@dbsp/core 3.2.0 → 3.3.0

package/dist/index.js

@@ -3430,8 +3430,15 @@ function capabilityAvailable(descriptor, context) {
     }
   }
 }
+var RETIRED_CONNECTION_OWNERSHIP_MEMBERS = ["checkout", "release"];
+function retiredConnectionOwnershipMember(value) {
+  return RETIRED_CONNECTION_OWNERSHIP_MEMBERS.find((member) => member in value);
+}
 function isOperationRuntime(semantics) {
-  return "checkout" in semantics && "release" in semantics && "writeIntentJournal" in semantics && "begin" in semantics && "setLockTimeout" in semantics && "acquireLocks" in semantics && "observeContext" in semantics && "observeOperation" in semantics && "checkGuard" in semantics && "executeOperation" in semantics && "writeCompletionJournal" in semantics && "commit" in semantics && "rollback" in semantics && "writeObservedJournal" in semantics && "isLockTimeout" in semantics;
+  if (retiredConnectionOwnershipMember(semantics) !== void 0) {
+    return false;
+  }
+  return "writeIntentJournal" in semantics && "begin" in semantics && "setLockTimeout" in semantics && "acquireLocks" in semantics && "observeContext" in semantics && "observeOperation" in semantics && "checkGuard" in semantics && "executeOperation" in semantics && "writeCompletionJournal" in semantics && "commit" in semantics && "rollback" in semantics && "writeObservedJournal" in semantics && "isLockTimeout" in semantics;
 }
 function validateRulePrecedenceFacts(facts, rules) {
   const rulesByKey = new Map(rules.map((rule) => [ruleKey(rule), rule]));
@@ -3574,6 +3581,12 @@ var PackRegistry = class {
       compositionFactOwnerByKind.set(kind, owner);
     };
     for (const pack of packs) {
+      const retiredMember = pack.executionCoordinator ? retiredConnectionOwnershipMember(pack.executionCoordinator) : void 0;
+      if (retiredMember !== void 0) {
+        throw new Error(
+          `transition pack executionCoordinator declares retired connection ownership member ${retiredMember}`
+        );
+      }
       const transactionDomain = pack.transactionDomain ?? pack.executionCoordinator?.transactionDomain;
       if (pack.executionCoordinator && !transactionDomain) {
         throw new Error(
@@ -3892,6 +3905,129 @@ function assumptionAccepted(assumption, policy) {
 // src/transition/resume.ts
 import { createHash as createHash2 } from "crypto";
 
+// src/transition/transition-lessor.ts
+var TRANSITION_LESSOR_BRAND = /* @__PURE__ */ Symbol.for("dbsp.transition.lessor");
+var TRANSITION_LESSOR_PROTOCOL_VERSION = 1;
+var TRANSITION_LESSOR_REJECTION = "transition target must be a core-minted lessor";
+async function captureLease(value) {
+  const { query, release } = leaseMembers(value);
+  if (typeof query !== "function" || typeof release !== "function") {
+    const rejection = new Error(
+      "A transition lessor must acquire a lease exposing query() and release(). This acquisition returned an unusable member pair."
