@dbsp/cli 3.0.0 → 3.0.1

package/dist/index.js

@@ -19,7 +19,7 @@ import { Command as Command12, CommanderError } from "commander";
 
 // src/commands/apply.ts
 import { AsyncLocalStorage } from "async_hooks";
-import { createHash as createHash3 } from "crypto";
+import { createHash } from "crypto";
 import { readFile } from "fs/promises";
 import { createInterface } from "readline/promises";
 import {
@@ -29,6 +29,8 @@ import {
   createPgTransitionPack as createPgTransitionPack2,
   escapeDiagnosticText as escapeDiagnosticText3,
   preparePgExecutionSession,
+  readPgLedgerAddressChain as readPgLedgerAddressChain2,
+  readPgLedgerReservationsForExecution,
   readTransitionJournal,
   TransitionRunIdentityMismatchError,
   validatePgManagedLedgerCurrency,
@@ -45,7 +47,7 @@ import {
   validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest3
 } from "@dbsp/core";
 import { mintDurablyLoadedRun } from "@dbsp/core/internal";
-import { REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
+import { ledgerAddressKey as ledgerAddressKey2, REFUSAL_VOCABULARY as REFUSAL_VOCABULARY2 } from "@dbsp/types";
 import { Command as Command2 } from "commander";
 
 // src/utils/output.ts
@@ -59,13 +61,29 @@ function printCliJson(value) {
   console.log(serializeCliJson(value));
 }
 
+// src/commands/execution-ids.ts
+function executionIdsForRun(journal) {
+  const executionIds = /* @__PURE__ */ new Set([journal.run.runId]);
+  for (const event of journal.events) {
+    const record2 = event.record;
+    if (event.event === "intent" && "executionId" in record2 && typeof record2.executionId === "string")
+      executionIds.add(record2.executionId);
+    if (event.event === "observed" && "intent" in record2 && record2.intent && typeof record2.intent.executionId === "string")
+      executionIds.add(record2.intent.executionId);
+  }
+  if ("generator" in journal.plan)
+    executionIds.add(`dbsp.generator.execution.${journal.run.runId}`);
+  return [...executionIds];
+}
+
 // src/commands/generator-execution.ts
-import { createHash, randomUUID } from "crypto";
+import { randomUUID } from "crypto";
 import { isDeepStrictEqual } from "util";
 import {
+  assertGeneratedPostconditionSession,
   compareSchemata,
   createPgsqlAdapter,
-  dbTypesEqual,
+  decodeGeneratedPostconditionPayload,
   executePgAdmittedOperation,
   executePgDeclaredAdoption,
   executePgPersistedTableReaddress,
@@ -73,9 +91,18 @@ import {
   readPgCatalogueIdentity,
   readPgLedgerAddressChain,
   readPgLedgerScopeCurrency,
-  readPgRemovalEffectsClosure
+  readPgRemovalEffectsClosure,
+  toGeneratedPostconditionBindingAddress,
+  verifyGeneratedCheckPostcondition,
+  verifyGeneratedColumnPostcondition,
+  verifyGeneratedIdentityPostcondition,
+  verifyGeneratedIndexPostcondition,
+  verifyGeneratedTablePostcondition,
+  withGeneratedPostconditionSession
 } from "@dbsp/adapter-pgsql";
 import {
+  canonicalJson,
+  canonicalJsonDigest,
   outcomeClaimEventId,
   outcomeClaimId,
   projectLedgerChain,
@@ -194,261 +221,180 @@ function observed(address) {
     digest: `generator:${address.kind}:${address.name}`
   };
 }
-function normalizedDefinition(value) {
-  return value.replaceAll('"', "").replace(/\s+/gu, " ").replace(/;$/u, "").trim().toLowerCase();
-}
 function generatedPayload(value) {
+  const encoded = canonicalJson(value);
+  const normalized = JSON.parse(encoded);
   return {
-    value,
-    digest: createHash("sha256").update(JSON.stringify(value)).digest("hex")
+    value: normalized,
+    digest: canonicalJsonDigest(normalized),
+    payloadKind: "generated-structural-observation"
   };
 }
-function textList(value) {
-  return Array.isArray(value) ? value.map((item) => String(item)) : [];
-}
-function foreignKeyAction(code) {
-  switch (code) {
-    case "a":
-      return "NO ACTION";
-    case "r":
-      return "RESTRICT";
-    case "c":
-      return "CASCADE";
-    case "n":
-      return "SET NULL";
-    case "d":
-      return "SET DEFAULT";
-    default:
-      return void 0;
-  }
+async function identityObserved(executor, postcondition, address, kind) {
+  const verified = await verifyGeneratedIdentityPostcondition({
+    session: executor,
+    postcondition,
+    address,
+    kind
+  });
+  const value = JSON.parse(
+    canonicalJson({
+      kind: "identity-observed",
+      observedKind: verified.kind,
+      address: {
+        scope: address.scope,
+        ...address.schema === void 0 ? {} : { schema: address.schema },
+        name: address.name
+      },
+      identity: verified.identity,
+      structuralSemantics: "unverified"
+    })
+  );
+  return {
+    catalogueIdentity: verified.catalogueIdentity,
+    observed: {
+      value,
+      digest: canonicalJsonDigest(value),
+      payloadKind: "generated-identity-observation"
+    }
+  };
 }
 function generatedPostcondition(step, address) {
-  const value = step.expectedDeclaration?.value;
-  if (!value || typeof value !== "object" || Array.isArray(value))
+  const declaration = step.expectedDeclaration;
+  if (!declaration?.value || typeof declaration.value !== "object" || Array.isArray(declaration.value))
     throw new Error(
-      `generated ${address.kind} step ${step.stepKey} has no structural postcondition`
+      `generated ${address.kind} step ${step.stepKey} has no decodable generated declaration`
     );
-  const postcondition = value;
-  return postcondition;
-}
-async function readGeneratedPostcondition(executor, step, address) {
-  const parent = address.parent?.name;
-  if (address.kind === "column" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "column")
-      throw new Error(
-        `generated column ${address.name} has a non-column structural postcondition`
-      );
-    const expected = postcondition.column;
-    if (expected.name !== address.name)
-      throw new Error(
-        `generated column ${address.name} structural postcondition names another column`
-      );
-    const row = (await executor.query(
-      `SELECT pg_catalog.format_type(attribute.atttypid, attribute.atttypmod) AS column_type, attribute.attnotnull AS is_not_null, pg_catalog.pg_get_expr(default_value.adbin, default_value.adrelid) AS column_default, collation.collname AS collation_name, attribute.attidentity AS identity_kind FROM pg_catalog.pg_attribute attribute JOIN pg_catalog.pg_class relation ON relation.oid = attribute.attrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_attrdef default_value ON default_value.adrelid = attribute.attrelid AND default_value.adnum = attribute.attnum LEFT JOIN pg_catalog.pg_collation collation ON collation.oid = attribute.attcollation WHERE namespace.nspname = $1 AND relation.relname = $2 AND attribute.attname = $3 AND attribute.attnum > 0 AND NOT attribute.attisdropped`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated column ${address.name} is absent`);
-    const type = String(row.column_type ?? "");
-    const nullable = row.is_not_null === true ? false : row.is_not_null === false ? true : void 0;
-    const actualDefault = row.column_default == null ? void 0 : String(row.column_default);
