@danceiny/gotry 0.0.1-rc.9 → 0.2.0-rc.28

package/dist/src/booking-surface/runtime.js

@@ -0,0 +1,1968 @@
+/** Durable, task-scoped runtime for the embedded Booking Copilot. */
+import { createHash, randomUUID } from 'node:crypto';
+import { BOOKING_COPILOT_MAX_OPERATIONS, } from './contracts.js';
+import { validateApprovalAgainstBlocker, validateCriterionBlocker, validateBookingReadAction, validateBookingIntentProjection, validateBookingSurfaceEvent, validateBookingSurface, isBookingDateTime, isSafeBookingRequestKey, } from './validation.js';
+import { assertWorkspaceLoadedOfferRefsUnique, canIssueOfferCheck, createAvailabilityPolicy, reduceAvailabilityAction, reduceAvailabilityReceipt, validateOffersReceiptWorkspace, availabilityPolicyResult, validateAvailabilityPolicy, } from './availability-policy.js';
+import { normalizeBookingErrorCode, safeBookingErrorMessage } from './error-codes.js';
+import { BOOKING_INTENT_ACTION_ORDINAL, BOOKING_INTENT_TARGET_ACTION, BOOKING_INTENT_TARGET_ORDINAL, } from './booking-intent.js';
+const LEDGER_SCHEMA = 'booking.copilot.ledger';
+const ACTOR = 'system:booking-copilot';
+const STARTED = 'booking.copilot.task.started';
+const TURN = 'booking.copilot.user.turn.observed';
+const ACTION = 'booking.copilot.action.issued';
+const RECEIPT = 'booking.copilot.receipt.observed';
+const EVENT = 'booking.copilot.event.emitted';
+const APPROVAL_GRANTED = 'booking.copilot.approval.granted';
+const APPROVAL_OFFERED = 'booking.copilot.approval.option.offered';
+const APPROVAL_CONSUMED = 'booking.copilot.approval.consumed';
+const DECISION_BATCH = 'booking.copilot.decision.batch';
+const REQUEST_BINDING = 'booking.copilot.request.binding';
+function stable(value) {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (!value || typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const key of Object.keys(value).sort())
+        out[key] = stable(value[key]);
+    return out;
+}
+export function bookingDigest(value) {
+    return createHash('sha256').update(JSON.stringify(stable(value))).digest('hex');
+}
+export function bookingWorkspaceDigest(workspace) {
+    const { contextRef: _contextRef, ...contextBoundWorkspace } = workspace;
+    return bookingDigest(contextBoundWorkspace);
+}
+function bookingWorkspaceSemanticDigest(workspace) {
+    const { contextRef: _contextRef, revision: _revision, ...semanticWorkspace } = workspace;
+    return bookingDigest(semanticWorkspace);
+}
+export function bookingTurnDigest(turn) {
+    return bookingDigest(turn);
+}
+function actionAdvancesIntent(action, intent) {
+    // Existing-order observation is an independent surface waypoint. Checkout
+    // preparation is deliberately not a prefix: the user-authorized Checkout
+    // flow creates a new trusted order context before observation can begin.
+    if (intent.target === 'order.observed')
+        return action.kind === 'order.observe';
+    const actionOrdinal = BOOKING_INTENT_ACTION_ORDINAL[action.kind];
+    const targetOrdinal = BOOKING_INTENT_TARGET_ORDINAL[intent.target];
+    // Earlier path steps may advance toward a later target; an action after
+    // that target is an overshoot and cannot be bound to the same intent.
+    if (actionOrdinal === undefined || targetOrdinal === undefined || actionOrdinal > targetOrdinal)
+        return false;
+    if (intent.offerCriteria && (action.kind === 'offers.query' || action.kind === 'offers.view.patch')) {
+        if (bookingDigest(action.input.criteria) !== bookingDigest(intent.offerCriteria))
+            return false;
+    }
+    if (intent.target === 'offers.compared' && action.kind === 'offers.compare') {
+        const targetCount = intent.offerCriteria?.targetCount ?? 3;
+        if (action.input.requestedCount !== targetCount)
+            return false;
+    }
+    return true;
+}
+function intentCheckpointDigest(value) {
+    return bookingDigest(value);
+}
+function validateIntentCheckpoint(checkpoint, state, action) {
+    const projection = validateBookingIntentProjection(checkpoint?.projection);
+    const { intentDigest: _digest, ...base } = checkpoint ?? {};
+    if (!projection.ok
+        || checkpoint.intentDigest !== intentCheckpointDigest(base)
+        || checkpoint.taskId !== state.taskId
+        || checkpoint.contextRef !== state.contextRef
+        || !state.allowedActions.includes(BOOKING_INTENT_TARGET_ACTION[checkpoint.projection.target])
+        || (state.activeIntent
+            ? bookingDigest(state.activeIntent) !== bookingDigest(checkpoint)
+            : checkpoint.sourceTurnId !== action.sourceTurnId
+                || checkpoint.sourceTurnId !== state.lastTurnId
+                || checkpoint.sourceRequestDigest !== state.lastTurnRequestDigest)) {
+        throw new Error('intent_checkpoint_invalid');
+    }
+    if (!actionAdvancesIntent(action, checkpoint.projection))
+        throw new Error('intent_checkpoint_invalid');
+}
+function bindIntentCheckpoint(state, action, projection) {
+    if (state.activeIntent) {
+        if (projection && bookingDigest(projection) !== bookingDigest(state.activeIntent.projection)) {
+            throw new Error('intent_mutation_forbidden');
+        }
+        return state.activeIntent;
+    }
+    if (!state.lastTurnId || !state.lastTurnRequestDigest)
+        throw new Error('intent_source_turn_missing');
+    const nextProjection = projection;
+    const checked = validateBookingIntentProjection(nextProjection);
+    if (!checked.ok)
+        throw new Error('invalid_booking_intent');
+    if (!state.allowedActions.includes(BOOKING_INTENT_TARGET_ACTION[nextProjection.target]))
+        throw new Error('intent_target_unsupported');
+    const base = {
+        taskId: state.taskId,
+        contextRef: state.contextRef,
+        sourceTurnId: state.lastTurnId,
+        sourceRequestDigest: state.lastTurnRequestDigest,
+        projection: JSON.parse(JSON.stringify(nextProjection)),
+    };
+    return { ...base, intentDigest: intentCheckpointDigest(base) };
+}
+function canonicalReceiptDigest(value) { return bookingDigest(value); }
+function replayDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingDigest(raw) || recordedDigest === bookingDigest(normalized));
+}
+function replayWorkspaceDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingWorkspaceDigest(raw) || recordedDigest === bookingWorkspaceDigest(normalized));
+}
+function replayWorkspaceSemanticDigestMatches(recordedDigest, raw, normalized) {
+    return typeof recordedDigest === 'string' && (recordedDigest === bookingWorkspaceSemanticDigest(raw) || recordedDigest === bookingWorkspaceSemanticDigest(normalized));
+}
+function rememberReplayWorkspaceDigest(digests, recordedDigest, raw, normalized) {
+    const normalizedDigest = bookingWorkspaceDigest(normalized);
+    digests.set(bookingWorkspaceDigest(raw), normalizedDigest);
+    if (typeof recordedDigest === 'string')
+        digests.set(recordedDigest, normalizedDigest);
+}
+function legacyOfferVersionRef(contextRef, offer) {
+    return `legacy-offer-version:${bookingDigest({
+        contextRef,
+        offerRef: offer.offerRef,
+        hotelRef: offer.hotelRef,
+        evidenceLevel: offer.evidenceLevel,
+        factRefs: Array.isArray(offer.factRefs) ? offer.factRefs : [],
+    }).slice(0, 40)}`;
+}
+function normalizeWorkspaceForReplay(raw) {
+    const candidate = raw;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !Array.isArray(candidate.loadedOffers) || typeof candidate.contextRef !== 'string')
+        throw new Error('booking_malformed_workspace');
+    const workspace = structuredClone(raw);
+    workspace.loadedOffers = workspace.loadedOffers.map((offer) => offer.offerVersionRef ? offer : { ...offer, offerVersionRef: legacyOfferVersionRef(workspace.contextRef, offer) });
+    delete workspace.verifiedOfferRef;
+    return workspace;
+}
+function resolveReplayOfferVersion(offerRef, workspace, action, actionId, priorAvailability) {
+    const priorAttempt = actionId ? priorAvailability?.attempts.find((attempt) => attempt.actionId === actionId) : undefined;
+    if (priorAttempt?.offerVersionRef)
+        return priorAttempt.offerVersionRef;
+    if (action?.kind === 'offer.check' && action.actionId === actionId && action.input.offerRef === offerRef && typeof action.input.offerVersionRef === 'string')
+        return action.input.offerVersionRef;
+    const match = workspace?.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    if (match?.offerVersionRef)
+        return match.offerVersionRef;
+    throw new Error('booking_replan_required:offer_version_unbound');
+}
+function normalizeAvailabilityPolicyForReplay(raw, workspace, action, priorAvailability, workspaceDigestMap = new Map(), receipt) {
+    const normalized = structuredClone(raw);
+    if (normalized.hotels && typeof normalized.hotels === 'object') {
+        for (const [hotelRef, hotel] of Object.entries(normalized.hotels)) {
+            const rawHotel = raw.hotels?.[hotelRef];
+            const priorHotel = priorAvailability?.hotels[hotelRef];
+            if (!Array.isArray(hotel.tombstonedOfferRefs))
+                hotel.tombstonedOfferRefs = priorHotel ? [...priorHotel.tombstonedOfferRefs] : [];
+            if (!Array.isArray(hotel.tombstonedOfferVersionRefs))
+                hotel.tombstonedOfferVersionRefs = priorHotel ? [...priorHotel.tombstonedOfferVersionRefs] : [];
+            if (rawHotel && Array.isArray(rawHotel.tombstonedOfferRefs) && priorHotel) {
+                for (const ref of priorHotel.tombstonedOfferRefs)
+                    if (!hotel.tombstonedOfferRefs.includes(ref))
+                        throw new Error('booking_replan_required:tombstone_regression');
+            }
+            if (rawHotel && Array.isArray(rawHotel.tombstonedOfferVersionRefs) && priorHotel) {
+                for (const ref of priorHotel.tombstonedOfferVersionRefs)
+                    if (!hotel.tombstonedOfferVersionRefs.includes(ref))
+                        throw new Error('booking_replan_required:tombstone_regression');
+            }
+            const source = hotel.currentGeneration?.source;
+            if (source?.kind === 'workspace_snapshot') {
+                const mappedDigest = workspaceDigestMap.get(source.workspaceDigest);
+                if (mappedDigest)
+                    source.workspaceDigest = mappedDigest;
+            }
+        }
+    }
+    if (Array.isArray(normalized.attempts)) {
+        normalized.attempts = normalized.attempts.map((attempt) => attempt.offerVersionRef ? attempt : { ...attempt, offerVersionRef: resolveReplayOfferVersion(attempt.offerRef, workspace, action, attempt.actionId, priorAvailability) });
+    }
+    const availability = receipt?.observation.kind === 'offer.availability' ? receipt.observation : undefined;
+    if (receipt && action?.kind === 'offer.check' && availability && availability.offerRef === action.input.offerRef && availability.checkedOfferVersionRef === action.input.offerVersionRef) {
+        const attempt = normalized.attempts.find((candidate) => candidate.actionId === action.actionId);
+        const hotel = attempt ? normalized.hotels[attempt.hotelRef] : undefined;
+        if (hotel) {
+            if (receipt.status === 'changed' && availability.available === true && availability.currentOfferVersionRef && availability.currentOfferVersionRef !== action.input.offerVersionRef) {
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef))
+                    hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+            }
+            const completeNegative = (receipt.status === 'unavailable' || receipt.status === 'no_match')
+                && receipt.resultContract.outcome === 'empty'
+                && receipt.resultContract.gapCodes.length === 0
+                && receipt.resultContract.blockers.length === 0
+                && availability.available === false
+                && !availability.currentOfferVersionRef
+                && !availability.verifiedOfferRef
+                && !availability.gapCodes?.length;
+            if (completeNegative) {
+                if (!hotel.tombstonedOfferVersionRefs.includes(action.input.offerVersionRef))
+                    hotel.tombstonedOfferVersionRefs.push(action.input.offerVersionRef);
+                if (!hotel.tombstonedOfferRefs.includes(action.input.offerRef))
+                    hotel.tombstonedOfferRefs.push(action.input.offerRef);
+            }
+        }
+    }
+    return normalized;
+}
+function normalizeActionCheckpointForReplay(raw, workspace) {
+    if (!['offer.select', 'offer.check', 'checkout.prepare'].includes(raw.kind) || typeof raw.input.offerVersionRef === 'string')
+        return raw;
+    if (typeof raw.input.offerRef !== 'string')
+        throw new Error('booking_replan_required:offer_version_unbound');
+    const offerVersionRef = resolveReplayOfferVersion(raw.input.offerRef, workspace, undefined, raw.actionId);
+    const input = { ...raw.input, offerVersionRef };
+    if (raw.kind === 'checkout.prepare' && (!workspace?.verifiedOffer || workspace.verifiedOffer.offerRef !== input.offerRef || workspace.verifiedOffer.offerVersionRef !== offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== input.verifiedOfferRef))
+        throw new Error('booking_replan_required:legacy_checkout_unverified');
+    const { actionDigest: _rawActionDigest, ...rawBase } = raw;
+    const normalizedBase = { ...rawBase, input, inputDigest: bookingDigest(input) };
+    return { ...normalizedBase, actionDigest: checkpointDigest(normalizedBase) };
+}
+function checkpointDigestMatchesForReplay(raw, normalized) {
+    const { actionDigest: _rawDigest, ...rawBase } = raw;
+    const { actionDigest: _normalizedDigest, ...normalizedBase } = normalized;
+    return raw.actionDigest === checkpointDigest(rawBase) || raw.actionDigest === checkpointDigest(normalizedBase);
+}
+function replanAfterReplayUpgradeGap(state, workspace = state.workspaceSnapshot, revision = workspace?.revision) {
+    if (!workspace)
+        return { ...state, phase: 'error', pendingAction: undefined };
+    const safeRevision = typeof revision === 'number' && Number.isSafeInteger(revision) ? revision : state.revision;
+    return {
+        ...state,
+        revision: safeRevision,
+        phase: 'planning',
+        pendingAction: undefined,
+        lastCompletedAction: undefined,
+        lastReceipt: undefined,
+        activeIntent: undefined,
+        awaitingApproval: undefined,
+        workspaceDigest: bookingWorkspaceDigest(workspace),
+        workspaceSemanticDigest: bookingWorkspaceSemanticDigest(workspace),
+        workspaceSnapshot: workspace,
+        availability: createAvailabilityPolicy(workspace),
+        replayUpgradeRequired: true,
+    };
+}
+function assertReplayUpgradeReanchored(state) {
+    if (state.replayUpgradeRequired)
+        throw new Error('reanchor_turn_required');
