@danceiny/gotry 0.0.1-rc.8 → 0.2.0-rc.27

package/dist/scripts/booking-copilot-availability-ledger-binding-tests.js

@@ -0,0 +1,126 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ensureLedger } from '../src/state-ledger.js';
+import { bookingDigest } from '../src/booking-surface/runtime.js';
+import { BookingCopilotProofRuntime as BookingCopilotTaskRuntime } from './booking-copilot-proof-runtime.js';
+const offerVerifiedIntent = { schemaVersion: 'booking.intent.v1', target: 'offer.verified' };
+const workspace = (revision) => ({
+    schemaVersion: 'booking.surface', contextRef: 'ctx-ledger-binding', surface: 'tenant', revision,
+    locale: 'en-US', currency: 'AED', searchDraft: {}, results: { status: 'idle' },
+    visibleHotels: [{ hotelRef: 'h1', name: 'H1', factRefs: [] }, { hotelRef: 'h2', name: 'H2', factRefs: [] }],
+    loadedOffers: [{ offerRef: 'o1', offerVersionRef: 'o1:v1', hotelRef: 'h1', evidenceLevel: 'rate_loaded', factRefs: [] }, { offerRef: 'o2', offerVersionRef: 'o2:v1', hotelRef: 'h2', evidenceLevel: 'rate_loaded', factRefs: [] }],
+    shortlistedOfferRefs: ['o1', 'o2'], capabilities: { surface: 'tenant', allowedActions: ['offers.query', 'offer.check'] },
+});
+const offersReceipt = (actionId, revision) => ({
+    schemaVersion: 'booking.surface', kind: 'action.receipt', actionId, contextRef: 'ctx-ledger-binding', status: 'applied', revision,
+    observation: { kind: 'offers.state', hotelRefs: ['h1'], offerRefs: ['o1'], loadedHotelCount: 1 },
+    resultContract: { outcome: 'complete', hardCriteriaMet: true, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] },
+});
+const checkReceipt = (actionId, revision) => ({
+    schemaVersion: 'booking.surface', kind: 'action.receipt', actionId, contextRef: 'ctx-ledger-binding', status: 'unavailable', revision,
+    observation: { kind: 'offer.availability', offerRef: 'o1', checkedOfferVersionRef: 'o1:v1', available: false, changedFactRefs: [], gapCodes: [] },
+    resultContract: { outcome: 'empty', hardCriteriaMet: false, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] },
+});
+function fixture(stage) {
+    const root = mkdtempSync(join(tmpdir(), 'gotry-availability-ledger-binding-'));
+    const ledger = ensureLedger(root);
+    const runtime = new BookingCopilotTaskRuntime(ledger, { contextRefFactory: () => 'ctx-ledger-binding' });
+    const task = 'ledger-binding-task';
+    runtime.startTask({ schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task, turnId: 'turn-1', workspace: workspace(0), request: { text: 'find rates' } });
+    const query = { schemaVersion: 'booking.surface', kind: 'offers.query', actionId: 'query-1', contextRef: 'ctx-ledger-binding', expectedRevision: 0, reason: 'load offers', factRefs: [], input: { hotelRefs: ['h1'], criteria: {} } };
+    runtime.issueOperation(task, query, offerVerifiedIntent);
+    runtime.continueWithReceipt({ schemaVersion: 'booking.surface', kind: 'action.receipt.continuation', taskId: task, workspace: workspace(1), receipt: offersReceipt('query-1', 1) });
+    const check = { schemaVersion: 'booking.surface', kind: 'offer.check', actionId: 'check-1', contextRef: 'ctx-ledger-binding', expectedRevision: 1, reason: 'check', factRefs: [], input: { offerRef: 'o1', offerVersionRef: 'o1:v1' } };
+    runtime.issueOperation(task, check, offerVerifiedIntent);
+    if (stage === 'receipt')
+        runtime.continueWithReceipt({ schemaVersion: 'booking.surface', kind: 'action.receipt.continuation', taskId: task, workspace: { ...workspace(2), shortlistedOfferRefs: ['o2'], selectedOfferRef: undefined, verifiedOffer: undefined }, receipt: checkReceipt('check-1', 2) });
+    ledger.close();
+    return { root, ledger, task };
+}
+function rewrite(root, kind, mutate) {
+    const ledger = ensureLedger(root);
+    const row = ledger.db.prepare('SELECT seq, payload FROM events WHERE run_id = ? AND kind = ? ORDER BY seq DESC LIMIT 1').get('ledger-binding-task', kind);
+    assert.ok(row);
+    const payload = JSON.parse(row.payload);
+    mutate(payload);
+    ledger.db.prepare('UPDATE events SET payload = ? WHERE seq = ?').run(JSON.stringify(payload), row.seq);
+    ledger.close();
+}
+function assertCorrupt(root, label) {
+    const ledger = ensureLedger(root);
+    const runtime = new BookingCopilotTaskRuntime(ledger, { contextRefFactory: () => 'ctx-ledger-binding' });
+    assert.throws(() => runtime.resumeTask('ledger-binding-task'), /ledger_corrupt:ledger-binding-task/, label);
+    ledger.close();
+}
+// The untouched durable sequence is replayable after reopening the ledger.
+{
+    const fixtureState = fixture('action');
+    const ledger = ensureLedger(fixtureState.root);
+    assert.doesNotThrow(() => new BookingCopilotTaskRuntime(ledger).resumeTask(fixtureState.task));
+    ledger.close();
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+for (const [label, mutate] of [
+    ['candidate digest', (payload) => { payload.availability.candidateSetDigest = 'f'.repeat(64); payload.availabilityDigest = bookingDigest(payload.availability); }],
+    ['offer set digest', (payload) => { payload.availability.hotels.h1.currentGeneration.offerSetDigest = 'e'.repeat(64); payload.availabilityDigest = bookingDigest(payload.availability); }],
+    ['source receipt digest', (payload) => { payload.availability.hotels.h1.currentGeneration.source.receiptDigest = 'd'.repeat(64); payload.availabilityDigest = bookingDigest(payload.availability); }],
+    ['active ordinal', (payload) => { payload.availability.activeHotelOrdinal = 1; payload.availabilityDigest = bookingDigest(payload.availability); }],
+    ['fake terminal', (payload) => { payload.availability.terminal = { code: 'availability_confirmed', hotelRefs: ['h1', 'h2'], reason: 'confirmed', evidence: 'conclusive' }; payload.availability.availabilityPhase = 'terminal'; payload.availabilityDigest = bookingDigest(payload.availability); }],
+]) {
+    const fixtureState = fixture('action');
+    rewrite(fixtureState.root, 'booking.copilot.action.issued', mutate);
+    assertCorrupt(fixtureState.root, label);
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+// A digest mismatch must be rejected before any legacy/normalized availability
+// migration can make the payload appear coherent.
+{
+    const fixtureState = fixture('action');
+    rewrite(fixtureState.root, 'booking.copilot.action.issued', (payload) => { payload.availability.activeHotelOrdinal = 1; });
+    assertCorrupt(fixtureState.root, 'raw ACTION availability digest mismatch');
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+{
+    const fixtureState = fixture('receipt');
+    rewrite(fixtureState.root, 'booking.copilot.receipt.observed', (payload) => { payload.availability.activeHotelOrdinal = 1; });
+    assertCorrupt(fixtureState.root, 'raw RECEIPT availability digest mismatch');
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+// A forged action can be structurally valid and re-digested, but cannot change
+// the transition that the prior state and workspace authorize.