-    const actualCollation = row.collation_name == null ? null : String(row.collation_name);
-    const actualIdentity = row.identity_kind === "a" ? "always" : row.identity_kind === "d" ? "byDefault" : null;
-    if (expected.type !== void 0 && !dbTypesEqual(type, expected.type))
-      throw new Error(
-        `generated column ${address.name} type postcondition differs`
-      );
-    if (expected.nullable !== void 0 && nullable !== expected.nullable)
-      throw new Error(
-        `generated column ${address.name} nullability postcondition differs`
-      );
-    if (expected.hasDefault === true && (actualDefault === void 0 || expected.default === void 0 || actualDefault !== expected.default))
-      throw new Error(
-        `generated column ${address.name} default postcondition differs`
-      );
-    if (expected.hasDefault === false && actualDefault !== void 0)
-      throw new Error(
-        `generated column ${address.name} default postcondition differs`
-      );
-    if (expected.collation !== void 0 && actualCollation !== expected.collation)
-      throw new Error(
-        `generated column ${address.name} collation postcondition differs`
-      );
-    if (expected.identity !== void 0 && actualIdentity !== expected.identity)
-      throw new Error(
-        `generated column ${address.name} identity postcondition differs`
-      );
-    return generatedPayload({
-      kind: "column",
-      type,
-      nullable,
-      default: actualDefault
-    });
-  }
-  if (address.kind === "constraint" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "constraint")
-      throw new Error(
-        `generated constraint ${address.name} has a non-constraint structural postcondition`
-      );
-    const expected = postcondition.constraint;
-    const row = (await executor.query(
-      `SELECT constraint_item.contype AS constraint_type, pg_catalog.pg_get_constraintdef(constraint_item.oid, true) AS constraint_definition, ARRAY(SELECT attribute.attname::text FROM unnest(constraint_item.conkey) WITH ORDINALITY AS key_column(attnum, position) JOIN pg_catalog.pg_attribute attribute ON attribute.attrelid = constraint_item.conrelid AND attribute.attnum = key_column.attnum ORDER BY key_column.position) AS key_columns, referenced_namespace.nspname AS referenced_schema, referenced_relation.relname AS referenced_table, ARRAY(SELECT attribute.attname::text FROM unnest(constraint_item.confkey) WITH ORDINALITY AS key_column(attnum, position) JOIN pg_catalog.pg_attribute attribute ON attribute.attrelid = constraint_item.confrelid AND attribute.attnum = key_column.attnum ORDER BY key_column.position) AS referenced_columns, constraint_item.confdeltype AS on_delete, constraint_item.confupdtype AS on_update, constraint_item.condeferrable AS is_deferrable, constraint_item.condeferred AS is_deferred, constraint_item.convalidated AS is_validated FROM pg_catalog.pg_constraint constraint_item JOIN pg_catalog.pg_class relation ON relation.oid = constraint_item.conrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_class referenced_relation ON referenced_relation.oid = constraint_item.confrelid LEFT JOIN pg_catalog.pg_namespace referenced_namespace ON referenced_namespace.oid = referenced_relation.relnamespace WHERE namespace.nspname = $1 AND relation.relname = $2 AND constraint_item.conname = $3`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated constraint ${address.name} is absent`);
-    const definition = String(row.constraint_definition ?? "");
-    if (String(row.constraint_type) !== expected.type)
-      throw new Error(
-        `generated constraint ${address.name} postcondition differs`
-      );
-    if ((expected.type === "p" || expected.type === "u") && JSON.stringify(textList(row.key_columns)) !== JSON.stringify(expected.columns))
-      throw new Error(
-        `generated constraint ${address.name} postcondition differs`
-      );
-    if (expected.type === "c") {
-      if (normalizedDefinition(definition) !== normalizedDefinition(expected.definition) || row.is_validated === true === expected.notValid)
-        throw new Error(
-          `generated constraint ${address.name} postcondition differs`
-        );
+  return decodeGeneratedPostconditionPayload(declaration, step.stepKey);
+}
+async function readGeneratedV3Postcondition(executor, postcondition, address) {
+  const bindingAddress = toGeneratedPostconditionBindingAddress(address);
+  switch (postcondition.declaration.kind) {
+    case "column": {
+      const verified = await verifyGeneratedColumnPostcondition({
+        session: executor,
+        postcondition,
+        address: bindingAddress
+      });
+      return {
+        catalogueIdentity: verified.catalogueIdentity,
+        observed: generatedPayload({
+          kind: "column",
+          type: verified.projection.type,
+          nullable: verified.projection.nullable,
+          ...verified.projection.default === void 0 ? {} : { default: verified.projection.default },
+          ...verified.projection.collation === void 0 ? {} : { collation: verified.projection.collation },
+          ...verified.projection.identity === void 0 ? {} : { identity: verified.projection.identity }
+        })
+      };
     }
-    if (expected.type === "f") {
-      if (JSON.stringify(textList(row.key_columns)) !== JSON.stringify(expected.columns) || String(row.referenced_table ?? "") !== expected.references.table || expected.references.schema !== void 0 && String(row.referenced_schema ?? "") !== expected.references.schema || JSON.stringify(textList(row.referenced_columns)) !== JSON.stringify(expected.references.columns) || foreignKeyAction(row.on_delete) !== expected.onDelete || foreignKeyAction(row.on_update) !== expected.onUpdate || (row.is_deferrable === true && row.is_deferred === true) !== expected.deferred || row.is_validated === true === expected.notValid)
-        throw new Error(
-          `generated constraint ${address.name} postcondition differs`
-        );
+    case "check": {
+      const verified = await verifyGeneratedCheckPostcondition({
+        session: executor,
+        postcondition,
+        address: bindingAddress
+      });
+      return {
+        catalogueIdentity: verified.catalogueIdentity,
+        observed: generatedPayload({
+          kind: verified.kind,
+          type: "c",
+          expression: verified.projection.expression,
+          validated: verified.projection.validated,
+          noInherit: verified.projection.noInherit,
+          enforced: verified.projection.enforced,
+          isLocal: verified.projection.isLocal,
+          inheritanceCount: verified.projection.inheritanceCount,
+          parentId: verified.projection.parentId
+        })
+      };
     }
-    return generatedPayload({
-      kind: "constraint",
-      type: String(row.constraint_type ?? ""),
-      definition
-    });
-  }
-  if (address.kind === "index" && parent && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "index")
-      throw new Error(
-        `generated index ${address.name} has a non-index structural postcondition`
+    case "constraint": {
+      return identityObserved(