+    );
+    releaseMalformedAcquisition(value, release, rejection);
+    throw rejection;
+  }
+  return {
+    raw: value,
+    query,
+    release
+  };
+}
+async function acquireTransitionLease(target) {
+  const { raw: raw2, query, release } = await captureLease(await target.acquire());
+  let closed = false;
+  const session = Object.freeze({
+    query: (sql2, params) => {
+      if (closed) {
+        return Promise.reject(
+          new Error("transition lease was already given back")
+        );
+      }
+      return query.call(raw2, sql2, params);
+    }
+  });
+  const releaseLease = (failure) => {
+    if (closed) {
+      return Promise.resolve();
+    }
+    closed = true;
+    try {
+      const returned = failure ? release.call(raw2, releaseArgument(failure)) : release.call(raw2);
+      void Promise.resolve(returned).catch(() => void 0);
+    } catch {
+    }
+    return Promise.resolve();
+  };
+  return Object.freeze({
+    session,
+    release: releaseLease
+  });
+}
+function leaseMembers(value) {
+  if (value == null || typeof value !== "object" && typeof value !== "function") {
+    return { query: void 0, release: void 0 };
+  }
+  const release = readMember(value, "release");
+  return { query: readMember(value, "query"), release };
+}
+function readMember(value, member) {
+  try {
+    return value[member];
+  } catch {
+    return void 0;
+  }
+}
+function releaseMalformedAcquisition(value, release, rejection) {
+  if (typeof release !== "function") {
+    return;
+  }
+  try {
+    void Promise.resolve(release.call(value, rejection)).catch(() => void 0);
+  } catch {
+  }
+}
+function createTransitionLessor(acquire) {
+  const lessor = { acquire };
+  Object.defineProperty(lessor, TRANSITION_LESSOR_BRAND, {
+    value: Object.freeze({
+      protocolVersion: TRANSITION_LESSOR_PROTOCOL_VERSION
+    }),
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(lessor);
+}
+function isTransitionLessor(value) {
+  try {
+    if (value == null || typeof value !== "object" && typeof value !== "function" || Array.isArray(value)) {
+      return false;
+    }
+    const brand = value[TRANSITION_LESSOR_BRAND];
+    return brand != null && typeof brand === "object" && brand.protocolVersion === TRANSITION_LESSOR_PROTOCOL_VERSION && typeof value.acquire === "function";
+  } catch {
+    return false;
+  }
+}
+var TransitionLeaseFailureError = class extends Error {
+  constructor(cause) {
+    super("transition lease released after a failure", { cause });
+    this.name = "TransitionLeaseFailureError";
+  }
+};
+function releaseArgument(failure) {
+  return failure.error ? failure.error : new TransitionLeaseFailureError(failure.error);
+}
+function transitionLessorRejectionAssessment(artifact, lifecycle = "planned") {
+  return {
+    decision: "blocked",
+    assurance: "unproven",
+    lifecycle,
+    continuation: "human-intervention-required",
+    reasons: [
+      {
+        code: "context-mismatch",
+        artifact,
+        fact: {
+          key: "transition-lessor",
+          value: TRANSITION_LESSOR_REJECTION
+        },
+        scope: []
+      }
+    ]
+  };
+}
+
 // src/transition/validation.ts
 function sameTrustRoot2(left, right) {
   return stableJson(left) === stableJson(right);
@@ -4787,6 +4923,11 @@ function latestIntent(step, events) {
     recordedAt: recordedAt()
   };
 }
+function orderedPlanSteps(plan2, stepById) {
+  return plan2.segments.flatMap(
+    (segment) => segment.stepIds.map((stepId2) => stepById.get(stepId2)).filter((step) => step !== void 0)
+  );
+}
 function resumeRequiredResult(params) {
   const hasCompleted = params.completed.length > 0;
   return {
@@ -4925,80 +5066,71 @@ function completedJournal(intent, completion, observations) {
     observedOutcome
   };
 }
-async function observeStep(registry, step, target, baseContext, phase) {
+async function withObservedStep(registry, step, target, baseContext, phase, use) {
   const resolution = registry.resolveOperation(step.operation);
   if (!resolution.ok || !isOperationRuntime(resolution.semantics)) {
-    return { ok: false, detail: "operation runtime missing" };
+    return use({ ok: false, detail: "operation runtime missing" });
   }
   const runtime = resolution.semantics;
   const issuer = registry.resolveIssuer(step.operation.operationKind.artifact);
   if (!issuer) {
-    return { ok: false, detail: "operation observation issuer missing" };
+    return use({ ok: false, detail: "operation observation issuer missing" });
   }