+{
+    const fixtureState = fixture('action');
+    rewrite(fixtureState.root, 'booking.copilot.action.issued', (payload) => {
+        payload.action.input.offerRef = 'o2';
+        const { actionDigest: _ignored, ...base } = payload.action;
+        payload.action.actionDigest = bookingDigest(base);
+    });
+    assertCorrupt(fixtureState.root, 'wrong action transition');
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+// The receipt shape and canonical receipt digest can both be valid while the
+// availability transition is forged; replay must still derive the mismatch.
+{
+    const fixtureState = fixture('receipt');
+    const runtimeLedger = ensureLedger(fixtureState.root);
+    const runtime = new BookingCopilotTaskRuntime(runtimeLedger);
+    assert.deepEqual(runtime.resumeTask(fixtureState.task)?.availability.criteria, {}, 'recovery retains the canonical offer criteria after restart');
+    const wrongDetour = { schemaVersion: 'booking.surface', kind: 'search.run', actionId: 'detour', contextRef: 'ctx-ledger-binding', expectedRevision: 2, reason: 'detour', factRefs: [], input: {} };
+    const activeIntent = runtime.resumeTask(fixtureState.task)?.activeIntent?.projection;
+    assert.ok(activeIntent);
+    assert.throws(() => runtime.applyDecisionBatch(fixtureState.task, 'detour-batch', [{ kind: 'operation', action: wrongDetour, intent: activeIntent }]), /availability_operation_incompatible/);
+    runtimeLedger.close();
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+{
+    const fixtureState = fixture('receipt');
+    rewrite(fixtureState.root, 'booking.copilot.receipt.observed', (payload) => {
+        payload.receipt.status = 'applied';
+        payload.receiptDigest = bookingDigest(payload.receipt);
+    });
+    assertCorrupt(fixtureState.root, 'wrong receipt transition');
+    rmSync(fixtureState.root, { recursive: true, force: true });
+}
+console.log('BOOKING COPILOT AVAILABILITY LEDGER BINDING: exact replay and candidate/generation/source/ordinal/terminal/action/receipt tamper rejection OK');

package/dist/scripts/booking-copilot-availability-policy-tests.js

@@ -0,0 +1,265 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ensureLedger } from '../src/state-ledger.js';
+import { BookingCopilotProofRuntime as BookingCopilotTaskRuntime } from './booking-copilot-proof-runtime.js';
+import { createAvailabilityPolicy, digest, MAX_HOTELS_PER_TASK, MAX_OFFER_CHECKS_PER_HOTEL, MAX_OFFER_QUERIES_PER_HOTEL, recordObservedOffersQuery, recordOfferCheckIssued, recordOfferCheckReceipt, recordOffersGeneration, recordOffersQueryIssued, canIssueOfferCheck } from '../src/booking-surface/availability-policy.js';
+import { bookingSurfaceAllowedActions, bookingSurfaceFleetFeatures, bookingSurfaceNegotiatedActions } from '../src/booking-surface/contracts.js';
+const versionFor = (offerRef, suffix = 'v1') => `${offerRef}:${suffix}`;
+const verifiedCapability = (offerRef, offerVersionRef = versionFor(offerRef), expiresAt = '2026-09-01T10:30:00.000Z') => ({ offerRef, offerVersionRef, verifiedOfferRef: `verified-${offerRef}`, expiresAt });
+const ws = (revision, hotels, offers, shortlistedOfferRefs = [], verifiedOffer) => ({ schemaVersion: 'booking.surface', contextRef: 'ctx-availability', surface: 'tenant', revision, locale: 'en-US', currency: 'AED', searchDraft: {}, results: { status: 'idle' }, visibleHotels: hotels.map(h => ({ hotelRef: h, name: h, factRefs: [] })), loadedOffers: offers.map(([offerRef, hotelRef, offerVersionRef = versionFor(offerRef)]) => ({ offerRef, offerVersionRef, hotelRef, evidenceLevel: 'rate_loaded', factRefs: [] })), shortlistedOfferRefs, capabilities: { surface: 'tenant', allowedActions: ['offers.query', 'offer.check'] }, ...(verifiedOffer ? { verifiedOffer } : {}) });
+const receipt = (actionId, revision, offerRef, status = 'unavailable', available = false, checkedOfferVersionRef = versionFor(offerRef), currentOfferVersionRef) => ({ schemaVersion: 'booking.surface', kind: 'action.receipt', actionId, contextRef: 'ctx-availability', status, revision, observation: { kind: 'offer.availability', offerRef, checkedOfferVersionRef, currentOfferVersionRef: available ? (currentOfferVersionRef ?? checkedOfferVersionRef) : undefined, available, verifiedOfferRef: available ? 'verified-' + offerRef : undefined, changedFactRefs: [], gapCodes: [] }, resultContract: { outcome: available ? 'complete' : 'empty', hardCriteriaMet: available, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] } });
+const foldQuery = (state, hotelRefs, workspace, actionId, queryReceipt, criteriaDigest = '') => recordOffersGeneration(state, hotelRefs, workspace, actionId, digest(queryReceipt), queryReceipt, criteriaDigest);
+const criteria = {};
+const offerVerifiedIntent = { schemaVersion: 'booking.intent.v1', target: 'offer.verified' };
+const offersReceipt = (actionId, revision, hotelRefs, offerRefs, loadedHotelCount, status = 'applied', outcome = 'complete', hardCriteriaMet = true) => ({ schemaVersion: 'booking.surface', kind: 'action.receipt', actionId, contextRef: 'ctx-availability', status, revision, observation: { kind: 'offers.state', hotelRefs, offerRefs, loadedHotelCount, gapCodes: [] }, resultContract: { outcome, hardCriteriaMet, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] } });
+const gapReceipt = (actionId, revision, status = 'failed') => ({ schemaVersion: 'booking.surface', kind: 'action.receipt', actionId, contextRef: 'ctx-availability', status, revision, observation: { kind: 'gap', code: 'hotel_rates_failed', factRefs: [] }, resultContract: { outcome: 'partial', hardCriteriaMet: false, factRefs: [], gapCodes: ['hotel_rates_failed'], blockers: [], relaxationsApplied: [] } });
+// UAT-facing product availability observation: these are exact least-privilege
+// sets, and are intentionally separate from the full tenant action vocabulary.
+assert.deepEqual(bookingSurfaceAllowedActions('storefront'), ['search.patch', 'search.run', 'results.view.patch', 'hotel.focus']);
+assert.deepEqual(bookingSurfaceAllowedActions('payment_link'), ['search.patch', 'search.run', 'results.view.patch', 'hotel.focus', 'hotel.select']);
+assert.deepEqual(bookingSurfaceAllowedActions('tenant'), ['search.patch', 'search.run', 'results.view.patch', 'hotel.focus', 'offers.query', 'offers.view.patch', 'offers.compare', 'offer.select', 'offer.check', 'checkout.prepare', 'order.observe']);
+assert.deepEqual(bookingSurfaceAllowedActions('customer_portal'), ['search.patch', 'search.run', 'results.view.patch', 'hotel.focus', 'offers.query', 'offers.view.patch', 'offers.compare', 'offer.select', 'offer.check', 'checkout.prepare', 'order.observe']);
+assert.equal(bookingSurfaceAllowedActions('tenant').includes('hotel.select'), false);
+assert.equal(bookingSurfaceAllowedActions('customer_portal').includes('hotel.select'), false);
+// Additive compatibility is negotiated from the fleet intersection, never
+// from a schema hash or a single lucky load-balanced probe.