+        executor,
+        postcondition,
+        bindingAddress,
+        "constraint"
       );
-    const row = (await executor.query(
-      `SELECT index_relation.relname AS index_name, index_meta.indisunique AS is_unique, pg_catalog.pg_get_indexdef(index_meta.indexrelid, 0, true) AS index_definition FROM pg_catalog.pg_index index_meta JOIN pg_catalog.pg_class relation ON relation.oid = index_meta.indrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace JOIN pg_catalog.pg_class index_relation ON index_relation.oid = index_meta.indexrelid WHERE namespace.nspname = $1 AND relation.relname = $2 AND index_relation.relname = $3`,
-      [address.schema, parent, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated index ${address.name} is absent`);
-    const definition = String(row.index_definition ?? "");
-    if (normalizedDefinition(definition) !== normalizedDefinition(postcondition.definition))
-      throw new Error(`generated index ${address.name} postcondition differs`);
-    return generatedPayload({
-      kind: "index",
-      unique: row.is_unique === true,
-      definition
-    });
-  }
-  if (address.kind === "table" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "table")
-      throw new Error(
-        `generated table ${address.name} has a non-table structural postcondition`
-      );
-    const rows = (await executor.query(
-      `SELECT attribute.attname AS column_name, pg_catalog.format_type(attribute.atttypid, attribute.atttypmod) AS column_type, attribute.attnotnull AS is_not_null, pg_catalog.pg_get_expr(default_value.adbin, default_value.adrelid) AS column_default FROM pg_catalog.pg_attribute attribute JOIN pg_catalog.pg_class relation ON relation.oid = attribute.attrelid JOIN pg_catalog.pg_namespace namespace ON namespace.oid = relation.relnamespace LEFT JOIN pg_catalog.pg_attrdef default_value ON default_value.adrelid = attribute.attrelid AND default_value.adnum = attribute.attnum WHERE namespace.nspname = $1 AND relation.relname = $2 AND attribute.attnum > 0 AND NOT attribute.attisdropped ORDER BY attribute.attnum`,
-      [address.schema, address.name]
-    )).rows;
-    const expected = postcondition.columns;
-    if (expected.length === 0 || rows.length !== expected.length)
-      throw new Error(
-        `generated table ${address.name} column postcondition differs: expected ${JSON.stringify(expected)}, live ${JSON.stringify(rows)}`
-      );
-    for (const specification of expected) {
-      const actual = rows.find((row) => row.column_name === specification.name);
-      if (!actual || specification.type !== void 0 && !dbTypesEqual(
-        String(actual.column_type ?? ""),
-        specification.type
-      ) || specification.nullable !== void 0 && actual.is_not_null !== true !== specification.nullable || specification.hasDefault === true && (specification.default === void 0 || actual.column_default == null || String(actual.column_default) !== specification.default) || specification.hasDefault === false && actual.column_default != null)
-        throw new Error(
-          `generated table ${address.name} column postcondition differs: expected ${JSON.stringify(specification)}, live ${JSON.stringify(actual)}`
-        );
     }
-    return generatedPayload({
-      kind: "table",
-      columns: rows.map((row) => ({
-        name: String(row.column_name),
-        type: String(row.column_type),
-        nullable: row.is_not_null !== true,
-        default: row.column_default == null ? void 0 : String(row.column_default)
-      }))
-    });
-  }
-  if (address.kind === "enum" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "enum")
-      throw new Error(
-        `generated enum ${address.name} has a non-enum structural postcondition`
+    case "index": {
+      const verified = await verifyGeneratedIndexPostcondition({
+        session: executor,
+        postcondition,
+        address: bindingAddress
+      });
+      return {
+        catalogueIdentity: verified.catalogueIdentity,
+        observed: generatedPayload({
+          kind: verified.kind,
+          projection: verified.projection
+        })
+      };
+    }
+    case "table": {
+      const verified = await verifyGeneratedTablePostcondition({
+        session: executor,
+        postcondition,
+        address: bindingAddress
+      });
+      return {
+        catalogueIdentity: verified.catalogueIdentity,
+        observed: generatedPayload({
+          kind: verified.kind,
+          columns: verified.projection.columns.map((column) => ({
+            name: column.name,
+            type: column.type,
+            nullable: column.nullable,
+            ...column.default === void 0 ? {} : { default: column.default },
+            ...column.collation === void 0 ? {} : { collation: column.collation },
+            ...column.identity === void 0 ? {} : { identity: column.identity }
+          }))
+        })
+      };
+    }
+    case "enum": {
+      return identityObserved(executor, postcondition, bindingAddress, "enum");
+    }
+    case "sequence": {
+      return identityObserved(
+        executor,
+        postcondition,
+        bindingAddress,
+        "sequence"
       );
-    const rows = (await executor.query(
-      `SELECT enum_label.enumlabel AS label FROM pg_catalog.pg_type type JOIN pg_catalog.pg_namespace namespace ON namespace.oid = type.typnamespace JOIN pg_catalog.pg_enum enum_label ON enum_label.enumtypid = type.oid WHERE namespace.nspname = $1 AND type.typname = $2 ORDER BY enum_label.enumsortorder`,
-      [address.schema, address.name]
-    )).rows;
-    const labels = rows.map((row) => String(row.label));
-    if (JSON.stringify(labels) !== JSON.stringify(postcondition.labels))
-      throw new Error(`generated enum ${address.name} postcondition differs`);
-    return generatedPayload({ kind: "enum", labels });
-  }
-  if (address.kind === "sequence" && address.schema) {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "sequence")
-      throw new Error(
-        `generated sequence ${address.name} has a non-sequence structural postcondition`
+    }
+    case "extension": {
+      return identityObserved(
+        executor,
+        postcondition,
+        bindingAddress,
+        "extension"
       );
-    const row = (await executor.query(
-      `SELECT sequence.start_value::text AS start_value, sequence.increment_by::text AS increment_by, sequence.min_value::text AS min_value, sequence.max_value::text AS max_value, sequence.cache_size::text AS cache_size, sequence.cycle AS cycle FROM pg_catalog.pg_sequences sequence WHERE sequence.schemaname = $1 AND sequence.sequencename = $2`,
-      [address.schema, address.name]
-    )).rows[0];
-    if (!row) throw new Error(`generated sequence ${address.name} is absent`);
-    const actual = {
-      startValue: String(row.start_value),
-      incrementBy: String(row.increment_by),
-      minValue: String(row.min_value),
-      maxValue: String(row.max_value),
-      cycle: row.cycle === true
-    };
-    for (const key of [
-      "startValue",
-      "incrementBy",
-      "minValue",
