }
 function assertPrincipal(principal) {
-    if (!principal || typeof principal.subject !== 'string' || !principal.subject || principal.subject.length > 256 || typeof principal.scope !== 'string' || !principal.scope || principal.scope.length > 256) throw new Error('trusted_principal_required');
+    if (!principal || typeof principal.subject !== 'string' || !principal.subject || principal.subject.length > 256 || typeof principal.scope !== 'string' || !principal.scope || principal.scope.length > 256)
+        throw new Error('trusted_principal_required');
 }
 function assertAvailabilityLiveness(state, decisions) {
-    if (!state.availability.recoveryStarted || state.awaitingApproval) return;
-    const operations = decisions.filter((decision)=>decision.kind === 'operation');
-    if (operations.length !== 1 || !state.workspaceSnapshot) throw new Error('availability_operation_required');
+    if (!state.availability.recoveryStarted || state.awaitingApproval)
+        return;
+    const operations = decisions.filter((decision) => decision.kind === 'operation');
+    if (operations.length !== 1 || !state.workspaceSnapshot)
+        throw new Error('availability_operation_required');
     const action = operations[0].action;
     const activeHotelRef = state.availability.hotelRefs[state.availability.activeHotelOrdinal];
-    if (!activeHotelRef) throw new Error('availability_active_hotel_missing');
+    if (!activeHotelRef)
+        throw new Error('availability_active_hotel_missing');
     if (state.availability.availabilityPhase === 'need_offers') {
-        if (action.kind !== 'offers.query' || action.input.hotelRefs.length !== 1 || action.input.hotelRefs[0] !== activeHotelRef) throw new Error('availability_operation_incompatible');
-    } else if (state.availability.availabilityPhase === 'need_check') {
-        if (action.kind !== 'offer.check' || action.input.offerRef === undefined || action.input.offerVersionRef === undefined || !state.availability.hotels[activeHotelRef]?.currentOfferRefs.includes(action.input.offerRef) || !canIssueOfferCheck(state.availability, state.workspaceSnapshot, action.input.offerRef, action.input.offerVersionRef).ok) throw new Error('availability_operation_incompatible');
-    } else {
+        if (action.kind !== 'offers.query' || action.input.hotelRefs.length !== 1 || action.input.hotelRefs[0] !== activeHotelRef)
+            throw new Error('availability_operation_incompatible');
+    }
+    else if (state.availability.availabilityPhase === 'need_check') {
+        if (action.kind !== 'offer.check' || action.input.offerRef === undefined || action.input.offerVersionRef === undefined || !state.availability.hotels[activeHotelRef]?.currentOfferRefs.includes(action.input.offerRef) || !canIssueOfferCheck(state.availability, state.workspaceSnapshot, action.input.offerRef, action.input.offerVersionRef).ok)
+            throw new Error('availability_operation_incompatible');
+    }
+    else {
         throw new Error('availability_operation_incompatible');
     }
 }
@@ -397,9 +401,7 @@ function checkpointFor(action, eventId, sequence, emittedAt, sourceTurnId) {
         kind: action.kind,
         contextRef: action.contextRef,
         expectedRevision: action.expectedRevision,
-        factRefs: [
-            ...action.factRefs
-        ],
+        factRefs: [...action.factRefs],
         reasonDigest: bookingDigest(action.reason),
         inputDigest: bookingDigest(action.input),
         input: action.input,
@@ -407,20 +409,12 @@ function checkpointFor(action, eventId, sequence, emittedAt, sourceTurnId) {
         sequence,
         emittedAt,
         sourceTurnId,
-        ...action.relaxationApprovalRef ? {
-            relaxationApprovalRef: action.relaxationApprovalRef
-        } : {}
-    };
-    return {
-        ...base,
-        actionDigest: checkpointDigest(base)
+        ...(action.relaxationApprovalRef ? { relaxationApprovalRef: action.relaxationApprovalRef } : {}),
     };
+    return { ...base, actionDigest: checkpointDigest(base) };
 }
 function matchesCheckpoint(action, checkpoint) {
-    const candidate = checkpointFor(action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : {
-        ...action,
-        relaxationApprovalRef: checkpoint.relaxationApprovalRef
-    }, checkpoint.eventId, checkpoint.sequence, checkpoint.emittedAt, checkpoint.sourceTurnId);
+    const candidate = checkpointFor(action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : { ...action, relaxationApprovalRef: checkpoint.relaxationApprovalRef }, checkpoint.eventId, checkpoint.sequence, checkpoint.emittedAt, checkpoint.sourceTurnId);
     const { actionDigest: _ignored, ...candidateBase } = candidate;
     return checkpoint.actionDigest === checkpointDigest(candidateBase);
 }
@@ -429,58 +423,57 @@ function receiptSourceDigest(receipt) {
         ...receipt,
         resultContract: {
             ...receipt.resultContract,
-            blockers: receipt.resultContract.blockers.map(({ sourceReceiptDigest: _ignored, ...blocker })=>blocker)
-        }
+            blockers: receipt.resultContract.blockers.map(({ sourceReceiptDigest: _ignored, ...blocker }) => blocker),
+        },
     });
 }
 function assertCanonicalReceipt(receipt) {
     const expected = receiptSourceDigest(receipt);
-    if (receipt.resultContract.blockers.some((blocker)=>blocker.sourceReceiptDigest !== expected)) throw new Error('receipt_source_digest_mismatch');
+    if (receipt.resultContract.blockers.some((blocker) => blocker.sourceReceiptDigest !== expected))
+        throw new Error('receipt_source_digest_mismatch');
 }
 function receiptObservationMatchesAction(observation, action) {
-    if (observation === 'gap') return true;
+    if (observation === 'gap')
+        return true;
     const expected = {
-        'search.patch': 'search.state',
-        'search.run': 'search.state',
-        'results.view.patch': 'results.state',
-        'hotel.focus': 'hotel.focus',
-        'hotel.select': 'hotel.selection',
-        'offers.query': 'offers.state',
-        'offers.view.patch': 'offers.state',
-        'offers.compare': 'offers.state',
-        'offer.select': 'offer.selection',
-        'offer.check': 'offer.availability',
-        'checkout.prepare': 'checkout.handoff',
-        'order.observe': 'order.state'
+        'search.patch': 'search.state', 'search.run': 'search.state', 'results.view.patch': 'results.state',
+        'hotel.focus': 'hotel.focus', 'hotel.select': 'hotel.selection', 'offers.query': 'offers.state',
+        'offers.view.patch': 'offers.state', 'offers.compare': 'offers.state', 'offer.select': 'offer.selection',
+        'offer.check': 'offer.availability', 'checkout.prepare': 'checkout.handoff', 'order.observe': 'order.state',
     };
     return expected[action] === observation;
 }
 function sameRefSet(a, b) {
-    return a.length === b.length && [
-        ...a
-    ].sort().every((value, index)=>value === [
-            ...b
-        ].sort()[index]);
+    return a.length === b.length && [...a].sort().every((value, index) => value === [...b].sort()[index]);
 }
 function receiptTargetMatchesAction(receipt, action) {
     const observation = receipt.observation;
     const input = action.input;
-    if (action.kind === 'hotel.focus' && observation.kind === 'hotel.focus') return observation.hotelRef === input.hotelRef;
-    if (action.kind === 'hotel.select' && observation.kind === 'hotel.selection') return observation.hotelRef === input.hotelRef;
-    if (action.kind === 'offer.select' && observation.kind === 'offer.selection') return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef;
-    if (action.kind === 'offer.check' && observation.kind === 'offer.availability') return observation.offerRef === input.offerRef && observation.checkedOfferVersionRef === input.offerVersionRef;
-    if (action.kind === 'checkout.prepare' && observation.kind === 'checkout.handoff') return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef && observation.verifiedOfferRef === input.verifiedOfferRef;
-    if (action.kind === 'offers.query' && observation.kind === 'offers.state') return sameRefSet(observation.hotelRefs, input.hotelRefs);
-    if (action.kind === 'offers.view.patch' && observation.kind === 'offers.state') return observation.hotelRefs.includes(input.hotelRef);
-    if (action.kind === 'offers.compare' && observation.kind === 'offers.state') return input.offerRefs.every((offerRef)=>observation.offerRefs.includes(offerRef));
-    if (action.kind === 'order.observe' && observation.kind === 'order.state') return observation.orderRef === input.orderRef;
+    if (action.kind === 'hotel.focus' && observation.kind === 'hotel.focus')
+        return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'hotel.select' && observation.kind === 'hotel.selection')
+        return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'offer.select' && observation.kind === 'offer.selection')
+        return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef;
+    if (action.kind === 'offer.check' && observation.kind === 'offer.availability')
+        return observation.offerRef === input.offerRef && observation.checkedOfferVersionRef === input.offerVersionRef;
+    if (action.kind === 'checkout.prepare' && observation.kind === 'checkout.handoff')
+        return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef && observation.verifiedOfferRef === input.verifiedOfferRef;
+    if (action.kind === 'offers.query' && observation.kind === 'offers.state')
+        return sameRefSet(observation.hotelRefs, input.hotelRefs);
+    if (action.kind === 'offers.view.patch' && observation.kind === 'offers.state')
+        return observation.hotelRefs.includes(input.hotelRef);
+    if (action.kind === 'offers.compare' && observation.kind === 'offers.state')
+        return input.offerRefs.every((offerRef) => observation.offerRefs.includes(offerRef));
+    if (action.kind === 'order.observe' && observation.kind === 'order.state')
+        return observation.orderRef === input.orderRef;
     return observation.kind === 'gap' || action.kind === 'search.patch' || action.kind === 'search.run' || action.kind === 'results.view.patch';
 }
 function workspaceBoundaryMatches(a, b) {
     return a.locale === b.locale && a.currency === b.currency && a.surface === b.surface && a.contextRef === b.contextRef && a.capabilities.surface === b.capabilities.surface && sameActions(a.capabilities.allowedActions, b.capabilities.allowedActions);
 }
 function workspaceHasOfferVersion(workspace, offerRef, offerVersionRef) {
-    return workspace.loadedOffers.some((offer)=>offer.offerRef === offerRef && offer.offerVersionRef === offerVersionRef);
+    return workspace.loadedOffers.some((offer) => offer.offerRef === offerRef && offer.offerVersionRef === offerVersionRef);
 }
 function verifiedOfferMatches(workspace, input) {
     return workspace.verifiedOffer?.offerRef === input.offerRef && workspace.verifiedOffer.offerVersionRef === input.offerVersionRef && workspace.verifiedOffer.verifiedOfferRef === input.verifiedOfferRef;
@@ -489,171 +482,142 @@ function verifiedOfferUnexpired(workspace, now) {
     return Boolean(workspace.verifiedOffer && isBookingDateTime(workspace.verifiedOffer.expiresAt) && Date.parse(workspace.verifiedOffer.expiresAt) > Date.parse(now));
 }
 function actionHitsCurrentOfferVersion(workspace, action, now) {
-    if (action.kind === 'offer.select' || action.kind === 'offer.check') return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef);
-    if (action.kind === 'checkout.prepare') return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef) && verifiedOfferMatches(workspace, action.input) && (now === undefined || verifiedOfferUnexpired(workspace, now));
+    if (action.kind === 'offer.select' || action.kind === 'offer.check')
+        return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef);
+    if (action.kind === 'checkout.prepare')
+        return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef) && verifiedOfferMatches(workspace, action.input) && (now === undefined || verifiedOfferUnexpired(workspace, now));
     return true;
 }
 function shortlistAfterCheckedOffer(previous, current, checkedOfferRef) {
-    if (sameActions(previous, current)) return true;
-    const removedChecked = previous.filter((ref)=>ref !== checkedOfferRef);
+    if (sameActions(previous, current))
+        return true;
+    const removedChecked = previous.filter((ref) => ref !== checkedOfferRef);
     return removedChecked.length === previous.length - 1 && sameActions(removedChecked, current);
 }
 function loadedOffersUnchanged(previous, current) {
-    return sameActions(previous.loadedOffers.map((offer)=>bookingDigest(offer)), current.loadedOffers.map((offer)=>bookingDigest(offer)));
+    return sameActions(previous.loadedOffers.map((offer) => bookingDigest(offer)), current.loadedOffers.map((offer) => bookingDigest(offer)));
 }
 function changedFactRefsMatch(previousFactRefs, currentFactRefs, changedFactRefs) {
-    if (!changedFactRefs.length) return false;
+    if (!changedFactRefs.length)
+        return false;
     const before = new Set(previousFactRefs);
     const after = new Set(currentFactRefs);
     const diff = [
-        ...previousFactRefs.filter((ref)=>!after.has(ref)),
-        ...currentFactRefs.filter((ref)=>!before.has(ref))
+        ...previousFactRefs.filter((ref) => !after.has(ref)),
+        ...currentFactRefs.filter((ref) => !before.has(ref)),
     ];
     return sameActions(diff, changedFactRefs);
 }
 function loadedOffersChangedVersionOnly(previous, current, offerRef, currentOfferVersionRef, changedFactRefs) {
-    if (previous.loadedOffers.length !== current.loadedOffers.length) return false;
-    const previousChecked = previous.loadedOffers.find((offer)=>offer.offerRef === offerRef);
-    const currentChecked = current.loadedOffers.find((offer)=>offer.offerRef === offerRef);
-    if (!previousChecked || !currentChecked || previousChecked.hotelRef !== currentChecked.hotelRef || currentChecked.offerVersionRef !== currentOfferVersionRef || previousChecked.offerVersionRef === currentChecked.offerVersionRef) return false;
-    if (previousChecked.evidenceLevel !== currentChecked.evidenceLevel) return false;
-    if (!changedFactRefsMatch(previousChecked.factRefs, currentChecked.factRefs, changedFactRefs)) return false;
-    const previousOther = previous.loadedOffers.filter((offer)=>offer.offerRef !== offerRef).map((offer)=>bookingDigest(offer));
-    const currentOther = current.loadedOffers.filter((offer)=>offer.offerRef !== offerRef).map((offer)=>bookingDigest(offer));
+    if (previous.loadedOffers.length !== current.loadedOffers.length)
+        return false;
+    const previousChecked = previous.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    const currentChecked = current.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    if (!previousChecked || !currentChecked || previousChecked.hotelRef !== currentChecked.hotelRef || currentChecked.offerVersionRef !== currentOfferVersionRef || previousChecked.offerVersionRef === currentChecked.offerVersionRef)