-  let client;
+  let lease;
+  let failed = false;
+  let failure;
   try {
-    client = await runtime.checkout(target);
-    let context = await runtime.observeContext(
-      client,
-      step.operation,
-      baseContext
-    );
-    context = registry.contextWithDerivedCapabilities(context);
-    const liveContextMatch = matchLiveObservationContext({
-      expected: baseContext,
-      actual: context
-    });
-    if (!liveContextMatch.ok) {
-      await runtimeSafeRelease(runtime, client);
-      return { ok: false, detail: liveContextMatch.detail };
-    }
-    const observed = await runtime.observeOperation(
-      client,
-      step.operation,
-      context,
-      phase,
-      issuer
-    );
-    return {
-      ok: true,
-      observations: observed.observations,
-      fingerprint: observed.fingerprint,
-      client,
-      runtime
-    };
-  } catch (error) {
-    if (client) {
-      await runtimeSafeRelease(
-        resolution.ok && isOperationRuntime(resolution.semantics) ? resolution.semantics : void 0,
+    let observation;
+    try {
+      lease = await acquireTransitionLease(target);
+      const client = { opaqueClient: lease.session };
+      let context = await runtime.observeContext(
         client,
-        error
+        step.operation,
+        baseContext
       );
+      context = registry.contextWithDerivedCapabilities(context);
+      const liveContextMatch = matchLiveObservationContext({
+        expected: baseContext,
+        actual: context
+      });
+      if (!liveContextMatch.ok) {
+        observation = { ok: false, detail: liveContextMatch.detail };
+      } else {
+        const observed = await runtime.observeOperation(
+          client,
+          step.operation,
+          context,
+          phase,
+          issuer
+        );
+        observation = {
+          ok: true,
+          observations: observed.observations,
+          fingerprint: observed.fingerprint,
+          writeJournal: async (journal) => runtime.writeObservedJournal(client, journal)
+        };
+      }
+    } catch (error) {
+      failed = true;
+      failure = error;
+      observation = {
+        ok: false,
+        detail: error instanceof Error ? error.message : "observation failed"
+      };
+    }
+    try {
+      return await use(observation);
+    } catch (error) {
+      failed = true;
+      failure = error;
+      throw error;
+    }
+  } finally {
+    if (lease) {
+      await lease.release(failed ? { error: failure } : void 0);
     }
-    return {
-      ok: false,
-      detail: error instanceof Error ? error.message : "observation failed"
-    };
-  }
-}
-async function runtimeSafeRelease(runtime, client, error) {
-  if (!runtime) {
-    return;
-  }
-  try {
-    await runtime.release(client, error);
-  } catch {
-  }
-}
-async function releaseObservedAttempt(attempt, error) {
-  if (attempt.ok) {
-    await runtimeSafeRelease(attempt.runtime, attempt.client, error);
-  }
-}
-async function writeObserved(attempt, journal) {
-  if (!attempt.ok) {
-    return;
   }
-  await attempt.runtime.writeObservedJournal(attempt.client, journal);
 }
 function stepAssumption(plan2, assumptionId2) {
   return plan2.assumptions.find((assumption) => assumption.id === assumptionId2);
@@ -5035,6 +5167,43 @@ async function resumeTransitionRun(registry, input) {
   if (!evidenceContext) {
     return contextMismatch("loaded plan contains no durable evidence context");
   }
+  const referencedAssumptions = /* @__PURE__ */ new Set();
+  for (const step of loaded.plan.steps) {
+    for (const assumptionId2 of step.restsOnAssumptions) {
+      referencedAssumptions.add(assumptionId2);
+    }
+    const policyFailure = validatePolicyForStep(
+      loaded.plan,
+      step,
+      input.policy
+    );
+    if (policyFailure) {
+      return policyFailure;
+    }
+  }
+  for (const assumption of loaded.plan.assumptions) {
+    if (!referencedAssumptions.has(assumption.id) && !assumptionAccepted(assumption, input.policy)) {
+      return unacceptedPlanAssumption(loaded.plan, assumption);
+    }
+  }
+  const stepById = new Map(
+    loaded.plan.steps.map((step) => [step.stepId, step])
+  );
+  const groupedResult = groupEvents(loaded.events, loaded.run.runId, stepById);
+  if (!groupedResult.ok) {
+    return contextMismatch(groupedResult.detail);
+  }
+  const grouped = groupedResult.grouped;
+  if (!isTransitionLessor(input.target)) {
+    return {
+      assessment: transitionLessorRejectionAssessment(
+        RESUMER_ARTIFACT,