-      "maxValue",
-      "cycle"
-    ])
-      if (postcondition[key] !== void 0 && postcondition[key] !== actual[key])
+    }
+    case "absent": {
+      const live = await readPgCatalogueIdentity(executor, address);
+      if (live)
         throw new Error(
-          `generated sequence ${address.name} postcondition differs`
+          `generated ${address.kind} absence postcondition differs: ${address.name} is still present`
         );
-    return generatedPayload({ kind: "sequence", ...row });
-  }
-  if (address.kind === "extension") {
-    const postcondition = generatedPostcondition(step, address);
-    if (postcondition.kind !== "extension")
-      throw new Error(
-        `generated extension ${address.name} has a non-extension structural postcondition`
-      );
-    const row = (await executor.query(
-      `SELECT extension.extversion AS version FROM pg_catalog.pg_extension extension WHERE extension.extname = $1`,
-      [address.name]
-    )).rows[0];
-    if (!row)
-      throw new Error(
-        `generated extension ${address.name} version postcondition differs`
-      );
-    if (postcondition.version !== void 0 && String(row.version) !== postcondition.version)
-      throw new Error(
-        `generated extension ${address.name} version postcondition differs`
-      );
-    return generatedPayload({
-      kind: "extension",
-      version: String(row.version)
-    });
+      return { observed: generatedPayload({ kind: "absent" }) };
+    }
+    default:
+      throw new Error("generated v3 postcondition has no declarable read-back");
   }
-  throw new Error(`generated ${address.kind} has no declarable read-back`);
+}
+async function readGeneratedPostcondition(executor, step, address) {
+  executor = assertGeneratedPostconditionSession(executor);
+  const decodedPostcondition = generatedPostcondition(step, address);
+  if (decodedPostcondition.postconditionVersion === 3)
+    return (await readGeneratedV3Postcondition(
+      executor,
+      decodedPostcondition,
+      address
+    )).observed;
+  throw new Error(
+    "generated postcondition decoder returned no supported version"
+  );
 }
 function containedBy(root, candidate) {
   for (let parent = candidate.parent; parent; parent = parent.parent) {
@@ -531,7 +477,7 @@ async function executeGeneratorPlan(input) {
   try {
     const database = await databaseId(input.pool);
     const executionId = `dbsp.generator.execution.${randomUUID()}`;
-    await input.recordAttempt?.(executionId);
+    await input.recordAttempt(executionId);
     const steps = managedSteps(manifest);
     for (const step of steps) {
       if (step.lifecycle?.kind === "adoption-refused")
@@ -599,6 +545,7 @@ async function executeGeneratorPlan(input) {
           manifest,
           recomputedPlanDigest: input.planDigest,
           approval,
+          executionId,
           step,
           home: home(address2),
           address: address2,
@@ -611,7 +558,11 @@ async function executeGeneratorPlan(input) {
           completedStepKeys.push(step.stepKey);
           continue;
         }
-        return adopted.outcome === "adoption-refused" ? { outcome: "adoption-refused", detail: adopted.detail } : { outcome: "execution-failed", detail: adopted.detail };
+        if (adopted.outcome === "adoption-refused")
+          return { outcome: "adoption-refused", detail: adopted.detail };
+        if (adopted.outcome === "recovery-required") return adopted;
+        if (adopted.outcome === "transport-ambiguous") return adopted;
+        return { outcome: "execution-failed", detail: adopted.detail };
       }
       if (step.lifecycle?.kind === "readdress") {
         const result = await executePgPersistedTableReaddress({
@@ -620,6 +571,7 @@ async function executeGeneratorPlan(input) {
           manifest,
           recomputedPlanDigest: input.planDigest,
           approval,
+          executionId,
           step,
           database,
           targetSchema: input.schema,
@@ -705,6 +657,8 @@ async function executeGeneratorPlan(input) {
             claimId: result.claimId,
             detail: `claim ${result.claimId} remains open and requires recovery: ${result.reason}`
           };
+        if (result.kind === "outcome-transport-ambiguous")
+          return { outcome: "transport-ambiguous", detail: result.reason };
         if ("reason" in result) return partial(result.reason);
         completedStepKeys.push(step.stepKey);
         continue;
@@ -814,7 +768,31 @@ async function executeGeneratorPlan(input) {
           kind: "destructive-outcome",
           request: admitRequest,
           readBackAndResolve: async (session) => {
-            const live = await readPgCatalogueIdentity(session, address);
+            const declarationReadBack = step.classification === "data-destructive" && step.expectedDeclaration !== void 0 ? await withGeneratedPostconditionSession(
+              {
+                connect: async () => ({
+                  query: session.query.bind(session),
+                  release: () => void 0
+                })
+              },
+              (proof) => {
+                const postcondition = generatedPostcondition(
+                  step,
+                  address
+                );
+                if (postcondition.postconditionVersion !== 3)
+                  throw new Error(
+                    "generated postcondition decoder returned no supported version"
+                  );
+                return readGeneratedV3Postcondition(
+                  proof,
+                  postcondition,
+                  address
+                );
+              }
+            ) : void 0;
+            const live = step.classification === "removal" ? await readPgCatalogueIdentity(session, address) : void 0;
+            const terminalCatalogueIdentity = step.classification === "removal" ? live?.catalogueIdentity : declarationReadBack?.catalogueIdentity;
             const survivors = step.classification === "removal" && live ? [address] : [];
             const childLives = await Promise.all(
               containedClaims.map(async (child) => ({
@@ -831,9 +809,10 @@ async function executeGeneratorPlan(input) {
               const survivorNames = survivors.map(
                 (survivor) => `${survivor.kind} ${survivor.schema ?? "<database>"}.${survivor.name}`
               );
+              const survivorValue = { survivors: survivorNames };
               const survivorObservation = {
-                value: { survivors: survivorNames },
-                digest: createHash("sha256").update(JSON.stringify(survivorNames)).digest("hex")
+                value: survivorValue,
+                digest: canonicalJsonDigest(survivorValue)
               };
               return {
                 rootClaimId: claim.claimId,
@@ -893,8 +872,10 @@ async function executeGeneratorPlan(input) {
                   eventKind: step.classification === "removal" ? "absent" : "observed",
                   // The append protocol reads this address's terminal on its
                   // pinned transaction session after the post-DDL read-back.