+        return false;
+    if (previousChecked.evidenceLevel !== currentChecked.evidenceLevel)
+        return false;
+    if (!changedFactRefsMatch(previousChecked.factRefs, currentChecked.factRefs, changedFactRefs))
+        return false;
+    const previousOther = previous.loadedOffers.filter((offer) => offer.offerRef !== offerRef).map((offer) => bookingDigest(offer));
+    const currentOther = current.loadedOffers.filter((offer) => offer.offerRef !== offerRef).map((offer) => bookingDigest(offer));
     return sameActions(previousOther, currentOther);
 }
 function availabilityReceiptIsComplete(receipt) {
-    return receipt.resultContract.outcome === 'complete' && receipt.resultContract.hardCriteriaMet && receipt.resultContract.gapCodes.length === 0 && receipt.resultContract.blockers.length === 0;
+    return receipt.resultContract.outcome === 'complete'
+        && receipt.resultContract.hardCriteriaMet
+        && receipt.resultContract.gapCodes.length === 0
+        && receipt.resultContract.blockers.length === 0;
 }
 function offerCheckPostActionMatches(previous, current, action, receipt) {
     const checkedOfferRef = action.input.offerRef;
     const checkedOfferVersionRef = action.input.offerVersionRef;
     const observation = receipt.observation.kind === 'offer.availability' ? receipt.observation : undefined;
     const negative = receipt.status === 'unavailable' || receipt.status === 'no_match';
-    if ([
-        'applied',
-        'changed',
-        'unavailable',
-        'no_match'
-    ].includes(receipt.status) && !observation) return false;
+    if (['applied', 'changed', 'unavailable', 'no_match'].includes(receipt.status) && !observation)
+        return false;
     if (receipt.status === 'applied' && observation?.available && observation.verifiedOfferRef) {
-        if (!availabilityReceiptIsComplete(receipt) || observation.gapCodes?.length) return false;
-        if (!loadedOffersUnchanged(previous, current)) return false;
-        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef !== checkedOfferVersionRef) return false;
-        if (current.selectedOfferRef !== checkedOfferRef) return false;
-        if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs)) return false;
-        if (!current.verifiedOffer || current.verifiedOffer.offerRef !== checkedOfferRef || current.verifiedOffer.offerVersionRef !== checkedOfferVersionRef || current.verifiedOffer.verifiedOfferRef !== observation.verifiedOfferRef || Number.isNaN(Date.parse(current.verifiedOffer.expiresAt))) return false;
+        if (!availabilityReceiptIsComplete(receipt) || observation.gapCodes?.length)
+            return false;
+        if (!loadedOffersUnchanged(previous, current))
+            return false;
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef !== checkedOfferVersionRef)
+            return false;
+        if (current.selectedOfferRef !== checkedOfferRef)
+            return false;
+        if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs))
+            return false;
+        if (!current.verifiedOffer || current.verifiedOffer.offerRef !== checkedOfferRef || current.verifiedOffer.offerVersionRef !== checkedOfferVersionRef || current.verifiedOffer.verifiedOfferRef !== observation.verifiedOfferRef || Number.isNaN(Date.parse(current.verifiedOffer.expiresAt)))
+            return false;
         return true;
     }
     if (receipt.status === 'changed' && observation?.available && observation.currentOfferVersionRef) {
-        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef === checkedOfferVersionRef || observation.verifiedOfferRef || !observation.changedFactRefs.length) return false;
-        if (!loadedOffersChangedVersionOnly(previous, current, checkedOfferRef, observation.currentOfferVersionRef, observation.changedFactRefs)) return false;
-        if (current.selectedOfferRef !== checkedOfferRef || current.verifiedOffer !== undefined) return false;
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef === checkedOfferVersionRef || observation.verifiedOfferRef || !observation.changedFactRefs.length)
+            return false;
+        if (!loadedOffersChangedVersionOnly(previous, current, checkedOfferRef, observation.currentOfferVersionRef, observation.changedFactRefs))
+            return false;
+        if (current.selectedOfferRef !== checkedOfferRef || current.verifiedOffer !== undefined)
+            return false;
         return sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs);
     }
-    if (!loadedOffersUnchanged(previous, current)) return false;
+    if (!loadedOffersUnchanged(previous, current))
+        return false;
     if (negative) {
-        if (current.selectedOfferRef !== undefined || current.verifiedOffer !== undefined) return false;
-        if (!shortlistAfterCheckedOffer(previous.shortlistedOfferRefs, current.shortlistedOfferRefs, checkedOfferRef)) return false;
+        if (current.selectedOfferRef !== undefined || current.verifiedOffer !== undefined)
+            return false;
+        if (!shortlistAfterCheckedOffer(previous.shortlistedOfferRefs, current.shortlistedOfferRefs, checkedOfferRef))
+            return false;
         return !current.shortlistedOfferRefs.includes(checkedOfferRef);
     }
-    if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs)) return false;
-    if (previous.selectedOfferRef !== current.selectedOfferRef) return false;
-    if (bookingDigest(previous.verifiedOffer ?? null) !== bookingDigest(current.verifiedOffer ?? null)) return false;
+    if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs))
+        return false;
+    if (previous.selectedOfferRef !== current.selectedOfferRef)
+        return false;
+    if (bookingDigest(previous.verifiedOffer ?? null) !== bookingDigest(current.verifiedOffer ?? null))
+        return false;
     return true;
 }
 function offerSelectPostActionMatches(previous, current, action, receipt) {
-    if (receipt.status !== 'applied') return current.selectedOfferRef === previous.selectedOfferRef && loadedOffersUnchanged(previous, current);
-    if (receipt.observation.kind !== 'offer.selection' || receipt.observation.offerRef !== action.input.offerRef || receipt.observation.offerVersionRef !== action.input.offerVersionRef) return false;
-    if (current.selectedOfferRef !== action.input.offerRef) return false;
+    if (receipt.status !== 'applied')
+        return current.selectedOfferRef === previous.selectedOfferRef && loadedOffersUnchanged(previous, current);
+    if (receipt.observation.kind !== 'offer.selection' || receipt.observation.offerRef !== action.input.offerRef || receipt.observation.offerVersionRef !== action.input.offerVersionRef)
+        return false;
+    if (current.selectedOfferRef !== action.input.offerRef)
+        return false;
     return loadedOffersUnchanged(previous, current);
 }
 function workspacePostActionMatches(previous, current, action, receipt) {
-    if (!workspaceBoundaryMatches(previous, current)) return false;
+    if (!workspaceBoundaryMatches(previous, current))
+        return false;
     const mutable = {
-        'search.patch': [
-            'searchDraft'
-        ],
-        'search.run': [
-            'results',
-            'visibleHotels'
-        ],
-        'results.view.patch': [
-            'results'
-        ],
-        'hotel.focus': [
-            'focusedHotelRef'
-        ],
-        'hotel.select': [
-            'focusedHotelRef'
-        ],
-        'offers.query': [
-            'loadedOffers'
-        ],
-        'offers.view.patch': [
-            'loadedOffers'
-        ],
-        'offer.select': [
-            'selectedOfferRef'
-        ],
-        'offer.check': [
-            'selectedOfferRef',
-            'shortlistedOfferRefs',
-            'verifiedOffer',
-            'loadedOffers'
-        ]
+        'search.patch': ['searchDraft'], 'search.run': ['results', 'visibleHotels'], 'results.view.patch': ['results'],
+        'hotel.focus': ['focusedHotelRef'], 'hotel.select': ['focusedHotelRef'],
+        'offers.query': ['loadedOffers'], 'offers.view.patch': ['loadedOffers'],
+        'offer.select': ['selectedOfferRef'], 'offer.check': ['selectedOfferRef', 'shortlistedOfferRefs', 'verifiedOffer', 'loadedOffers'],
     };
-    if (action.kind === 'offer.select' && !offerSelectPostActionMatches(previous, current, {
-        kind: 'offer.select',
-        input: {
-            offerRef: action.input.offerRef,
-            offerVersionRef: action.input.offerVersionRef
-        }
-    }, receipt)) return false;
-    if (action.kind === 'offer.check' && !offerCheckPostActionMatches(previous, current, {
-        kind: 'offer.check',
-        input: {
-            offerRef: action.input.offerRef,
-            offerVersionRef: action.input.offerVersionRef
-        }
-    }, receipt)) return false;
-    const allowed = new Set([
-        'revision',
-        ...mutable[action.kind] ?? []
-    ]);
-    const keys = new Set([
-        ...Object.keys(previous),
-        ...Object.keys(current)
-    ]);
-    for (const key of keys){
-        if (allowed.has(key)) continue;
-        if (bookingDigest(previous[key]) !== bookingDigest(current[key])) return false;
+    if (action.kind === 'offer.select' && !offerSelectPostActionMatches(previous, current, { kind: 'offer.select', input: { offerRef: action.input.offerRef, offerVersionRef: action.input.offerVersionRef } }, receipt))
+        return false;
+    if (action.kind === 'offer.check' && !offerCheckPostActionMatches(previous, current, { kind: 'offer.check', input: { offerRef: action.input.offerRef, offerVersionRef: action.input.offerVersionRef } }, receipt))
+        return false;
+    const allowed = new Set(['revision', ...(mutable[action.kind] ?? [])]);
+    const keys = new Set([...Object.keys(previous), ...Object.keys(current)]);
+    for (const key of keys) {
+        if (allowed.has(key))
+            continue;
+        if (bookingDigest(previous[key]) !== bookingDigest(current[key]))
+            return false;
     }
     return true;
 }
 function approvalOption(taskId, contextRef, sourceTurnId, presentationRequestKey, blocker, to, deliveryNonce) {
     const base = {
-        taskId,
-        contextRef,
-        sourceTurnId,
-        presentationRequestKey,
-        approvalId: `approval-${blocker.blockerId}-${to}`,
-        deliveryNonce,
-        blockerId: blocker.blockerId,
-        sourceActionId: blocker.sourceActionId,
-        sourceReceiptDigest: blocker.sourceReceiptDigest,
-        scope: blocker.scope,
-        code: blocker.code,
-        criterionPath: blocker.criterionPath,
-        valueDigest: blocker.valueDigest,
-        from: 'must',
-        to,
-        approved: true
-    };
-    return {
-        ...base,
-        optionDigest: bookingDigest(base)
+        taskId, contextRef, sourceTurnId, presentationRequestKey,
+        approvalId: `approval-${blocker.blockerId}-${to}`, deliveryNonce, blockerId: blocker.blockerId,
+        sourceActionId: blocker.sourceActionId, sourceReceiptDigest: blocker.sourceReceiptDigest,
+        scope: blocker.scope, code: blocker.code, criterionPath: blocker.criterionPath,
+        valueDigest: blocker.valueDigest, from: 'must', to, approved: true,
     };
+    return { ...base, optionDigest: bookingDigest(base) };
 }
 function approvalOptionDigest(approval) {
     const { optionDigest: _optionDigest, ...base } = approval;
@@ -665,7 +629,8 @@ function presentationKey(taskId, sourceTurnId, actionId, receiptDigest) {
 function assertApprovalRef(ref, state, action) {
     const approval = state.awaitingApproval?.approval;
     const blocker = state.awaitingApproval?.blocker;
-    if (!approval || !blocker || ref.approvalId !== approval.approvalId || ref.blockerId !== blocker.blockerId || ref.contextRef !== state.contextRef || ref.sourceTurnId !== state.awaitingApproval?.sourceTurnId || ref.presentationRequestKey !== state.awaitingApproval?.presentationRequestKey || ref.sourceActionId !== blocker.sourceActionId || ref.targetActionId !== action.actionId || ref.sourceRevision !== action.expectedRevision || ref.targetActionKind !== action.kind || ref.to !== approval.to || ref.expiresAt !== state.awaitingApproval?.expiresAt || ref.nonce !== state.awaitingApproval?.nonce || ref.sourceReceiptDigest !== blocker.sourceReceiptDigest || ref.scope !== blocker.scope || ref.code !== blocker.code || ref.criterionPath !== blocker.criterionPath || ref.valueDigest !== blocker.valueDigest) throw new Error('ledger_corrupt:approval_ref');
+    if (!approval || !blocker || ref.approvalId !== approval.approvalId || ref.blockerId !== blocker.blockerId || ref.contextRef !== state.contextRef || ref.sourceTurnId !== state.awaitingApproval?.sourceTurnId || ref.presentationRequestKey !== state.awaitingApproval?.presentationRequestKey || ref.sourceActionId !== blocker.sourceActionId || ref.targetActionId !== action.actionId || ref.sourceRevision !== action.expectedRevision || ref.targetActionKind !== action.kind || ref.to !== approval.to || ref.expiresAt !== state.awaitingApproval?.expiresAt || ref.nonce !== state.awaitingApproval?.nonce || ref.sourceReceiptDigest !== blocker.sourceReceiptDigest || ref.scope !== blocker.scope || ref.code !== blocker.code || ref.criterionPath !== blocker.criterionPath || ref.valueDigest !== blocker.valueDigest)
+        throw new Error('ledger_corrupt:approval_ref');
 }
 export class BookingCopilotTaskRuntime {
     ledger;
@@ -673,48 +638,60 @@ export class BookingCopilotTaskRuntime {
     contextRefFactory;
     now;
     approvalTtlMs;
-    constructor(ledger, options = {}){
+    constructor(ledger, options = {}) {
         this.ledger = ledger;
-        this.idFactory = options.idFactory ?? ((prefix)=>`${prefix}-${randomUUID()}`);
-        this.contextRefFactory = options.contextRefFactory ?? (()=>this.idFactory('context'));
-        this.now = options.now ?? (()=>new Date().toISOString());
+        this.idFactory = options.idFactory ?? ((prefix) => `${prefix}-${randomUUID()}`);
+        this.contextRefFactory = options.contextRefFactory ?? (() => this.idFactory('context'));
+        this.now = options.now ?? (() => new Date().toISOString());
         this.approvalTtlMs = options.approvalTtlMs ?? 120_000;
     }
+    /** Read-only conflict check used before startTask can append a new turn. */
     assertRequestBinding(requestKey, turn, input) {
         assertRequestKey(requestKey);
         assertPrincipal(input.principal);
-        if (input.requestKey !== requestKey) throw new Error('request_conflict');
+        if (input.requestKey !== requestKey)
+            throw new Error('request_conflict');
         const existing = this.requestBinding(requestKey);
-        if (!existing) return;
+        if (!existing)