+}
+function consumedIdentityKey(eventId, sequence) { return `${eventId}\0${sequence}`; }
+function clearPendingBatch(consumed) {
+    consumed.pendingBatchKeys.clear();
+    consumed.pendingBatchOpen = false;
+}
+function rememberPendingBatchKey(consumed, key) {
+    consumed.pendingBatchKeys.add(key);
+}
+function rememberConsumedEventIdentity(consumed, payload) {
+    if (payload.eventKind === 'status' && (payload.status === 'submitted' || payload.status === 'working') && !consumed.pendingBatchOpen) {
+        clearPendingBatch(consumed);
+        consumed.pendingBatchOpen = true;
+    }
+    const key = consumedIdentityKey(payload.eventId, payload.sequence);
+    consumed.events.set(key, payload);
+    rememberPendingBatchKey(consumed, key);
+}
+function rememberConsumedActionIdentity(consumed, action) {
+    const key = consumedIdentityKey(action.eventId, action.sequence);
+    consumed.actions.set(key, action);
+    rememberPendingBatchKey(consumed, key);
+}
+function consumeSkippedActionOrdinal(state, payload, consumed) {
+    const action = payload.action;
+    const operationCount = payload.operationCount ?? state.operationCount + 1;
+    if (!action || typeof action !== 'object')
+        throw new Error('skip_action_invalid');
+    const { actionDigest: _actionDigest, ...actionBase } = action;
+    if (action.actionDigest !== checkpointDigest(actionBase) || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(action.sequence) || action.sequence <= state.lastSequence)
+        throw new Error('skip_action_invalid');
+    state.operationCount = operationCount;
+    state.lastSequence = action.sequence;
+    if (consumed) {
+        rememberConsumedActionIdentity(consumed, action);
+    }
+}
+function eventDraftDigest(event) {
+    if (event.kind === 'status')
+        return bookingDigest({ kind: event.kind, status: event.status });
+    if (event.kind === 'question')
+        return bookingDigest({ kind: event.kind, question: event.question });
+    if (event.kind === 'explanation')
+        return bookingDigest({ kind: event.kind, explanation: event.explanation });
+    if (event.kind === 'terminal')
+        return bookingDigest({ kind: event.kind, terminal: event.terminal });
+    return bookingDigest({ kind: event.kind, error: event.error });
+}
+function eventPayloadMatchesEvent(payload, event) {
+    const expectedDigest = eventDraftDigest(event);
+    const legacyTerminalDigest = event.kind === 'terminal' ? bookingDigest(event.terminal) : undefined;
+    return payload.eventId === event.eventId
+        && payload.sequence === event.sequence
+        && payload.emittedAt === event.emittedAt
+        && payload.contextRef === event.contextRef
+        && payload.eventKind === event.kind
+        && (event.kind !== 'status' || payload.status === event.status)
+        && (payload.contentDigest === expectedDigest || payload.contentDigest === legacyTerminalDigest);
+}
+function actionFromOperationEventForReplay(event, checkpoint) {
+    const action = event.action;
+    if ((action.kind === 'offer.select' || action.kind === 'offer.check' || action.kind === 'checkout.prepare') && typeof action.input.offerRef === 'string' && typeof action.input.offerVersionRef !== 'string' && typeof checkpoint.input.offerVersionRef === 'string') {
+        return { ...action, input: { ...action.input, offerVersionRef: checkpoint.input.offerVersionRef } };
+    }
+    if ((action.kind === 'offer.select' || action.kind === 'offer.check' || action.kind === 'checkout.prepare') && typeof action.input.offerRef === 'string' && typeof action.input.offerVersionRef === 'string' && typeof checkpoint.input.offerVersionRef !== 'string') {
+        // A pre-versioned ACTION row is the authority during a skipped legacy
+        // tail. Its duplicate decision envelope may still contain a newer
+        // offerVersionRef field. Ignore that unbound field for envelope identity;
+        // the action itself is never resumed and a fresh intent/turn is required.
+        const { offerVersionRef: _unboundVersion, ...legacyInput } = action.input;
+        return { ...action, input: legacyInput };
+    }
+    return action;
+}
+function operationEventMatchesAction(event, checkpoint) {
+    return event.eventId === checkpoint.eventId
+        && event.sequence === checkpoint.sequence
+        && event.emittedAt === checkpoint.emittedAt
+        && event.contextRef === checkpoint.contextRef
+        && matchesCheckpoint(actionFromOperationEventForReplay(event, checkpoint), checkpoint);
+}
+function normalizeDecisionBatchEnvelopeForReplay(payload, consumed, requireSchemaValid = false) {
+    if (typeof payload.requestKey !== 'string' || !payload.requestKey || !payload.events.length)
+        throw new Error('skip_decision_batch_invalid');
+    let lastBatchSequence = -1;
+    const seen = new Set();
+    const normalizedEvents = [];
+    for (const event of payload.events) {
+        if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence)
+            throw new Error('skip_decision_batch_invalid');
+        lastBatchSequence = event.sequence;
+        const key = consumedIdentityKey(event.eventId, event.sequence);
+        if (seen.has(key))
+            throw new Error('skip_decision_batch_invalid');
+        seen.add(key);
+        if (event.kind === 'operation') {
+            const checkpoint = consumed.actions.get(key);
+            if (!checkpoint || !operationEventMatchesAction(event, checkpoint))
+                throw new Error('skip_decision_batch_invalid');
+            const normalized = { ...event, action: actionFromOperationEventForReplay(event, checkpoint) };
+            if (requireSchemaValid && !validateBookingSurfaceEvent(normalized).ok)
+                throw new Error('skip_decision_batch_invalid');
+            normalizedEvents.push(normalized);
+        }
+        else {
+            const recorded = consumed.events.get(key);
+            if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event))
+                throw new Error('skip_decision_batch_invalid');
+            normalizedEvents.push(event);
+        }
+        if (!consumed.pendingBatchKeys.has(key))
+            throw new Error('skip_decision_batch_invalid');
+    }
+    if (seen.size !== consumed.pendingBatchKeys.size)
+        throw new Error('skip_decision_batch_invalid');
+    for (const key of consumed.pendingBatchKeys)
+        if (!seen.has(key))
+            throw new Error('skip_decision_batch_invalid');
+    clearPendingBatch(consumed);
+    return normalizedEvents;
+}
+function consumeSkippedEventSequence(state, payload, consumed) {
+    if (!payload || typeof payload !== 'object')
+        throw new Error('skip_event_invalid');
+    if ('sequence' in payload) {
+        const eventPayload = payload;
+        if (typeof eventPayload.eventId !== 'string' || !eventPayload.eventId || !['status', 'question', 'explanation', 'terminal', 'error'].includes(String(eventPayload.eventKind)) || typeof eventPayload.contentDigest !== 'string' || !/^[0-9a-f]{64}$/.test(eventPayload.contentDigest) || typeof eventPayload.sequence !== 'number' || !Number.isSafeInteger(eventPayload.sequence) || eventPayload.sequence <= state.lastSequence)
+            throw new Error('skip_event_invalid');
+        state.lastSequence = eventPayload.sequence;
+        rememberConsumedEventIdentity(consumed, eventPayload);
+    }
+    else if ('events' in payload && Array.isArray(payload.events)) {
+        normalizeDecisionBatchEnvelopeForReplay(payload, consumed);
+    }
+}
+function normalizeReceiptForReplay(raw, action, workspace) {
+    const receipt = structuredClone(raw);
+    if (action.kind === 'offer.select' && receipt.observation.kind === 'offer.selection' && receipt.observation.offerRef === action.input.offerRef && !receipt.observation.offerVersionRef) {
+        receipt.observation.offerVersionRef = action.input.offerVersionRef;
+    }
+    if (action.kind === 'checkout.prepare' && receipt.observation.kind === 'checkout.handoff' && receipt.observation.offerRef === action.input.offerRef && !receipt.observation.offerVersionRef) {
+        if (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== action.input.verifiedOfferRef)
+            throw new Error('booking_replan_required:legacy_checkout_unverified');
+        receipt.observation.offerVersionRef = action.input.offerVersionRef;
+    }
+    if (action.kind === 'offer.check' && receipt.observation.kind === 'offer.availability' && receipt.observation.offerRef === action.input.offerRef) {
+        if (!receipt.observation.checkedOfferVersionRef)
+            receipt.observation.checkedOfferVersionRef = action.input.offerVersionRef;
+        if (receipt.status === 'applied' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef)
+            receipt.observation.currentOfferVersionRef = action.input.offerVersionRef;
+        if (receipt.status === 'changed' && receipt.observation.available === true && !receipt.observation.currentOfferVersionRef) {
+            const current = workspace.loadedOffers.find((offer) => offer.offerRef === action.input.offerRef && offer.offerVersionRef !== action.input.offerVersionRef);
+            if (!current)
+                throw new Error('booking_replan_required:changed_version_unbound');
+            receipt.observation.currentOfferVersionRef = current.offerVersionRef;
+        }
+        if (receipt.status === 'applied' && receipt.observation.verifiedOfferRef && (!workspace.verifiedOffer || workspace.verifiedOffer.offerRef !== action.input.offerRef || workspace.verifiedOffer.offerVersionRef !== action.input.offerVersionRef || workspace.verifiedOffer.verifiedOfferRef !== receipt.observation.verifiedOfferRef))
+            throw new Error('booking_replan_required:legacy_verified_scalar');
+    }
+    if (receipt.resultContract.blockers.length && bookingDigest(raw) !== bookingDigest(receipt))
+        throw new Error('booking_replan_required:legacy_blocker_digest');
+    return receipt;
+}
+function errorText(result) { return result.ok ? '' : result.errors.join('; '); }
+function assertTaskId(taskId) { if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(taskId))
+    throw new Error('invalid_task_id'); }
+function assertSafeRef(value) { if (!/^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value))
+    throw new Error('unsafe_opaque_ref'); }
+function safeIdentity(value) { return typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value); }
+function sameActions(a, b) { return a.length === b.length && [...a].sort().every((x, i) => x === [...b].sort()[i]); }
+function availabilityPolicyTerminal(state) { return availabilityPolicyResult(state); }
+function availabilityTerminalEndsTask(terminal) {
+    return Boolean(terminal && terminal.code !== 'availability_confirmed');
+}
+function taskHasTerminalBudget(state) {
+    return state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS || availabilityTerminalEndsTask(state.availability.terminal);
+}
+function assertRequestKey(requestKey) {
+    if (!isSafeBookingRequestKey(requestKey))
+        throw new Error('unsafe_request_key');
+}
+/** Decision batches are runtime-owned and may contain long task/turn/action refs. */
+function assertInternalDecisionKey(requestKey) {
+    if (typeof requestKey !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,2047}$/.test(requestKey))
+        throw new Error('unsafe_internal_decision_key');
+}
+function progressDecisionKey(requestKey) {
+    return `progress:${bookingDigest(requestKey)}`;
+}
+function assertDecisionBatchFinality(decisions) {
+    let finalSeen = false;
+    for (const decision of decisions) {
+        const isFinal = decision.kind === 'terminal' || decision.kind === 'error';
+        if (finalSeen)
+            throw new Error('decision_batch_finality');
+        if (isFinal)
+            finalSeen = true;
+    }
+}
+function assertPrincipal(principal) {
+    if (!principal || typeof principal.subject !== 'string' || !principal.subject || principal.subject.length > 256 || typeof principal.scope !== 'string' || !principal.scope || principal.scope.length > 256)
+        throw new Error('trusted_principal_required');
+}
+function actionAllowedAfterAvailabilityConfirmed(state, action, now) {
+    const confirmed = state.lastReceipt;
+    return state.availability.terminal?.code === 'availability_confirmed'
+        && confirmed?.status === 'applied'
+        && confirmed.observation.kind === 'offer.availability'
+        && confirmed.observation.available === true
+        && confirmed.observation.currentOfferVersionRef === confirmed.observation.checkedOfferVersionRef
+        && action.kind === 'checkout.prepare'
+        && action.input.offerRef === confirmed.observation.offerRef
+        && action.input.offerVersionRef === confirmed.observation.checkedOfferVersionRef
+        && action.input.verifiedOfferRef === confirmed.observation.verifiedOfferRef
+        && Boolean(state.workspaceSnapshot && actionHitsCurrentOfferVersion(state.workspaceSnapshot, action, now));
+}
+function assertAvailabilityActionCompatible(state, action, now) {
+    if (!state.availability.recoveryStarted)
+        return;
+    if (!state.workspaceSnapshot)
+        throw new Error('availability_operation_required');
+    if (state.availability.terminal?.code === 'availability_confirmed') {
+        if (!actionAllowedAfterAvailabilityConfirmed(state, action, now))
+            throw new Error('availability_operation_incompatible');
+        return;
+    }
+    if (state.availability.terminal)
+        throw new Error('availability_operation_incompatible');
+    const activeHotelRef = state.availability.hotelRefs[state.availability.activeHotelOrdinal];
+    if (!activeHotelRef)
+        throw new Error('availability_active_hotel_missing');
+    if (state.availability.availabilityPhase === 'need_offers') {
+        if (action.kind !== 'offers.query' || action.input.hotelRefs.length !== 1 || action.input.hotelRefs[0] !== activeHotelRef)
+            throw new Error('availability_operation_incompatible');
+        return;
+    }
+    if (state.availability.availabilityPhase === 'need_check') {
+        if (action.kind !== 'offer.check' || !state.availability.hotels[activeHotelRef]?.currentOfferRefs.includes(action.input.offerRef) || !canIssueOfferCheck(state.availability, state.workspaceSnapshot, action.input.offerRef, action.input.offerVersionRef).ok)
+            throw new Error('availability_operation_incompatible');
+        return;
+    }
+    throw new Error('availability_operation_incompatible');
+}
+function checkoutReceiptPreparedHandoff(receipt) {
+    return receipt.status === 'applied'
+        && receipt.observation.kind === 'checkout.handoff'
+        && receipt.resultContract.outcome === 'complete'
+        && receipt.resultContract.hardCriteriaMet
+        && receipt.resultContract.gapCodes.length === 0