-                  ...live?.catalogueIdentity ? { catalogueIdentity: live.catalogueIdentity } : {},
-                  ...step.classification === "removal" ? {} : { observed: observed(address) }
+                  ...terminalCatalogueIdentity === void 0 ? {} : { catalogueIdentity: terminalCatalogueIdentity },
+                  ...step.classification === "removal" ? {} : {
+                    observed: declarationReadBack?.observed ?? observed(address)
+                  }
                 }
               }
             ];
@@ -931,10 +912,7 @@ async function executeGeneratorPlan(input) {
           detail: `claim ${executed.claimId} remains open and requires recovery: ${executed.reason}`
         };
       if (executed.kind === "outcome-transport-ambiguous")
-        return {
-          outcome: "execution-failed",
-          detail: executed.reason
-        };
+        return { outcome: "transport-ambiguous", detail: executed.reason };
       if (executed.kind === "outcome-protocol-pending")
         return partial(
           `destructive claim ${claim.claimId} remains pending after executing: ${executed.reason}`
@@ -958,7 +936,7 @@ async function executeGeneratorPlan(input) {
 }
 
 // src/commands/generator-plan.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import {
   assertDeclarableChangeKind,
   classifyGeneratedMutation,
@@ -974,17 +952,16 @@ import {
 } from "@dbsp/adapter-pgsql";
 import {
   acquireTransitionLease,
+  canonicalJson as canonicalJson2,
+  canonicalJsonDigest as canonicalJsonDigest2,
   transitionPlanDigest,
   validateNormalizedManagedStepManifest as validateNormalizedManagedStepManifest2
 } from "@dbsp/core";
-function digest(value) {
-  return createHash2("sha256").update(JSON.stringify(value)).digest("hex");
-}
 function adoptionDeclaration(table) {
   const value = JSON.parse(
-    JSON.stringify({ kind: "table", name: table.name, shape: table })
+    canonicalJson2({ kind: "table", name: table.name, shape: table })
   );
-  return { value, digest: digest(value) };
+  return { value, digest: canonicalJsonDigest2(value) };
 }
 function replacementStatements(table, schema) {
   const quote = (value) => `"${value.replaceAll('"', '""')}"`;
@@ -1481,7 +1458,10 @@ async function runGeneratorPlan(input) {
     const run = {
       runId: `dbsp-generator-${randomUUID2()}`,
       planDigest,
-      targetContextDigest: digest({ database: await databaseId2(pool), schema }),
+      targetContextDigest: canonicalJsonDigest2({
+        database: await databaseId2(pool),
+        schema
+      }),
       databaseId: await databaseId2(pool),
       coreVersion: "schema-differ-generator-v1",
       startedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2067,6 +2047,72 @@ function generatorRunHasPriorStepEvents(loaded) {
     return !(typeof executionId === "string" && event.stepId === `dbsp.generator.attempt:${executionId}` && event.operationRef === "dbsp.generator.attempt");
   });
 }
+function ledgerHomeForGeneratorAddress(address) {
+  if (address.scope === "database") return { scope: "database" };
+  if (!address.schema)
+    throw new Error(
+      `schema-scoped generated address ${address.name} has no schema ledger`
+    );
+  return { scope: "schema", schema: address.schema };
+}
+function generatorPlanLedgerAddresses(steps) {
+  const addresses = /* @__PURE__ */ new Map();
+  for (const step of steps) {
+    if (step.address !== void 0) {
+      addresses.set(ledgerAddressKey2(step.address), step.address);
+      continue;
+    }
+    const closure = step.closure;
+    if (!closure)
+      throw new Error(`generated step ${step.stepKey} has no ledger address`);
+    const candidates = [
+      closure.root,
+      ...closure.members.map((member) => member.address)
+    ];
+    for (const address of candidates)
+      addresses.set(ledgerAddressKey2(address), address);
+  }
+  return [...addresses.values()];
+}
+async function generatorRunHasLedgerEvidence(session, journal, steps) {
+  const executionIds = executionIdsForRun(journal);
+  const executionIdSet = new Set(executionIds);
+  const addresses = generatorPlanLedgerAddresses(steps);
+  const homes = /* @__PURE__ */ new Map();
+  for (const address of addresses) {
+    const home2 = ledgerHomeForGeneratorAddress(address);
+    homes.set(`${home2.scope}:${home2.schema ?? ""}`, home2);
+  }
+  for (const home2 of homes.values()) {
+    for (const executionId of executionIds) {
+      const reservations = await readPgLedgerReservationsForExecution(
+        session,
+        home2,
+        executionId
+      );
+      if (reservations.length > 0) return true;
+    }
+  }
+  for (const address of addresses) {
+    const chain = await readPgLedgerAddressChain2(
+      session,
+      ledgerHomeForGeneratorAddress(address),
+      address
+    );
+    if (chain.events.some((event) => executionIdSet.has(event.executionId ?? "")))
+      return true;
+  }
+  return false;
+}
+async function generatorRunRequiresRecovery(target, journal, steps) {
+  if (generatorRunHasPriorStepEvents(journal)) return true;
+  const lease = await acquireExclusiveTransitionLease(target);
+  try {
+    return await generatorRunHasLedgerEvidence(lease.session, journal, steps);
+  } finally {
+    await lease.release();
+  }
+}
 var GENERATOR_ATTEMPT_OPERATION = {
   ref: "dbsp.generator.attempt",
   operationKind: {
@@ -2114,19 +2160,19 @@ async function withPoolCleanupReported(result, close) {
 function compareCodeUnits(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
-function canonicalJson(value) {
+function canonicalJson3(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number") {
     if (typeof value === "number" && !Number.isFinite(value))
       throw new Error("policy values must be finite JSON values");
     return JSON.stringify(value);
   }
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (Array.isArray(value)) return `[${value.map(canonicalJson3).join(",")}]`;
   if (typeof value !== "object")
     throw new Error(
       "policy values must be JSON values (undefined is not allowed)"
     );
   const record2 = value;