+        loaded.events.length === 0 ? "planned" : "outcome-unknown"
+      ),
+      journals: [],
+      observations: []
+    };
+  }
   const baseContext = await input.readContext(input.target, loaded.run);
   const runContextMatch = matchRunObservationContext({
     run: loaded.run,
@@ -5074,36 +5243,7 @@ async function resumeTransitionRun(registry, input) {
       `loaded plan failed semantic invariant validation: ${semanticDiagnostic.detail}`
     );
   }
-  const referencedAssumptions = /* @__PURE__ */ new Set();
-  for (const step of loaded.plan.steps) {
-    for (const assumptionId2 of step.restsOnAssumptions) {
-      referencedAssumptions.add(assumptionId2);
-    }
-    const policyFailure = validatePolicyForStep(
-      loaded.plan,
-      step,
-      input.policy
-    );
-    if (policyFailure) {
-      return policyFailure;
-    }
-  }
-  for (const assumption of loaded.plan.assumptions) {
-    if (!referencedAssumptions.has(assumption.id) && !assumptionAccepted(assumption, input.policy)) {
-      return unacceptedPlanAssumption(loaded.plan, assumption);
-    }
-  }
-  const stepById = new Map(
-    loaded.plan.steps.map((step) => [step.stepId, step])
-  );
-  const groupedResult = groupEvents(loaded.events, loaded.run.runId, stepById);
-  if (!groupedResult.ok) {
-    return contextMismatch(groupedResult.detail);
-  }
-  const grouped = groupedResult.grouped;
-  const orderedSteps = loaded.plan.segments.flatMap(
-    (segment) => segment.stepIds.map((stepId2) => stepById.get(stepId2)).filter(Boolean)
-  );
+  const orderedSteps = orderedPlanSteps(loaded.plan, stepById);
   const completed = [];
   const observations = [];
   for (const step of orderedSteps) {
@@ -5138,65 +5278,90 @@ async function resumeTransitionRun(registry, input) {
     }
     const transactional = effects.effects.execution.transaction !== "forbids-transaction";
     if (observedJournal?.outcome === "completed" || completion) {
-      const after2 = await observeStep(
+      const after2 = await withObservedStep(
         registry,
         step,
         input.target,
         baseContext,
-        "after"
+        "after",
+        async (observation) => {
+          if (!observation.ok || !fingerprintMatches(step.expectedAfter, observation.fingerprint)) {
+            return {
+              kind: "unmatched",
+              detail: observation.ok ? "current fingerprint no longer matches expectedAfter" : observation.detail
+            };
+          }
+          const journal = observedJournal?.outcome === "completed" ? observedJournal : completedJournal(intent, completion, observation.observations);
+          if (!observedJournal) {
+            await observation.writeJournal(journal);
+          }
+          return {
+            kind: "completed",
+            observations: observation.observations,
+            journal
+          };
+        }
       );
-      if (after2.ok && fingerprintMatches(step.expectedAfter, after2.fingerprint)) {
+      if (after2.kind === "completed") {
         observations.push(...after2.observations);
-        const journal = observedJournal?.outcome === "completed" ? observedJournal : completedJournal(intent, completion, after2.observations);
-        if (!observedJournal) {
-          await writeObserved(after2, journal);
-        }
-        await releaseObservedAttempt(after2);
-        completed.push(journal);
+        completed.push(after2.journal);
         continue;
       }
-      await releaseObservedAttempt(after2);
       return unknownResult({
         step,
         completed,
         observations,
-        detail: after2.ok ? "current fingerprint no longer matches expectedAfter" : after2.detail
+        detail: after2.detail
       });
     }
     if (transactional) {
-      const before2 = await observeStep(
+      const before2 = await withObservedStep(
         registry,
         step,
         input.target,
         baseContext,
-        "before"
+        "before",
+        async (observation) => ({
+          kind: observation.ok && fingerprintMatches(step.expectedBefore, observation.fingerprint) ? "resume-required" : "unmatched",
+          observations: observation.ok ? observation.observations : []
+        })
       );
-      if (before2.ok && fingerprintMatches(step.expectedBefore, before2.fingerprint)) {
+      if (before2.kind === "resume-required") {
         observations.push(...before2.observations);
-        await releaseObservedAttempt(before2);
         return resumeRequiredResult({