+        && receipt.resultContract.blockers.length === 0;
+}
+function assertAvailabilityLiveness(state, decisions, now) {
+    if (!state.availability.recoveryStarted)
+        return;
+    const operations = decisions.filter((decision) => decision.kind === 'operation');
+    if (state.availability.terminal?.code === 'availability_confirmed') {
+        if (!state.workspaceSnapshot)
+            throw new Error('availability_operation_required');
+        if (operations.length === 0) {
+            const last = decisions.at(-1);
+            if (!last || !['terminal', 'error'].includes(last.kind) || decisions.some((decision) => decision.kind !== 'explanation' && decision.kind !== 'terminal' && decision.kind !== 'error'))
+                throw new Error('availability_operation_required');
+            return;
+        }
+        if (operations.length !== 1 || decisions.length !== 1)
+            throw new Error('availability_operation_required');
+        assertAvailabilityActionCompatible(state, operations[0].action, now);
+        return;
+    }
+    if (operations.length !== 1)
+        throw new Error('availability_operation_required');
+    assertAvailabilityActionCompatible(state, operations[0].action, now);
+}
+function checkpointDigest(action) {
+    return bookingDigest(action);
+}
+function checkpointFor(action, eventId, sequence, emittedAt, sourceTurnId) {
+    const base = {
+        actionId: action.actionId,
+        kind: action.kind,
+        contextRef: action.contextRef,
+        expectedRevision: action.expectedRevision,
+        factRefs: [...action.factRefs],
+        reasonDigest: bookingDigest(action.reason),
+        inputDigest: bookingDigest(action.input),
+        input: action.input,
+        eventId,
+        sequence,
+        emittedAt,
+        sourceTurnId,
+        ...(action.relaxationApprovalRef ? { relaxationApprovalRef: action.relaxationApprovalRef } : {}),
+    };
+    return { ...base, actionDigest: checkpointDigest(base) };
+}
+function matchesCheckpoint(action, checkpoint) {
+    const candidate = checkpointFor(action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : { ...action, relaxationApprovalRef: checkpoint.relaxationApprovalRef }, checkpoint.eventId, checkpoint.sequence, checkpoint.emittedAt, checkpoint.sourceTurnId);
+    const { actionDigest: _ignored, ...candidateBase } = candidate;
+    return checkpoint.actionDigest === checkpointDigest(candidateBase);
+}
+function receiptSourceDigest(receipt) {
+    return bookingDigest({
+        ...receipt,
+        resultContract: {
+            ...receipt.resultContract,
+            blockers: receipt.resultContract.blockers.map(({ sourceReceiptDigest: _ignored, ...blocker }) => blocker),
+        },
+    });
+}
+function assertCanonicalReceipt(receipt) {
+    const expected = receiptSourceDigest(receipt);
+    if (receipt.resultContract.blockers.some((blocker) => blocker.sourceReceiptDigest !== expected))
+        throw new Error('receipt_source_digest_mismatch');
+}
+function receiptObservationMatchesAction(observation, action) {
+    if (observation === 'gap')
+        return true;
+    const expected = {
+        'search.patch': 'search.state', 'search.run': 'search.state', 'results.view.patch': 'results.state',
+        'hotel.focus': 'hotel.focus', 'hotel.select': 'hotel.selection', 'offers.query': 'offers.state',
+        'offers.view.patch': 'offers.state', 'offers.compare': 'offers.state', 'offer.select': 'offer.selection',
+        'offer.check': 'offer.availability', 'checkout.prepare': 'checkout.handoff', 'order.observe': 'order.state',
+    };
+    return expected[action] === observation;
+}
+function sameRefSet(a, b) {
+    return a.length === b.length && [...a].sort().every((value, index) => value === [...b].sort()[index]);
+}
+function receiptTargetMatchesAction(receipt, action) {
+    const observation = receipt.observation;
+    const input = action.input;
+    if (action.kind === 'hotel.focus' && observation.kind === 'hotel.focus')
+        return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'hotel.select' && observation.kind === 'hotel.selection')
+        return observation.hotelRef === input.hotelRef;
+    if (action.kind === 'offer.select' && observation.kind === 'offer.selection')
+        return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef;
+    if (action.kind === 'offer.check' && observation.kind === 'offer.availability')
+        return observation.offerRef === input.offerRef && observation.checkedOfferVersionRef === input.offerVersionRef;
+    if (action.kind === 'checkout.prepare' && observation.kind === 'checkout.handoff')
+        return observation.offerRef === input.offerRef && observation.offerVersionRef === input.offerVersionRef && observation.verifiedOfferRef === input.verifiedOfferRef;
+    if (action.kind === 'offers.query' && observation.kind === 'offers.state')
+        return sameRefSet(observation.hotelRefs, input.hotelRefs);
+    if (action.kind === 'offers.view.patch' && observation.kind === 'offers.state')
+        return observation.hotelRefs.includes(input.hotelRef);
+    if (action.kind === 'offers.compare' && observation.kind === 'offers.state') {
+        return observation.offerRefs.every((offerRef) => input.offerRefs.includes(offerRef))
+            && receipt.resultContract.requestedCount === input.requestedCount
+            && receipt.resultContract.actualCount === observation.offerRefs.length;
+    }
+    if (action.kind === 'order.observe' && observation.kind === 'order.state')
+        return observation.orderRef === input.orderRef;
+    return observation.kind === 'gap' || action.kind === 'search.patch' || action.kind === 'search.run' || action.kind === 'results.view.patch';
+}
+/**
+ * An offers.state receipt is only executable evidence when it is reconciled
+ * against the page's post-action loaded offer registry. The planner may
+ * propose the receipt shape, but it cannot create offer refs or counts that
+ * are absent from that registry.
+ */
+function assertOffersReceiptWorkspaceBinding(receipt, workspace, action) {
+    if (receipt.observation.kind !== 'offers.state')
+        return;
+    if (action.kind !== 'offers.query' && action.kind !== 'offers.view.patch')
+        return;
+    const hotelRefs = action.kind === 'offers.query' ? action.input.hotelRefs : [action.input.hotelRef];
+    validateOffersReceiptWorkspace(receipt, workspace, hotelRefs);
+    if (receipt.resultContract.actualCount !== undefined
+        && receipt.resultContract.actualCount !== receipt.observation.offerRefs.length) {
+        throw new Error('availability_offers_count_mismatch');
+    }
+}
+function workspaceBoundaryMatches(a, b) {
+    return a.locale === b.locale && a.currency === b.currency && a.surface === b.surface && a.contextRef === b.contextRef && a.capabilities.surface === b.capabilities.surface && sameActions(a.capabilities.allowedActions, b.capabilities.allowedActions);
+}
+function workspaceHasOfferVersion(workspace, offerRef, offerVersionRef) {
+    return workspace.loadedOffers.some((offer) => offer.offerRef === offerRef && offer.offerVersionRef === offerVersionRef);
+}
+function verifiedOfferMatches(workspace, input) {
+    return workspace.verifiedOffer?.offerRef === input.offerRef && workspace.verifiedOffer.offerVersionRef === input.offerVersionRef && workspace.verifiedOffer.verifiedOfferRef === input.verifiedOfferRef;
+}
+function verifiedOfferUnexpired(workspace, now) {
+    return Boolean(workspace.verifiedOffer && isBookingDateTime(workspace.verifiedOffer.expiresAt) && Date.parse(workspace.verifiedOffer.expiresAt) > Date.parse(now));
+}
+function actionHitsCurrentOfferVersion(workspace, action, now) {
+    if (action.kind === 'offer.select' || action.kind === 'offer.check')
+        return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef);
+    if (action.kind === 'checkout.prepare')
+        return workspaceHasOfferVersion(workspace, action.input.offerRef, action.input.offerVersionRef) && verifiedOfferMatches(workspace, action.input) && (now === undefined || verifiedOfferUnexpired(workspace, now));
+    return true;
+}
+function shortlistAfterCheckedOffer(previous, current, checkedOfferRef) {
+    if (sameActions(previous, current))
+        return true;
+    const removedChecked = previous.filter((ref) => ref !== checkedOfferRef);
+    return removedChecked.length === previous.length - 1 && sameActions(removedChecked, current);
+}
+function loadedOffersUnchanged(previous, current) {
+    return sameActions(previous.loadedOffers.map((offer) => bookingDigest(offer)), current.loadedOffers.map((offer) => bookingDigest(offer)));
+}
+function changedFactRefsMatch(previousFactRefs, currentFactRefs, changedFactRefs) {
+    if (!changedFactRefs.length)
+        return false;
+    const before = new Set(previousFactRefs);
+    const after = new Set(currentFactRefs);
+    const diff = [
+        ...previousFactRefs.filter((ref) => !after.has(ref)),
+        ...currentFactRefs.filter((ref) => !before.has(ref)),
+    ];
+    return sameActions(diff, changedFactRefs);
+}
+function loadedOffersChangedVersionOnly(previous, current, offerRef, currentOfferVersionRef, changedFactRefs) {
+    if (previous.loadedOffers.length !== current.loadedOffers.length)
+        return false;
+    const previousChecked = previous.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    const currentChecked = current.loadedOffers.find((offer) => offer.offerRef === offerRef);
+    if (!previousChecked || !currentChecked || previousChecked.hotelRef !== currentChecked.hotelRef || currentChecked.offerVersionRef !== currentOfferVersionRef || previousChecked.offerVersionRef === currentChecked.offerVersionRef)
+        return false;
+    if (previousChecked.evidenceLevel !== currentChecked.evidenceLevel)
+        return false;
+    if (!changedFactRefsMatch(previousChecked.factRefs, currentChecked.factRefs, changedFactRefs))
+        return false;
+    const previousOther = previous.loadedOffers.filter((offer) => offer.offerRef !== offerRef).map((offer) => bookingDigest(offer));
+    const currentOther = current.loadedOffers.filter((offer) => offer.offerRef !== offerRef).map((offer) => bookingDigest(offer));
+    return sameActions(previousOther, currentOther);
+}
+function availabilityReceiptIsComplete(receipt) {
+    return receipt.resultContract.outcome === 'complete'
+        && receipt.resultContract.hardCriteriaMet
+        && receipt.resultContract.gapCodes.length === 0
+        && receipt.resultContract.blockers.length === 0;
+}
+function offerCheckPostActionMatches(previous, current, action, receipt) {
+    const checkedOfferRef = action.input.offerRef;
+    const checkedOfferVersionRef = action.input.offerVersionRef;
+    const observation = receipt.observation.kind === 'offer.availability' ? receipt.observation : undefined;
+    const negative = receipt.status === 'unavailable' || receipt.status === 'no_match';
+    if (['applied', 'changed', 'unavailable', 'no_match'].includes(receipt.status) && !observation)
+        return false;
+    if (receipt.status === 'applied' && observation?.available && observation.verifiedOfferRef) {
+        if (!availabilityReceiptIsComplete(receipt) || observation.gapCodes?.length)
+            return false;
+        if (!loadedOffersUnchanged(previous, current))
+            return false;
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef !== checkedOfferVersionRef)
+            return false;
+        if (current.selectedOfferRef !== checkedOfferRef)
+            return false;
+        if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs))
+            return false;
+        if (!current.verifiedOffer || current.verifiedOffer.offerRef !== checkedOfferRef || current.verifiedOffer.offerVersionRef !== checkedOfferVersionRef || current.verifiedOffer.verifiedOfferRef !== observation.verifiedOfferRef || Number.isNaN(Date.parse(current.verifiedOffer.expiresAt)))
+            return false;
+        return true;
+    }
+    if (receipt.status === 'changed' && observation?.available && observation.currentOfferVersionRef) {
+        if (observation.checkedOfferVersionRef !== checkedOfferVersionRef || observation.currentOfferVersionRef === checkedOfferVersionRef || observation.verifiedOfferRef || !observation.changedFactRefs.length)
+            return false;
+        if (!loadedOffersChangedVersionOnly(previous, current, checkedOfferRef, observation.currentOfferVersionRef, observation.changedFactRefs))
+            return false;
+        if (current.selectedOfferRef !== checkedOfferRef || current.verifiedOffer !== undefined)
+            return false;
+        return sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs);
+    }
+    if (!loadedOffersUnchanged(previous, current))
+        return false;
+    if (negative) {
+        if (current.selectedOfferRef !== undefined || current.verifiedOffer !== undefined)
+            return false;
+        if (!shortlistAfterCheckedOffer(previous.shortlistedOfferRefs, current.shortlistedOfferRefs, checkedOfferRef))
+            return false;
+        return !current.shortlistedOfferRefs.includes(checkedOfferRef);
+    }
+    if (!sameActions(previous.shortlistedOfferRefs, current.shortlistedOfferRefs))
+        return false;
+    if (previous.selectedOfferRef !== current.selectedOfferRef)
+        return false;
+    if (bookingDigest(previous.verifiedOffer ?? null) !== bookingDigest(current.verifiedOffer ?? null))
+        return false;
+    return true;
+}
+function offerSelectPostActionMatches(previous, current, action, receipt) {
+    if (receipt.status !== 'applied')
+        return current.selectedOfferRef === previous.selectedOfferRef && loadedOffersUnchanged(previous, current);
+    if (receipt.observation.kind !== 'offer.selection' || receipt.observation.offerRef !== action.input.offerRef || receipt.observation.offerVersionRef !== action.input.offerVersionRef)
+        return false;
+    if (current.selectedOfferRef !== action.input.offerRef)
+        return false;
+    return loadedOffersUnchanged(previous, current);
+}
+const SEARCH_INVALIDATION_FIELDS = [
+    'results', 'visibleHotels', 'focusedHotelRef', 'loadedOffers',
+    'shortlistedOfferRefs', 'selectedOfferRef', 'verifiedOffer',
+];
+function searchPostActionMatches(current, action, receipt) {
+    if (receipt.revision === action.expectedRevision)
+        return true;
+    return current.focusedHotelRef === undefined
+        && current.loadedOffers.length === 0
+        && current.shortlistedOfferRefs.length === 0
+        && current.selectedOfferRef === undefined
+        && current.verifiedOffer === undefined;
+}
+function workspaceFieldDigest(value) {
+    // Hash an envelope so an absent optional field remains comparable instead
+    // of passing undefined to crypto.Hash.update(). Null stays distinguishable.