+assert.deepEqual(bookingSurfaceFleetFeatures([{ features: ['trusted-order-observation-v1'] }]), ['trusted-order-observation-v1']);
+assert.deepEqual(bookingSurfaceFleetFeatures([{ features: ['trusted-order-observation-v1'] }, {}]), [], 'an old peer with no feature advertisement disables the additive field');
+assert.deepEqual(bookingSurfaceFleetFeatures([{ features: ['trusted-order-observation-v1'] }, { features: [] }]), [], 'a mixed rolling fleet uses the safe intersection');
+assert.deepEqual(bookingSurfaceFleetFeatures([{ features: ['trusted-order-observation-v1', 'future-feature'] }]), ['trusted-order-observation-v1'], 'unknown future features do not poison known negotiation');
+assert.equal(bookingSurfaceNegotiatedActions('tenant', [{ schemaSha256: 'same-hash-is-not-authority' }]).includes('order.observe'), false, 'schema hash never enables an additive action');
+assert.equal(bookingSurfaceNegotiatedActions('tenant', [{ features: ['trusted-order-observation-v1'] }]).includes('order.observe'), true, 'the advertised fleet feature enables order observation');
+assert.deepEqual(bookingSurfaceNegotiatedActions('storefront', [{ features: ['trusted-order-observation-v1'] }]), bookingSurfaceAllowedActions('storefront'), 'feature negotiation cannot expand the product surface matrix');
+// Lifetime budget mutation guard: these assertions exercise the transitions,
+// not just the exported constants, so changing a comparison or reset policy
+// makes this proof fail.
+{
+    assert.equal(MAX_HOTELS_PER_TASK, 5);
+    assert.equal(MAX_OFFER_CHECKS_PER_HOTEL, 2);
+    assert.equal(MAX_OFFER_QUERIES_PER_HOTEL, 2);
+    const unavailableWorkspace = ws(0, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]);
+    let exhausted = recordOfferCheckIssued(createAvailabilityPolicy(unavailableWorkspace), unavailableWorkspace, 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 'budget-check-1');
+    exhausted = recordOfferCheckReceipt(exhausted, ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), receipt('budget-check-1', 1, 'budget-hotel:ratepkg-1'), 'budget-check-1', 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 0);
+    assert.equal(exhausted.hotels['budget-hotel']?.freshOffersRequired, true, 'first unavailable opens exactly one fresh-generation transition');
+    exhausted = recordOffersQueryIssued(exhausted, ['budget-hotel'], ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), 'budget-query-1');
+    const reusedReceipt = offersReceipt('budget-query-1', 2, ['budget-hotel'], ['budget-hotel:ratepkg-1'], 1);
+    const reused = recordOffersGeneration(exhausted, ['budget-hotel'], ws(2, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), 'budget-query-1', digest(reusedReceipt), reusedReceipt);
+    assert.deepEqual(reused.hotels['budget-hotel']?.currentOfferRefs, [], 'fresh HotelRates cannot re-admit the checked stale OfferRef');
+    assert.equal(reused.hotels['budget-hotel']?.freshOffersRequired, true, 'stale OfferRef reuse leaves an explicit refresh transition');
+    const refreshedReceipt = offersReceipt('budget-query-1', 2, ['budget-hotel'], ['budget-hotel:ratepkg-2'], 1);
+    exhausted = recordOffersGeneration(exhausted, ['budget-hotel'], ws(2, ['budget-hotel'], [['budget-hotel:ratepkg-2', 'budget-hotel']]), 'budget-query-1', digest(refreshedReceipt), refreshedReceipt);
+    exhausted = recordOfferCheckIssued(exhausted, ws(2, ['budget-hotel'], [['budget-hotel:ratepkg-2', 'budget-hotel']]), 'budget-hotel:ratepkg-2', versionFor('budget-hotel:ratepkg-2'), 'budget-check-2');
+    exhausted = recordOfferCheckReceipt(exhausted, ws(3, ['budget-hotel'], [['budget-hotel:ratepkg-2', 'budget-hotel']]), receipt('budget-check-2', 3, 'budget-hotel:ratepkg-2'), 'budget-check-2', 'budget-hotel:ratepkg-2', versionFor('budget-hotel:ratepkg-2'), 2);
+    assert.equal(exhausted.hotels['budget-hotel']?.checksIssued, 2, 'second unavailable consumes the lifetime CheckAvail budget');
+    assert.equal(exhausted.terminal?.code, 'availability_exhausted_complete', 'second unavailable reaches conclusive exhaustion');
+    assert.throws(() => recordOfferCheckIssued(exhausted, ws(3, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 'budget-check-3'), /availability_terminal/, 'third CheckAvail cannot be issued after terminal exhaustion');
+    const unavailableWithGap = (actionId, revision) => ({
+        ...receipt(actionId, revision, 'budget-hotel:ratepkg-1'),
+        observation: { kind: 'offer.availability', offerRef: 'budget-hotel:ratepkg-1', checkedOfferVersionRef: versionFor('budget-hotel:ratepkg-1'), available: false, changedFactRefs: [], gapCodes: ['hotel_rates_failed'] },
+        resultContract: { outcome: 'empty', hardCriteriaMet: false, factRefs: [], gapCodes: ['hotel_rates_failed'], blockers: [], relaxationsApplied: [] },
+    });
+    let inconclusive = recordOfferCheckIssued(createAvailabilityPolicy(unavailableWorkspace), unavailableWorkspace, 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 'gap-check-1');
+    inconclusive = recordOfferCheckReceipt(inconclusive, ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), unavailableWithGap('gap-check-1', 1), 'gap-check-1', 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 0);
+    assert.equal(inconclusive.hotels['budget-hotel']?.status, 'inconclusive', 'generic gap is not accepted as a typed negative');
+    assert.equal(inconclusive.hotels['budget-hotel']?.tombstonedOfferRefs.includes('budget-hotel:ratepkg-1'), false, 'generic gap cannot tombstone logical offer');
+    assert.equal(inconclusive.hotels['budget-hotel']?.tombstonedOfferVersionRefs.includes(versionFor('budget-hotel:ratepkg-1')), false, 'generic gap cannot tombstone offer version');
+    inconclusive = recordOffersQueryIssued(inconclusive, ['budget-hotel'], ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), 'gap-query-1');
+    const gapRefreshedReceipt = offersReceipt('gap-query-1', 2, ['budget-hotel'], ['budget-hotel:ratepkg-3'], 1);
+    inconclusive = recordOffersGeneration(inconclusive, ['budget-hotel'], ws(2, ['budget-hotel'], [['budget-hotel:ratepkg-3', 'budget-hotel']]), 'gap-query-1', digest(gapRefreshedReceipt), gapRefreshedReceipt);
+    inconclusive = recordOfferCheckIssued(inconclusive, ws(2, ['budget-hotel'], [['budget-hotel:ratepkg-3', 'budget-hotel']]), 'budget-hotel:ratepkg-3', versionFor('budget-hotel:ratepkg-3'), 'gap-check-2');