+            return;
         const candidate = this.requestBindingPayload(requestKey, turn, input);
-        if (existing.requestDigest !== candidate.requestDigest || existing.turnId !== candidate.turnId || existing.workspaceDigest !== candidate.workspaceDigest || existing.workspaceSemanticDigest !== candidate.workspaceSemanticDigest || existing.surface !== candidate.surface || existing.capabilityDigest !== candidate.capabilityDigest || existing.contextRef !== turn.workspace.contextRef || existing.principalDigest !== candidate.principalDigest || existing.scopeDigest !== candidate.scopeDigest || existing.taskHandle !== candidate.taskHandle) throw new Error('request_conflict');
+        if (existing.requestDigest !== candidate.requestDigest || existing.turnId !== candidate.turnId || existing.workspaceDigest !== candidate.workspaceDigest || existing.workspaceSemanticDigest !== candidate.workspaceSemanticDigest || existing.surface !== candidate.surface || existing.capabilityDigest !== candidate.capabilityDigest || existing.contextRef !== turn.workspace.contextRef || existing.principalDigest !== candidate.principalDigest || existing.scopeDigest !== candidate.scopeDigest || existing.taskHandle !== candidate.taskHandle)
+            throw new Error('request_conflict');
     }
+    /** Verifies a direct planner turn against its durable TURN row. */
     assertTurnBinding(taskId, turn) {
         assertTaskId(taskId);
         const row = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, taskId, TURN);
-        const observed = row.map(({ payload })=>JSON.parse(payload)).find((candidate)=>candidate.turnId === turn.turnId);
-        if (!observed || observed.requestDigest !== bookingTurnDigest(turn) || observed.workspaceDigest !== bookingWorkspaceDigest(turn.workspace) || observed.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turn.workspace) || observed.contextRef !== turn.workspace.contextRef) throw new Error('turn_conflict');
+        const observed = row.map(({ payload }) => JSON.parse(payload)).find((candidate) => candidate.turnId === turn.turnId);
+        if (!observed || observed.requestDigest !== bookingTurnDigest(turn) || observed.workspaceDigest !== bookingWorkspaceDigest(turn.workspace) || observed.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turn.workspace) || observed.contextRef !== turn.workspace.contextRef)
+            throw new Error('turn_conflict');
     }
+    /** Rejects a canonical approval after its durable runtime consumption. */
     assertApprovalNotConsumed(taskId, approval) {
         assertTaskId(taskId);
         const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
-        for (const row of rows){
+        for (const row of rows) {
             const consumed = JSON.parse(row.payload);
-            if (consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval)) throw new Error('approval_replayed');
+            if (consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval))
+                throw new Error('approval_replayed');
         }
     }
+    /** Persists the per-requestKey receipt/replay binding after task creation. */
     persistRequestBinding(requestKey, turn, input) {
         assertRequestKey(requestKey);
         assertPrincipal(input.principal);
-        if (input.requestKey !== requestKey) throw new Error('request_conflict');
-        const run = this.ledger.db.transaction(()=>{
+        if (input.requestKey !== requestKey)
+            throw new Error('request_conflict');
+        const run = this.ledger.db.transaction(() => {
             const state = this.requireTask(turn.taskId);
-            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
             assertReplayUpgradeReanchored(state);
             this.appendRequestBindingInTransaction(requestKey, turn, input);
         });
         run.immediate();
     }
+    /** Binds the untrusted ingress snapshot to server-owned task/context/capabilities. */
     bindIngressTurn(turn, task, turnId) {
         assertSafeRef(turnId);
         const approval = turn.request.approval;
@@ -722,64 +699,57 @@ export class BookingCopilotTaskRuntime {
             throw new Error('invalid_ingress_approval_authority');
         }
         return {
-            schemaVersion: 'booking.surface',
-            kind: 'user.turn',
-            taskId: task.taskId,
-            turnId,
+            schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId,
             workspace: {
                 ...turn.workspace,
-                schemaVersion: 'booking.surface',
-                contextRef: task.contextRef,
-                surface: task.surface,
-                capabilities: {
-                    surface: task.surface,
-                    allowedActions: [
-                        ...task.allowedActions
-                    ]
-                }
+                schemaVersion: 'booking.surface', contextRef: task.contextRef, surface: task.surface,
+                capabilities: { surface: task.surface, allowedActions: [...task.allowedActions] },
             },
-            request: approval ? {
-                text: turn.request.text,
-                approval: {
-                    ...approval
-                }
-            } : {
-                text: turn.request.text
-            }
+            request: approval
+                ? { text: turn.request.text, approval: { ...approval } }
+                : { text: turn.request.text },
         };
     }
     startTask(turn, requestBinding) {
         const validation = validateBookingSurface(turn);
-        if (!validation.ok) throw new Error(`invalid_planner_turn:${errorText(validation)}`);
-        if (turn.kind === 'user.turn.ingress') throw new Error('ingress_binding_required');
-        if (turn.kind === 'action.receipt.continuation') throw new Error('receipt_continuation_requires_continue');
+        if (!validation.ok)
+            throw new Error(`invalid_planner_turn:${errorText(validation)}`);
+        if (turn.kind === 'user.turn.ingress')
+            throw new Error('ingress_binding_required');
+        if (turn.kind === 'action.receipt.continuation')
+            throw new Error('receipt_continuation_requires_continue');
         const userTurn = turn;
-        if (!userTurn.taskId) throw new Error('invalid_planner_turn:task_id_required');
+        if (!userTurn.taskId)
+            throw new Error('invalid_planner_turn:task_id_required');
         const taskId = userTurn.taskId;
         assertTaskId(taskId);
         const turnId = userTurn.turnId;
-        if (!turnId) throw new Error('invalid_planner_turn:turn_id_required');
+        if (!turnId)
+            throw new Error('invalid_planner_turn:turn_id_required');
         assertSafeRef(turnId);
         const contextRef = userTurn.workspace.contextRef;
         const surface = userTurn.workspace.surface;
         const revision = userTurn.workspace.revision;
-        const allowedActions = [
-            ...userTurn.workspace.capabilities.allowedActions
-        ];
+        const allowedActions = [...userTurn.workspace.capabilities.allowedActions];
         const requestDigest = bookingTurnDigest(turn);
         const boundWorkspace = userTurn.workspace;
         assertWorkspaceLoadedOfferRefsUnique(boundWorkspace);
         const workspaceDigest = bookingWorkspaceDigest(boundWorkspace);
         const workspaceSemanticDigest = bookingWorkspaceSemanticDigest(boundWorkspace);
         const availability = createAvailabilityPolicy(boundWorkspace);
-        const run = this.ledger.db.transaction(()=>{
+        const run = this.ledger.db.transaction(() => {
             const existing = this.resumeTask(taskId);
             if (existing) {
-                if (existing.contextRef !== contextRef) throw new Error('task_conflict:context_mismatch');
-                if (existing.surface !== surface) throw new Error('task_conflict:surface_mismatch');
-                if (existing.revision !== revision && existing.phase !== 'waiting_receipt' && !existing.replayUpgradeRequired) throw new Error('task_conflict:revision_mismatch');
-                if (!sameActions(existing.allowedActions, allowedActions)) throw new Error('task_conflict:capability_mismatch');
-                if (existing.phase === 'terminal' || existing.phase === 'error') throw new Error('task_terminal');
+                if (existing.contextRef !== contextRef)
+                    throw new Error('task_conflict:context_mismatch');
+                if (existing.surface !== surface)
+                    throw new Error('task_conflict:surface_mismatch');
+                if (existing.revision !== revision && existing.phase !== 'waiting_receipt' && !existing.replayUpgradeRequired)
+                    throw new Error('task_conflict:revision_mismatch');
+                if (!sameActions(existing.allowedActions, allowedActions))
+                    throw new Error('task_conflict:capability_mismatch');
+                if (existing.phase === 'terminal' || existing.phase === 'error')
+                    throw new Error('task_terminal');
                 if (turnId && existing.lastTurnId === turnId) {
                     this.assertTurnBinding(taskId, userTurn);
                     if (requestBinding) {
@@ -788,50 +758,47 @@ export class BookingCopilotTaskRuntime {
                     }
                     return existing;
                 }
-                if (existing.phase === 'waiting_receipt') throw new Error('receipt_required');
+                if (existing.phase === 'waiting_receipt')
+                    throw new Error('receipt_required');
                 const approval = userTurn && 'approval' in userTurn.request ? userTurn.request.approval : undefined;
                 let approvalState;
                 if (approval) {
                     assertReplayUpgradeReanchored(existing);
                     const awaiting = existing.awaitingApproval;
-                    if (!awaiting) throw new Error('approval_not_awaiting');
-                    if (!awaiting.optionsEmitted) throw new Error('approval_not_presented');
-                    if (Date.parse(awaiting.expiresAt) <= Date.parse(this.now())) throw new Error('approval_expired');
+                    if (!awaiting)
+                        throw new Error('approval_not_awaiting');
+                    if (!awaiting.optionsEmitted)
+                        throw new Error('approval_not_presented');
+                    if (Date.parse(awaiting.expiresAt) <= Date.parse(this.now()))
+                        throw new Error('approval_expired');
                     const checked = validateApprovalAgainstBlocker(approval, awaiting.blocker);
-                    const option = awaiting.options.find((candidate)=>candidate.optionDigest === approval.optionDigest && bookingDigest(candidate) === bookingDigest(approval));
-                    if (!checked.ok || !option || approval.taskId !== existing.taskId || approval.contextRef !== existing.contextRef || approval.sourceTurnId !== awaiting.sourceTurnId || approval.presentationRequestKey !== awaiting.presentationRequestKey || approval.optionDigest !== approvalOptionDigest(approval) || awaiting.approval && bookingDigest(approval) !== bookingDigest(awaiting.approval)) throw new Error('approval_mismatch');
+                    const option = awaiting.options.find((candidate) => candidate.optionDigest === approval.optionDigest && bookingDigest(candidate) === bookingDigest(approval));
+                    if (!checked.ok || !option || approval.taskId !== existing.taskId || approval.contextRef !== existing.contextRef || approval.sourceTurnId !== awaiting.sourceTurnId || approval.presentationRequestKey !== awaiting.presentationRequestKey || approval.optionDigest !== approvalOptionDigest(approval) || (awaiting.approval && bookingDigest(approval) !== bookingDigest(awaiting.approval)))
+                        throw new Error('approval_mismatch');
                     if (awaiting.approval && bookingDigest(awaiting.approval) === bookingDigest(approval)) {
+                        // The canonical approval may only be advanced by its original
+                        // turn identity. A fresh key must not join the in-flight planner
+                        // and receive the operation batch before durable consumption.
                         throw new Error('approval_replayed');
                     }
-                    approvalState = {
-                        ...awaiting,
-                        approval
-                    };
+                    approvalState = { ...awaiting, approval };
                     this.appendApproval(taskId, existing.contextRef, approvalState);
-                } else if (existing.awaitingApproval) {
+                }
+                else if (existing.awaitingApproval) {
                     throw new Error('approval_required');
                 }
                 this.appendTurn(taskId, existing.contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, existing.userTurnCount + 1, turnId, boundWorkspace);
-                if (requestBinding) this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+                if (requestBinding)
+                    this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
                 return this.requireTask(taskId);
             }
-            if (userTurn?.request.approval) throw new Error('approval_not_awaiting');
-            const started = {
-                schema: LEDGER_SCHEMA,
-                taskId,
-                contextRef,
-                surface,
-                revision,
-                allowedActions,
-                workspaceDigest,
-                workspaceSemanticDigest,
-                workspace: boundWorkspace,
-                availability,
-                availabilityDigest: bookingDigest(availability)
-            };
+            if (userTurn?.request.approval)
+                throw new Error('approval_not_awaiting');
+            const started = { schema: LEDGER_SCHEMA, taskId, contextRef, surface, revision, allowedActions, workspaceDigest, workspaceSemanticDigest, workspace: boundWorkspace, availability, availabilityDigest: bookingDigest(availability) };
             this.append(STARTED, taskId, started, `booking-copilot:task:${taskId}`);
             this.appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, 1, turnId, boundWorkspace);
-            if (requestBinding) this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+            if (requestBinding)
+                this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
             return this.requireTask(taskId);
         });
         return run.immediate();
@@ -839,108 +806,96 @@ export class BookingCopilotTaskRuntime {
     resumeTask(taskId) {
         assertTaskId(taskId);
         const rows = this.rows(taskId);
-        if (!rows.length) return null;
+        if (!rows.length)
+            return null;
         let state = null;