+    return bookingDigest({ value });
+}
+function workspacePostActionMatches(previous, current, action, receipt) {
+    if (!workspaceBoundaryMatches(previous, current))
+        return false;
+    const searchAction = action.kind === 'search.patch' || action.kind === 'search.run';
+    const searchMutation = searchAction && receipt.revision > action.expectedRevision;
+    if (searchAction && !searchPostActionMatches(current, action, receipt))
+        return false;
+    const mutable = {
+        'search.patch': ['searchDraft', ...SEARCH_INVALIDATION_FIELDS], 'search.run': [...SEARCH_INVALIDATION_FIELDS], 'results.view.patch': ['results'],
+        'hotel.focus': ['focusedHotelRef'], 'hotel.select': ['focusedHotelRef'],
+        'offers.query': ['loadedOffers'], 'offers.view.patch': ['loadedOffers'],
+        'offer.select': ['selectedOfferRef'], 'offer.check': ['selectedOfferRef', 'shortlistedOfferRefs', 'verifiedOffer', 'loadedOffers'],
+    };
+    if (action.kind === 'offer.select' && !offerSelectPostActionMatches(previous, current, { kind: 'offer.select', input: { offerRef: action.input.offerRef, offerVersionRef: action.input.offerVersionRef } }, receipt))
+        return false;
+    if (action.kind === 'offer.check' && !offerCheckPostActionMatches(previous, current, { kind: 'offer.check', input: { offerRef: action.input.offerRef, offerVersionRef: action.input.offerVersionRef } }, receipt))
+        return false;
+    const allowed = new Set(['revision', ...(searchAction && !searchMutation ? [] : (mutable[action.kind] ?? []))]);
+    const keys = new Set([...Object.keys(previous), ...Object.keys(current)]);
+    for (const key of keys) {
+        if (allowed.has(key))
+            continue;
+        if (workspaceFieldDigest(previous[key]) !== workspaceFieldDigest(current[key]))
+            return false;
+    }
+    return true;
+}
+function approvalOption(taskId, contextRef, sourceTurnId, presentationRequestKey, blocker, to, deliveryNonce) {
+    const base = {
+        taskId, contextRef, sourceTurnId, presentationRequestKey,
+        approvalId: `approval-${blocker.blockerId}-${to}`, deliveryNonce, blockerId: blocker.blockerId,
+        sourceActionId: blocker.sourceActionId, sourceReceiptDigest: blocker.sourceReceiptDigest,
+        scope: blocker.scope, code: blocker.code, criterionPath: blocker.criterionPath,
+        valueDigest: blocker.valueDigest, from: 'must', to, approved: true,
+    };
+    return { ...base, optionDigest: bookingDigest(base) };
+}
+function approvalOptionDigest(approval) {
+    const { optionDigest: _optionDigest, ...base } = approval;
+    return bookingDigest(base);
+}
+function presentationKey(taskId, sourceTurnId, actionId, receiptDigest) {
+    return `approval:${taskId}:${sourceTurnId}:${actionId}:${receiptDigest}`;
+}
+function assertApprovalRef(ref, state, action) {
+    const approval = state.awaitingApproval?.approval;
+    const blocker = state.awaitingApproval?.blocker;
+    if (!approval || !blocker || ref.approvalId !== approval.approvalId || ref.blockerId !== blocker.blockerId || ref.contextRef !== state.contextRef || ref.sourceTurnId !== state.awaitingApproval?.sourceTurnId || ref.presentationRequestKey !== state.awaitingApproval?.presentationRequestKey || ref.sourceActionId !== blocker.sourceActionId || ref.targetActionId !== action.actionId || ref.sourceRevision !== action.expectedRevision || ref.targetActionKind !== action.kind || ref.to !== approval.to || ref.expiresAt !== state.awaitingApproval?.expiresAt || ref.nonce !== state.awaitingApproval?.nonce || ref.sourceReceiptDigest !== blocker.sourceReceiptDigest || ref.scope !== blocker.scope || ref.code !== blocker.code || ref.criterionPath !== blocker.criterionPath || ref.valueDigest !== blocker.valueDigest)
+        throw new Error('ledger_corrupt:approval_ref');
+}
+export class BookingCopilotTaskRuntime {
+    ledger;
+    idFactory;
+    contextRefFactory;
+    now;
+    approvalTtlMs;
+    constructor(ledger, options = {}) {
+        this.ledger = ledger;
+        this.idFactory = options.idFactory ?? ((prefix) => `${prefix}-${randomUUID()}`);
+        this.contextRefFactory = options.contextRefFactory ?? (() => this.idFactory('context'));
+        this.now = options.now ?? (() => new Date().toISOString());
+        this.approvalTtlMs = options.approvalTtlMs ?? 120_000;
+    }
+    /** Read-only conflict check used before startTask can append a new turn. */
+    assertRequestBinding(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        if (input.requestKey !== requestKey)
+            throw new Error('request_conflict');
+        const existing = this.requestBinding(requestKey);
+        if (!existing)
+            return;
+        const candidate = this.requestBindingPayload(requestKey, turn, input);
+        if (existing.requestDigest !== candidate.requestDigest || existing.turnId !== candidate.turnId || existing.workspaceDigest !== candidate.workspaceDigest || existing.workspaceSemanticDigest !== candidate.workspaceSemanticDigest || existing.surface !== candidate.surface || existing.capabilityDigest !== candidate.capabilityDigest || existing.contextRef !== turn.workspace.contextRef || existing.principalDigest !== candidate.principalDigest || existing.scopeDigest !== candidate.scopeDigest || existing.taskHandle !== candidate.taskHandle)
+            throw new Error('request_conflict');
+    }
+    /** Verifies a direct planner turn against its durable TURN row. */
+    assertTurnBinding(taskId, turn) {
+        assertTaskId(taskId);
+        const row = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, taskId, TURN);
+        const observed = row.map(({ payload }) => JSON.parse(payload)).find((candidate) => candidate.turnId === turn.turnId);
+        if (!observed || observed.requestDigest !== bookingTurnDigest(turn) || observed.workspaceDigest !== bookingWorkspaceDigest(turn.workspace) || observed.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turn.workspace) || observed.contextRef !== turn.workspace.contextRef)
+            throw new Error('turn_conflict');
+    }
+    /** Rejects a canonical approval after its durable runtime consumption. */
+    assertApprovalNotConsumed(taskId, approval) {
+        assertTaskId(taskId);
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
+        for (const row of rows) {
+            const consumed = JSON.parse(row.payload);
+            if (consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval))
+                throw new Error('approval_replayed');
+        }
+    }
+    /** Persists the per-requestKey receipt/replay binding after task creation. */
+    persistRequestBinding(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        if (input.requestKey !== requestKey)
+            throw new Error('request_conflict');
+        const run = this.ledger.db.transaction(() => {
+            const state = this.requireTask(turn.taskId);
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
+            assertReplayUpgradeReanchored(state);
+            this.appendRequestBindingInTransaction(requestKey, turn, input);
+        });
+        run.immediate();
+    }
+    /** Binds the untrusted ingress snapshot to server-owned task/context/capabilities. */
+    bindIngressTurn(turn, task, turnId) {
+        assertSafeRef(turnId);
+        const approval = turn.request.approval;
+        if (approval && (approval.taskId !== task.taskId || approval.contextRef !== task.contextRef)) {
+            throw new Error('invalid_ingress_approval_authority');
+        }
+        return {
+            schemaVersion: 'booking.surface', kind: 'user.turn', taskId: task.taskId, turnId,
+            workspace: {
+                ...turn.workspace,
+                schemaVersion: 'booking.surface', contextRef: task.contextRef, surface: task.surface,
+                capabilities: { surface: task.surface, allowedActions: [...task.allowedActions] },
+            },
+            request: approval
+                ? { text: turn.request.text, approval: { ...approval } }
+                : { text: turn.request.text },
+        };
+    }
+    startTask(turn, requestBinding) {
+        const validation = validateBookingSurface(turn);
+        if (!validation.ok)
+            throw new Error(`invalid_planner_turn:${errorText(validation)}`);
+        if (turn.kind === 'user.turn.ingress')
+            throw new Error('ingress_binding_required');
+        if (turn.kind === 'action.receipt.continuation')
+            throw new Error('receipt_continuation_requires_continue');
+        const userTurn = turn;
+        if (!userTurn.taskId)
+            throw new Error('invalid_planner_turn:task_id_required');
+        const taskId = userTurn.taskId;
+        assertTaskId(taskId);
+        const turnId = userTurn.turnId;
+        if (!turnId)
+            throw new Error('invalid_planner_turn:turn_id_required');
+        assertSafeRef(turnId);
+        const contextRef = userTurn.workspace.contextRef;
+        const surface = userTurn.workspace.surface;
+        const revision = userTurn.workspace.revision;
+        const allowedActions = [...userTurn.workspace.capabilities.allowedActions];
+        const requestDigest = bookingTurnDigest(turn);
+        const boundWorkspace = userTurn.workspace;
+        assertWorkspaceLoadedOfferRefsUnique(boundWorkspace);
+        const workspaceDigest = bookingWorkspaceDigest(boundWorkspace);
+        const workspaceSemanticDigest = bookingWorkspaceSemanticDigest(boundWorkspace);
+        const availability = createAvailabilityPolicy(boundWorkspace);
+        const run = this.ledger.db.transaction(() => {
+            const existing = this.resumeTask(taskId);
+            if (existing) {
+                if (existing.contextRef !== contextRef)
+                    throw new Error('task_conflict:context_mismatch');
+                if (existing.surface !== surface)
+                    throw new Error('task_conflict:surface_mismatch');
+                if (existing.revision !== revision && existing.phase !== 'waiting_receipt' && !existing.replayUpgradeRequired)
+                    throw new Error('task_conflict:revision_mismatch');
+                if (!sameActions(existing.allowedActions, allowedActions))
+                    throw new Error('task_conflict:capability_mismatch');
+                if (existing.availability.terminal?.code === 'availability_confirmed' && (existing.revision !== revision || existing.workspaceSemanticDigest !== workspaceSemanticDigest))
+                    throw new Error('workspace_mismatch');
+                if (existing.phase === 'terminal' || existing.phase === 'error')
+                    throw new Error('task_terminal');
+                if (turnId && existing.lastTurnId === turnId) {
+                    this.assertTurnBinding(taskId, userTurn);
+                    if (requestBinding) {
+                        assertReplayUpgradeReanchored(existing);
+                        this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+                    }
+                    return existing;
+                }
+                if (existing.phase === 'waiting_receipt')
+                    throw new Error('receipt_required');
+                if (!existing.replayUpgradeRequired && existing.revision === revision && existing.workspaceSemanticDigest !== workspaceSemanticDigest)
+                    throw new Error('workspace_mismatch');
+                const approval = userTurn && 'approval' in userTurn.request ? userTurn.request.approval : undefined;
+                let approvalState;
+                if (approval) {
+                    assertReplayUpgradeReanchored(existing);
+                    const awaiting = existing.awaitingApproval;
+                    if (!awaiting)
+                        throw new Error('approval_not_awaiting');
+                    if (!awaiting.optionsEmitted)
+                        throw new Error('approval_not_presented');
+                    if (Date.parse(awaiting.expiresAt) <= Date.parse(this.now()))
+                        throw new Error('approval_expired');
+                    const checked = validateApprovalAgainstBlocker(approval, awaiting.blocker);
+                    const option = awaiting.options.find((candidate) => candidate.optionDigest === approval.optionDigest && bookingDigest(candidate) === bookingDigest(approval));
+                    if (!checked.ok || !option || approval.taskId !== existing.taskId || approval.contextRef !== existing.contextRef || approval.sourceTurnId !== awaiting.sourceTurnId || approval.presentationRequestKey !== awaiting.presentationRequestKey || approval.optionDigest !== approvalOptionDigest(approval) || (awaiting.approval && bookingDigest(approval) !== bookingDigest(awaiting.approval)))
+                        throw new Error('approval_mismatch');
+                    if (awaiting.approval && bookingDigest(awaiting.approval) === bookingDigest(approval)) {
+                        // The canonical approval may only be advanced by its original
+                        // turn identity. A fresh key must not join the in-flight planner
+                        // and receive the operation batch before durable consumption.