+    inconclusive = recordOfferCheckReceipt(inconclusive, ws(3, ['budget-hotel'], [['budget-hotel:ratepkg-3', 'budget-hotel']]), { ...unavailableWithGap('gap-check-2', 3), observation: { kind: 'offer.availability', offerRef: 'budget-hotel:ratepkg-3', checkedOfferVersionRef: versionFor('budget-hotel:ratepkg-3'), available: false, changedFactRefs: [], gapCodes: [] } }, 'gap-check-2', 'budget-hotel:ratepkg-3', versionFor('budget-hotel:ratepkg-3'), 2);
+    assert.equal(inconclusive.terminal?.code, 'availability_exhausted_inconclusive', 'an unavailable receipt with a gap never masquerades as conclusive exhaustion');
+    for (const status of ['unavailable', 'no_match']) {
+        const gapAction = `generic-gap-${status}`;
+        const gapState = recordOfferCheckIssued(createAvailabilityPolicy(unavailableWorkspace), unavailableWorkspace, 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), gapAction);
+        const gap = { ...receipt(gapAction, 1, 'budget-hotel:ratepkg-1', status), observation: { kind: 'offer.availability', offerRef: 'budget-hotel:ratepkg-1', checkedOfferVersionRef: versionFor('budget-hotel:ratepkg-1'), available: false, changedFactRefs: [], gapCodes: ['hotel_rates_failed'] }, resultContract: { outcome: 'empty', hardCriteriaMet: false, factRefs: [], gapCodes: ['hotel_rates_failed'], blockers: [], relaxationsApplied: [] } };
+        const afterGap = recordOfferCheckReceipt(gapState, ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), gap, gapAction, 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 0);
+        assert.equal(afterGap.hotels['budget-hotel']?.status, 'inconclusive', `${status} with generic gap remains inconclusive`);
+        assert.equal(afterGap.hotels['budget-hotel']?.tombstonedOfferRefs.includes('budget-hotel:ratepkg-1'), false, `${status} with generic gap cannot tombstone logical offer`);
+        assert.equal(afterGap.hotels['budget-hotel']?.tombstonedOfferVersionRefs.includes(versionFor('budget-hotel:ratepkg-1')), false, `${status} with generic gap cannot tombstone version`);
+    }
+    let queryBudget = recordOfferCheckIssued(createAvailabilityPolicy(unavailableWorkspace), unavailableWorkspace, 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 'query-budget-check');
+    queryBudget = recordOfferCheckReceipt(queryBudget, ws(1, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), receipt('query-budget-check', 1, 'budget-hotel:ratepkg-1'), 'query-budget-check', 'budget-hotel:ratepkg-1', versionFor('budget-hotel:ratepkg-1'), 0);
+    for (const [actionId, revision] of [['query-budget-1', 2], ['query-budget-2', 3]]) {
+        const offerRef = `budget-hotel:query-ratepkg-${revision}`;
+        queryBudget = recordOffersQueryIssued(queryBudget, ['budget-hotel'], ws(revision - 1, ['budget-hotel'], [[offerRef, 'budget-hotel']]), actionId);
+        const queryReceipt = offersReceipt(actionId, revision, ['budget-hotel'], [offerRef], 1);
+        queryBudget = recordOffersGeneration(queryBudget, ['budget-hotel'], ws(revision, ['budget-hotel'], [[offerRef, 'budget-hotel']]), actionId, digest(queryReceipt), queryReceipt);
+    }
+    assert.equal(queryBudget.hotels['budget-hotel']?.offerQueriesIssued, 2, 'two refresh queries are retained as lifetime usage');
+    assert.throws(() => recordOffersQueryIssued(queryBudget, ['budget-hotel'], ws(3, ['budget-hotel'], [['budget-hotel:ratepkg-1', 'budget-hotel']]), 'query-budget-3'), /availability_offer_query_limit_reached/, 'third offers.query is rejected');
+    const hotels = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6'];
+    const candidateWorkspace = ws(0, hotels, hotels.map((hotelRef, index) => [`candidate-${index + 1}`, hotelRef]), ['candidate-6', 'candidate-1', 'candidate-2', 'candidate-3', 'candidate-4', 'candidate-5']);
+    const candidates = recordOfferCheckIssued(createAvailabilityPolicy(candidateWorkspace), candidateWorkspace, 'candidate-6', versionFor('candidate-6'), 'candidate-check');
+    assert.deepEqual(candidates.hotelRefs, ['h6', 'h1', 'h2', 'h3', 'h4'], 'selected hotel is first and recovery freezes at five candidates');
+    assert.equal(candidates.hotelRefs.includes('h5'), false, 'sixth shortlisted hotel never enters the recovery epoch');
+    const duplicateWorkspace = ws(0, ['dup-a', 'dup-b'], [['dup-offer', 'dup-a'], ['dup-offer', 'dup-b']]);
+    assert.throws(() => createAvailabilityPolicy(duplicateWorkspace), /availability_duplicate_offer_ref/, 'loaded OfferRef must be globally unique before any .find-based authority lookup');
+    assert.throws(() => canIssueOfferCheck(createAvailabilityPolicy(ws(0, ['dup-a'], [])), duplicateWorkspace, 'dup-offer', versionFor('dup-offer')), /availability_duplicate_offer_ref/);
+}
+// Locked cap and source cases: a selected RoomList offer wins ordering, while
+// a complete recovery generation never admits more than three offers.
+{
+    const roomList = ws(0, ['room-hotel'], [['room-1', 'room-hotel'], ['room-2', 'room-hotel'], ['room-3', 'room-hotel'], ['room-4', 'room-hotel']], ['room-4']);
+    const selected = recordOfferCheckIssued(createAvailabilityPolicy(roomList), roomList, 'room-4', versionFor('room-4'), 'room-check');
+    assert.deepEqual(selected.hotels['room-hotel']?.currentOfferRefs, ['room-4', 'room-1', 'room-2']);
+    assert.equal(selected.hotels['room-hotel']?.currentGeneration?.source.kind, 'workspace_snapshot');
+    const complete = ws(0, ['complete-hotel'], [['complete-1', 'complete-hotel']]);
+    const completeStarted = recordOfferCheckIssued(createAvailabilityPolicy(complete), complete, 'complete-1', versionFor('complete-1'), 'complete-check');
+    const completeQuery = recordOffersQueryIssued(completeStarted, ['complete-hotel'], complete, 'complete-query', digest(criteria), criteria);
+    const fourOfferWorkspace = ws(1, ['complete-hotel'], [['complete-1', 'complete-hotel'], ['complete-2', 'complete-hotel'], ['complete-3', 'complete-hotel'], ['complete-4', 'complete-hotel']]);
+    assert.throws(() => recordOffersGeneration(completeQuery, ['complete-hotel'], fourOfferWorkspace, 'complete-query', digest(offersReceipt('complete-query', 1, ['complete-hotel'], ['complete-1', 'complete-2', 'complete-3', 'complete-4'], 1)), offersReceipt('complete-query', 1, ['complete-hotel'], ['complete-1', 'complete-2', 'complete-3', 'complete-4'], 1), digest(criteria), criteria), /availability_offer_limit_exceeded/);
+}
+// Locked partial/empty reconciliation: a partial receipt may only project an
+// evidenced subset, and a clean empty receipt must agree with workspace truth.