-  return `{${Object.keys(record2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
+  return `{${Object.keys(record2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson3(record2[key])}`).join(",")}}`;
 }
 function nonEmptyString(value, path) {
   if (typeof value !== "string" || value.length === 0 || value.trim() !== value)
@@ -2186,7 +2232,7 @@ function validateResourceAddress(value, path) {
       `${path}.catalogueIdentity.value`
     );
     try {
-      canonicalJson(identityValue);
+      canonicalJson3(identityValue);
     } catch (error) {
       throw new Error(
         `${path}.catalogueIdentity.value must be a canonicalizable JSON object: ${errorDetail(error)}`
@@ -2256,11 +2302,11 @@ function normaliseAcceptance(acceptance2) {
   const validated = validateAssumptionAcceptance(acceptance2);
   const withinScope = validated.withinScope ? [
     ...new Map(
-      validated.withinScope.map((item) => [canonicalJson(item), item])
+      validated.withinScope.map((item) => [canonicalJson3(item), item])
     )
-  ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => JSON.parse(canonicalJson(item))) : void 0;
+  ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => JSON.parse(canonicalJson3(item))) : void 0;
   return JSON.parse(
-    canonicalJson({
+    canonicalJson3({
       class: validated.class,
       ...validated.fromTrustRoot ? { fromTrustRoot: validated.fromTrustRoot } : {},
       ...withinScope === void 0 ? {} : { withinScope }
@@ -2272,7 +2318,7 @@ function canonicalApplyPolicy(acceptances) {
     ...new Map(
       acceptances.map((item) => {
         const normalized = normaliseAcceptance(item);
-        return [canonicalJson(normalized), normalized];
+        return [canonicalJson3(normalized), normalized];
       })
     )
   ].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, item]) => item);
@@ -2281,8 +2327,8 @@ function authorizationDigest(runId, planDigest, policy, grants, actor, authorize
   const authorizedInstant = new Date(authorizedAt);
   if (Number.isNaN(authorizedInstant.getTime()))
     throw new Error("authorization timestamp must be a valid instant");
-  return createHash3("sha256").update(
-    canonicalJson({
+  return createHash("sha256").update(
+    canonicalJson3({
       runId,
       planDigest,
       policy: canonicalApplyPolicy(policy),
@@ -2295,7 +2341,7 @@ function authorizationDigest(runId, planDigest, policy, grants, actor, authorize
 }
 function hasReusableAuthorization(authorizations, runId, planDigest, policy, grants) {
   return authorizations?.some(
-    (item) => canonicalJson(item.policy) === canonicalJson(policy) && canonicalJson(item.grants) === canonicalJson(grants) && item.digest === authorizationDigest(
+    (item) => canonicalJson3(item.policy) === canonicalJson3(policy) && canonicalJson3(item.grants) === canonicalJson3(grants) && item.digest === authorizationDigest(
       runId,
       planDigest,
       policy,
@@ -2370,7 +2416,7 @@ var APPLY_OUTCOME_CONTRACT = [
   [
     "prior-step-events-refusal",
     19,
-    "attempted runs must be classified by recover"
+    "attempted runs with prior generator step-attempt events must be classified by dbsp reconcile --db <database> <run-id>"
   ],
   [
     "compatibility-refusal",
@@ -2402,7 +2448,12 @@ var APPLY_OUTCOME_CONTRACT = [
   [
     "recovery-required",
     64,
-    "an admitted non-transactional claim remains open; run recover with the reported claim reference"
+    "an admitted claim remains open; run dbsp reconcile --db <database> <run-id>"
+  ],
+  [
+    "transport-ambiguous",
+    65,
+    "an admitted operation has an ambiguous transport outcome; reconcile the run before retrying"
   ],
   ["database-read-only", 34, "target cannot accept managed writes"],
   [
@@ -2455,6 +2506,7 @@ function exitCodeForApplyOutcome(outcome) {
   return applyExitCodes.get(outcome);
 }
 function outcomeForApplyResult(result) {
+  if (result.unresolvedOutcome) return result.unresolvedOutcome.kind;
   if (result.durableOutcome && isApplyExecutionOutcome(result.durableOutcome))
     return result.durableOutcome;
   if (result.assessment.lifecycle === "partially-applied")
@@ -2475,8 +2527,90 @@ function outcomeForApplyResult(result) {
     return "outcome-unknown";
   return "context-mismatch";
 }
+function generatorApplyCommandResult(execution, runId, refusal) {
+  const fields = refusal === void 0 ? {} : { refusal };
+  switch (execution.outcome) {
+    case "completed":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "partially-applied":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "selection-incomplete":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "adoption-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "readdress-unsupported":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "readdress-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "destructive-authority-refused":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "prior-step-events-refusal":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "recovery-required":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "transport-ambiguous":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+    case "execution-failed":
+      return {
+        outcome: execution.outcome,
+        runId,
+        result: execution,
+        ...fields
+      };
+  }
+}
 function formatApplyHuman(result) {
-  const line = `${result.outcome}: ${result.runId}`;
+  const line = `${escapeDiagnosticText3(result.outcome)}: ${escapeDiagnosticText3(result.runId)}`;
   if (result.refusal) {
     if ("address" in result.refusal)
       return formatPreAppendRefusalHuman(line, result.refusal);
@@ -2488,13 +2622,62 @@ function formatApplyHuman(result) {
       `resolving command: ${escapeDiagnosticText3(result.refusal.resolvingCommand)}`
     ].join("\n");
   }
-  if (result.outcome !== "plan-digest-mismatch" || !result.result) return line;
-  const detail = result.result.assessment.reasons[0]?.detail;
-  return detail ? `${line}
-${detail}` : line;
+  if (!("result" in result)) return line;
+  if ("assessment" in result.result) {
+    if (result.result.unresolvedOutcome) {