+                        throw new Error('approval_replayed');
+                    }
+                    approvalState = { ...awaiting, approval };
+                    this.appendApproval(taskId, existing.contextRef, approvalState);
+                }
+                else if (existing.awaitingApproval) {
+                    throw new Error('approval_required');
+                }
+                this.appendTurn(taskId, existing.contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, existing.userTurnCount + 1, turnId, boundWorkspace, Boolean(approval));
+                if (requestBinding)
+                    this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+                return this.requireTask(taskId);
+            }
+            if (userTurn?.request.approval)
+                throw new Error('approval_not_awaiting');
+            const started = { schema: LEDGER_SCHEMA, taskId, contextRef, surface, revision, allowedActions, workspaceDigest, workspaceSemanticDigest, workspace: boundWorkspace, availability, availabilityDigest: bookingDigest(availability) };
+            this.append(STARTED, taskId, started, `booking-copilot:task:${taskId}`);
+            this.appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, 1, turnId, boundWorkspace, false);
+            if (requestBinding)
+                this.appendRequestBindingInTransaction(requestBinding.requestKey, userTurn, requestBinding);
+            return this.requireTask(taskId);
+        });
+        return run.immediate();
+    }
+    resumeTask(taskId) {
+        assertTaskId(taskId);
+        const rows = this.rows(taskId);
+        if (!rows.length)
+            return null;
+        let state = null;
+        let skipLegacyUpgradeTail = false;
+        const replayWorkspaceDigests = new Map();
+        const consumed = { events: new Map(), actions: new Map(), pendingBatchKeys: new Set(), pendingBatchOpen: false };
+        const suppressedDecisionRequestKeys = new Set();
+        const suppressedRequestBindingKeys = new Set();
+        const suppressedReceiptActionIds = new Set();
+        const suppressedApprovalTargetActionIds = new Set();
+        for (const row of rows) {
+            const payload = JSON.parse(row.payload);
+            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId)
+                throw new Error(`ledger_corrupt:${taskId}:seq=${row.seq}`);
+            if (row.kind === STARTED) {
+                skipLegacyUpgradeTail = false;
+                if (state)
+                    throw new Error(`ledger_corrupt:${taskId}:duplicate_start`);
+                const started = payload;
+                let startedWorkspace;
+                try {
+                    startedWorkspace = normalizeWorkspaceForReplay(started.workspace);
+                }
+                catch {
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                }
+                let initialAvailability;
+                try {
+                    initialAvailability = createAvailabilityPolicy(startedWorkspace);
+                }
+                catch {
+                    throw new Error(`ledger_corrupt:${taskId}:start_availability`);
+                }
+                try {
+                    assertWorkspaceLoadedOfferRefsUnique(startedWorkspace);
+                }
+                catch {
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                }
+                rememberReplayWorkspaceDigest(replayWorkspaceDigests, started.workspaceDigest, started.workspace, startedWorkspace);
+                const startedAvailability = normalizeAvailabilityPolicyForReplay(started.availability, startedWorkspace, undefined, undefined, replayWorkspaceDigests);
+                if (!started.workspaceDigest || !started.workspaceSemanticDigest || !started.workspace || !started.availability || !started.availabilityDigest || !validateAvailabilityPolicy(startedAvailability) || !replayDigestMatches(started.availabilityDigest, started.availability, startedAvailability) || bookingDigest(initialAvailability) !== bookingDigest(startedAvailability) || !replayWorkspaceDigestMatches(started.workspaceDigest, started.workspace, startedWorkspace) || !replayWorkspaceSemanticDigestMatches(started.workspaceSemanticDigest, started.workspace, startedWorkspace))
+                    throw new Error(`ledger_corrupt:${taskId}:start_workspace`);
+                state = { schemaVersion: 'booking.surface', taskId, contextRef: started.contextRef, surface: started.surface, revision: started.revision, allowedActions: [...started.allowedActions], userTurnCount: 0, operationCount: 0, phase: availabilityTerminalEndsTask(startedAvailability.terminal) ? 'terminal' : 'planning', lastSequence: 0, workspaceDigest: bookingWorkspaceDigest(startedWorkspace), workspaceSemanticDigest: bookingWorkspaceSemanticDigest(startedWorkspace), workspaceSnapshot: startedWorkspace, availability: startedAvailability };
+            }
+            else {
+                if (!state)
+                    throw new Error(`ledger_corrupt:${taskId}:event_before_start`);
+                if (payload.contextRef !== state.contextRef)
+                    throw new Error(`ledger_corrupt:${taskId}:context_drift`);
+                if (row.kind === REQUEST_BINDING) {
+                    if (skipLegacyUpgradeTail) {
+                        const binding = payload;
+                        if (typeof binding.requestKey === 'string')
+                            suppressedRequestBindingKeys.add(binding.requestKey);
+                        continue;
+                    }
+                    const binding = payload;
+                    const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, TURN);
+                    const rawBoundTurn = turnRows.map(({ payload }) => JSON.parse(payload)).find((candidate) => candidate.turnId === binding.turnId);
+                    let boundTurn;
+                    try {
+                        boundTurn = rawBoundTurn ? { ...rawBoundTurn, workspace: normalizeWorkspaceForReplay(rawBoundTurn.workspace) } : undefined;
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:request_binding`);
+                    }
+                    if (!isSafeBookingRequestKey(binding.requestKey) || !safeIdentity(binding.turnId) || !safeIdentity(binding.contextRef) || (binding.taskHandle !== undefined && !safeIdentity(binding.taskHandle)) || !/^[0-9a-f]{64}$/.test(binding.requestDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceDigest) || !/^[0-9a-f]{64}$/.test(binding.workspaceSemanticDigest) || !/^[0-9a-f]{64}$/.test(binding.capabilityDigest) || !/^[0-9a-f]{64}$/.test(binding.principalDigest) || !/^[0-9a-f]{64}$/.test(binding.scopeDigest) || !['tenant', 'customer_portal', 'storefront', 'payment_link'].includes(binding.surface) || !boundTurn || boundTurn.requestDigest !== binding.requestDigest || boundTurn.workspaceDigest !== binding.workspaceDigest || boundTurn.workspaceSemanticDigest !== binding.workspaceSemanticDigest || bookingDigest(boundTurn.workspace.capabilities) !== binding.capabilityDigest || boundTurn.workspace.surface !== binding.surface)
+                        throw new Error(`ledger_corrupt:${taskId}:request_binding`);
+                }
+                else if (row.kind === TURN) {
+                    skipLegacyUpgradeTail = false;
+                    const t = payload;
+                    if (Object.prototype.hasOwnProperty.call(payload, 'approval'))
+                        throw new Error(`ledger_corrupt:${taskId}:turn_approval`);
+                    let turnWorkspace;
+                    try {
+                        turnWorkspace = normalizeWorkspaceForReplay(t.workspace);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    }
+                    try {
+                        assertWorkspaceLoadedOfferRefsUnique(turnWorkspace);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    }
+                    if (!t.workspaceDigest || !t.workspaceSemanticDigest || !t.workspace || !replayWorkspaceDigestMatches(t.workspaceDigest, t.workspace, turnWorkspace) || !replayWorkspaceSemanticDigestMatches(t.workspaceSemanticDigest, t.workspace, turnWorkspace))
+                        throw new Error(`ledger_corrupt:${taskId}:turn_workspace`);
+                    // Same-revision replay guard: an ordinary TURN row must not silently
+                    // rewrite the durable workspace semantic digest. A ledger written by
+                    // an old public startTask (no live-time same-revision guard) would
+                    // otherwise smuggle a verifiedOffer/loadedOffer/selection drift into
+                    // replay and turn the replayed workspace into checkout authority.
+                    // The explicit replayUpgradeRequired reanchor stays intact for the
+                    // legacy-tail replan path.
+                    if (state.availability.terminal?.code === 'availability_confirmed' && (state.revision !== turnWorkspace.revision || state.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turnWorkspace)))
+                        throw new Error(`ledger_corrupt:${taskId}:confirmed_workspace_drift`);
+                    if (!state.replayUpgradeRequired && state.revision === turnWorkspace.revision && state.workspaceSemanticDigest !== bookingWorkspaceSemanticDigest(turnWorkspace))
+                        throw new Error(`ledger_corrupt:${taskId}:same_revision_turn_workspace_drift`);
+                    rememberReplayWorkspaceDigest(replayWorkspaceDigests, t.workspaceDigest, t.workspace, turnWorkspace);
+                    state.userTurnCount++;
+                    state.lastTurnId = t.turnId;
+                    if (!/^[0-9a-f]{64}$/.test(t.requestDigest))
+                        throw new Error(`ledger_corrupt:${taskId}:turn_request_digest`);
+                    state.lastTurnRequestDigest = t.requestDigest;
+                    if (!t.preserveIntent) {
+                        delete state.activeIntent;
+                        delete state.lastCompletedAction;
+                        delete state.lastReceipt;
+                    }
+                    state.workspaceDigest = bookingWorkspaceDigest(turnWorkspace);
+                    state.workspaceSemanticDigest = bookingWorkspaceSemanticDigest(turnWorkspace);
+                    state.workspaceSnapshot = turnWorkspace;
+                    state.revision = turnWorkspace.revision;
+                    delete state.replayUpgradeRequired;
+                    // Approval authority is established only by APPROVAL_GRANTED; a turn
+                    // is merely an observation and cannot restore or mutate approval state.
+                }
+                else if (row.kind === APPROVAL_GRANTED) {
+                    if (skipLegacyUpgradeTail)
+                        continue;
+                    const granted = payload;
+                    if (!granted.approval || granted.approvalDigest !== bookingDigest(granted.approval) || !granted.approval.sourceTurnId || !granted.approval.presentationRequestKey || !validateCriterionBlocker(granted.approval.blocker).ok || !granted.approval.options?.length || granted.approval.options.some((option) => !validateApprovalAgainstBlocker(option, granted.approval.blocker).ok || option.taskId !== taskId || option.contextRef !== state.contextRef || option.sourceTurnId !== granted.approval.sourceTurnId || option.presentationRequestKey !== granted.approval.presentationRequestKey || option.optionDigest !== approvalOptionDigest(option)) || (granted.approval.approval && !granted.approval.options.some((option) => bookingDigest(option) === bookingDigest(granted.approval.approval))))
+                        throw new Error(`ledger_corrupt:${taskId}:approval_granted`);
+                    state.awaitingApproval = granted.approval;
+                    state.phase = 'input_required';
+                }
+                else if (row.kind === APPROVAL_OFFERED) {
+                    if (skipLegacyUpgradeTail)
+                        continue;
+                    const offered = payload;
+                    if (!offered.approval || offered.approvalDigest !== bookingDigest(offered.approval) || !state.awaitingApproval || bookingDigest(offered.approval) !== bookingDigest(state.awaitingApproval))
+                        throw new Error(`ledger_corrupt:${taskId}:approval_offered`);
+                    // This is a durable outbox intent only.  It is deliberately not
+                    // evidence that the question entered a replayable output batch:
+                    // a crash between this row and DECISION_BATCH must still reject an
+                    // approval until the exact question can be replayed.
+                    state.phase = 'input_required';
+                }
+                else if (row.kind === ACTION) {
+                    const actionPayload = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                        }
+                        catch {
+                            throw new Error(`ledger_corrupt:${taskId}:action`);
+                        }
+                        continue;
+                    }
+                    const rawAction = actionPayload.action;
+                    const operationCount = actionPayload.operationCount ?? state.operationCount + 1;
+                    const { actionDigest: _rawActionDigest, ...rawActionBase } = rawAction;
+                    if (rawAction.actionDigest !== checkpointDigest(rawActionBase) || rawAction.contextRef !== state.contextRef || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !Number.isSafeInteger(rawAction.sequence) || rawAction.sequence <= state.lastSequence)
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
+                    const hasIntent = Object.prototype.hasOwnProperty.call(actionPayload, 'intent');
+                    if (!hasIntent) {
+                        // Pre-intent rows remain readable without being upgraded into a
+                        // guessed user goal. Stop before applying newer action invariants,
+                        // preserve the ordinal, and suppress the legacy tail until a fresh
+                        // user turn reanchors the workspace and intent.
+                        state = replanAfterReplayUpgradeGap(state);
+                        try {
+                            consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                        }
+                        catch {
+                            throw new Error(`ledger_corrupt:${taskId}:action`);
+                        }
+                        skipLegacyUpgradeTail = true;
+                        continue;
+                    }
+                    let a;
+                    try {
+                        a = normalizeActionCheckpointForReplay(rawAction, state.workspaceSnapshot);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            state = replanAfterReplayUpgradeGap(state);
+                            try {
+                                consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                            }
+                            catch {
+                                throw new Error(`ledger_corrupt:${taskId}:action`);
+                            }
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    const { actionDigest: _actionDigest, ...actionBase } = a;
+                    if (!actionPayload.availability || actionPayload.availabilityDigest !== bookingDigest(actionPayload.availability))
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
+                    let actionAvailability;
+                    try {
+                        actionAvailability = normalizeAvailabilityPolicyForReplay(actionPayload.availability, state.workspaceSnapshot, a, state.availability, replayWorkspaceDigests);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            state = replanAfterReplayUpgradeGap(state);
+                            try {
+                                consumeSkippedActionOrdinal(state, actionPayload, consumed);
+                            }
+                            catch {
+                                throw new Error(`ledger_corrupt:${taskId}:action`);
+                            }
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    if (!checkpointDigestMatchesForReplay(rawAction, a) || a.actionDigest !== checkpointDigest(actionBase) || a.sourceTurnId !== state.lastTurnId || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount + 1 || operationCount > BOOKING_COPILOT_MAX_OPERATIONS || !validateAvailabilityPolicy(actionAvailability) || !replayDigestMatches(actionPayload.availabilityDigest, actionPayload.availability, actionAvailability) || !state.workspaceSnapshot)
+                        throw new Error(`ledger_corrupt:${taskId}:action`);
+                    if (actionPayload.intent) {
+                        try {
+                            validateIntentCheckpoint(actionPayload.intent, state, a);
+                        }
+                        catch {
+                            throw new Error(`ledger_corrupt:${taskId}:intent`);
+                        }
+                    }
+                    else
+                        throw new Error(`ledger_corrupt:${taskId}:intent`);
+                    if (a.relaxationApprovalRef)
+                        assertApprovalRef(a.relaxationApprovalRef, state, a);
+                    if (state.pendingAction)
+                        throw new Error(`ledger_corrupt:${taskId}:parallel_actions`);
+                    let expectedAvailability;
+                    try {
+                        expectedAvailability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, a);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:action_transition`);
+                    }
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(actionAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:action_transition`);
+                    state.operationCount = operationCount;
+                    state.availability = actionAvailability;
+                    if (actionPayload.intent)
+                        state.activeIntent = actionPayload.intent;
+                    state.pendingAction = a;
+                    state.phase = 'waiting_receipt';
+                    state.lastSequence = Math.max(state.lastSequence, a.sequence);
+                    {
+                        rememberConsumedActionIdentity(consumed, a);
+                    }
+                    delete state.awaitingApproval;
+                }
+                else if (row.kind === RECEIPT) {
+                    if (skipLegacyUpgradeTail) {
+                        const r = payload;
+                        if (typeof r.receipt?.actionId === 'string')
+                            suppressedReceiptActionIds.add(r.receipt.actionId);
+                        // A standalone legacy action has no decision envelope to consume
+                        // its pending identity set. Its receipt closes that skipped unit;
+                        // otherwise a later, freshly anchored batch is falsely treated as
+                        // a graft containing identities from the legacy action.