+{
+    const partialWorkspace = ws(0, ['partial-hotel'], [['partial-1', 'partial-hotel'], ['partial-2', 'partial-hotel'], ['partial-3', 'partial-hotel']]);
+    const partialStarted = recordOfferCheckIssued(createAvailabilityPolicy(partialWorkspace), partialWorkspace, 'partial-1', versionFor('partial-1'), 'partial-check');
+    const partialQuery = recordOffersQueryIssued(partialStarted, ['partial-hotel'], partialWorkspace, 'partial-query', digest(criteria), criteria);
+    const partialReceipt = offersReceipt('partial-query', 1, ['partial-hotel'], ['partial-2'], 1, 'partial', 'partial', false);
+    const partial = recordOffersGeneration(partialQuery, ['partial-hotel'], ws(1, ['partial-hotel'], [['partial-1', 'partial-hotel'], ['partial-2', 'partial-hotel'], ['partial-3', 'partial-hotel']]), 'partial-query', digest(partialReceipt), partialReceipt, digest(criteria), criteria);
+    assert.equal(partial.hotels['partial-hotel']?.currentGeneration?.evidence, 'partial');
+    assert.equal(partial.hotels['partial-hotel']?.currentOfferRefs.length, 0);
+    assert.equal(partial.hotels['partial-hotel']?.freshOffersRequired, true);
+    assert.throws(() => recordOffersGeneration(partialQuery, ['partial-hotel'], ws(1, ['partial-hotel'], [['partial-1', 'partial-hotel'], ['partial-2', 'partial-hotel']]), 'partial-query', digest(offersReceipt('partial-query', 1, ['partial-hotel'], ['partial-1'], 2, 'partial', 'partial', false)), offersReceipt('partial-query', 1, ['partial-hotel'], ['partial-1'], 2, 'partial', 'partial', false), digest(criteria), criteria), /availability_offers_count_mismatch/);
+    const emptyWorkspace = ws(0, ['empty-hotel'], [['empty-1', 'empty-hotel']]);
+    const emptyStarted = recordOfferCheckIssued(createAvailabilityPolicy(emptyWorkspace), emptyWorkspace, 'empty-1', versionFor('empty-1'), 'empty-check');
+    const emptyQuery = recordOffersQueryIssued(emptyStarted, ['empty-hotel'], emptyWorkspace, 'empty-query');
+    const empty = offersReceipt('empty-query', 1, ['empty-hotel'], [], 0, 'no_match', 'empty', false);
+    assert.throws(() => recordOffersGeneration(emptyQuery, ['empty-hotel'], emptyWorkspace, 'empty-query', digest(empty), empty), /availability_offers_workspace_mismatch/);
+}
+// Locked provenance and verification cases: failed ordinary queries erase the
+// seed, while a CheckAvail claim is confirmed only by the current workspace's
+// verifiedOffer capability; changed is inconclusive and requires a fresh generation.
+{
+    const seedWorkspace = ws(0, ['seed-hotel'], [['seed-1', 'seed-hotel']]);
+    const seed = offersReceipt('seed-query', 1, ['seed-hotel'], ['seed-1'], 1);
+    const seeded = recordObservedOffersQuery(createAvailabilityPolicy(seedWorkspace), ['seed-hotel'], digest(criteria), seedWorkspace, seed, 'seed-query', digest(seed), criteria);
+    assert.equal(seeded.criteriaDigest, digest(criteria));
+    const cleared = recordObservedOffersQuery(seeded, ['seed-hotel'], digest(criteria), ws(2, ['seed-hotel'], []), gapReceipt('failed-query', 2), 'failed-query', digest(gapReceipt('failed-query', 2)), criteria);
+    assert.equal(cleared.criteria, undefined);
+    assert.equal(cleared.criteriaDigest, undefined);
+    assert.equal(cleared.lastQuerySourceActionId, undefined);
+    const verificationWorkspace = ws(0, ['verify-hotel'], [['verify-1', 'verify-hotel']]);
+    const verificationStarted = recordOfferCheckIssued(createAvailabilityPolicy(verificationWorkspace), verificationWorkspace, 'verify-1', versionFor('verify-1'), 'verify-check');
+    const wrongVerified = { ...verificationWorkspace, revision: 1, verifiedOffer: verifiedCapability('other-offer', versionFor('other-offer')) };
+    const wrong = recordOfferCheckReceipt(verificationStarted, wrongVerified, receipt('verify-check', 1, 'verify-1', 'applied', true), 'verify-check', 'verify-1', versionFor('verify-1'), 0);
+    assert.notEqual(wrong.terminal?.code, 'availability_confirmed');
+    assert.equal(wrong.hotels['verify-hotel']?.status, 'inconclusive');
+    const matchingStarted = recordOfferCheckIssued(createAvailabilityPolicy(verificationWorkspace), verificationWorkspace, 'verify-1', versionFor('verify-1'), 'verify-match');
+    const matchingWorkspace = { ...verificationWorkspace, revision: 1, verifiedOffer: verifiedCapability('verify-1') };
+    const matching = recordOfferCheckReceipt(matchingStarted, matchingWorkspace, receipt('verify-match', 1, 'verify-1', 'applied', true), 'verify-match', 'verify-1', versionFor('verify-1'), 0);
+    assert.equal(matching.terminal?.code, 'availability_confirmed');
+    const verificationSeedReceipt = offersReceipt('verify-seed', 0, ['verify-hotel'], ['verify-1'], 1);
+    const verificationSeed = recordObservedOffersQuery(createAvailabilityPolicy(verificationWorkspace), ['verify-hotel'], digest(criteria), verificationWorkspace, verificationSeedReceipt, 'verify-seed', digest(verificationSeedReceipt), criteria);
+    const changedStarted = recordOfferCheckIssued(verificationSeed, verificationWorkspace, 'verify-1', versionFor('verify-1'), 'verify-changed');
+    const changedReceipt = { ...receipt('verify-changed', 1, 'verify-1', 'changed', true, versionFor('verify-1'), versionFor('verify-1', 'v2')), observation: { kind: 'offer.availability', offerRef: 'verify-1', checkedOfferVersionRef: versionFor('verify-1'), currentOfferVersionRef: versionFor('verify-1', 'v2'), available: true, changedFactRefs: ['price'], gapCodes: [] }, resultContract: { outcome: 'partial', hardCriteriaMet: false, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] } };
+    const changed = recordOfferCheckReceipt(changedStarted, { ...verificationWorkspace, revision: 1, loadedOffers: [{ offerRef: 'verify-1', offerVersionRef: versionFor('verify-1', 'v2'), hotelRef: 'verify-hotel', evidenceLevel: 'rate_loaded', factRefs: [] }] }, changedReceipt, 'verify-changed', 'verify-1', versionFor('verify-1'), 0);