+      const unresolved = result.result.unresolvedOutcome;
+      return unresolved.kind === "recovery-required" ? [
+        line,
+        `claim: ${escapeDiagnosticText3(unresolved.claimId)}`,
+        `detail: ${escapeDiagnosticText3(unresolved.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n") : [
+        line,
+        `detail: ${escapeDiagnosticText3(unresolved.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    }
+    if (result.outcome !== "plan-digest-mismatch") return line;
+    const detail = result.result.assessment.reasons[0]?.detail;
+    return detail ? `${line}
+${escapeDiagnosticText3(detail)}` : line;
+  }
+  const execution = result.result;
+  switch (execution.outcome) {
+    case "completed":
+      return line;
+    case "recovery-required":
+      return [
+        line,
+        `claim: ${escapeDiagnosticText3(execution.claimId)}`,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    case "transport-ambiguous":
+      return [
+        line,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+    case "partially-applied":
+    case "selection-incomplete":
+    case "adoption-refused":
+    case "readdress-unsupported":
+    case "readdress-refused":
+    case "destructive-authority-refused":
+    case "execution-failed":
+      return `${line}
+detail: ${escapeDiagnosticText3(execution.detail)}`;
+    case "prior-step-events-refusal":
+      return [
+        line,
+        `detail: ${escapeDiagnosticText3(execution.detail)}`,
+        `resolving command: dbsp reconcile --db <database> ${escapeDiagnosticText3(result.runId)}`
+      ].join("\n");
+  }
 }
 function acceptanceMatches(assumption, acceptance2) {
-  return acceptance2.class === assumption.class && (!acceptance2.fromTrustRoot || canonicalJson(acceptance2.fromTrustRoot) === canonicalJson(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance2.withinScope || acceptance2.withinScope.length === 0 : !acceptance2.withinScope || acceptance2.withinScope.length === 0 || assumption.scope.every(
+  return acceptance2.class === assumption.class && (!acceptance2.fromTrustRoot || canonicalJson3(acceptance2.fromTrustRoot) === canonicalJson3(assumption.asserter)) && (assumption.scope.length === 0 ? !acceptance2.withinScope || acceptance2.withinScope.length === 0 : !acceptance2.withinScope || acceptance2.withinScope.length === 0 || assumption.scope.every(
     (resource) => acceptance2.withinScope?.some(
       (selector) => selectorMatchesResource(selector, resource)
     )
@@ -2730,10 +2913,14 @@ async function runApplyInternal(runId, options, pool) {
             throw new RecordedPlanDigestMismatchError(
               `persisted generator manifest is invalid: ${lifecycleError}`
             );
-          if (generatorRunHasPriorStepEvents(current))
+          if (await generatorRunRequiresRecovery(
+            target,
+            current,
+            manifest.manifest.steps
+          ))
             return {
               outcome: "prior-step-events-refusal",
-              detail: "run has prior generator step-attempt events; run dbsp recover instead"
+              detail: "run has prior generator step-attempt events; run dbsp reconcile --db <database> <run-id>"
             };
           return executeGeneratorPlan({
             pool: owned,
@@ -2780,12 +2967,11 @@ async function runApplyInternal(runId, options, pool) {
             withheldAuthority
           }
         };
-        result = {
-          outcome: execution.outcome,
+        result = generatorApplyCommandResult(
+          execution,
           runId,
-          result: execution,
-          ...preAppendRefusal === void 0 ? {} : { refusal: preAppendRefusal }
-        };
+          preAppendRefusal
+        );
       }
     } else {
       const locked = await withPgTransitionRunLock(
@@ -2837,7 +3023,7 @@ async function runApplyInternal(runId, options, pool) {
                 return;
               const actor = process.env.USER ?? process.env.LOGNAME ?? "unknown-local-actor";
               const authorizedAt = (/* @__PURE__ */ new Date()).toISOString();
-              const digest2 = authorizationDigest(
+              const digest = authorizationDigest(
                 run.runId,
                 transitionPlanDigest2(plan),
                 policy.accepts,
@@ -2849,7 +3035,7 @@ async function runApplyInternal(runId, options, pool) {
                 runId: run.runId,
                 policy: policy.accepts,
                 grants,
-                digest: digest2,
+                digest,
                 actor,
                 authorizedAt
               };
@@ -2965,9 +3151,7 @@ var applyCommand = new Command2("apply").description(
         console.log("confirmation-declined: persisted run was not executed");
       else if (result2.outcome === "not-executable") {
       } else if (result2.outcome !== "dry-run" && "result" in result2)
-        console.log(
-          "runId" in result2.result ? formatApplyHuman(result2.result) : `${result2.result.outcome}${"detail" in result2.result ? `: ${result2.result.detail}` : ""}`
-        );
+        console.log(formatApplyHuman(result2.result));
     }
     process.exitCode = exitCode2;
     return;
@@ -3143,7 +3327,7 @@ import {
   DBSP_LEDGER_EVENT_TABLE,
   escapeDiagnosticText as escapeDiagnosticText4,
   readPgCatalogueIdentity as readPgCatalogueIdentity3,
-  readPgLedgerAddressChain as readPgLedgerAddressChain2,
+  readPgLedgerAddressChain as readPgLedgerAddressChain3,
   readPgLedgerMarker
 } from "@dbsp/adapter-pgsql";
 import { acquireTransitionLease as acquireTransitionLease4, projectLedgerChain as projectLedgerChain2 } from "@dbsp/core";
@@ -3316,7 +3500,7 @@ async function runInspect(selector, options) {
       let projection;
       try {
         projection = projectLedgerChain2(
-          await readPgLedgerAddressChain2(lease.session, ledger, address)
+          await readPgLedgerAddressChain3(lease.session, ledger, address)
         );
       } catch (error) {
         return {
@@ -3483,7 +3667,7 @@ var introspectCommand = new Command5("introspect").description("Generate schema.