+                        clearPendingBatch(consumed);
+                        continue;
+                    }
+                    const r = payload;
+                    const operationCount = r.operationCount ?? state.operationCount;
+                    if (!state.pendingAction || state.pendingAction.actionId !== r.receipt.actionId)
+                        throw new Error(`ledger_corrupt:${taskId}:orphan_receipt`);
+                    let receiptWorkspace;
+                    try {
+                        receiptWorkspace = normalizeWorkspaceForReplay(r.workspace);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    }
+                    try {
+                        assertWorkspaceLoadedOfferRefsUnique(receiptWorkspace);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    }
+                    if (!r.workspaceDigest || !r.workspaceSemanticDigest || !r.workspace || !replayWorkspaceDigestMatches(r.workspaceDigest, r.workspace, receiptWorkspace) || !replayWorkspaceSemanticDigestMatches(r.workspaceSemanticDigest, r.workspace, receiptWorkspace))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_workspace`);
+                    rememberReplayWorkspaceDigest(replayWorkspaceDigests, r.workspaceDigest, r.workspace, receiptWorkspace);
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, r.receipt) || r.receipt.contextRef !== state.contextRef || r.receipt.actionId !== state.pendingAction.actionId || !Number.isSafeInteger(r.receipt.revision) || r.receipt.revision < state.pendingAction.expectedRevision || !Number.isSafeInteger(operationCount) || operationCount !== state.operationCount)
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (!r.availability || r.availabilityDigest !== bookingDigest(r.availability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    let receipt;
+                    try {
+                        receipt = normalizeReceiptForReplay(r.receipt, state.pendingAction, receiptWorkspace);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            clearPendingBatch(consumed);
+                            state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    let receiptAvailability;
+                    try {
+                        receiptAvailability = normalizeAvailabilityPolicyForReplay(r.availability, receiptWorkspace, state.pendingAction, state.availability, replayWorkspaceDigests, receipt);
+                    }
+                    catch (error) {
+                        if (error instanceof Error && error.message.startsWith('booking_replan_required:')) {
+                            clearPendingBatch(consumed);
+                            state = replanAfterReplayUpgradeGap(state, receiptWorkspace, r.receipt.revision);
+                            skipLegacyUpgradeTail = true;
+                            continue;
+                        }
+                        throw error;
+                    }
+                    if (!replayDigestMatches(r.receiptDigest, r.receipt, receipt) || !validateBookingSurface(receipt).ok || !r.availability || !r.availabilityDigest || !validateAvailabilityPolicy(receiptAvailability) || !replayDigestMatches(r.availabilityDigest, r.availability, receiptAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt`);
+                    if (Boolean(r.availabilityTerminal) !== Boolean(receiptAvailability.terminal) || (r.availabilityTerminal && receiptAvailability.terminal && bookingDigest(r.availabilityTerminal) !== bookingDigest(receiptAvailability.terminal)))
+                        throw new Error(`ledger_corrupt:${taskId}:availability_terminal`);
+                    assertCanonicalReceipt(receipt);
+                    try {
+                        assertOffersReceiptWorkspaceBinding(receipt, receiptWorkspace, state.pendingAction);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    }
+                    if (!state.workspaceSnapshot || !workspacePostActionMatches(state.workspaceSnapshot, receiptWorkspace, state.pendingAction, receipt) || !receiptObservationMatchesAction(receipt.observation.kind, state.pendingAction.kind) || !receiptTargetMatchesAction(receipt, state.pendingAction))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    let expectedAvailability;
+                    try {
+                        expectedAvailability = reduceAvailabilityReceipt(state.availability, receiptWorkspace, receipt, state.pendingAction);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    }
+                    if (bookingDigest(expectedAvailability) !== bookingDigest(receiptAvailability))
+                        throw new Error(`ledger_corrupt:${taskId}:receipt_transition`);
+                    state.lastCompletedAction = state.pendingAction;
+                    state.lastReceipt = receipt;
+                    state.revision = receipt.revision;
+                    state.workspaceDigest = bookingWorkspaceDigest(receiptWorkspace);
+                    state.workspaceSemanticDigest = bookingWorkspaceSemanticDigest(receiptWorkspace);
+                    state.workspaceSnapshot = receiptWorkspace;
+                    state.availability = receiptAvailability;
+                    delete state.pendingAction;
+                    state.phase = availabilityTerminalEndsTask(receiptAvailability.terminal) || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS ? 'terminal' : 'planning';
+                    clearPendingBatch(consumed);
+                    delete state.awaitingApproval;
+                }
+                else if (row.kind === APPROVAL_CONSUMED) {
+                    if (skipLegacyUpgradeTail) {
+                        const consumed = payload;
+                        if (typeof consumed.ref?.targetActionId === 'string')
+                            suppressedApprovalTargetActionIds.add(consumed.ref.targetActionId);
+                        continue;
+                    }
+                    const consumed = payload;
+                    if (!consumed.ref || consumed.approvalDigest !== bookingDigest(consumed.ref) || !consumed.approval?.approval || !consumed.approval.options?.some((option) => bookingDigest(option) === bookingDigest(consumed.approval.approval)) || !state.awaitingApproval || bookingDigest(consumed.approval) !== bookingDigest(state.awaitingApproval) || consumed.ref.approvalId !== consumed.approval.approval.approvalId || consumed.ref.blockerId !== consumed.approval.blocker.blockerId || consumed.ref.contextRef !== state.contextRef || consumed.ref.sourceTurnId !== consumed.approval.sourceTurnId || consumed.ref.presentationRequestKey !== consumed.approval.presentationRequestKey || consumed.ref.sourceActionId !== consumed.approval.blocker.sourceActionId || consumed.ref.targetActionId === '' || consumed.ref.sourceReceiptDigest !== consumed.approval.blocker.sourceReceiptDigest || consumed.ref.nonce !== consumed.approval.nonce || consumed.ref.nonce !== consumed.approval.approval.deliveryNonce || consumed.ref.to !== consumed.approval.approval.to || consumed.ref.scope !== consumed.approval.blocker.scope || consumed.ref.code !== consumed.approval.blocker.code || consumed.ref.criterionPath !== consumed.approval.blocker.criterionPath || consumed.ref.valueDigest !== consumed.approval.blocker.valueDigest)
+                        throw new Error(`ledger_corrupt:${taskId}:approval`);
+                }
+                else if (row.kind === DECISION_BATCH) {
+                    const batch = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedEventSequence(state, batch, consumed);
+                        }
+                        catch {
+                            throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                        }
+                        if (typeof batch.requestKey === 'string')
+                            suppressedDecisionRequestKeys.add(batch.requestKey);
+                        continue;
+                    }
+                    if (!batch.requestKey || !Array.isArray(batch.events) || batch.events.some((event) => event.taskId !== taskId))
+                        throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                    let batchEvents;
+                    try {
+                        batchEvents = normalizeDecisionBatchEnvelopeForReplay(batch, consumed, true);
+                    }
+                    catch {
+                        throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+                    }
+                    for (const event of batchEvents) {
+                        if (event.kind !== 'question')
+                            continue;
+                        const awaiting = state.awaitingApproval;
+                        if (!awaiting || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => bookingDigest(option) === bookingDigest(approval))))
+                            throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+                        // Only the atomic, durable batch makes the presentation nonce
+                        // usable.  APPROVAL_OFFERED alone is intentionally insufficient.
+                        awaiting.optionsEmitted = true;
+                        state.phase = 'input_required';
+                    }
+                }
+                else if (row.kind === EVENT) {
+                    const event = payload;
+                    if (skipLegacyUpgradeTail) {
+                        try {
+                            consumeSkippedEventSequence(state, event, consumed);
+                        }
+                        catch {
+                            throw new Error(`ledger_corrupt:${taskId}:event`);
+                        }
+                        continue;
+                    }
+                    state.lastSequence = Math.max(state.lastSequence, event.sequence);
+                    {
+                        rememberConsumedEventIdentity(consumed, event);
+                    }
+                    if (event.eventKind === 'status')
+                        state.phase = event.status === 'submitted' ? 'submitted' : event.status === 'working' ? 'working' : event.status === 'waiting_receipt' ? 'waiting_receipt' : 'input_required';
+                    else if (event.eventKind === 'question')
+                        state.phase = 'input_required';
+                    else if (event.eventKind === 'terminal')
+                        state.phase = 'terminal';
+                    else if (event.eventKind === 'error')
+                        state.phase = 'error';
+                }
+            }
+        }
+        if (state) {
+            if (suppressedDecisionRequestKeys.size)
+                state.legacySuppressedDecisionRequestKeys = [...suppressedDecisionRequestKeys];
+            if (suppressedRequestBindingKeys.size)
+                state.legacySuppressedRequestBindingKeys = [...suppressedRequestBindingKeys];
+            if (suppressedReceiptActionIds.size)
+                state.legacySuppressedReceiptActionIds = [...suppressedReceiptActionIds];
+            if (suppressedApprovalTargetActionIds.size)
+                state.legacySuppressedApprovalTargetActionIds = [...suppressedApprovalTargetActionIds];
+        }
+        return state;
+    }
+    withReceiptDigest(receipt) {
+        // The source receipt digest is the authority used by the approval binding.
+        const sourceDigest = receiptSourceDigest(receipt);
+        return { ...receipt, resultContract: { ...receipt.resultContract, blockers: receipt.resultContract.blockers.map((b) => ({ ...b, sourceReceiptDigest: sourceDigest })) } };
+    }
+    receiptDigest(receipt) { return canonicalReceiptDigest(receipt); }
+    /** Builds the only relaxation question exposed to the planner stream. The
+     * blocker is ledger-derived; a planner cannot invent its tuple or ref. */
+    approvalQuestion(taskId) {
+        const task = this.requireTask(taskId);
+        const awaiting = task.awaitingApproval;
+        if (!awaiting)
+            throw new Error('approval_not_awaiting');
+        return {
+            kind: 'question',
+            question: {
+                questionId: `question-${awaiting.blocker.blockerId}`,
+                prompt: `Relax required criterion ${awaiting.blocker.criterionPath}?`,
+                missingFields: [awaiting.blocker.criterionPath],
+                type: 'relaxation_approval_required',
+                blocker: awaiting.blocker,
+                approvalOptions: awaiting.options.map((approval) => ({ approval })),
+            },
+        };
+    }
+    approvalPresentationRequestKey(taskId) {
+        const task = this.requireTask(taskId);
+        const awaiting = task.awaitingApproval;
+        if (!awaiting)
+            throw new Error('approval_not_awaiting');
+        return awaiting.presentationRequestKey;
+    }
+    commitDecisionBatch(taskId, requestKey, decisions) {
+        return this.applyDecisionBatch(taskId, requestKey, decisions);
+    }
+    /**
+     * Persists the server's initial SSE progress before planner execution. The
+     * progress batch has a derived idempotency key, so the final decision batch
+     * keeps the public request key and never repeats these status events.