+    assert.equal(changed.hotels['verify-hotel']?.status, 'active');
+    assert.deepEqual(changed.hotels['verify-hotel']?.currentOfferRefs, ['verify-1']);
+    assert.equal(changed.hotels['verify-hotel']?.tombstonedOfferVersionRefs.includes(versionFor('verify-1')), true);
+    assert.equal(changed.hotels['verify-hotel']?.freshOffersRequired, false);
+}
+const initial = ws(0, ['h1', 'h2'], [['o1', 'h1'], ['o2', 'h1'], ['b1', 'h2']], ['b1']);
+assert.throws(() => recordOffersQueryIssued(createAvailabilityPolicy(initial), ['h1'], initial, 'pre-q'), /recovery_not_started/);
+let state = recordOfferCheckIssued(createAvailabilityPolicy(initial), initial, 'o1', versionFor('o1'), 'check-1');
+assert.deepEqual(state.hotelRefs, ['h1', 'h2']);
+assert.equal(state.hotels.h1?.offerQueriesIssued, 0);
+state = recordOfferCheckReceipt(state, ws(1, ['h1', 'h2'], [['o1', 'h1'], ['o2', 'h1'], ['b1', 'h2']]), receipt('check-1', 1, 'o1'), 'check-1', 'o1', versionFor('o1'), 0);
+assert.equal(state.hotels.h1?.freshOffersRequired, true);
+assert.equal(canIssueOfferCheck(state, ws(1, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'b1', versionFor('b1')).ok, false);
+let q = recordOffersQueryIssued(state, ['h1'], ws(1, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'q1', 'criteria-a');
+assert.throws(() => recordOffersQueryIssued(q, ['h1'], ws(1, ['h1', 'h2'], []), 'q2', 'criteria-b'), /criteria_changed/);
+const staleQueryReceipt = { ...receipt('q1', 2, 'o2', 'stale'), observation: { kind: 'gap', code: 'stale_revision', factRefs: [] } };
+q = foldQuery(q, ['h1'], ws(2, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'q1', staleQueryReceipt, 'criteria-a');
+assert.equal(q.hotels.h1?.generationNo, 1);
+assert.equal(q.hotels.h1?.currentGeneration?.generationId, 'h1:generation:1');
+const completeQueryReceipt = { ...receipt('q2', 3, 'o2', 'applied'), observation: { kind: 'offers.state', hotelRefs: ['h1'], offerRefs: ['o2'], loadedHotelCount: 1 } };
+q = recordOffersQueryIssued(q, ['h1'], ws(2, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'q2', 'criteria-a');
+q = foldQuery(q, ['h1'], ws(3, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'q2', completeQueryReceipt, 'criteria-a');
+assert.deepEqual(q.hotels.h1?.currentOfferRefs, ['o2']);
+q = recordOfferCheckIssued(q, ws(3, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), 'o2', versionFor('o2'), 'check-2');
+q = recordOfferCheckReceipt(q, ws(4, ['h1', 'h2'], [['o2', 'h1'], ['b1', 'h2']]), receipt('check-2', 4, 'o2'), 'check-2', 'o2', versionFor('o2'), 3);
+assert.deepEqual(q.hotels.h1?.invalidatedOfferRefs, ['o2']);
+assert.equal(q.hotels.h1?.freshOffersRequired, false);
+assert.equal(q.terminal, undefined);
+assert.throws(() => recordOffersQueryIssued(q, ['h1'], ws(4, ['h1', 'h2'], [['b1', 'h2']]), 'q-after-two-checks', 'criteria-a'), /hotel_not_active/);
+const fw = ws(0, ['a', 'b'], [['a:ratepkg-1', 'a'], ['b:ratepkg-1', 'b']], ['b:ratepkg-1']);
+let fallback = recordOfferCheckIssued(createAvailabilityPolicy(fw), fw, 'a:ratepkg-1', versionFor('a:ratepkg-1'), 'fa');
+fallback = recordOfferCheckReceipt(fallback, ws(1, ['a', 'b'], [['a:ratepkg-1', 'a'], ['b:ratepkg-1', 'b']], ['b:ratepkg-1']), receipt('fa', 1, 'a:ratepkg-1'), 'fa', 'a:ratepkg-1', versionFor('a:ratepkg-1'), 0);
+assert.equal(fallback.hotels.a?.freshOffersRequired, true);
+fallback = recordOffersQueryIssued(fallback, ['a'], ws(1, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'fq1');
+const fallbackEmpty = { ...receipt('fq1', 2, 'a:ratepkg-1', 'no_match'), observation: { kind: 'offers.state', hotelRefs: ['a'], offerRefs: [], loadedHotelCount: 0 } };
+fallback = foldQuery(fallback, ['a'], ws(2, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'fq1', fallbackEmpty);
+assert.equal(fallback.activeHotelOrdinal, 1);
+assert.equal(canIssueOfferCheck(fallback, ws(2, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'b:ratepkg-1', versionFor('b:ratepkg-1')).ok, false);
+fallback = recordOffersQueryIssued(fallback, ['b'], ws(2, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'fq2');
+const fallbackOffers = { ...receipt('fq2', 3, 'b:ratepkg-1', 'applied'), observation: { kind: 'offers.state', hotelRefs: ['b'], offerRefs: ['b:ratepkg-1'], loadedHotelCount: 1 } };
+fallback = foldQuery(fallback, ['b'], ws(3, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'fq2', fallbackOffers);
+assert.equal(canIssueOfferCheck(fallback, ws(3, ['a', 'b'], [['b:ratepkg-1', 'b']]), 'b:ratepkg-1', versionFor('b:ratepkg-1')).ok, true);
+let exhausted = recordOfferCheckIssued(createAvailabilityPolicy(ws(0, ['x'], [['x1', 'x']])), ws(0, ['x'], [['x1', 'x']]), 'x1', versionFor('x1'), 'ex1');
+exhausted = recordOfferCheckReceipt(exhausted, ws(1, ['x'], [['x1', 'x']]), receipt('ex1', 1, 'x1'), 'ex1', 'x1', versionFor('x1'), 0);
+assert.equal(exhausted.terminal, undefined);
+assert.equal(exhausted.hotels.x?.freshOffersRequired, true);
+exhausted = recordOffersQueryIssued(exhausted, ['x'], ws(1, ['x'], [['x1', 'x']]), 'exq');
+const exhaustedReceipt = { ...receipt('exq', 2, 'x1', 'no_match'), observation: { kind: 'offers.state', hotelRefs: ['x'], offerRefs: [], loadedHotelCount: 0 } };
+exhausted = foldQuery(exhausted, ['x'], ws(2, ['x'], []), 'exq', exhaustedReceipt);
+assert.equal(exhausted.hotels.x?.generationNo, 2);
+assert.equal(exhausted.terminal?.code, 'availability_exhausted_complete');
+assert.throws(() => recordOfferCheckIssued(exhausted, ws(2, ['x'], []), 'x1', versionFor('x1'), 'after-terminal'), /availability_terminal/);
+// A failed A@v1 must not poison a same-hotel candidate query containing B@v1.
+// The reducer filters A's tombstone inside the generation, admits only B, and
+// issues the next CheckAvail without getting stuck on the old offer.