 );
 
 // src/commands/preflight.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { mkdtemp, open, rename, rm } from "fs/promises";
 import { dirname as dirname3, join } from "path";
 import {
@@ -3568,7 +3752,7 @@ function declarationsForScopes(model, database, scopes, naming) {
   });
   return {
     version: 1,
-    digest: createHash4("sha256").update(canonical).digest("hex"),
+    digest: createHash2("sha256").update(canonical).digest("hex"),
     declarations: uniqueDeclarations
   };
 }
@@ -3655,14 +3839,14 @@ var preflightCommand = new Command6("preflight").description(
 });
 
 // src/commands/reconcile.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import {
   assertCreateUniqueIndexConcurrentlyRecoveryNotInvalid,
   assertPgDatabaseWritable,
   escapeDiagnosticText as escapeDiagnosticText6,
   isPgDatabaseReadOnlyError,
-  readPgLedgerAddressChain as readPgLedgerAddressChain3,
-  readPgLedgerReservationsForExecution,
+  readPgLedgerAddressChain as readPgLedgerAddressChain4,
+  readPgLedgerReservationsForExecution as readPgLedgerReservationsForExecution2,
   readPgLedgerScopeCurrency as readPgLedgerScopeCurrency2,
   readTransitionJournal as readTransitionJournal2,
   readVerifiedPgLedgerReservationsForPair,
@@ -3673,6 +3857,8 @@ import { recoverPgOutcomeClaim } from "@dbsp/adapter-pgsql/internal";
 import {
   acquireExclusiveTransitionLease as acquireExclusiveTransitionLease2,
   assumptionAccepted,
+  canonicalJson as canonicalJson4,
+  canonicalJsonDigest as canonicalJsonDigest3,
   outcomeClaimId as outcomeClaimId2,
   projectLedgerChain as projectLedgerChain3,
   resourceScopeCovers,
@@ -3705,6 +3891,9 @@ function classifyReconcileFailure(error, stage) {
   if (stage === "journal") return "malformed-journal";
   return "catalogue";
 }
+function isUnresolvedRecoveryOutcome(report) {
+  return report.outcome === "pending" || report.outcome === "blocked" || report.outcome === "malformed-chain" || report.outcome === "protocol-refused" || report.outcome === "transport-ambiguous" || report.outcome === "no-open-claim" || report.outcome === "indeterminate-appended" || report.outcome === "indeterminate-pair";
+}
 function ledgerHome(address) {
   if (address.scope === "database") return { scope: "database" };
   if (!address.schema)
@@ -3715,18 +3904,21 @@ function ledgerHome(address) {
 }
 function recoveryPayload(identity) {
   const value = JSON.parse(
-    JSON.stringify({ catalogueIdentity: identity })
+    canonicalJson4({
+      ...identity === void 0 ? {} : { catalogueIdentity: identity }
+    })
   );
   return {
     value,
-    digest: createHash5("sha256").update(JSON.stringify(value)).digest("hex")
+    digest: canonicalJsonDigest3(value)
   };
 }
 function recoveryReport(address, result) {
   if (result.kind === "outcome-recovery-appended") {
+    const indeterminate = result.classification.resolution.eventKind === "indeterminate";
     return {
       address,
-      outcome: result.append.kind === "already-appended-outcome-resolution" ? "already-appended" : "appended",
+      outcome: indeterminate ? "indeterminate-appended" : result.append.kind === "already-appended-outcome-resolution" ? "already-appended" : "appended",
       reason: result.classification.resolution.reason
     };
   }
@@ -3796,9 +3988,7 @@ function readdressRecoveryReport(reservations, result) {
   };
 }
 function unresolvedRecoveryDetail(reports) {
-  const unresolved = reports.filter(
-    (report) => report.outcome === "pending" || report.outcome === "blocked" || report.outcome === "malformed-chain" || report.outcome === "protocol-refused" || report.outcome === "transport-ambiguous" || report.outcome === "no-open-claim" || report.outcome === "indeterminate-pair"
-  );
+  const unresolved = reports.filter(isUnresolvedRecoveryOutcome);
   if (unresolved.length === 0) return void 0;
   return unresolved.map(
     (report) => `${escapeDiagnosticText6(report.address.name)}: ${escapeDiagnosticText6(report.reason ?? report.outcome)}`
@@ -3806,23 +3996,18 @@ function unresolvedRecoveryDetail(reports) {
 }
 function formatReconcileHuman(result) {
   const line = `${escapeDiagnosticText6(result.outcome)}: ${escapeDiagnosticText6(result.runId)}`;
-  return result.refusal ? formatPreAppendRefusalHuman(line, result.refusal) : line;
-}
-function executionIdsForRun(journal) {
-  const executionIds = /* @__PURE__ */ new Set([journal.run.runId]);
-  for (const event of journal.events) {
-    const record2 = event.record;
-    if (event.event === "intent" && "executionId" in record2 && typeof record2.executionId === "string")
-      executionIds.add(record2.executionId);
-    if (event.event === "observed" && "intent" in record2 && record2.intent && typeof record2.intent.executionId === "string")
-      executionIds.add(record2.intent.executionId);
-  }
-  if ("generator" in journal.plan)
-    executionIds.add(`dbsp.generator.execution.${journal.run.runId}`);
-  return [...executionIds];
+  const base = result.refusal ? formatPreAppendRefusalHuman(line, result.refusal) : line;
+  if (result.outcome === "reconcile-completed" || !result.recovery) return base;
+  const unresolved = result.recovery.filter(isUnresolvedRecoveryOutcome);
+  return unresolved.length === 0 ? base : [
+    base,
+    ...unresolved.map(
+      (report) => `${escapeDiagnosticText6(report.address.name)}: ${escapeDiagnosticText6(report.outcome)}${report.reason ? `: ${escapeDiagnosticText6(report.reason)}` : ""}`
+    )
+  ].join("\n");
 }
 function statementBundleDigest(statements) {
-  return createHash5("sha256").update(
+  return createHash3("sha256").update(
     JSON.stringify(statements.map(({ ordinal, sql }) => [ordinal, sql]))
   ).digest("hex");
 }
@@ -3963,7 +4148,7 @@ async function runReconcile(runId, options, pool) {
           const reservations = (await Promise.all(
             [...homes.values()].flatMap(
               (home2) => executionIds.map(
-                (executionId) => readPgLedgerReservationsForExecution(
+                (executionId) => readPgLedgerReservationsForExecution2(
                   lease.session,
                   home2,
                   executionId
@@ -4024,7 +4209,7 @@ async function runReconcile(runId, options, pool) {
             const rootCandidates = [];
             for (const row of rows) {
               stage = "catalogue";
-              const chain = await readPgLedgerAddressChain3(
+              const chain = await readPgLedgerAddressChain4(
                 lease.session,
                 ledgerHome(row.address),
                 row.address