+     */
+    ensureProgressBatch(taskId, requestKey, includeSubmitted = false) {
+        assertInternalDecisionKey(requestKey);
+        const progressKey = progressDecisionKey(requestKey);
+        const prior = this.readDecisionBatch(taskId, progressKey);
+        if (prior)
+            return prior;
+        if (this.readDecisionBatch(taskId, requestKey))
+            return [];
+        const run = this.ledger.db.transaction(() => {
+            const state = this.requireTask(taskId);
+            if (state.phase === 'terminal' || state.phase === 'error')
+                return [];
+            const recorded = this.readDecisionBatch(taskId, progressKey);
+            if (recorded)
+                return recorded;
+            const events = [];
+            if (includeSubmitted)
+                events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'submitted' }));
+            events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'working' }));
+            this.append(DECISION_BATCH, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, requestKey: progressKey, events }, `booking-copilot:decision-batch:${taskId}:${progressKey}`);
+            return events;
+        });
+        return run.immediate();
+    }
+    readProgressBatch(taskId, requestKey) {
+        assertInternalDecisionKey(requestKey);
+        return this.readDecisionBatch(taskId, progressDecisionKey(requestKey));
+    }
+    readDecisionBatch(taskId, requestKey) {
+        const state = this.requireTask(taskId);
+        if (state.legacySuppressedDecisionRequestKeys?.includes(requestKey))
+            throw new Error('request_key_invalidated');
+        const rows = this.ledger.db.prepare('SELECT seq, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq DESC').all(this.ledger.tenant, taskId, DECISION_BATCH);
+        for (const row of rows) {
+            const payload = JSON.parse(row.payload);
+            if (payload.requestKey !== requestKey)
+                continue;
+            if (payload.schema !== LEDGER_SCHEMA || payload.taskId !== taskId || payload.contextRef !== state.contextRef || !Array.isArray(payload.events) || payload.events.some((event) => event.taskId !== taskId || event.contextRef !== state.contextRef))
+                throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            const events = this.normalizeDecisionBatchFromDurableRows(taskId, payload.events, row.seq);
+            if (!events)
+                throw new Error(`ledger_corrupt:${taskId}:decision_batch`);
+            for (const event of events) {
+                if (event.kind !== 'question')
+                    continue;
+                const awaiting = state.awaitingApproval;
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(event.question.blocker) !== bookingDigest(awaiting.blocker) || event.question.approvalOptions.length !== awaiting.options.length || event.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval))))
+                    throw new Error(`ledger_corrupt:${taskId}:decision_batch_question`);
+            }
+            return events;
+        }
+        return null;
+    }
+    /** Materializes the durable policy/budget terminal response once, before SSE. */
+    terminalDecisionBatch(taskId, requestKey) {
+        assertInternalDecisionKey(requestKey);
+        const prior = this.readDecisionBatch(taskId, requestKey);
+        if (prior)
+            return prior;
+        const state = this.requireTask(taskId);
+        if (state.phase === 'terminal' || state.phase === 'error')
+            throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(state);
+        const run = this.ledger.db.transaction(() => {
+            const state = this.requireTask(taskId);
+            if (!taskHasTerminalBudget(state) || state.phase !== 'terminal')
+                throw new Error('task_not_terminal');
+            assertReplayUpgradeReanchored(state);
+            const event = this.terminalEvent(state);
+            this.appendTerminalEvent(taskId, event);
+            this.append(DECISION_BATCH, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, requestKey, events: [event] }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            return [event];
+        });
+        return run.immediate();
+    }
+    /** Atomically applies planner decisions and records the exact SSE batch before it is sent. */
+    applyDecisionBatch(taskId, requestKey, decisions, includeSubmitted = false, options = {}) {
+        assertInternalDecisionKey(requestKey);
+        const prior = this.readDecisionBatch(taskId, requestKey);
+        if (prior)
+            return prior;
+        const current = this.requireTask(taskId);
+        if (current.phase === 'terminal' || current.phase === 'error')
+            throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(current);
+        assertDecisionBatchFinality(decisions);
+        assertAvailabilityLiveness(current, decisions, this.now());
+        if (current.availability.recoveryStarted && !current.availability.terminal && decisions.some((decision) => decision.kind === 'terminal' || decision.kind === 'error'))
+            throw new Error('availability_terminal_policy_owned');
+        for (const decision of decisions) {
+            if (decision.kind === 'operation') {
+                const checked = validateBookingReadAction(decision.action);
+                if (!checked.ok)
+                    throw new Error(`invalid_action:${errorText(checked)}`);
+                if (!validateBookingIntentProjection(decision.intent).ok)
+                    throw new Error('invalid_booking_intent');
+            }
+        }
+        const run = this.ledger.db.transaction(() => {
+            const events = [];
+            const before = this.requireTask(taskId);
+            assertReplayUpgradeReanchored(before);
+            assertAvailabilityLiveness(before, decisions, this.now());
+            if (before.availability.recoveryStarted && !before.availability.terminal && decisions.some((decision) => decision.kind === 'terminal' || decision.kind === 'error'))
+                throw new Error('availability_terminal_policy_owned');
+            for (const decision of decisions) {
+                if (decision.kind !== 'question')
+                    continue;
+                const awaiting = before.awaitingApproval;
+                if (!awaiting || requestKey !== awaiting.presentationRequestKey || bookingDigest(decision.question.blocker) !== bookingDigest(awaiting.blocker) || decision.question.approvalOptions.length !== awaiting.options.length || decision.question.approvalOptions.some(({ approval }) => !awaiting.options.some((option) => option.optionDigest === approval.optionDigest && bookingDigest(option) === bookingDigest(approval))))
+                    throw new Error('approval_presentation_key_mismatch');
+                this.ensureApprovalOffered(taskId, before.contextRef, awaiting, requestKey);
+            }
+            if (!options.suppressProgressStatuses) {
+                if (includeSubmitted)
+                    events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'submitted' }));
+                events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'working' }));
+            }
+            for (const decision of decisions) {
+                if (decision.kind === 'operation') {
+                    events.push(this.issueOperationInTransaction(taskId, decision.action, decision.intent));
+                    events.push(this.emitEventInTransaction(taskId, { kind: 'status', status: 'waiting_receipt' }));
+                }
+                else
+                    events.push(this.emitEventInTransaction(taskId, decision));
+            }
+            const state = this.requireTask(taskId);
+            this.append(DECISION_BATCH, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, requestKey, events }, `booking-copilot:decision-batch:${taskId}:${requestKey}`);
+            return events;
+        });
+        return run.immediate();
+    }
+    issueOperation(taskId, candidate, intentProjection) {
+        const validation = validateBookingReadAction(candidate);
+        if (!validation.ok)
+            throw new Error(`invalid_action:${errorText(validation)}`);
+        assertTaskId(taskId);
+        assertSafeRef(candidate.actionId);
+        candidate.factRefs.forEach(assertSafeRef);
+        return this.ledger.db.transaction(() => this.issueOperationInTransaction(taskId, candidate, intentProjection)).immediate();
+    }
+    issueOperationInTransaction(taskId, candidate, intentProjection) {
+        if (intentProjection === undefined || intentProjection === null)
+            throw new Error('booking_intent_required');
+        assertSafeRef(candidate.actionId);
+        candidate.factRefs.forEach(assertSafeRef);
+        const state = this.requireTask(taskId);
+        if (state.phase === 'terminal' || state.phase === 'error')
+            throw new Error('task_terminal');
+        assertReplayUpgradeReanchored(state);
+        if (state.pendingAction) {
+            if (state.pendingAction.actionId !== candidate.actionId)
+                throw new Error('receipt_required');
+            if (!matchesCheckpoint(candidate, state.pendingAction))
+                throw new Error('action_conflict');
+            return this.operationEvent(taskId, state.pendingAction, candidate);
+        }
+        if (candidate.contextRef !== state.contextRef)
+            throw new Error('context_mismatch');
+        if (!state.allowedActions.includes(candidate.kind))
+            throw new Error('unsupported_action');
+        if (candidate.expectedRevision !== state.revision)
+            throw new Error('stale_revision');
+        if (state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS)
+            throw new Error('operation_limit_reached');
+        if (candidate.relaxationApprovalRef)
+            throw new Error('approval_ref_planner_owned_forbidden');
+        if (!state.workspaceSnapshot)
+            throw new Error(`ledger_corrupt:${taskId}:workspace_missing`);
+        const intent = bindIntentCheckpoint(state, candidate, intentProjection);
+        if (!actionAdvancesIntent(candidate, intent.projection))
+            throw new Error('action_intent_mismatch');
+        assertAvailabilityActionCompatible(state, candidate, this.now());
+        if (!actionHitsCurrentOfferVersion(state.workspaceSnapshot, candidate, this.now()))
+            throw new Error('offer_version_not_loaded');
+        let action = candidate;
+        const availability = reduceAvailabilityAction(state.availability, state.workspaceSnapshot, candidate);
+        if (state.awaitingApproval) {
+            const approval = state.awaitingApproval;
+            if (!approval.approval || Date.parse(approval.expiresAt) <= Date.parse(this.now()))
+                throw new Error('approval_expired');
+            const ref = {
+                approvalId: approval.approval.approvalId, blockerId: approval.blocker.blockerId,
+                contextRef: state.contextRef, sourceTurnId: approval.sourceTurnId,
+                presentationRequestKey: approval.presentationRequestKey, sourceActionId: approval.blocker.sourceActionId,
+                targetActionId: candidate.actionId, sourceRevision: candidate.expectedRevision,
+                targetActionKind: candidate.kind, to: approval.approval.to, expiresAt: approval.expiresAt,
+                nonce: approval.nonce, sourceReceiptDigest: approval.blocker.sourceReceiptDigest,
+                scope: approval.blocker.scope, code: approval.blocker.code, criterionPath: approval.blocker.criterionPath,
+                valueDigest: approval.blocker.valueDigest,
+            };
+            action = { ...candidate, relaxationApprovalRef: ref };
+            this.append(APPROVAL_CONSUMED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, approval, ref, approvalDigest: bookingDigest(ref) }, `booking-copilot:approval-consumed:${taskId}:${approval.approval.approvalId}:${approval.nonce}`);
+        }
+        const eventId = this.idFactory('event');
+        const emittedAt = this.now();
+        const sequence = state.lastSequence + 1;
+        const event = { schemaVersion: 'booking.surface', eventId, taskId, contextRef: state.contextRef, sequence, emittedAt, kind: 'operation', action };
+        const eventValidation = validateBookingSurfaceEvent(event);
+        if (!eventValidation.ok)
+            throw new Error(`invalid_operation_event:${errorText(eventValidation)}`);
+        if (!state.lastTurnId)
+            throw new Error(`ledger_corrupt:${taskId}:turn_id`);
+        this.appendAction(taskId, state.contextRef, checkpointFor(action, eventId, sequence, emittedAt, state.lastTurnId), state.operationCount + 1, availability, intent);
+        return event;
+    }
+    continueWithReceipt(turn) {
+        const validation = validateBookingSurface(turn);
+        if (!validation.ok)
+            throw new Error(`invalid_receipt_continuation:${errorText(validation)}`);
+        assertWorkspaceLoadedOfferRefsUnique(turn.workspace);
+        assertCanonicalReceipt(turn.receipt);
+        const run = this.ledger.db.transaction(() => {
+            const state = this.requireTask(turn.taskId);
+            assertReplayUpgradeReanchored(state);
+            if (turn.workspace.contextRef !== state.contextRef || turn.receipt.contextRef !== state.contextRef)
+                throw new Error('context_mismatch');
+            const receiptWorkspace = bookingWorkspaceDigest(turn.workspace);
+            const receiptWorkspaceSemantic = bookingWorkspaceSemanticDigest(turn.workspace);
+            if (!state.workspaceSnapshot || !workspaceBoundaryMatches(state.workspaceSnapshot, turn.workspace))
+                throw new Error('workspace_mismatch');
+            const existing = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? ORDER BY seq`).all(this.ledger.tenant, turn.taskId, RECEIPT);
+            const receiptDigest = canonicalReceiptDigest(turn.receipt);
+            if (state.legacySuppressedReceiptActionIds?.includes(turn.receipt.actionId))
+                throw new Error('request_key_invalidated');
+            for (const row of existing) {
+                const prior = JSON.parse(row.payload);
+                if (prior.receipt.actionId !== turn.receipt.actionId)
+                    continue;
+                if (prior.receiptDigest !== receiptDigest)
+                    throw new Error('receipt_conflict');
+                if (prior.workspaceDigest !== receiptWorkspace)
+                    throw new Error('workspace_mismatch');
+                return state;
+            }
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
+            if (!state.pendingAction)
+                throw new Error('unexpected_receipt');
+            if (state.pendingAction.actionId !== turn.receipt.actionId)
+                throw new Error('receipt_action_mismatch');
+            if (turn.receipt.revision < state.pendingAction.expectedRevision)
+                throw new Error('revision_regression');
+            if (turn.receipt.resultContract.blockers.some((blocker) => blocker.sourceActionId !== state.pendingAction.actionId))
+                throw new Error('receipt_source_action_mismatch');
+            if (!workspacePostActionMatches(state.workspaceSnapshot, turn.workspace, state.pendingAction, turn.receipt))
+                throw new Error('workspace_mismatch');
+            if (!receiptObservationMatchesAction(turn.receipt.observation.kind, state.pendingAction.kind))
+                throw new Error('receipt_observation_action_mismatch');
+            if (!receiptTargetMatchesAction(turn.receipt, state.pendingAction))
+                throw new Error('receipt_target_mismatch');
+            assertOffersReceiptWorkspaceBinding(turn.receipt, turn.workspace, state.pendingAction);
+            if (state.pendingAction.kind === 'offer.check' && turn.receipt.status === 'applied' && !verifiedOfferUnexpired(turn.workspace, this.now()))
+                throw new Error('receipt_verified_offer_expired');
+            // Failed/stale query receipts may carry a typed gap observation; only an
+            // offers.state observation can claim passive offer provenance.
+            if (turn.receipt.resultContract.relaxationsApplied.some((approval) => !this.approvalWasConsumed(turn.taskId, approval, state.pendingAction.actionId)))
+                throw new Error('receipt_relaxation_unauthorized');
+            const pending = state.pendingAction;
+            if (turn.receipt.revision !== turn.workspace.revision)
+                throw new Error('revision_mismatch');
+            const availability = reduceAvailabilityReceipt(state.availability, turn.workspace, turn.receipt, pending);
+            const availabilityTerminal = availabilityPolicyTerminal(availability);
+            this.append(RECEIPT, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, receipt: turn.receipt, receiptDigest, operationCount: state.operationCount, workspaceDigest: receiptWorkspace, workspaceSemanticDigest: receiptWorkspaceSemantic, workspace: turn.workspace, availability, availabilityDigest: bookingDigest(availability), ...(availabilityTerminal ? { availabilityTerminal } : {}) }, `booking-copilot:receipt:${turn.taskId}:${turn.receipt.actionId}`);
+            if (availabilityTerminalEndsTask(availabilityTerminal) || state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS) {
+                const terminalState = this.requireTask(turn.taskId);
+                const terminalEvent = this.terminalEvent(terminalState);
+                this.appendTerminalEvent(turn.taskId, terminalEvent);
+                this.append(DECISION_BATCH, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, requestKey: `receipt:${turn.receipt.actionId}:${receiptDigest}`, events: [terminalEvent] }, `booking-copilot:decision-batch:${turn.taskId}:receipt:${turn.receipt.actionId}:${receiptDigest}`);
+                return terminalState;
+            }
+            if (pending.kind === 'checkout.prepare' && state.activeIntent?.projection.target === 'checkout.prepared') {
+                const terminalState = this.requireTask(turn.taskId);
+                const terminalEvent = this.checkoutHandoffTerminalEvent(terminalState, checkoutReceiptPreparedHandoff(turn.receipt));
+                this.appendTerminalEvent(turn.taskId, terminalEvent);
+                this.append(DECISION_BATCH, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, requestKey: `receipt:${turn.receipt.actionId}:${receiptDigest}`, events: [terminalEvent] }, `booking-copilot:decision-batch:${turn.taskId}:receipt:${turn.receipt.actionId}:${receiptDigest}`);
+                return this.requireTask(turn.taskId);
+            }
+            const blocker = turn.receipt.resultContract.blockers[0];
+            if (blocker) {
+                // Never derive this claim from the injectable id factory: production
+                // and crash proofs must not make a presentation nonce guessable from
+                // deterministic task/event ids.