+{
+    const candidateWorkspace = ws(0, ['candidate-hotel'], [['candidate-a', 'candidate-hotel'], ['candidate-b', 'candidate-hotel']], ['candidate-a', 'candidate-b']);
+    let candidateState = recordOfferCheckIssued(createAvailabilityPolicy(candidateWorkspace), candidateWorkspace, 'candidate-a', versionFor('candidate-a'), 'candidate-a-check');
+    candidateState = recordOfferCheckReceipt(candidateState, ws(1, ['candidate-hotel'], [['candidate-a', 'candidate-hotel'], ['candidate-b', 'candidate-hotel']], ['candidate-a', 'candidate-b']), receipt('candidate-a-check', 1, 'candidate-a'), 'candidate-a-check', 'candidate-a', versionFor('candidate-a'), 0);
+    const queryWorkspace = ws(1, ['candidate-hotel'], [['candidate-a', 'candidate-hotel'], ['candidate-b', 'candidate-hotel']], ['candidate-a', 'candidate-b']);
+    const candidateQueryReceipt = offersReceipt('candidate-query', 2, ['candidate-hotel'], ['candidate-a', 'candidate-b'], 1);
+    candidateState = recordOffersQueryIssued(candidateState, ['candidate-hotel'], queryWorkspace, 'candidate-query');
+    candidateState = recordOffersGeneration(candidateState, ['candidate-hotel'], queryWorkspace, 'candidate-query', digest(candidateQueryReceipt), candidateQueryReceipt);
+    assert.equal(candidateState.hotels['candidate-hotel']?.currentOfferRefs.includes('candidate-a'), false, 'unavailable A@v1 is not re-admitted by a same-hotel candidate query');
+    assert.deepEqual(candidateState.hotels['candidate-hotel']?.currentOfferRefs, ['candidate-b'], 'same-hotel candidate query admits B@v1 only');
+    assert.equal(candidateState.activeHotelOrdinal, 0, 'same-hotel recovery remains on the active hotel after filtering A');
+    const bWorkspace = ws(2, ['candidate-hotel'], [['candidate-b', 'candidate-hotel']], ['candidate-b']);
+    assert.equal(canIssueOfferCheck(candidateState, bWorkspace, 'candidate-b', versionFor('candidate-b')).ok, true, 'B@v1 is recheckable after A@v1 unavailable');
+    candidateState = recordOfferCheckIssued(candidateState, bWorkspace, 'candidate-b', versionFor('candidate-b'), 'candidate-b-check');
+    const bVerified = verifiedCapability('candidate-b', versionFor('candidate-b'));
+    candidateState = recordOfferCheckReceipt(candidateState, ws(3, ['candidate-hotel'], [['candidate-b', 'candidate-hotel']], ['candidate-b'], bVerified), receipt('candidate-b-check', 3, 'candidate-b', 'applied', true), 'candidate-b-check', 'candidate-b', versionFor('candidate-b'), 2);
+    assert.equal(candidateState.terminal?.code, 'availability_confirmed', 'recheck of B@v1 can confirm after A@v1 unavailable');
+}
+console.log('BOOKING COPILOT AVAILABILITY POLICY: admission, criteria CAS, stale no-generation, invalidation, cursor fallback, exhaustion, absorbing terminal OK');
+// Runtime proof: action replay, restart restoration, terminal SSE batch and absorbing seams.
+const ledgerRoot = mkdtempSync(join(tmpdir(), 'gotry-availability-proof-'));
+const ledger = ensureLedger(ledgerRoot);
+const runtime = new BookingCopilotTaskRuntime(ledger, { contextRefFactory: () => 'ctx-availability' });
+const runtimeWorkspace = ws(0, ['rh'], []);
+runtime.startTask({ schemaVersion: 'booking.surface', kind: 'user.turn', taskId: 'runtime-availability', turnId: 'turn-1', workspace: runtimeWorkspace, request: { text: 'find rates' } });
+const query = { schemaVersion: 'booking.surface', kind: 'offers.query', actionId: 'rq-1', contextRef: 'ctx-availability', expectedRevision: 0, reason: 'ordinary query', factRefs: [], input: { hotelRefs: ['rh'], criteria: {} } };
+runtime.issueOperation('runtime-availability', query, offerVerifiedIntent);
+runtime.continueWithReceipt({ schemaVersion: 'booking.surface', kind: 'action.receipt.continuation', taskId: 'runtime-availability', workspace: ws(1, ['rh'], [['ro1', 'rh']]), receipt: { schemaVersion: 'booking.surface', kind: 'action.receipt', actionId: 'rq-1', contextRef: 'ctx-availability', status: 'applied', revision: 1, observation: { kind: 'offers.state', hotelRefs: ['rh'], offerRefs: ['ro1'], loadedHotelCount: 1 }, resultContract: { outcome: 'complete', hardCriteriaMet: true, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] } } });
+const check = { schemaVersion: 'booking.surface', kind: 'offer.check', actionId: 'rc-1', contextRef: 'ctx-availability', expectedRevision: 1, reason: 'CheckAvail', factRefs: [], input: { offerRef: 'ro1', offerVersionRef: versionFor('ro1') } };
+runtime.issueOperation('runtime-availability', check, offerVerifiedIntent);
+runtime.issueOperation('runtime-availability', check, offerVerifiedIntent);
+assert.equal(runtime.resumeTask('runtime-availability')?.availability.attempts.length, 1);
+const restarted = new BookingCopilotTaskRuntime(ensureLedger(ledgerRoot), { contextRefFactory: () => 'ctx-availability' });
+assert.equal(restarted.resumeTask('runtime-availability')?.availability.attempts[0]?.actionId, 'rc-1');
+runtime.continueWithReceipt({ schemaVersion: 'booking.surface', kind: 'action.receipt.continuation', taskId: 'runtime-availability', workspace: ws(2, ['rh'], [['ro1', 'rh']]), receipt: { ...receipt('rc-1', 2, 'ro1'), status: 'unavailable' } });
+const query2 = { ...query, actionId: 'rq-2', expectedRevision: 2 };
+runtime.issueOperation('runtime-availability', query2, offerVerifiedIntent);
+runtime.continueWithReceipt({ schemaVersion: 'booking.surface', kind: 'action.receipt.continuation', taskId: 'runtime-availability', workspace: ws(3, ['rh'], []), receipt: { schemaVersion: 'booking.surface', kind: 'action.receipt', actionId: 'rq-2', contextRef: 'ctx-availability', status: 'no_match', revision: 3, observation: { kind: 'offers.state', hotelRefs: ['rh'], offerRefs: [], loadedHotelCount: 0 }, resultContract: { outcome: 'empty', hardCriteriaMet: false, factRefs: [], gapCodes: [], blockers: [], relaxationsApplied: [] } } });
+assert.equal(runtime.resumeTask('runtime-availability')?.phase, 'terminal');
+const eventCount = ledger.countEvents();
+const terminalBatchPayload = ledger.db.prepare("SELECT payload FROM events WHERE kind = 'booking.copilot.decision.batch' ORDER BY seq DESC LIMIT 1").get();
+const terminalBatch = JSON.parse(terminalBatchPayload.payload);
+assert.deepEqual(runtime.terminalDecisionBatch('runtime-availability', terminalBatch.requestKey), terminalBatch.events);
+assert.deepEqual(runtime.terminalDecisionBatch('runtime-availability', terminalBatch.requestKey), terminalBatch.events, 'exact terminal batch replay is read-only');
+assert.throws(() => runtime.terminalDecisionBatch('runtime-availability', 'arbitrary-new-terminal-key'), /task_terminal/);