         let skipLegacyUpgradeTail = false;
         const replayWorkspaceDigests = new Map();
-        const consumed = {
-            events: new Map(),
-            actions: new Map(),
-            pendingBatchKeys: new Set(),
-            pendingBatchOpen: false
-        };
+        const consumed = { events: new Map(), actions: new Map(), pendingBatchKeys: new Set(), pendingBatchOpen: false };
         const suppressedDecisionRequestKeys = new Set();
         const suppressedRequestBindingKeys = new Set();
         const suppressedReceiptActionIds = new Set();
         const suppressedApprovalTargetActionIds = new Set();
-        for (const row of rows){
+        for (const row of rows) {
             const payload = JSON.parse(row.payload);
-            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId) throw new Error(`ledger_corrupt:${taskId}:seq=${row.seq}`);
+            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId)
+                throw new Error(`ledger_corrupt:${taskId}:seq=${row.seq}`);
             if (row.kind === STARTED) {
                 skipLegacyUpgradeTail = false;
-                if (state) throw new Error(`ledger_corrupt:${taskId}:duplicate_start`);
+                if (state)
+                    throw new Error(`ledger_corrupt:${taskId}:duplicate_start`);
                 const started = payload;
                 let startedWorkspace;
                 try {
                     startedWorkspace = normalizeWorkspaceForReplay(started.workspace);
-                } catch  {
+                }
+                catch {
                     throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
                 }
                 let initialAvailability;
                 try {
                     initialAvailability = createAvailabilityPolicy(startedWorkspace);
-                } catch  {
+                }
+                catch {
                     throw new Error(`ledger_corrupt:${taskId}:start_availability`);
                 }
                 try {
                     assertWorkspaceLoadedOfferRefsUnique(startedWorkspace);
-                } catch  {
+                }
+                catch {
                     throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
                 }
                 rememberReplayWorkspaceDigest(replayWorkspaceDigests, started.workspaceDigest, started.workspace, startedWorkspace);
                 const startedAvailability = normalizeAvailabilityPolicyForReplay(started.availability, startedWorkspace, undefined, undefined, replayWorkspaceDigests);
-                if (!started.workspaceDigest || !started.workspaceSemanticDigest || !started.workspace || !started.availability || !started.availabilityDigest || !validateAvailabilityPolicy(startedAvailability) || !replayDigestMatches(started.availabilityDigest, started.availability, startedAvailability) || bookingDigest(initialAvailability) !== bookingDigest(startedAvailability) || !replayWorkspaceDigestMatches(started.workspaceDigest, started.workspace, startedWorkspace) || !replayWorkspaceSemanticDigestMatches(started.workspaceSemanticDigest, started.workspace, startedWorkspace)) throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
-                state = {
-                    schemaVersion: 'booking.surface',
-                    taskId,
-                    contextRef: started.contextRef,
-                    surface: started.surface,
-                    revision: started.revision,
-                    allowedActions: [
-                        ...started.allowedActions
-                    ],
-                    userTurnCount: 0,
-                    operationCount: 0,
-                    phase: startedAvailability.terminal ? 'terminal' : 'planning',
-                    lastSequence: 0,
-                    workspaceDigest: bookingWorkspaceDigest(startedWorkspace),
-                    workspaceSemanticDigest: bookingWorkspaceSemanticDigest(startedWorkspace),
-                    workspaceSnapshot: startedWorkspace,
-                    availability: startedAvailability
-                };
-            } else {
-                if (!state) throw new Error(`ledger_corrupt:${taskId}:event_before_start`);
-                if (payload.contextRef !== state.contextRef) throw new Error(`ledger_corrupt:${taskId}:context_drift`);
+                if (!started.workspaceDigest || !started.workspaceSemanticDigest || !started.workspace || !started.availability || !started.availabilityDigest || !validateAvailabilityPolicy(startedAvailability) || !replayDigestMatches(started.availabilityDigest, started.availability, startedAvailability) || bookingDigest(initialAvailability) !== bookingDigest(startedAvailability) || !replayWorkspaceDigestMatches(started.workspaceDigest, started.workspace, startedWorkspace) || !replayWorkspaceSemanticDigestMatches(started.workspaceSemanticDigest, started.workspace, startedWorkspace))
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                state = { schemaVersion: 'booking.surface', taskId, contextRef: started.contextRef, surface: started.surface, revision: started.revision, allowedActions: [...started.allowedActions], userTurnCount: 0, operationCount: 0, phase: startedAvailability.terminal ? 'terminal' : 'planning', lastSequence: 0, workspaceDigest: bookingWorkspaceDigest(startedWorkspace), workspaceSemanticDigest: bookingWorkspaceSemanticDigest(startedWorkspace), workspaceSnapshot: startedWorkspace, availability: startedAvailability };
+            }
+            else {
+                if (!state)
+                    throw new Error(`ledger_corrupt:${taskId}:event_before_start`);
+                if (payload.contextRef !== state.contextRef)
+                    throw new Error(`ledger_corrupt:${taskId}:context_drift`);
                 if (row.kind === REQUEST_BINDING) {
                     if (skipLegacyUpgradeTail) {
                         const binding = payload;
-                        if (typeof binding.requestKey === 'string') suppressedRequestBindingKeys.add(binding.requestKey);
+                        if (typeof binding.requestKey === 'string')
+                            suppressedRequestBindingKeys.add(binding.requestKey);
                         continue;
                     }
                     const binding = payload;
                     const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, TURN);
-                    const rawBoundTurn = turnRows.map(({ payload })=>JSON.parse(payload)).find((candidate)=>candidate.turnId === binding.turnId);
+                    const rawBoundTurn = turnRows.map(({ payload }) => JSON.parse(payload)).find((candidate) => candidate.turnId === binding.turnId);
                     let boundTurn;
                     try {
-                        boundTurn = rawBoundTurn ? {
-                            ...rawBoundTurn,
-                            workspace: normalizeWorkspaceForReplay(rawBoundTurn.workspace)
-                        } : undefined;
-                    } catch  {
+                        boundTurn = rawBoundTurn ? { ...rawBoundTurn, workspace: normalizeWorkspaceForReplay(rawBoundTurn.workspace) } : undefined;
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:request_binding`);
                     }
-                    if (!isSafeBookingRequestKey(binding.requestKey) || !safeIdentity(binding.turnId) || !safeIdentity(binding.contextRef) || binding.taskHandle !== undefined && !safeIdentity(binding.taskHandle) || !/^[0-9a-f]{64}$/.test(binding.requestDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceSemanticDigest) || !/^[0-9a-f]{64}$/.test(binding.capabilityDigest) || !/^[0-9a-f]{64}$/.test(binding.principalDigest) || !/^[0-9a-f]{64}$/.test(binding.scopeDigest) || ![
-                        'tenant',
-                        'customer_portal',
-                        'storefront',
-                        'payment_link'
-                    ].includes(binding.surface) || !boundTurn || boundTurn.requestDigest !== binding.requestDigest || boundTurn.workspaceDigest !== binding.workspaceDigest || boundTurn.workspaceSemanticDigest !== binding.workspaceSemanticDigest || bookingDigest(boundTurn.workspace.capabilities) !== binding.capabilityDigest || boundTurn.workspace.surface !== binding.surface) throw new Error(`ledger_corrupt:${taskId}:request_binding`);
-                } else if (row.kind === TURN) {
+                    if (!isSafeBookingRequestKey(binding.requestKey) || !safeIdentity(binding.turnId) || !safeIdentity(binding.contextRef) || (binding.taskHandle !== undefined && !safeIdentity(binding.taskHandle)) || !/^[0-9a-f]{64}$/.test(binding.requestDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceSemanticDigest) || !/^[0-9a-f]{64}$/.test(binding.capabilityDigest) || !/^[0-9a-f]{64}$/.test(binding.principalDigest) || !/^[0-9a-f]{64}$/.test(binding.scopeDigest) || !['tenant', 'customer_portal', 'storefront', 'payment_link'].includes(binding.surface) || !boundTurn || boundTurn.requestDigest !== binding.requestDigest || boundTurn.workspaceDigest !== binding.workspaceDigest || boundTurn.workspaceSemanticDigest !== binding.workspaceSemanticDigest || bookingDigest(boundTurn.workspace.capabilities) !== binding.capabilityDigest || boundTurn.workspace.surface !== binding.surface)
+                        throw new Error(`ledger_corrupt:${taskId}:request_binding`);
+                }
+                else if (row.kind === TURN) {
                     skipLegacyUpgradeTail = false;
                     const t = payload;
-                    if (Object.prototype.hasOwnProperty.call(payload, 'approval')) throw new Error(`ledger_corrupt:${taskId}:turn_approval`);
+                    if (Object.prototype.hasOwnProperty.call(payload, 'approval'))
+                        throw new Error(`ledger_corrupt:${taskId}:turn_approval`);
                     let turnWorkspace;
                     try {
                         turnWorkspace = normalizeWorkspaceForReplay(t.workspace);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
                     }
                     try {
                         assertWorkspaceLoadedOfferRefsUnique(turnWorkspace);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
                     }
-                    if (!t.workspaceDigest || !t.workspaceSemanticDigest || !t.workspace || !replayWorkspaceDigestMatches(t.workspaceDigest, t.workspace, turnWorkspace) || !replayWorkspaceSemanticDigestMatches(t.workspaceSemanticDigest, t.workspace, turnWorkspace)) throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    if (!t.workspaceDigest || !t.workspaceSemanticDigest || !t.workspace || !replayWorkspaceDigestMatches(t.workspaceDigest, t.workspace, turnWorkspace) || !replayWorkspaceSemanticDigestMatches(t.workspaceSemanticDigest, t.workspace, turnWorkspace))
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
                     rememberReplayWorkspaceDigest(replayWorkspaceDigests, t.workspaceDigest, t.workspace, turnWorkspace);
                     state.userTurnCount++;
                     state.lastTurnId = t.turnId;
@@ -949,23 +904,37 @@ export class BookingCopilotTaskRuntime {
                     state.workspaceSnapshot = turnWorkspace;
                     state.revision = turnWorkspace.revision;
                     delete state.replayUpgradeRequired;
-                } else if (row.kind === APPROVAL_GRANTED) {
-                    if (skipLegacyUpgradeTail) continue;
+                    // Approval authority is established only by APPROVAL_GRANTED; a turn
+                    // is merely an observation and cannot restore or mutate approval state.
+                }
+                else if (row.kind === APPROVAL_GRANTED) {
+                    if (skipLegacyUpgradeTail)
+                        continue;
                     const granted = payload;
-                    if (!granted.approval || granted.approvalDigest !== bookingDigest(granted.approval) || !granted.approval.sourceTurnId || !granted.approval.presentationRequestKey || !validateCriterionBlocker(granted.approval.blocker).ok || !granted.approval.options?.length || granted.approval.options.some((option)=>!validateApprovalAgainstBlocker(option, granted.approval.blocker).ok || option.taskId !== taskId || option.contextRef !== state.contextRef || option.sourceTurnId !== granted.approval.sourceTurnId || option.presentationRequestKey !== granted.approval.presentationRequestKey || option.optionDigest !== approvalOptionDigest(option)) || granted.approval.approval && !granted.approval.options.some((option)=>bookingDigest(option) === bookingDigest(granted.approval.approval))) throw new Error(`ledger_corrupt:${taskId}:approval_granted`);
+                    if (!granted.approval || granted.approvalDigest !== bookingDigest(granted.approval) || !granted.approval.sourceTurnId || !granted.approval.presentationRequestKey || !validateCriterionBlocker(granted.approval.blocker).ok || !granted.approval.options?.length || granted.approval.options.some((option) => !validateApprovalAgainstBlocker(option, granted.approval.blocker).ok || option.taskId !== taskId || option.contextRef !== state.contextRef || option.sourceTurnId !== granted.approval.sourceTurnId || option.presentationRequestKey !== granted.approval.presentationRequestKey || option.optionDigest !== approvalOptionDigest(option)) || (granted.approval.approval && !granted.approval.options.some((option) => bookingDigest(option) === bookingDigest(granted.approval.approval))))
+                        throw new Error(`ledger_corrupt:${taskId}:approval_granted`);
                     state.awaitingApproval = granted.approval;
                     state.phase = 'input_required';
-                } else if (row.kind === APPROVAL_OFFERED) {
-                    if (skipLegacyUpgradeTail) continue;
+                }
+                else if (row.kind === APPROVAL_OFFERED) {
+                    if (skipLegacyUpgradeTail)
+                        continue;
                     const offered = payload;
-                    if (!offered.approval || offered.approvalDigest !== bookingDigest(offered.approval) || !state.awaitingApproval || bookingDigest(offered.approval) !== bookingDigest(state.awaitingApproval)) throw new Error(`ledger_corrupt:${taskId}:approval_offered`);
+                    if (!offered.approval || offered.approvalDigest !== bookingDigest(offered.approval) || !state.awaitingApproval || bookingDigest(offered.approval) !== bookingDigest(state.awaitingApproval))
+                        throw new Error(`ledger_corrupt:${taskId}:approval_offered`);
+                    // This is a durable outbox intent only.  It is deliberately not
+                    // evidence that the question entered a replayable output batch:
+                    // a crash between this row and DECISION_BATCH must still reject an
+                    // approval until the exact question can be replayed.