           step,
           completed,
           observations
         });
       }
-      await releaseObservedAttempt(before2);
-      const after2 = await observeStep(
+      const after2 = await withObservedStep(
         registry,
         step,
         input.target,
         baseContext,
-        "after"
+        "after",
+        async (observation) => {
+          if (!observation.ok || !fingerprintMatches(step.expectedAfter, observation.fingerprint)) {
+            return { kind: "unmatched" };
+          }
+          const journal = completedJournal(
+            intent,
+            void 0,
+            observation.observations
+          );
+          await observation.writeJournal(journal);
+          return {
+            kind: "completed",
+            observations: observation.observations,
+            journal
+          };
+        }
       );
-      if (after2.ok && fingerprintMatches(step.expectedAfter, after2.fingerprint)) {
+      if (after2.kind === "completed") {
         observations.push(...after2.observations);
-        const journal = completedJournal(intent, void 0, after2.observations);
-        await writeObserved(after2, journal);
-        await releaseObservedAttempt(after2);
-        completed.push(journal);
+        completed.push(after2.journal);
         continue;
       }
-      await releaseObservedAttempt(after2);
       return unknownResult({
         step,
         completed,
@@ -5204,39 +5369,53 @@ async function resumeTransitionRun(registry, input) {
         detail: "transactional intent had no completion and current state matches neither expectedBefore nor expectedAfter"
       });
     }
-    const after = await observeStep(
+    const after = await withObservedStep(
       registry,
       step,
       input.target,
       baseContext,
-      "after"
+      "after",
+      async (observation) => {
+        if (!observation.ok || !fingerprintMatches(step.expectedAfter, observation.fingerprint)) {
+          return { kind: "unmatched" };
+        }
+        const journal = completedJournal(
+          intent,
+          void 0,
+          observation.observations
+        );
+        await observation.writeJournal(journal);
+        return {
+          kind: "completed",
+          observations: observation.observations,
+          journal
+        };
+      }
     );
-    if (after.ok && fingerprintMatches(step.expectedAfter, after.fingerprint)) {
+    if (after.kind === "completed") {
       observations.push(...after.observations);
-      const journal = completedJournal(intent, void 0, after.observations);
-      await writeObserved(after, journal);
-      await releaseObservedAttempt(after);
-      completed.push(journal);
+      completed.push(after.journal);
       continue;
     }
-    await releaseObservedAttempt(after);
-    const before = await observeStep(
+    const before = await withObservedStep(
       registry,
       step,
       input.target,
       baseContext,
-      "before"
+      "before",
+      async (observation) => ({
+        kind: observation.ok && fingerprintMatches(step.expectedBefore, observation.fingerprint) ? "resume-required" : "unmatched",
+        observations: observation.ok ? observation.observations : []
+      })
     );
-    if (before.ok && fingerprintMatches(step.expectedBefore, before.fingerprint)) {
+    if (before.kind === "resume-required") {
       observations.push(...before.observations);
-      await releaseObservedAttempt(before);
       return resumeRequiredResult({
         step,
         completed,
         observations
       });
     }
-    await releaseObservedAttempt(before);
     return unknownResult({
       step,
       completed,
@@ -5801,16 +5980,25 @@ function createApplier(registry) {
           );
         }
         let client;
+        let lease;
         let committed = false;
         let transactionStarted = false;
-        let releaseError;
+        let releaseFailure;
         let active = first;
         let activeContext = runtimeContext;
         let activeOperationAttempted = false;
         let activeNonRollbackableOperationExecuted = false;
         const completedInSegment = [];
+        if (!isTransitionLessor(target)) {
+          return resultWithCommittedJournals({
+            assessment: transitionLessorRejectionAssessment(APPLIER_ARTIFACT),
+            journals: [],
+            observations: []
+          });
+        }
         try {
-          client = await segmentCoordinator.checkout(target);