+assert.throws(() => runtime.issueOperation('runtime-availability', { ...query, actionId: 'late', expectedRevision: 3 }, offerVerifiedIntent), /task_terminal/);
+assert.throws(() => runtime.emitEvent('runtime-availability', { kind: 'status', status: 'working' }), /task_terminal/);
+assert.equal(ledger.countEvents(), eventCount);
+ledger.close();
+restarted['ledger'].close();
+rmSync(ledgerRoot, { recursive: true, force: true });

package/dist/scripts/booking-copilot-bin-proof-tests.js

@@ -0,0 +1,66 @@
+/** Production executable proof for the standalone Booking Copilot server. */
+import assert from 'node:assert/strict';
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+const root = resolve(import.meta.dirname, '../..');
+const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+assert.equal(packageJson.bin?.['gotry-booking-copilot'], 'bin/gotry-booking-copilot.js');
+const build = spawnSync(process.execPath, ['scripts/build-dist.mjs'], {
+    cwd: root,
+    encoding: 'utf8',
+});
+assert.equal(build.status, 0, build.stderr || build.stdout);
+const bin = join(root, 'bin/gotry-booking-copilot.js');
+const missingKey = spawnSync(process.execPath, [bin], {
+    cwd: root,
+    env: { PATH: process.env.PATH },
+    encoding: 'utf8',
+});
+assert.equal(missingKey.status, 1);
+assert.match(missingKey.stderr, /booking_copilot_api_key_required/);
+const stateRoot = mkdtempSync(join(tmpdir(), 'gotry-booking-bin-'));
+try {
+    const child = spawn(process.execPath, [bin], {
+        cwd: root,
+        env: {
+            PATH: process.env.PATH,
+            GOTRY_BOOKING_COPILOT_API_KEY: 'fixture-bff-key',
+            GOTRY_BOOKING_COPILOT_STATE_ROOT: stateRoot,
+            GOTRY_BOOKING_COPILOT_HOST: '127.0.0.1',
+            GOTRY_BOOKING_COPILOT_PORT: '0',
+            DEEPSEEK_API_KEY: 'fixture-model-key',
+        },
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stderr = '';
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => { stderr += chunk; });
+    await new Promise((resolveReady, reject) => {
+        const timeout = setTimeout(() => reject(new Error(`booking copilot bin did not listen: ${stderr}`)), 10_000);
+        const inspect = () => {
+            if (!stderr.includes('/a2a/booking-copilot/turn'))
+                return;
+            clearTimeout(timeout);
+            resolveReady();
+        };
+        child.stderr.on('data', inspect);
+        child.once('exit', (code) => {
+            clearTimeout(timeout);
+            reject(new Error(`booking copilot bin exited before listen: ${code}: ${stderr}`));
+        });
+    });
+    assert.match(stderr, /listening on http:\/\/127\.0\.0\.1:\d+\/a2a\/booking-copilot\/turn/);
+    assert.ok(!stderr.includes('fixture-bff-key'));
+    assert.ok(!stderr.includes('fixture-model-key'));
+    child.kill('SIGTERM');
+    const exit = await new Promise((resolveExit) => {
+        child.once('exit', (code, signal) => resolveExit({ code, signal }));
+    });
+    assert.deepEqual(exit, { code: 0, signal: null }, `graceful shutdown failed: ${stderr}`);
+}
+finally {
+    rmSync(stateRoot, { recursive: true, force: true });
+}
+console.log('BOOKING COPILOT BIN PROOF: startup failure/listen/SIGTERM lifecycle OK');

package/dist/scripts/booking-copilot-cleanup-proof-helper.js

@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict';
+/**
+ * Keep a body failure while attempting every independent cleanup operation.
+ * Each attempt is awaited in dependency order, while its failure is retained
+ * so a later cleanup attempt still runs.
+ */
+export async function throwWithCleanupFailures(bodyFailed, bodyError, cleanupAttempts, settlement) {
+    const cleanupErrors = [];
+    for (const attempt of cleanupAttempts) {
+        try {
+            await attempt();
+        }
+        catch (error) {
+            cleanupErrors.push(error);
+        }
+    }
+    try {
+        await (cleanupErrors.length === 0 ? settlement?.onSuccess : settlement?.onFailure)?.();
+    }
+    catch (error) {
+        cleanupErrors.push(error);
+    }
+    if (!bodyFailed && cleanupErrors.length === 0)
+        return;
+    if (bodyFailed && cleanupErrors.length === 0)
+        throw bodyError;
+    throw new AggregateError(bodyFailed ? [bodyError, ...cleanupErrors] : cleanupErrors, 'booking_copilot_proof_cleanup_failed');
+}
+if (process.argv[2] === '--negative-control') {
+    const cleanupOrder = [];
+    const bodyError = new Error('proof body failure');
+    const plannerCleanupError = new Error('proof planner cleanup failure');
+    const portCleanupError = new Error('proof port cleanup failure');
+    let legacyCaught;
+    try {
+        try {
+            throw bodyError;
+        }
+        finally {
+            cleanupOrder.push('legacy-planner');
+            throw plannerCleanupError;
+        }
+    }
+    catch (error) {
+        legacyCaught = error;
+    }
+    assert.equal(legacyCaught, plannerCleanupError, 'legacy sequential finally masks the body error');
+    assert.deepEqual(cleanupOrder, ['legacy-planner'], 'legacy sequential finally skips cleanup after the first failure');
+    cleanupOrder.length = 0;
+    let caught;
+    try {
+        await throwWithCleanupFailures(true, bodyError, [
+            async () => { cleanupOrder.push('planner'); throw plannerCleanupError; },
+            async () => { cleanupOrder.push('port'); throw portCleanupError; },
+            async () => { cleanupOrder.push('server'); },
+        ], {
+            onSuccess: () => { cleanupOrder.push('state-deleted'); },
+            onFailure: () => { cleanupOrder.push('state-retained'); },
+        });
+    }
+    catch (error) {
+        caught = error;
+    }
+    assert.ok(caught instanceof AggregateError, 'body and cleanup failures are aggregated');
+    assert.deepEqual(caught.errors, [bodyError, plannerCleanupError, portCleanupError], 'body error remains first and all cleanup errors remain');
+    assert.deepEqual(cleanupOrder, ['planner', 'port', 'server', 'state-retained'], 'later cleanup runs and the failed tree keeps its evidence');
+    let cleanStateRemoved = false;
+    await assert.rejects(throwWithCleanupFailures(true, bodyError, [async () => { }], {
+        onSuccess: () => { cleanStateRemoved = true; },
+    }), (error) => error === bodyError);
+    assert.equal(cleanStateRemoved, true, 'successful cleanup removes state even when the body failed');
+    console.log(JSON.stringify({
+        legacy: { caught: plannerCleanupError.message, cleanupOrder: ['legacy-planner'] },
+        repaired: { body: bodyError.message, cleanup: [plannerCleanupError.message, portCleanupError.message], cleanupOrder },
+    }));
+}