                     state.phase = 'input_required';
-                } else if (row.kind === ACTION) {
+                }
+                else if (row.kind === ACTION) {
                     const actionPayload = payload;
                     if (skipLegacyUpgradeTail) {
                         try {
                             consumeSkippedActionOrdinal(state, actionPayload, consumed);
-                        } catch  {
+                        }
+                        catch {
                             throw new Error(`ledger_corrupt:${taskId}:action`);
                         }
                         continue;
@@ -973,16 +942,19 @@ export class BookingCopilotTaskRuntime {
                     const rawAction = actionPayload.action;
                     const operationCount = actionPayload.operationCount ?? state.operationCount + 1;
                     const { actionDigest: _rawActionDigest, ...rawActionBase } = rawAction;
-                    if (rawAction.actionDigest !== checkpointDigest(rawActionBase) || rawAction.contextRef !== state.contextRef || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(rawAction.sequence) || rawAction.sequence <= state.lastSequence) throw new Error(`ledger_corrupt:${taskId}:action`);
+                    if (rawAction.actionDigest !== checkpointDigest(rawActionBase) || rawAction.contextRef !== state.contextRef || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(rawAction.sequence) || rawAction.sequence <= state.lastSequence)
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
                     let a;
                     try {
                         a = normalizeActionCheckpointForReplay(rawAction, state.workspaceSnapshot);
-                    } catch (error) {
+                    }
+                    catch (error) {
                         if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
                             state = replanAfterReplayUpgradeGap(state);
                             try {
                                 consumeSkippedActionOrdinal(state, actionPayload, consumed);
-                            } catch  {
+                            }
+                            catch {
                                 throw new Error(`ledger_corrupt:${taskId}:action`);
                             }
                             skipLegacyUpgradeTail = true;
@@ -991,16 +963,19 @@ export class BookingCopilotTaskRuntime {
                         throw error;
                     }
                     const { actionDigest: _actionDigest, ...actionBase } = a;
-                    if (!actionPayload.availability || actionPayload.availabilityDigest !== bookingDigest(actionPayload.availability)) throw new Error(`ledger_corrupt:${taskId}:action`);
+                    if (!actionPayload.availability || actionPayload.availabilityDigest !== bookingDigest(actionPayload.availability))
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
                     let actionAvailability;
                     try {
                         actionAvailability = normalizeAvailabilityPolicyForReplay(actionPayload.availability, state.workspaceSnapshot, a, state.availability, replayWorkspaceDigests);
-                    } catch (error) {
+                    }
+                    catch (error) {
                         if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
                             state = replanAfterReplayUpgradeGap(state);
                             try {
                                 consumeSkippedActionOrdinal(state, actionPayload, consumed);
-                            } catch  {
+                            }
+                            catch {
                                 throw new Error(`ledger_corrupt:${taskId}:action`);
                             }
                             skipLegacyUpgradeTail = true;
@@ -1008,16 +983,21 @@ export class BookingCopilotTaskRuntime {
                         }
                         throw error;
                     }
-                    if (!checkpointDigestMatchesForReplay(rawAction, a) || a.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !validateAvailabilityPolicy(actionAvailability) || !replayDigestMatches(actionPayload.availabilityDigest, actionPayload.availability, actionAvailability) || !state.workspaceSnapshot) throw new Error(`ledger_corrupt:${taskId}:action`);
-                    if (a.relaxationApprovalRef) assertApprovalRef(a.relaxationApprovalRef, state, a);
-                    if (state.pendingAction) throw new Error(`ledger_corrupt:${taskId}:parallel_actions`);
+                    if (!checkpointDigestMatchesForReplay(rawAction, a) || a.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !validateAvailabilityPolicy(actionAvailability) || !replayDigestMatches(actionPayload.availabilityDigest, actionPayload.availability, actionAvailability) || !state.workspaceSnapshot)
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
+                    if (a.relaxationApprovalRef)
+                        assertApprovalRef(a.relaxationApprovalRef, state, a);
+                    if (state.pendingAction)
+                        throw new Error(`ledger_corrupt:${taskId}:parallel_actions`);
                     let expectedAvailability;
                     try {
                         expectedAvailability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, a);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:action_transition`);
                     }
-                    if (bookingDigest(expectedAvailability) !== bookingDigest(actionAvailability)) throw new Error(`ledger_corrupt:${taskId}:action_transition`);
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(actionAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:action_transition`);
                     state.operationCount = operationCount;
                     state.availability = actionAvailability;
                     state.pendingAction = a;
@@ -1027,34 +1007,43 @@ export class BookingCopilotTaskRuntime {
                         rememberConsumedActionIdentity(consumed, a);
                     }
                     delete state.awaitingApproval;
-                } else if (row.kind === RECEIPT) {
+                }
+                else if (row.kind === RECEIPT) {
                     if (skipLegacyUpgradeTail) {
                         const r = payload;
-                        if (typeof r.receipt?.actionId === 'string') suppressedReceiptActionIds.add(r.receipt.actionId);
+                        if (typeof r.receipt?.actionId === 'string')
+                            suppressedReceiptActionIds.add(r.receipt.actionId);
                         continue;
                     }
                     const r = payload;
                     const operationCount = r.operationCount ?? state.operationCount;
-                    if (!state.pendingAction || state.pendingAction.actionId !== r.receipt.actionId) throw new Error(`ledger_corrupt:${taskId}:orphan_receipt`);
+                    if (!state.pendingAction || state.pendingAction.actionId !== r.receipt.actionId)
+                        throw new Error(`ledger_corrupt:${taskId}:orphan_receipt`);
                     let receiptWorkspace;
                     try {
                         receiptWorkspace = normalizeWorkspaceForReplay(r.workspace);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
                     }
                     try {
                         assertWorkspaceLoadedOfferRefsUnique(receiptWorkspace);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
                     }
-                    if (!r.workspaceDigest || !r.workspaceSemanticDigest || !r.workspace || !replayWorkspaceDigestMatches(r.workspaceDigest, r.workspace, receiptWorkspace) || !replayWorkspaceSemanticDigestMatches(r.workspaceSemanticDigest, r.workspace, receiptWorkspace)) throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    if (!r.workspaceDigest || !r.workspaceSemanticDigest || !r.workspace || !replayWorkspaceDigestMatches(r.workspaceDigest, r.workspace, receiptWorkspace) || !replayWorkspaceSemanticDigestMatches(r.workspaceSemanticDigest, r.workspace, receiptWorkspace))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
                     rememberReplayWorkspaceDigest(replayWorkspaceDigests, r.workspaceDigest, r.workspace, receiptWorkspace);
-                    if (!replayDigestMatches(r.receiptDigest, r.receipt, r.receipt) || r.receipt.contextRef !== state.contextRef || r.receipt.actionId !== state.pendingAction.actionId || !Number.isSafeInteger(r.receipt.revision) || r.receipt.revision < state.pendingAction.expectedRevision || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount) throw new Error(`ledger_corrupt:${taskId}:receipt`);
-                    if (!r.availability || r.availabilityDigest !== bookingDigest(r.availability)) throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, r.receipt) || r.receipt.contextRef !== state.contextRef || r.receipt.actionId !== state.pendingAction.actionId || !Number.isSafeInteger(r.receipt.revision) || r.receipt.revision < state.pendingAction.expectedRevision || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount)
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (!r.availability || r.availabilityDigest !== bookingDigest(r.availability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
                     let receipt;
                     try {
                         receipt = normalizeReceiptForReplay(r.receipt, state.pendingAction, receiptWorkspace);
-                    } catch (error) {
+                    }
+                    catch (error) {
                         if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
                             clearPendingBatch(consumed);
                             state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
@@ -1066,7 +1055,8 @@ export class BookingCopilotTaskRuntime {
                     let receiptAvailability;
                     try {
                         receiptAvailability = normalizeAvailabilityPolicyForReplay(r.availability, receiptWorkspace, state.pendingAction, state.availability, replayWorkspaceDigests, receipt);
-                    } catch (error) {
+                    }
+                    catch (error) {
                         if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
                             clearPendingBatch(consumed);
                             state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
@@ -1075,17 +1065,22 @@ export class BookingCopilotTaskRuntime {
                         }
                         throw error;
                     }
-                    if (!replayDigestMatches(r.receiptDigest, r.receipt, receipt) || !validateBookingSurface(receipt).ok || !r.availability || !r.availabilityDigest || !validateAvailabilityPolicy(receiptAvailability) || !replayDigestMatches(r.availabilityDigest, r.availability, receiptAvailability)) throw new Error(`ledger_corrupt:${taskId}:receipt`);
-                    if (Boolean(r.availabilityTerminal) !== Boolean(receiptAvailability.terminal) || r.availabilityTerminal && receiptAvailability.terminal && bookingDigest(r.availabilityTerminal) !== bookingDigest(receiptAvailability.terminal)) throw new Error(`ledger_corrupt:${taskId}:availability_terminal`);
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, receipt) || !validateBookingSurface(receipt).ok || !r.availability || !r.availabilityDigest || !validateAvailabilityPolicy(receiptAvailability) || !replayDigestMatches(r.availabilityDigest, r.availability, receiptAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (Boolean(r.availabilityTerminal) !== Boolean(receiptAvailability.terminal) || (r.availabilityTerminal && receiptAvailability.terminal && bookingDigest(r.availabilityTerminal) !== bookingDigest(receiptAvailability.terminal)))
+                        throw new Error(`ledger_corrupt:${taskId}:availability_terminal`);
                     assertCanonicalReceipt(receipt);
-                    if (!state.workspaceSnapshot || !workspacePostActionMatches(state.workspaceSnapshot, receiptWorkspace, state.pendingAction, receipt) || !receiptObservationMatchesAction(receipt.observation.kind, state.pendingAction.kind) || !receiptTargetMatchesAction(receipt, state.pendingAction)) throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    if (!state.workspaceSnapshot || !workspacePostActionMatches(state.workspaceSnapshot, receiptWorkspace, state.pendingAction, receipt) || !receiptObservationMatchesAction(receipt.observation.kind, state.pendingAction.kind) || !receiptTargetMatchesAction(receipt, state.pendingAction))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
                     let expectedAvailability;
                     try {
                         expectedAvailability = reduceAvailabilityReceipt(state.availability, receiptWorkspace, receipt, state.pendingAction);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
                     }
-                    if (bookingDigest(expectedAvailability) !== bookingDigest(receiptAvailability)) throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(receiptAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
                     state.lastReceipt = receipt;
                     state.revision = receipt.revision;
                     state.workspaceDigest = bookingWorkspaceDigest(receiptWorkspace);
@@ -1096,45 +1091,59 @@ export class BookingCopilotTaskRuntime {
                     state.phase = receiptAvailability.terminal || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS ? 'terminal' : 'planning';
                     clearPendingBatch(consumed);
                     delete state.awaitingApproval;
-                } else if (row.kind === APPROVAL_CONSUMED) {
+                }
+                else if (row.kind === APPROVAL_CONSUMED) {
                     if (skipLegacyUpgradeTail) {
                         const consumed = payload;
-                        if (typeof consumed.ref?.targetActionId === 'string') suppressedApprovalTargetActionIds.add(consumed.ref.targetActionId);
+                        if (typeof consumed.ref?.targetActionId === 'string')
+                            suppressedApprovalTargetActionIds.add(consumed.ref.targetActionId);
                         continue;
                     }
                     const consumed = payload;
-                    if (!consumed.ref || consumed.approvalDigest !== bookingDigest(consumed.ref) || !consumed.approval?.approval || !consumed.approval.options?.some((option)=>bookingDigest(option) === bookingDigest(consumed.approval.approval)) || !state.awaitingApproval || bookingDigest(consumed.approval) !== bookingDigest(state.awaitingApproval) || consumed.ref.approvalId !== consumed.approval.approval.approvalId || consumed.ref.blockerId !== consumed.approval.blocker.blockerId || consumed.ref.contextRef !== state.contextRef || consumed.ref.sourceTurnId !== consumed.approval.sourceTurnId || consumed.ref.presentationRequestKey !== consumed.approval.presentationRequestKey || consumed.ref.sourceActionId !== consumed.approval.blocker.sourceActionId || consumed.ref.targetActionId === '' || consumed.ref.sourceReceiptDigest !== consumed.approval.blocker.sourceReceiptDigest || consumed.ref.nonce !== consumed.approval.nonce || consumed.ref.nonce !== consumed.approval.approval.deliveryNonce || consumed.ref.to !== consumed.approval.approval.to || consumed.ref.scope !== consumed.approval.blocker.scope || consumed.ref.code !== consumed.approval.blocker.code || consumed.ref.criterionPath !== consumed.approval.blocker.criterionPath || consumed.ref.valueDigest !== consumed.approval.blocker.valueDigest) throw new Error(`ledger_corrupt:${taskId}:approval`);
-                } else if (row.kind === DECISION_BATCH) {
+                    if (!consumed.ref || consumed.approvalDigest !== bookingDigest(consumed.ref) || !consumed.approval?.approval || !consumed.approval.options?.some((option) => bookingDigest(option) === bookingDigest(consumed.approval.approval)) || !state.awaitingApproval || bookingDigest(consumed.approval) !== bookingDigest(state.awaitingApproval) || consumed.ref.approvalId !== consumed.approval.approval.approvalId || consumed.ref.blockerId !== consumed.approval.blocker.blockerId || consumed.ref.contextRef !== state.contextRef || consumed.ref.sourceTurnId !== consumed.approval.sourceTurnId || consumed.ref.presentationRequestKey !== consumed.approval.presentationRequestKey || consumed.ref.sourceActionId !== consumed.approval.blocker.sourceActionId || consumed.ref.targetActionId === '' || consumed.ref.sourceReceiptDigest !== consumed.approval.blocker.sourceReceiptDigest || consumed.ref.nonce !== consumed.approval.nonce || consumed.ref.nonce !== consumed.approval.approval.deliveryNonce || consumed.ref.to !== consumed.approval.approval.to || consumed.ref.scope !== consumed.approval.blocker.scope || consumed.ref.code !== consumed.approval.blocker.code || consumed.ref.criterionPath !== consumed.approval.blocker.criterionPath || consumed.ref.valueDigest !== consumed.approval.blocker.valueDigest)
+                        throw new Error(`ledger_corrupt:${taskId}:approval`);
+                }
+                else if (row.kind === DECISION_BATCH) {
                     const batch = payload;
                     if (skipLegacyUpgradeTail) {
                         try {
                             consumeSkippedEventSequence(state, batch, consumed);
-                        } catch  {
+                        }
+                        catch {
                             throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
                         }
-                        if (typeof batch.requestKey === 'string') suppressedDecisionRequestKeys.add(batch.requestKey);
+                        if (typeof batch.requestKey === 'string')
+                            suppressedDecisionRequestKeys.add(batch.requestKey);
                         continue;
                     }
-                    if (!batch.requestKey || !Array.isArray(batch.events) || batch.events.some((event)=>event.taskId !== taskId)) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                    if (!batch.requestKey || !Array.isArray(batch.events) || batch.events.some((event) => event.taskId !== taskId))
+                        throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
                     let batchEvents;
                     try {
                         batchEvents = normalizeDecisionBatchEnvelopeForReplay(batch, consumed, true);
-                    } catch  {
+                    }
+                    catch {
                         throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
                     }
-                    for (const event of batchEvents){
-                        if (event.kind !== 'question') continue;
+                    for (const event of batchEvents) {
+                        if (event.kind !== 'question')
+                            continue;
                         const awaiting = state.awaitingApproval;
-                        if (!awaiting || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>bookingDigest(option) === bookingDigest(approval)))) throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+                        if (!awaiting || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => bookingDigest(option) === bookingDigest(approval))))
+                            throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+                        // Only the atomic, durable batch makes the presentation nonce
+                        // usable.  APPROVAL_OFFERED alone is intentionally insufficient.
                         awaiting.optionsEmitted = true;
                         state.phase = 'input_required';
                     }
-                } else if (row.kind === EVENT) {
+                }
+                else if (row.kind === EVENT) {
                     const event = payload;
                     if (skipLegacyUpgradeTail) {
                         try {
                             consumeSkippedEventSequence(state, event, consumed);
-                        } catch  {
+                        }
+                        catch {
                             throw new Error(`ledger_corrupt:${taskId}:event`);
                         }
                         continue;
@@ -1143,69 +1152,59 @@ export class BookingCopilotTaskRuntime {
                     {
                         rememberConsumedEventIdentity(consumed, event);
                     }
-                    if (event.eventKind === 'status') state.phase = event.status === 'submitted' ? 'submitted' : event.status === 'working' ? 'working' : event.status === 'waiting_receipt' ? 'waiting_receipt' : 'input_required';
-                    else if (event.eventKind === 'question') state.phase = 'input_required';
-                    else if (event.eventKind === 'terminal') state.phase = 'terminal';
-                    else if (event.eventKind === 'error') state.phase = 'error';
+                    if (event.eventKind === 'status')
+                        state.phase = event.status === 'submitted' ? 'submitted' : event.status === 'working' ? 'working' : event.status === 'waiting_receipt' ? 'waiting_receipt' : 'input_required';
+                    else if (event.eventKind === 'question')
+                        state.phase = 'input_required';
+                    else if (event.eventKind === 'terminal')
+                        state.phase = 'terminal';
+                    else if (event.eventKind === 'error')
+                        state.phase = 'error';
                 }
             }
         }
         if (state) {
-            if (suppressedDecisionRequestKeys.size) state.legacySuppressedDecisionRequestKeys = [
-                ...suppressedDecisionRequestKeys
-            ];
-            if (suppressedRequestBindingKeys.size) state.legacySuppressedRequestBindingKeys = [
-                ...suppressedRequestBindingKeys
-            ];
-            if (suppressedReceiptActionIds.size) state.legacySuppressedReceiptActionIds = [
-                ...suppressedReceiptActionIds
-            ];
-            if (suppressedApprovalTargetActionIds.size) state.legacySuppressedApprovalTargetActionIds = [
-                ...suppressedApprovalTargetActionIds
-            ];
+            if (suppressedDecisionRequestKeys.size)
+                state.legacySuppressedDecisionRequestKeys = [...suppressedDecisionRequestKeys];
+            if (suppressedRequestBindingKeys.size)
+                state.legacySuppressedRequestBindingKeys = [...suppressedRequestBindingKeys];
+            if (suppressedReceiptActionIds.size)
+                state.legacySuppressedReceiptActionIds = [...suppressedReceiptActionIds];
+            if (suppressedApprovalTargetActionIds.size)
+                state.legacySuppressedApprovalTargetActionIds = [...suppressedApprovalTargetActionIds];
         }
         return state;
     }
     withReceiptDigest(receipt) {
+        // The source receipt digest is the authority used by the approval binding.