+          lease = await acquireTransitionLease(target);
+          client = { opaqueClient: lease.session };
           const executionClient = client;
           if (transactional) {
             await segmentCoordinator.begin(executionClient);
@@ -6361,7 +6549,7 @@ function createApplier(registry) {
             journals.push(journal);
           }
         } catch (error) {
-          releaseError = error;
+          releaseFailure = { error };
           if (error instanceof CommitOutcomeUncertainError) {
             if (client && transactionStarted) {
               await segmentCoordinator.rollback(client).catch(() => void 0);
@@ -6608,11 +6796,8 @@ function createApplier(registry) {
             outcomeDurable: true
           });
         } finally {
-          if (client) {
-            try {
-              await segmentCoordinator.release(client, releaseError);
-            } catch {
-            }
+          if (lease) {
+            await lease.release(releaseFailure);
           }
         }
       }
@@ -9674,22 +9859,8 @@ function validateIssuedObservation(observation, context) {
     detail: `observation ${observation.id ?? "unknown"} has an invalid role`
   };
 }
-function transitionPool(target) {
-  if (isJsonObject3(target) && typeof target.connect === "function" && typeof target.release !== "function") {
-    return target;
-  }
-  throw new Error(
-    "transition proof target must be a Pool-like object with connect(); checked-out clients are not accepted"
-  );
-}
 async function checkoutProofClient(target) {
-  const client = await transitionPool(target).connect();
-  if (!isJsonObject3(client) || typeof client.query !== "function" || typeof client.release !== "function") {
-    throw new Error(
-      "transition proof pool returned a client without query() and release()"
-    );
-  }
-  return client;
+  return acquireTransitionLease(target);
 }
 function conclusionForObligation(obligation, evidence, expectedContext) {
   const result = concludeEvidenceForObligation({
@@ -10326,13 +10497,15 @@ async function proveTransitions(registry, compare, target, context, initialState
   let minServerVersionRequests = /* @__PURE__ */ new Map();
   const obligationClaimByCanonicalKey = /* @__PURE__ */ new Map();
   const multiCandidateSnapshot = !initialState && compare.candidates.length > 1;
+  let sharedLease;
   let sharedClient;
-  let sharedReleaseError;
+  let sharedReleaseFailure;
   const sharedIssuedRequestKeys = /* @__PURE__ */ new Set();
   let sharedIssued = { evidence: [], advisory: [] };
   try {
     if (multiCandidateSnapshot) {
-      sharedClient = await checkoutProofClient(target);
+      sharedLease = await checkoutProofClient(target);
+      sharedClient = sharedLease.session;
       const allRequiredObservations = [];
       for (const candidate of compare.candidates) {
         const rule = registry.resolveRule(candidate.rule);
@@ -10506,10 +10679,12 @@ async function proveTransitions(registry, compare, target, context, initialState
           issued = appendIssued(sharedIssued, additional);
           sharedIssued = appendIssued(sharedIssued, additional);
         } else {
+          let lease;
           let client;
-          let releaseError;
+          let releaseFailure;
           try {
-            client = await checkoutProofClient(target);
+            lease = await checkoutProofClient(target);
+            client = lease.session;
             proofContext = issuer.readContext ? await issuer.readContext(client, context, requiredObservations) : context;
             proofContext = registry.contextWithDerivedCapabilities(proofContext);
             const supportMismatch = ruleSupportMismatch(rule, proofContext);
@@ -10529,7 +10704,7 @@ async function proveTransitions(registry, compare, target, context, initialState
               proofContext
             );
           } catch (error) {
-            releaseError = error;
+            releaseFailure = { error };
             return {
               kind: "blocked",
               assessment: artifactMismatch(
@@ -10538,8 +10713,8 @@ async function proveTransitions(registry, compare, target, context, initialState
               )
             };
           } finally {
-            if (client) {
-              client.release(releaseError);
+            if (lease) {
+              await lease.release(releaseFailure);
             }
           }
         }
@@ -10886,7 +11061,7 @@ async function proveTransitions(registry, compare, target, context, initialState