+                const nonce = randomUUID();
+                const sourceTurnId = state.pendingAction?.sourceTurnId ?? state.lastTurnId ?? `ordinal:${state.userTurnCount}`;
+                const requestKey = presentationKey(turn.taskId, sourceTurnId, turn.receipt.actionId, receiptDigest);
+                const approval = { blocker, options: [approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'prefer', nonce), approvalOption(turn.taskId, state.contextRef, sourceTurnId, requestKey, blocker, 'drop', nonce)], optionsEmitted: false, approval: undefined, nonce, expiresAt: new Date(Date.parse(this.now()) + this.approvalTtlMs).toISOString(), sourceTurnId, presentationRequestKey: requestKey };
+                this.append(APPROVAL_GRANTED, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: state.contextRef, approval, approvalDigest: bookingDigest(approval) }, `booking-copilot:approval-awaiting:${turn.taskId}:${turn.receipt.actionId}`);
+            }
+            return this.requireTask(turn.taskId);
+        });
+        return run.immediate();
+    }
+    emitEvent(taskId, draft) {
+        return this.ledger.db.transaction(() => {
+            const state = this.requireTask(taskId);
+            if (state.phase === 'terminal' || state.phase === 'error')
+                throw new Error('task_terminal');
+            assertReplayUpgradeReanchored(state);
+            return this.emitEventInTransaction(taskId, draft);
+        }).immediate();
+    }
+    emitEventInTransaction(taskId, draft) {
+        const state = this.requireTask(taskId);
+        assertReplayUpgradeReanchored(state);
+        const safeDraft = draft.kind === 'error'
+            ? {
+                ...draft,
+                error: {
+                    ...draft.error,
+                    code: normalizeBookingErrorCode(draft.error.code),
+                    message: safeBookingErrorMessage(normalizeBookingErrorCode(draft.error.code)),
+                    // An error event closes this task immediately. Until the public
+                    // protocol has an idempotent same-task retry command, claiming
+                    // that such an event is retryable would send the client into a
+                    // guaranteed task_terminal response on its next request.
+                    retryable: false,
+                },
+            }
+            : draft;
+        const event = { schemaVersion: 'booking.surface', eventId: this.idFactory('event'), taskId, contextRef: state.contextRef, sequence: state.lastSequence + 1, emittedAt: this.now(), ...safeDraft };
+        const checked = validateBookingSurfaceEvent(event);
+        if (!checked.ok)
+            throw new Error(`invalid_event:${errorText(checked)}`);
+        this.append(EVENT, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef: state.contextRef, eventId: event.eventId, sequence: event.sequence, emittedAt: event.emittedAt, eventKind: event.kind, ...(event.kind === 'status' ? { status: event.status } : {}), contentDigest: bookingDigest(safeDraft) }, `booking-copilot:event:${taskId}:${event.eventId}`);
+        return event;
+    }
+    operationEvent(taskId, checkpoint, action) {
+        const replayAction = action.relaxationApprovalRef || !checkpoint.relaxationApprovalRef ? action : { ...action, relaxationApprovalRef: checkpoint.relaxationApprovalRef };
+        return { schemaVersion: 'booking.surface', eventId: checkpoint.eventId, taskId, contextRef: checkpoint.contextRef, sequence: checkpoint.sequence, emittedAt: checkpoint.emittedAt, kind: 'operation', action: replayAction };
+    }
+    terminalEvent(state) {
+        if (!taskHasTerminalBudget(state))
+            throw new Error('task_not_terminal');
+        const terminalCode = state.operationCount >= BOOKING_COPILOT_MAX_OPERATIONS ? 'operation_limit_reached' : state.availability.terminal?.code ?? 'operation_limit_reached';
+        const event = { schemaVersion: 'booking.surface', eventId: `terminal-${state.taskId}-${state.operationCount}`, taskId: state.taskId, contextRef: state.contextRef, sequence: state.lastSequence + 1, emittedAt: this.now(), kind: 'terminal', terminal: { status: 'stopped', summary: terminalCode, factRefs: [] } };
+        const checked = validateBookingSurfaceEvent(event);
+        if (!checked.ok)
+            throw new Error(`invalid_terminal_event:${errorText(checked)}`);
+        return event;
+    }
+    checkoutHandoffTerminalEvent(state, prepared) {
+        const event = { schemaVersion: 'booking.surface', eventId: `terminal-${state.taskId}-${state.operationCount}`, taskId: state.taskId, contextRef: state.contextRef, sequence: state.lastSequence + 1, emittedAt: this.now(), kind: 'terminal', terminal: { status: prepared ? 'completed' : 'stopped', summary: prepared ? 'checkout_handoff_prepared' : 'checkout_handoff_not_prepared', factRefs: [] } };
+        const checked = validateBookingSurfaceEvent(event);
+        if (!checked.ok)
+            throw new Error(`invalid_terminal_event:${errorText(checked)}`);
+        return event;
+    }
+    requireTask(taskId) { const state = this.resumeTask(taskId); if (!state)
+        throw new Error('task_not_found'); return state; }
+    requestBinding(requestKey) {
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ? ORDER BY seq DESC`).all(this.ledger.tenant, REQUEST_BINDING);
+        for (const row of rows) {
+            const binding = JSON.parse(row.payload);
+            if (binding.requestKey === requestKey) {
+                const state = this.resumeTask(binding.taskId);
+                if (state?.legacySuppressedRequestBindingKeys?.includes(requestKey))
+                    throw new Error('request_key_invalidated');
+                return binding;
+            }
+        }
+        return null;
+    }
+    requestBindingPayload(requestKey, turn, input) {
+        assertPrincipal(input.principal);
+        assertRequestKey(requestKey);
+        if (input.taskHandle)
+            assertSafeRef(input.taskHandle);
+        return {
+            requestKey,
+            requestDigest: bookingTurnDigest(turn),
+            turnId: turn.turnId,
+            workspaceDigest: bookingWorkspaceDigest(turn.workspace),
+            workspaceSemanticDigest: bookingWorkspaceSemanticDigest(turn.workspace),
+            surface: turn.workspace.surface,
+            capabilityDigest: bookingDigest(turn.workspace.capabilities),
+            principalDigest: bookingDigest({ subject: input.principal.subject }),
+            scopeDigest: bookingDigest({ scope: input.principal.scope }),
+            ...(input.taskHandle ? { taskHandle: input.taskHandle } : {}),
+        };
+    }
+    appendRequestBindingInTransaction(requestKey, turn, input) {
+        assertRequestKey(requestKey);
+        assertPrincipal(input.principal);
+        const payload = this.requestBindingPayload(requestKey, turn, input);
+        if (input.taskHandle) {
+            const prior = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND kind = ?`).all(this.ledger.tenant, REQUEST_BINDING);
+            for (const row of prior) {
+                const binding = JSON.parse(row.payload);
+                if (binding.taskHandle !== input.taskHandle)
+                    continue;
+                if (binding.principalDigest !== payload.principalDigest || binding.scopeDigest !== payload.scopeDigest)
+                    throw new Error('principal_conflict');
+                if (binding.taskId !== turn.taskId || binding.contextRef !== turn.workspace.contextRef)
+                    throw new Error('task_handle_conflict');
+            }
+        }
+        const existing = this.requestBinding(requestKey);
+        if (existing) {
+            if (existing.taskId !== turn.taskId || existing.contextRef !== turn.workspace.contextRef || existing.requestDigest !== payload.requestDigest || existing.turnId !== payload.turnId || existing.workspaceDigest !== payload.workspaceDigest || existing.workspaceSemanticDigest !== payload.workspaceSemanticDigest || existing.surface !== payload.surface || existing.capabilityDigest !== payload.capabilityDigest || existing.principalDigest !== payload.principalDigest || existing.scopeDigest !== payload.scopeDigest || existing.taskHandle !== payload.taskHandle)
+                throw new Error('request_conflict');
+            return;
+        }
+        this.append(REQUEST_BINDING, turn.taskId, { schema: LEDGER_SCHEMA, taskId: turn.taskId, contextRef: turn.workspace.contextRef, ...payload }, `booking-copilot:request-binding:${requestKey}`);
+    }
+    normalizeDecisionBatchFromDurableRows(taskId, batchEvents, batchSeq) {
+        const individualRows = this.ledger.db.prepare(`SELECT kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND seq < ? AND kind IN (?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, batchSeq, EVENT, ACTION);
+        const turnRows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ? AND seq < ?`).all(this.ledger.tenant, taskId, TURN, batchSeq);
+        const sourceWorkspaces = new Map();
+        for (const row of turnRows) {
+            try {
+                const turn = JSON.parse(row.payload);
+                sourceWorkspaces.set(turn.turnId, normalizeWorkspaceForReplay(turn.workspace));
+            }
+            catch {
+                return null;
+            }
+        }
+        const recordedEvents = new Map();
+        const recordedActions = new Map();
+        for (const row of individualRows) {
+            if (row.kind === EVENT) {
+                const payload = JSON.parse(row.payload);
+                const key = consumedIdentityKey(payload.eventId, payload.sequence);
+                if (recordedEvents.has(key) || recordedActions.has(key))
+                    return null;
+                recordedEvents.set(key, payload);
+            }
+            else if (row.kind === ACTION) {
+                const payload = JSON.parse(row.payload);
+                let action = payload.action;
+                try {
+                    action = normalizeActionCheckpointForReplay(action, sourceWorkspaces.get(action.sourceTurnId));
+                }
+                catch {
+                    return null;
+                }
+                const key = consumedIdentityKey(action.eventId, action.sequence);
+                if (recordedEvents.has(key) || recordedActions.has(key))
+                    return null;
+                recordedActions.set(key, action);
+            }
+        }
+        let lastBatchSequence = -1;
+        const seen = new Set();
+        const normalizedEvents = [];
+        for (const event of batchEvents) {
+            if (!Number.isSafeInteger(event.sequence) || event.sequence <= lastBatchSequence)
+                return null;
+            lastBatchSequence = event.sequence;
+            const key = consumedIdentityKey(event.eventId, event.sequence);
+            if (seen.has(key))
+                return null;
+            seen.add(key);
+            if (event.kind === 'operation') {
+                const checkpoint = recordedActions.get(key);
+                if (!checkpoint || !operationEventMatchesAction(event, checkpoint))
+                    return null;
+                const normalized = { ...event, action: actionFromOperationEventForReplay(event, checkpoint) };
+                if (!validateBookingSurfaceEvent(normalized).ok)
+                    return null;
+                normalizedEvents.push(normalized);
+            }
+            else {
+                const recorded = recordedEvents.get(key);
+                if (!recorded || !validateBookingSurfaceEvent(event).ok || !eventPayloadMatchesEvent(recorded, event))
+                    return null;
+                normalizedEvents.push(event);
+            }
+        }
+        return normalizedEvents;
+    }
+    rows(taskId) { return this.ledger.db.prepare(`SELECT seq, kind, payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind IN (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ORDER BY seq`).all(this.ledger.tenant, taskId, STARTED, TURN, ACTION, RECEIPT, EVENT, APPROVAL_GRANTED, APPROVAL_OFFERED, APPROVAL_CONSUMED, DECISION_BATCH, REQUEST_BINDING); }
+    append(kind, taskId, payload, idemKey) {
+        const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, kind, taskId, JSON.stringify(payload), idemKey, taskId);
+        if (result.changes === 0)
+            throw new Error(`ledger_write_failed:${kind}`);
+    }
+    appendTurn(taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, ordinal, turnId, workspace, preserveIntent = false) { if (!workspace)
+        throw new Error('ledger_write_failed:turn_workspace'); this.append(TURN, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, requestDigest, workspaceDigest, workspaceSemanticDigest, workspace, turnId, preserveIntent }, `booking-copilot:turn:${taskId}:${turnId}`); }
+    appendApproval(taskId, contextRef, approval) { this.append(APPROVAL_GRANTED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, approval, approvalDigest: bookingDigest(approval) }, `booking-copilot:approval-granted:${taskId}:${approval.approval?.approvalId ?? 'pending'}:${approval.nonce}`); }
+    appendAction(taskId, contextRef, action, operationCount, availability, intent) { this.append(ACTION, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, action, operationCount, availability, availabilityDigest: bookingDigest(availability), intent }, `booking-copilot:action:${taskId}:${action.actionId}`); }
+    appendTerminalEvent(taskId, event) {
+        const payload = { schema: LEDGER_SCHEMA, taskId, contextRef: event.contextRef, eventId: event.eventId, sequence: event.sequence, emittedAt: event.emittedAt, eventKind: 'terminal', contentDigest: bookingDigest(event.terminal) };
+        const idemKey = `booking-copilot:terminal-event:${taskId}`;
+        const result = this.ledger.db.prepare(`INSERT OR IGNORE INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(this.ledger.tenant, this.now(), ACTOR, EVENT, taskId, JSON.stringify(payload), idemKey, taskId);
+        if (result.changes === 0) {
+            const existing = this.ledger.db.prepare('SELECT payload FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
+            if (!existing || JSON.parse(existing.payload).contentDigest !== payload.contentDigest)
+                throw new Error('ledger_write_failed:terminal_event');
+        }
+    }
+    ensureApprovalOffered(taskId, contextRef, approval, requestKey) {
+        if (requestKey !== approval.presentationRequestKey)
+            throw new Error('approval_presentation_key_mismatch');
+        const idemKey = `booking-copilot:approval-offered:${taskId}:${requestKey}`;
+        const exists = this.ledger.db.prepare('SELECT 1 AS present FROM events WHERE tenant_id = ? AND idem_key = ?').get(this.ledger.tenant, idemKey);
+        if (!exists)
+            this.append(APPROVAL_OFFERED, taskId, { schema: LEDGER_SCHEMA, taskId, contextRef, approval, approvalDigest: bookingDigest(approval) }, idemKey);
+    }
+    approvalWasConsumed(taskId, approval, targetActionId) {
+        const state = this.resumeTask(taskId);
+        if (state?.legacySuppressedApprovalTargetActionIds?.includes(targetActionId))
+            return false;
+        const rows = this.ledger.db.prepare(`SELECT payload FROM events WHERE tenant_id = ? AND run_id = ? AND kind = ?`).all(this.ledger.tenant, taskId, APPROVAL_CONSUMED);
+        return rows.some(({ payload }) => {
+            const consumed = JSON.parse(payload);
+            return consumed.ref?.targetActionId === targetActionId && consumed.approval?.approval && bookingDigest(consumed.approval.approval) === bookingDigest(approval);
+        });
+    }
+}