         const sourceDigest = receiptSourceDigest(receipt);
-        return {
-            ...receipt,
-            resultContract: {
-                ...receipt.resultContract,
-                blockers: receipt.resultContract.blockers.map((b)=>({
-                        ...b,
-                        sourceReceiptDigest: sourceDigest
-                    }))
-            }
-        };
-    }
-    receiptDigest(receipt) {
-        return canonicalReceiptDigest(receipt);
+        return { ...receipt, resultContract: { ...receipt.resultContract, blockers: receipt.resultContract.blockers.map((b) => ({ ...b, sourceReceiptDigest: sourceDigest })) } };
     }
+    receiptDigest(receipt) { return canonicalReceiptDigest(receipt); }
+    /** Builds the only relaxation question exposed to the planner stream. The
+     * blocker is ledger-derived; a planner cannot invent its tuple or ref. */
     approvalQuestion(taskId) {
         const task = this.requireTask(taskId);
         const awaiting = task.awaitingApproval;
-        if (!awaiting) throw new Error('approval_not_awaiting');
+        if (!awaiting)
+            throw new Error('approval_not_awaiting');
         return {
             kind: 'question',
             question: {
                 questionId: `question-${awaiting.blocker.blockerId}`,
                 prompt: `Relax required criterion ${awaiting.blocker.criterionPath}?`,
-                missingFields: [
-                    awaiting.blocker.criterionPath
-                ],
+                missingFields: [awaiting.blocker.criterionPath],
                 type: 'relaxation_approval_required',
                 blocker: awaiting.blocker,
-                approvalOptions: awaiting.options.map((approval)=>({
-                        approval
-                    }))
-            }
+                approvalOptions: awaiting.options.map((approval) => ({ approval })),
+            },
         };
     }
     approvalPresentationRequestKey(taskId) {
         const task = this.requireTask(taskId);
         const awaiting = task.awaitingApproval;
-        if (!awaiting) throw new Error('approval_not_awaiting');
+        if (!awaiting)
+            throw new Error('approval_not_awaiting');
         return awaiting.presentationRequestKey;
     }
     commitDecisionBatch(taskId, requestKey, decisions) {
@@ -1213,292 +1212,258 @@ export class BookingCopilotTaskRuntime {
     }
     readDecisionBatch(taskId, requestKey) {
         const state = this.requireTask(taskId);
-        if (state.legacySuppressedDecisionRequestKeys?.includes(requestKey)) throw new Error('request_key_invalidated');
+        if (state.legacySuppressedDecisionRequestKeys?.includes(requestKey))
+            throw new Error('request_key_invalidated');
         const rows = this.ledger.db.prepare('SELECT seq, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC').all(this.ledger.tenant, taskId, DECISION_BATCH);
-        for (const row of rows){
+        for (const row of rows) {
             const payload = JSON.parse(row.payload);
-            if (payload.requestKey !== requestKey) continue;
-            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId || payload.contextRef !== state.contextRef || !Array.isArray(payload.events) || payload.events.some((event)=>event.taskId !== taskId || event.contextRef !== state.contextRef)) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            if (payload.requestKey !== requestKey)
+                continue;
+            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId || payload.contextRef !== state.contextRef || !Array.isArray(payload.events) || payload.events.some((event) => event.taskId !== taskId || event.contextRef !== state.contextRef))
+                throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
             const events = this.normalizeDecisionBatchFromDurableRows(taskId, payload.events, row.seq);
-            if (!events) throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
-            for (const event of events){
-                if (event.kind !== 'question') continue;
+            if (!events)
+                throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            for (const event of events) {
+                if (event.kind !== 'question')
+                    continue;
                 const awaiting = state.awaitingApproval;
-                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval)))) throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval))))
+                    throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
             }
             return events;
         }
         return null;
     }
+    /** Materializes the durable policy/budget terminal response once, before SSE. */
     terminalDecisionBatch(taskId, requestKey) {
         assertInternalDecisionKey(requestKey);
         const prior = this.readDecisionBatch(taskId, requestKey);
-        if (prior) return prior;
+        if (prior)
+            return prior;
         const state = this.requireTask(taskId);
-        if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+        if (state.phase === 'terminal' || state.phase === 'error')
+            throw new Error('task_terminal');
         assertReplayUpgradeReanchored(state);
-        const run = this.ledger.db.transaction(()=>{
+        const run = this.ledger.db.transaction(() => {
             const state = this.requireTask(taskId);
-            if (!taskHasTerminalBudget(state) || state.phase !== 'terminal') throw new Error('task_not_terminal');
+            if (!taskHasTerminalBudget(state) || state.phase !== 'terminal')
+                throw new Error('task_not_terminal');
             assertReplayUpgradeReanchored(state);
             const event = this.terminalEvent(state);
             this.appendTerminalEvent(taskId, event);
-            this.append(DECISION_BATCH, taskId, {
-                schema: LEDGER_SCHEMA,
-                taskId,
-                contextRef: state.contextRef,
-                requestKey,
-                events: [
-                    event
-                ]
-            }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
-            return [
-                event
-            ];
+            this.append(DECISION_BATCH, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, requestKey, events: [event] }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            return [event];
         });
         return run.immediate();
     }
+    /** Atomically applies planner decisions and records the exact SSE batch before it is sent. */
     applyDecisionBatch(taskId, requestKey, decisions, includeSubmitted = false) {
         assertInternalDecisionKey(requestKey);
         const prior = this.readDecisionBatch(taskId, requestKey);
-        if (prior) return prior;
+        if (prior)
+            return prior;
         const current = this.requireTask(taskId);
-        if (current.phase === 'terminal' || current.phase === 'error') throw new Error('task_terminal');
+        if (current.phase === 'terminal' || current.phase === 'error')
+            throw new Error('task_terminal');
         assertReplayUpgradeReanchored(current);
         assertDecisionBatchFinality(decisions);
         assertAvailabilityLiveness(current, decisions);
-        if (current.availability.recoveryStarted && !current.availability.terminal && decisions.some((decision)=>decision.kind === 'terminal' || decision.kind === 'error')) throw new Error('availability_terminal_policy_owned');
-        for (const decision of decisions){
+        if (current.availability.recoveryStarted && !current.availability.terminal && decisions.some((decision) => decision.kind === 'terminal' || decision.kind === 'error'))
+            throw new Error('availability_terminal_policy_owned');
+        for (const decision of decisions) {
             if (decision.kind === 'operation') {
                 const checked = validateBookingReadAction(decision.action);
-                if (!checked.ok) throw new Error(`invalid_action:${errorText(checked)}`);
+                if (!checked.ok)
+                    throw new Error(`invalid_action:${errorText(checked)}`);
             }
         }
-        const run = this.ledger.db.transaction(()=>{
+        const run = this.ledger.db.transaction(() => {
             const events = [];
             const before = this.requireTask(taskId);
             assertReplayUpgradeReanchored(before);
             assertAvailabilityLiveness(before, decisions);
-            if (before.availability.recoveryStarted && !before.availability.terminal && decisions.some((decision)=>decision.kind === 'terminal' || decision.kind === 'error')) throw new Error('availability_terminal_policy_owned');
-            for (const decision of decisions){
-                if (decision.kind !== 'question') continue;
+            if (before.availability.recoveryStarted && !before.availability.terminal && decisions.some((decision) => decision.kind === 'terminal' || decision.kind === 'error'))
+                throw new Error('availability_terminal_policy_owned');
+            for (const decision of decisions) {
+                if (decision.kind !== 'question')
+                    continue;
                 const awaiting = before.awaitingApproval;
-                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(decision.question.blocker) !== bookingDigest(awaiting.blocker) || decision.question.approvalOptions.length !== awaiting.options.length || decision.question.approvalOptions.some(({ approval })=>!awaiting.options.some((option)=>option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval)))) throw new Error('approval_presentation_key_mismatch');
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(decision.question.blocker) !== bookingDigest(awaiting.blocker) || decision.question.approvalOptions.length !== awaiting.options.length || decision.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval))))
+                    throw new Error('approval_presentation_key_mismatch');
                 this.ensureApprovalOffered(taskId, before.contextRef, awaiting, requestKey);
             }
-            if (includeSubmitted) events.push(this.emitEventInTransaction(taskId, {
-                kind: 'status',
-                status: 'submitted'
-            }));
-            events.push(this.emitEventInTransaction(taskId, {
-                kind: 'status',
-                status: 'working'
-            }));
-            for (const decision of decisions){
+            if (includeSubmitted)
+                events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'submitted' }));
+            events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'working' }));
+            for (const decision of decisions) {
                 if (decision.kind === 'operation') {
                     events.push(this.issueOperationInTransaction(taskId, decision.action));
-                    events.push(this.emitEventInTransaction(taskId, {
-                        kind: 'status',
-                        status: 'waiting_receipt'
-                    }));
-                } else events.push(this.emitEventInTransaction(taskId, decision));
+                    events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'waiting_receipt' }));
+                }
+                else
+                    events.push(this.emitEventInTransaction(taskId, decision));
             }
             const state = this.requireTask(taskId);
-            this.append(DECISION_BATCH, taskId, {
-                schema: LEDGER_SCHEMA,
-                taskId,
-                contextRef: state.contextRef,
-                requestKey,
-                events
-            }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            this.append(DECISION_BATCH, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, requestKey, events }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
             return events;
         });
         return run.immediate();
     }
     issueOperation(taskId, candidate) {
         const validation = validateBookingReadAction(candidate);
-        if (!validation.ok) throw new Error(`invalid_action:${errorText(validation)}`);
+        if (!validation.ok)
+            throw new Error(`invalid_action:${errorText(validation)}`);
         assertTaskId(taskId);
         assertSafeRef(candidate.actionId);
         candidate.factRefs.forEach(assertSafeRef);
-        return this.ledger.db.transaction(()=>this.issueOperationInTransaction(taskId, candidate)).immediate();
+        return this.ledger.db.transaction(() => this.issueOperationInTransaction(taskId, candidate)).immediate();
     }
     issueOperationInTransaction(taskId, candidate) {
         assertSafeRef(candidate.actionId);
         candidate.factRefs.forEach(assertSafeRef);
         const state = this.requireTask(taskId);
-        if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+        if (state.phase === 'terminal' || state.phase === 'error')
+            throw new Error('task_terminal');
         assertReplayUpgradeReanchored(state);
         if (state.pendingAction) {
-            if (state.pendingAction.actionId !== candidate.actionId) throw new Error('receipt_required');
-            if (!matchesCheckpoint(candidate, state.pendingAction)) throw new Error('action_conflict');
+            if (state.pendingAction.actionId !== candidate.actionId)
+                throw new Error('receipt_required');
+            if (!matchesCheckpoint(candidate, state.pendingAction))
+                throw new Error('action_conflict');
             return this.operationEvent(taskId, state.pendingAction, candidate);
         }
-        if (candidate.contextRef !== state.contextRef) throw new Error('context_mismatch');
-        if (!state.allowedActions.includes(candidate.kind)) throw new Error('unsupported_action');
-        if (candidate.expectedRevision !== state.revision) throw new Error('stale_revision');
-        if (state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS) throw new Error('operation_limit_reached');
-        if (candidate.relaxationApprovalRef) throw new Error('approval_ref_planner_owned_forbidden');
-        if (!state.workspaceSnapshot) throw new Error(`ledger_corrupt:${taskId}:workspace_missing`);
-        if (!actionHitsCurrentOfferVersion(state.workspaceSnapshot, candidate, this.now())) throw new Error('offer_version_not_loaded');
+        if (candidate.contextRef !== state.contextRef)
+            throw new Error('context_mismatch');
+        if (!state.allowedActions.includes(candidate.kind))
+            throw new Error('unsupported_action');
+        if (candidate.expectedRevision !== state.revision)
+            throw new Error('stale_revision');
+        if (state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS)
+            throw new Error('operation_limit_reached');
+        if (candidate.relaxationApprovalRef)
+            throw new Error('approval_ref_planner_owned_forbidden');
+        if (!state.workspaceSnapshot)
+            throw new Error(`ledger_corrupt:${taskId}:workspace_missing`);
+        if (!actionHitsCurrentOfferVersion(state.workspaceSnapshot, candidate, this.now()))
+            throw new Error('offer_version_not_loaded');
         let action = candidate;
         const availability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, candidate);
         if (state.awaitingApproval) {
             const approval = state.awaitingApproval;
-            if (!approval.approval || Date.parse(approval.expiresAt) <= Date.parse(this.now())) throw new Error('approval_expired');
+            if (!approval.approval || Date.parse(approval.expiresAt) <= Date.parse(this.now()))
+                throw new Error('approval_expired');
             const ref = {
-                approvalId: approval.approval.approvalId,
-                blockerId: approval.blocker.blockerId,
-                contextRef: state.contextRef,
-                sourceTurnId: approval.sourceTurnId,
-                presentationRequestKey: approval.presentationRequestKey,
-                sourceActionId: approval.blocker.sourceActionId,
-                targetActionId: candidate.actionId,
-                sourceRevision: candidate.expectedRevision,
-                targetActionKind: candidate.kind,
-                to: approval.approval.to,
-                expiresAt: approval.expiresAt,
-                nonce: approval.nonce,
-                sourceReceiptDigest: approval.blocker.sourceReceiptDigest,
-                scope: approval.blocker.scope,
-                code: approval.blocker.code,
-                criterionPath: approval.blocker.criterionPath,
-                valueDigest: approval.blocker.valueDigest
+                approvalId: approval.approval.approvalId, blockerId: approval.blocker.blockerId,
+                contextRef: state.contextRef, sourceTurnId: approval.sourceTurnId,
+                presentationRequestKey: approval.presentationRequestKey, sourceActionId: approval.blocker.sourceActionId,
+                targetActionId: candidate.actionId, sourceRevision: candidate.expectedRevision,
+                targetActionKind: candidate.kind, to: approval.approval.to, expiresAt: approval.expiresAt,
+                nonce: approval.nonce, sourceReceiptDigest: approval.blocker.sourceReceiptDigest,
+                scope: approval.blocker.scope, code: approval.blocker.code, criterionPath: approval.blocker.criterionPath,
+                valueDigest: approval.blocker.valueDigest,
             };
-            action = {
-                ...candidate,
-                relaxationApprovalRef: ref
-            };
-            this.append(APPROVAL_CONSUMED, taskId, {
-                schema: LEDGER_SCHEMA,
-                taskId,
-                contextRef: state.contextRef,
-                approval,
-                ref,
-                approvalDigest: bookingDigest(ref)
-            }, `booking-copilot:approval-consumed:${taskId}:${approval.approval.approvalId}:${approval.nonce}`);
+            action = { ...candidate, relaxationApprovalRef: ref };
+            this.append(APPROVAL_CONSUMED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, approval, ref, approvalDigest: bookingDigest(ref) }, `booking-copilot:approval-consumed:${taskId}:${approval.approval.approvalId}:${approval.nonce}`);
         }
         const eventId = this.idFactory('event');
         const emittedAt = this.now();
         const sequence = state.lastSequence + 1;
-        const event = {
-            schemaVersion: 'booking.surface',
-            eventId,
-            taskId,
-            contextRef: state.contextRef,
-            sequence,
-            emittedAt,
-            kind: 'operation',
-            action
-        };
+        const event = { schemaVersion: 'booking.surface', eventId, taskId, contextRef: state.contextRef, sequence, emittedAt, kind: 'operation', action };
         const eventValidation = validateBookingSurfaceEvent(event);
-        if (!eventValidation.ok) throw new Error(`invalid_operation_event:${errorText(eventValidation)}`);
-        if (!state.lastTurnId) throw new Error(`ledger_corrupt:${taskId}:turn_id`);
+        if (!eventValidation.ok)
+            throw new Error(`invalid_operation_event:${errorText(eventValidation)}`);
+        if (!state.lastTurnId)
+            throw new Error(`ledger_corrupt:${taskId}:turn_id`);
         this.appendAction(taskId, state.contextRef, checkpointFor(action, eventId, sequence, emittedAt, state.lastTurnId), state.operationCount + 1, availability);
         return event;
     }
     continueWithReceipt(turn) {
         const validation = validateBookingSurface(turn);
-        if (!validation.ok) throw new Error(`invalid_receipt_continuation:${errorText(validation)}`);
+        if (!validation.ok)
+            throw new Error(`invalid_receipt_continuation:${errorText(validation)}`);
         assertWorkspaceLoadedOfferRefsUnique(turn.workspace);
         assertCanonicalReceipt(turn.receipt);
-        const run = this.ledger.db.transaction(()=>{
+        const run = this.ledger.db.transaction(() => {
             const state = this.requireTask(turn.taskId);
             assertReplayUpgradeReanchored(state);
-            if (turn.workspace.contextRef !== state.contextRef || turn.receipt.contextRef !== state.contextRef) throw new Error('context_mismatch');
+            if (turn.workspace.contextRef !== state.contextRef || turn.receipt.contextRef !== state.contextRef)
+                throw new Error('context_mismatch');
             const receiptWorkspace = bookingWorkspaceDigest(turn.workspace);
             const receiptWorkspaceSemantic = bookingWorkspaceSemanticDigest(turn.workspace);
-            if (!state.workspaceSnapshot || !workspaceBoundaryMatches(state.workspaceSnapshot, turn.workspace)) throw new Error('workspace_mismatch');
+            if (!state.workspaceSnapshot || !workspaceBoundaryMatches(state.workspaceSnapshot, turn.workspace))
+                throw new Error('workspace_mismatch');
             const existing = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq`).all(this.ledger.tenant, turn.taskId, RECEIPT);
             const receiptDigest = canonicalReceiptDigest(turn.receipt);
-            if (state.legacySuppressedReceiptActionIds?.includes(turn.receipt.actionId)) throw new Error('request_key_invalidated');
-            for (const row of existing){
+            if (state.legacySuppressedReceiptActionIds?.includes(turn.receipt.actionId))
+                throw new Error('request_key_invalidated');
+            for (const row of existing) {
                 const prior = JSON.parse(row.payload);
-                if (prior.receipt.actionId !== turn.receipt.actionId) continue;
-                if (prior.receiptDigest !== receiptDigest) throw new Error('receipt_conflict');
-                if (prior.workspaceDigest !== receiptWorkspace) throw new Error('workspace_mismatch');
+                if (prior.receipt.actionId !== turn.receipt.actionId)
+                    continue;
+                if (prior.receiptDigest !== receiptDigest)
+                    throw new Error('receipt_conflict');
+                if (prior.workspaceDigest !== receiptWorkspace)
+                    throw new Error('workspace_mismatch');
                 return state;
             }
-            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
-            if (!state.pendingAction) throw new Error('unexpected_receipt');
-            if (state.pendingAction.actionId !== turn.receipt.actionId) throw new Error('receipt_action_mismatch');
-            if (turn.receipt.revision < state.pendingAction.expectedRevision) throw new Error('revision_regression');
-            if (turn.receipt.resultContract.blockers.some((blocker)=>blocker.sourceActionId !== state.pendingAction.actionId)) throw new Error('receipt_source_action_mismatch');
-            if (!workspacePostActionMatches(state.workspaceSnapshot, turn.workspace, state.pendingAction, turn.receipt)) throw new Error('workspace_mismatch');
-            if (!receiptObservationMatchesAction(turn.receipt.observation.kind, state.pendingAction.kind)) throw new Error('receipt_observation_action_mismatch');
-            if (!receiptTargetMatchesAction(turn.receipt, state.pendingAction)) throw new Error('receipt_target_mismatch');
-            if (state.pendingAction.kind === 'offer.check' && turn.receipt.status === 'applied' && !verifiedOfferUnexpired(turn.workspace, this.now())) throw new Error('receipt_verified_offer_expired');
-            if (state.pendingAction.kind === 'offers.query' && turn.receipt.observation.kind === 'offers.state') validateOffersReceiptWorkspace(turn.receipt, turn.workspace, state.pendingAction.input.hotelRefs);
-            if (turn.receipt.resultContract.relaxationsApplied.some((approval)=>!this.approvalWasConsumed(turn.taskId, approval, state.pendingAction.actionId))) throw new Error('receipt_relaxation_unauthorized');
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
+            if (!state.pendingAction)
+                throw new Error('unexpected_receipt');
+            if (state.pendingAction.actionId !== turn.receipt.actionId)
+                throw new Error('receipt_action_mismatch');
+            if (turn.receipt.revision < state.pendingAction.expectedRevision)
+                throw new Error('revision_regression');
+            if (turn.receipt.resultContract.blockers.some((blocker) => blocker.sourceActionId !== state.pendingAction.actionId))
+                throw new Error('receipt_source_action_mismatch');
+            if (!workspacePostActionMatches(state.workspaceSnapshot, turn.workspace, state.pendingAction, turn.receipt))
+                throw new Error('workspace_mismatch');
+            if (!receiptObservationMatchesAction(turn.receipt.observation.kind, state.pendingAction.kind))
+                throw new Error('receipt_observation_action_mismatch');
+            if (!receiptTargetMatchesAction(turn.receipt, state.pendingAction))
+                throw new Error('receipt_target_mismatch');
+            if (state.pendingAction.kind === 'offer.check' && turn.receipt.status === 'applied' && !verifiedOfferUnexpired(turn.workspace, this.now()))
+                throw new Error('receipt_verified_offer_expired');
+            // Failed/stale query receipts may carry a typed gap observation; only an
+            // offers.state observation can claim passive offer provenance.
+            if (state.pendingAction.kind === 'offers.query' && turn.receipt.observation.kind === 'offers.state')
+                validateOffersReceiptWorkspace(turn.receipt, turn.workspace, state.pendingAction.input.hotelRefs);
+            if (turn.receipt.resultContract.relaxationsApplied.some((approval) => !this.approvalWasConsumed(turn.taskId, approval, state.pendingAction.actionId)))
+                throw new Error('receipt_relaxation_unauthorized');
             const pending = state.pendingAction;
-            if (turn.receipt.revision !== turn.workspace.revision) throw new Error('revision_mismatch');
+            if (turn.receipt.revision !== turn.workspace.revision)
+                throw new Error('revision_mismatch');
             const availability = reduceAvailabilityReceipt(state.availability, turn.workspace, turn.receipt, pending);
             const availabilityTerminal = availabilityPolicyTerminal(availability);
-            this.append(RECEIPT, turn.taskId, {
-                schema: LEDGER_SCHEMA,
-                taskId: turn.taskId,
-                contextRef: state.contextRef,
-                receipt: turn.receipt,
-                receiptDigest,
-                operationCount: state.operationCount,
-                workspaceDigest: receiptWorkspace,
-                workspaceSemanticDigest: receiptWorkspaceSemantic,
-                workspace: turn.workspace,
-                availability,
-                availabilityDigest: bookingDigest(availability),
-                ...availabilityTerminal ? {
-                    availabilityTerminal
-                } : {}
-            }, `booking-copilot:receipt:${turn.taskId}:${turn.receipt.actionId}`);
+            this.append(RECEIPT, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, receipt: turn.receipt, receiptDigest, operationCount: state.operationCount, workspaceDigest: receiptWorkspace, workspaceSemanticDigest: receiptWorkspaceSemantic, workspace: turn.workspace, availability, availabilityDigest: bookingDigest(availability), ...(availabilityTerminal ? { availabilityTerminal } : {}) }, `booking-copilot:receipt:${turn.taskId}:${turn.receipt.actionId}`);
             if (availabilityTerminal || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS) {
                 const terminalState = this.requireTask(turn.taskId);
                 const terminalEvent = this.terminalEvent(terminalState);
                 this.appendTerminalEvent(turn.taskId, terminalEvent);
-                this.append(DECISION_BATCH, turn.taskId, {
-                    schema: LEDGER_SCHEMA,
-                    taskId: turn.taskId,
-                    contextRef: state.contextRef,
-                    requestKey: `receipt:${turn.receipt.actionId}:${receiptDigest}`,
-                    events: [
-                        terminalEvent
-                    ]
-                }, `booking-copilot:decision-batch:${turn.taskId}:receipt:${turn.receipt.actionId}:${receiptDigest}`);
+                this.append(DECISION_BATCH, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, requestKey: `receipt:${turn.receipt.actionId}:${receiptDigest}`, events: [terminalEvent] }, `booking-copilot:decision-batch:${turn.taskId}:receipt:${turn.receipt.actionId}:${receiptDigest}`);
                 return terminalState;
             }
             const blocker = turn.receipt.resultContract.blockers[0];
             if (blocker) {
+                // Never derive this claim from the injectable id factory: production
+                // and crash proofs must not make a presentation nonce guessable from
+                // deterministic task/event ids.
                 const nonce = randomUUID();
                 const sourceTurnId = state.pendingAction?.sourceTurnId ?? state.lastTurnId ?? `ordinal:${state.userTurnCount}`;
                 const requestKey = presentationKey(turn.taskId, sourceTurnId, turn.receipt.actionId, receiptDigest);
-                const approval = {
-                    blocker,
-                    options: [
-                        approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'prefer', nonce),
-                        approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'drop', nonce)
-                    ],
-                    optionsEmitted: false,
-                    approval: undefined,
-                    nonce,
-                    expiresAt: new Date(Date.parse(this.now()) + this.approvalTtlMs).toISOString(),
-                    sourceTurnId,
-                    presentationRequestKey: requestKey
-                };
-                this.append(APPROVAL_GRANTED, turn.taskId, {
-                    schema: LEDGER_SCHEMA,
-                    taskId: turn.taskId,
-                    contextRef: state.contextRef,
-                    approval,
-                    approvalDigest: bookingDigest(approval)
-                }, `booking-copilot:approval-awaiting:${turn.taskId}:${turn.receipt.actionId}`);
+                const approval = { blocker, options: [approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'prefer', nonce), approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'drop', nonce)], optionsEmitted: false, approval: undefined, nonce, expiresAt: new Date(Date.parse(this.now()) + this.approvalTtlMs).toISOString(), sourceTurnId, presentationRequestKey: requestKey };
+                this.append(APPROVAL_GRANTED, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, approval, approvalDigest: bookingDigest(approval) }, `booking-copilot:approval-awaiting:${turn.taskId}:${turn.receipt.actionId}`);
             }
             return this.requireTask(turn.taskId);
         });
         return run.immediate();
     }
     emitEvent(taskId, draft) {
-        return this.ledger.db.transaction(()=>{
+        return this.ledger.db.transaction(() => {
             const state = this.requireTask(taskId);
-            if (state.phase === 'terminal' || state.phase === 'error') throw new Error('task_terminal');
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
             assertReplayUpgradeReanchored(state);
             return this.emitEventInTransaction(taskId, draft);
         }).immediate();
@@ -1506,89 +1471,40 @@ export class BookingCopilotTaskRuntime {
     emitEventInTransaction(taskId, draft) {
         const state = this.requireTask(taskId);
         assertReplayUpgradeReanchored(state);
-        const safeDraft = draft.kind === 'error' ? {
-            ...draft,
-            error: {
-                ...draft.error,
-                code: normalizeBookingErrorCode(draft.error.code),
-                message: safeBookingErrorMessage(normalizeBookingErrorCode(draft.error.code))
-            }
-        } : draft;
-        const event = {
-            schemaVersion: 'booking.surface',
-            eventId: this.idFactory('event'),
-            taskId,
-            contextRef: state.contextRef,
-            sequence: state.lastSequence + 1,
-            emittedAt: this.now(),
-            ...safeDraft
-        };
+        const safeDraft = draft.kind === 'error'
+            ? { ...draft, error: { ...draft.error, code: normalizeBookingErrorCode(draft.error.code), message: safeBookingErrorMessage(normalizeBookingErrorCode(draft.error.code)) } }
+            : draft;
+        const event = { schemaVersion: 'booking.surface', eventId: this.idFactory('event'), taskId, contextRef: state.contextRef, sequence: state.lastSequence + 1, emittedAt: this.now(), ...safeDraft };
         const checked = validateBookingSurfaceEvent(event);
-        if (!checked.ok) throw new Error(`invalid_event:${errorText(checked)}`);
-        this.append(EVENT, taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef: state.contextRef,
-            eventId: event.eventId,
-            sequence: event.sequence,
-            emittedAt: event.emittedAt,
-            eventKind: event.kind,
-            ...event.kind === 'status' ? {
-                status: event.status
-            } : {},
-            contentDigest: bookingDigest(safeDraft)
-        }, `booking-copilot:event:${taskId}:${event.eventId}`);
+        if (!checked.ok)
+            throw new Error(`invalid_event:${errorText(checked)}`);
+        this.append(EVENT, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, eventId: event.eventId, sequence: event.sequence, emittedAt: event.emittedAt, eventKind: event.kind, ...(event.kind === 'status' ? { status: event.status } : {}), contentDigest: bookingDigest(safeDraft) }, `booking-copilot:event:${taskId}:${event.eventId}`);
         return event;
     }
     operationEvent(taskId, checkpoint, action) {
-        const replayAction = action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : {
-            ...action,
-            relaxationApprovalRef: checkpoint.relaxationApprovalRef
-        };
-        return {
-            schemaVersion: 'booking.surface',
-            eventId: checkpoint.eventId,
-            taskId,
-            contextRef: checkpoint.contextRef,
-            sequence: checkpoint.sequence,
-            emittedAt: checkpoint.emittedAt,
-            kind: 'operation',
-            action: replayAction
-        };
+        const replayAction = action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : { ...action, relaxationApprovalRef: checkpoint.relaxationApprovalRef };
+        return { schemaVersion: 'booking.surface', eventId: checkpoint.eventId, taskId, contextRef: checkpoint.contextRef, sequence: checkpoint.sequence, emittedAt: checkpoint.emittedAt, kind: 'operation', action: replayAction };
     }
     terminalEvent(state) {
-        if (!taskHasTerminalBudget(state)) throw new Error('task_not_terminal');
+        if (!taskHasTerminalBudget(state))
+            throw new Error('task_not_terminal');
         const terminalCode = state.availability.terminal?.code ?? 'operation_limit_reached';
-        const event = {
-            schemaVersion: 'booking.surface',
-            eventId: `terminal-${state.taskId}-${state.operationCount}`,
-            taskId: state.taskId,
-            contextRef: state.contextRef,
-            sequence: state.lastSequence + 1,
-            emittedAt: this.now(),
-            kind: 'terminal',
-            terminal: {
-                status: state.availability.terminal?.code === 'availability_confirmed' ? 'completed' : 'stopped',
-                summary: terminalCode,
-                factRefs: []
-            }
-        };
+        const event = { schemaVersion: 'booking.surface', eventId: `terminal-${state.taskId}-${state.operationCount}`, taskId: state.taskId, contextRef: state.contextRef, sequence: state.lastSequence + 1, emittedAt: this.now(), kind: 'terminal', terminal: { status: state.availability.terminal?.code === 'availability_confirmed' ? 'completed' : 'stopped', summary: terminalCode, factRefs: [] } };
         const checked = validateBookingSurfaceEvent(event);
-        if (!checked.ok) throw new Error(`invalid_terminal_event:${errorText(checked)}`);
+        if (!checked.ok)
+            throw new Error(`invalid_terminal_event:${errorText(checked)}`);
         return event;
     }
-    requireTask(taskId) {
-        const state = this.resumeTask(taskId);
-        if (!state) throw new Error('task_not_found');
-        return state;
-    }
+    requireTask(taskId) { const state = this.resumeTask(taskId); if (!state)
+        throw new Error('task_not_found'); return state; }
     requestBinding(requestKey) {
         const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, REQUEST_BINDING);
-        for (const row of rows){
+        for (const row of rows) {
             const binding = JSON.parse(row.payload);
             if (binding.requestKey === requestKey) {
                 const state = this.resumeTask(binding.taskId);
-                if (state?.legacySuppressedRequestBindingKeys?.includes(requestKey)) throw new Error('request_key_invalidated');
+                if (state?.legacySuppressedRequestBindingKeys?.includes(requestKey))
+                    throw new Error('request_key_invalidated');
                 return binding;
             }
         }
@@ -1597,7 +1513,8 @@ export class BookingCopilotTaskRuntime {
     requestBindingPayload(requestKey, turn, input) {
         assertPrincipal(input.principal);
         assertRequestKey(requestKey);
-        if (input.taskHandle) assertSafeRef(input.taskHandle);
+        if (input.taskHandle)
+            assertSafeRef(input.taskHandle);
         return {
             requestKey,
             requestDigest: bookingTurnDigest(turn),
@@ -1606,15 +1523,9 @@ export class BookingCopilotTaskRuntime {
             workspaceSemanticDigest: bookingWorkspaceSemanticDigest(turn.workspace),
             surface: turn.workspace.surface,
             capabilityDigest: bookingDigest(turn.workspace.capabilities),
-            principalDigest: bookingDigest({
-                subject: input.principal.subject
-            }),
-            scopeDigest: bookingDigest({
-                scope: input.principal.scope
-            }),
-            ...input.taskHandle ? {
-                taskHandle: input.taskHandle
-            } : {}
+            principalDigest: bookingDigest({ subject: input.principal.subject }),
+            scopeDigest: bookingDigest({ scope: input.principal.scope }),
+            ...(input.taskHandle ? { taskHandle: input.taskHandle } : {}),
         };
     }
     appendRequestBindingInTransaction(requestKey, turn, input) {
@@ -1623,164 +1534,127 @@ export class BookingCopilotTaskRuntime {
         const payload = this.requestBindingPayload(requestKey, turn, input);
         if (input.taskHandle) {
             const prior = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ?`).all(this.ledger.tenant, REQUEST_BINDING);
-            for (const row of prior){
+            for (const row of prior) {
                 const binding = JSON.parse(row.payload);
-                if (binding.taskHandle !== input.taskHandle) continue;
-                if (binding.principalDigest !== payload.principalDigest || binding.scopeDigest !== payload.scopeDigest) throw new Error('principal_conflict');
-                if (binding.taskId !== turn.taskId || binding.contextRef !== turn.workspace.contextRef) throw new Error('task_handle_conflict');
+                if (binding.taskHandle !== input.taskHandle)
+                    continue;
+                if (binding.principalDigest !== payload.principalDigest || binding.scopeDigest !== payload.scopeDigest)
+                    throw new Error('principal_conflict');
+                if (binding.taskId !== turn.taskId || binding.contextRef !== turn.workspace.contextRef)
+                    throw new Error('task_handle_conflict');
             }
         }
         const existing = this.requestBinding(requestKey);
         if (existing) {
-            if (existing.taskId !== turn.taskId || existing.contextRef !== turn.workspace.contextRef || existing.requestDigest !== payload.requestDigest || existing.turnId !== payload.turnId || existing.workspaceDigest !== payload.workspaceDigest || existing.workspaceSemanticDigest !== payload.workspaceSemanticDigest || existing.surface !== payload.surface || existing.capabilityDigest !== payload.capabilityDigest || existing.principalDigest !== payload.principalDigest || existing.scopeDigest !== payload.scopeDigest || existing.taskHandle !== payload.taskHandle) throw new Error('request_conflict');
+            if (existing.taskId !== turn.taskId || existing.contextRef !== turn.workspace.contextRef || existing.requestDigest !== payload.requestDigest || existing.turnId !== payload.turnId || existing.workspaceDigest !== payload.workspaceDigest || existing.workspaceSemanticDigest !== payload.workspaceSemanticDigest || existing.surface !== payload.surface || existing.capabilityDigest !== payload.capabilityDigest || existing.principalDigest !== payload.principalDigest || existing.scopeDigest !== payload.scopeDigest || existing.taskHandle !== payload.taskHandle)
+                throw new Error('request_conflict');
             return;
         }
-        this.append(REQUEST_BINDING, turn.taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId: turn.taskId,
-            contextRef: turn.workspace.contextRef,
-            ...payload
-        }, `booking-copilot:request-binding:${requestKey}`);
+        this.append(REQUEST_BINDING, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: turn.workspace.contextRef, ...payload }, `booking-copilot:request-binding:${requestKey}`);
     }
     normalizeDecisionBatchFromDurableRows(taskId, batchEvents, batchSeq) {
         const individualRows = this.ledger.db.prepare(`SELECT kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND seq < ? AND kind IN (?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, batchSeq, EVENT, ACTION);
         const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? AND seq < ?`).all(this.ledger.tenant, taskId, TURN, batchSeq);
         const sourceWorkspaces = new Map();
-        for (const row of turnRows){
+        for (const row of turnRows) {
             try {
                 const turn = JSON.parse(row.payload);
                 sourceWorkspaces.set(turn.turnId, normalizeWorkspaceForReplay(turn.workspace));
-            } catch  {
+            }
+            catch {
                 return null;
             }
         }
         const recordedEvents = new Map();
         const recordedActions = new Map();
-        for (const row of individualRows){
+        for (const row of individualRows) {
             if (row.kind === EVENT) {
                 const payload = JSON.parse(row.payload);
                 const key = consumedIdentityKey(payload.eventId, payload.sequence);
-                if (recordedEvents.has(key) || recordedActions.has(key)) return null;
+                if (recordedEvents.has(key) || recordedActions.has(key))
+                    return null;
                 recordedEvents.set(key, payload);
-            } else if (row.kind === ACTION) {
+            }
+            else if (row.kind === ACTION) {
                 const payload = JSON.parse(row.payload);
                 let action = payload.action;
                 try {
                     action = normalizeActionCheckpointForReplay(action, sourceWorkspaces.get(action.sourceTurnId));
-                } catch  {
+                }
+                catch {
                     return null;
                 }
                 const key = consumedIdentityKey(action.eventId, action.sequence);
-                if (recordedEvents.has(key) || recordedActions.has(key)) return null;
+                if (recordedEvents.has(key) || recordedActions.has(key))
+                    return null;
                 recordedActions.set(key, action);
             }
         }
         let lastBatchSequence = -1;
         const seen = new Set();
         const normalizedEvents = [];
-        for (const event of batchEvents){
-            if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence) return null;
+        for (const event of batchEvents) {
+            if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence)
+                return null;
             lastBatchSequence = event.sequence;
             const key = consumedIdentityKey(event.eventId, event.sequence);
-            if (seen.has(key)) return null;
+            if (seen.has(key))
+                return null;
             seen.add(key);
             if (event.kind === 'operation') {
                 const checkpoint = recordedActions.get(key);
-                if (!checkpoint || !operationEventMatchesAction(event, checkpoint)) return null;
-                const normalized = {
-                    ...event,
-                    action: actionFromOperationEventForReplay(event, checkpoint)
-                };
-                if (!validateBookingSurfaceEvent(normalized).ok) return null;
+                if (!checkpoint || !operationEventMatchesAction(event, checkpoint))
+                    return null;
+                const normalized = { ...event, action: actionFromOperationEventForReplay(event, checkpoint) };
+                if (!validateBookingSurfaceEvent(normalized).ok)
+                    return null;
                 normalizedEvents.push(normalized);
-            } else {
+            }
+            else {
                 const recorded = recordedEvents.get(key);
-                if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event)) return null;
+                if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event))
+                    return null;
                 normalizedEvents.push(event);
             }
         }
         return normalizedEvents;
     }
-    rows(taskId) {
-        return this.ledger.db.prepare(`SELECT seq, kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, STARTED, TURN, ACTION, RECEIPT, EVENT, APPROVAL_GRANTED, APPROVAL_OFFERED, APPROVAL_CONSUMED, DECISION_BATCH, REQUEST_BINDING);
-    }
+    rows(taskId) { return this.ledger.db.prepare(`SELECT seq, kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, STARTED, TURN, ACTION, RECEIPT, EVENT, APPROVAL_GRANTED, APPROVAL_OFFERED, APPROVAL_CONSUMED, DECISION_BATCH, REQUEST_BINDING); }
     append(kind, taskId, payload, idemKey) {
         const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, kind, taskId, JSON.stringify(payload), idemKey, taskId);
-        if (result.changes === 0) throw new Error(`ledger_write_failed:${kind}`);
-    }
-    appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, ordinal, turnId, workspace) {
-        if (!workspace) throw new Error('ledger_write_failed:turn_workspace');
-        this.append(TURN, taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef,
-            requestDigest,
-            workspaceDigest,
-            workspaceSemanticDigest,
-            workspace,
-            turnId
-        }, `booking-copilot:turn:${taskId}:${turnId}`);
-    }
-    appendApproval(taskId, contextRef, approval) {
-        this.append(APPROVAL_GRANTED, taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef,
-            approval,
-            approvalDigest: bookingDigest(approval)
-        }, `booking-copilot:approval-granted:${taskId}:${approval.approval?.approvalId ?? 'pending'}:${approval.nonce}`);
-    }
-    appendAction(taskId, contextRef, action, operationCount, availability) {
-        this.append(ACTION, taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef,
-            action,
-            operationCount,
-            availability,
-            availabilityDigest: bookingDigest(availability)
-        }, `booking-copilot:action:${taskId}:${action.actionId}`);
+        if (result.changes === 0)
+            throw new Error(`ledger_write_failed:${kind}`);
     }
+    appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, ordinal, turnId, workspace) { if (!workspace)
+        throw new Error('ledger_write_failed:turn_workspace'); this.append(TURN, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, workspace, turnId }, `booking-copilot:turn:${taskId}:${turnId}`); }
+    appendApproval(taskId, contextRef, approval) { this.append(APPROVAL_GRANTED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, approval, approvalDigest: bookingDigest(approval) }, `booking-copilot:approval-granted:${taskId}:${approval.approval?.approvalId ?? 'pending'}:${approval.nonce}`); }
+    appendAction(taskId, contextRef, action, operationCount, availability) { this.append(ACTION, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, action, operationCount, availability, availabilityDigest: bookingDigest(availability) }, `booking-copilot:action:${taskId}:${action.actionId}`); }
     appendTerminalEvent(taskId, event) {
-        const payload = {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef: event.contextRef,
-            eventId: event.eventId,
-            sequence: event.sequence,
-            emittedAt: event.emittedAt,
-            eventKind: 'terminal',
-            contentDigest: bookingDigest(event.terminal)
-        };
+        const payload = { schema: LEDGER_SCHEMA, taskId, contextRef: event.contextRef, eventId: event.eventId, sequence: event.sequence, emittedAt: event.emittedAt, eventKind: 'terminal', contentDigest: bookingDigest(event.terminal) };
         const idemKey = `booking-copilot:terminal-event:${taskId}`;
         const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, EVENT, taskId, JSON.stringify(payload), idemKey, taskId);
         if (result.changes === 0) {
             const existing = this.ledger.db.prepare('SELECT payload FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
-            if (!existing || JSON.parse(existing.payload).contentDigest !== payload.contentDigest) throw new Error('ledger_write_failed:terminal_event');
+            if (!existing || JSON.parse(existing.payload).contentDigest !== payload.contentDigest)
+                throw new Error('ledger_write_failed:terminal_event');
         }
     }
     ensureApprovalOffered(taskId, contextRef, approval, requestKey) {
-        if (requestKey !== approval.presentationRequestKey) throw new Error('approval_presentation_key_mismatch');
+        if (requestKey !== approval.presentationRequestKey)
+            throw new Error('approval_presentation_key_mismatch');
         const idemKey = `booking-copilot:approval-offered:${taskId}:${requestKey}`;
         const exists = this.ledger.db.prepare('SELECT 1 AS present FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
-        if (!exists) this.append(APPROVAL_OFFERED, taskId, {
-            schema: LEDGER_SCHEMA,
-            taskId,
-            contextRef,
-            approval,
-            approvalDigest: bookingDigest(approval)
-        }, idemKey);
+        if (!exists)
+            this.append(APPROVAL_OFFERED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, approval, approvalDigest: bookingDigest(approval) }, idemKey);
     }
     approvalWasConsumed(taskId, approval, targetActionId) {
         const state = this.resumeTask(taskId);
-        if (state?.legacySuppressedApprovalTargetActionIds?.includes(targetActionId)) return false;
+        if (state?.legacySuppressedApprovalTargetActionIds?.includes(targetActionId))
+            return false;
         const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
-        return rows.some(({ payload })=>{
+        return rows.some(({ payload }) => {
             const consumed = JSON.parse(payload);
             return consumed.ref?.targetActionId === targetActionId && consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval);
         });
     }
 }
-
-
-//# sourceURL=ts/src/booking-surface/runtime.ts