       planAssumptions.push(...assumptions2);
     }
   } catch (error) {
-    sharedReleaseError = error;
+    sharedReleaseFailure = { error };
     return {
       kind: "blocked",
       assessment: artifactMismatch(
@@ -10895,8 +11070,8 @@ async function proveTransitions(registry, compare, target, context, initialState
       )
     };
   } finally {
-    if (sharedClient) {
-      sharedClient.release(sharedReleaseError);
+    if (sharedLease) {
+      await sharedLease.release(sharedReleaseFailure);
     }
   }
   let assumptions;
@@ -11041,11 +11216,13 @@ async function retryUnknownRecognition(registry, compare, target, context) {
   ]);
   const issuer = registry.resolveIssuer(recognition.rule.pack);
   if (issuer) {
+    let lease;
     let client;
-    let releaseError;
+    let releaseFailure;
     const issuedRequestKeys = /* @__PURE__ */ new Set();
     try {
-      client = await checkoutProofClient(target);
+      lease = await checkoutProofClient(target);
+      client = lease.session;
       let proofContext2 = issuer.readContext ? await issuer.readContext(client, context, recognitionRequests) : context;
       proofContext2 = registry.contextWithDerivedCapabilities(proofContext2);
       const supportMismatch2 = ruleSupportMismatch(rule, proofContext2);
@@ -11152,7 +11329,7 @@ async function retryUnknownRecognition(registry, compare, target, context) {
         }
       );
     } catch (error) {
-      releaseError = error;
+      releaseFailure = { error };
       return {
         kind: "blocked",
         assessment: artifactMismatch(
@@ -11161,8 +11338,8 @@ async function retryUnknownRecognition(registry, compare, target, context) {
         )
       };
     } finally {
-      if (client) {
-        client.release(releaseError);
+      if (lease) {
+        await lease.release(releaseFailure);
       }
     }
   }
@@ -11259,7 +11436,7 @@ function createProver(registry) {
         case "unsupported":
           return { kind: "blocked", assessment: unsupported(compare) };
         case "unknown":
-          return retryUnknownRecognition(registry, compare, target, context);
+          break;
         case "ambiguous":
           return { kind: "blocked", assessment: ambiguous(compare) };
         case "uncomposable":
@@ -11267,7 +11444,13 @@ function createProver(registry) {
         case "transitions":
           break;
       }
-      return proveTransitions(registry, compare, target, context);
+      if (!isTransitionLessor(target)) {
+        return {
+          kind: "blocked",
+          assessment: transitionLessorRejectionAssessment(PROVER_ARTIFACT)
+        };
+      }
+      return compare.kind === "unknown" ? retryUnknownRecognition(registry, compare, target, context) : proveTransitions(registry, compare, target, context);
     }
   };
 }
@@ -11521,6 +11704,10 @@ function projectCompareToSingleCandidate(compare, entry) {
 }
 
 // src/transition/staged-orchestrator.ts
+var STAGED_ORCHESTRATOR_ARTIFACT = {
+  id: semanticArtifactId("dbsp.core.transition.staged-orchestrator"),
+  version: "0.1.0"
+};
 function uniqueResources2(resources) {
   const byKey = /* @__PURE__ */ new Map();
   for (const resource of resources) {
@@ -11679,6 +11866,20 @@ function createStagedTransitionOrchestrator(registry) {
       const observations = [];
       const completedProgress = /* @__PURE__ */ new Set();
       const maxIterations = input.maxIterations ?? 32;
+      const targetRejectionResult = () => resultWithAggregate(
+        transitionLessorRejectionAssessment(STAGED_ORCHESTRATOR_ARTIFACT),
+        journals,
+        observations
+      );
+      const proveAtTargetBoundary = async (compare, context) => {
+        if (!isTransitionLessor(input.target)) {
+          return { kind: "target-rejected" };
+        }
+        return {
+          kind: "proof",
+          proof: await prover.prove(compare, input.target, context)
+        };
+      };
       for (let iteration = 0; iteration < maxIterations; iteration += 1) {
         const context = await input.readContext();
         const current = await input.loadCurrent();
@@ -11696,7 +11897,14 @@ function createStagedTransitionOrchestrator(registry) {
         }
         if (compare.kind !== "transitions") {
           if (compare.kind === "unknown" && hasAppliedWork(journals)) {
-            const proof2 = await prover.prove(compare, input.target, context);
+            const proofAtBoundary2 = await proveAtTargetBoundary(
+              compare,
+              context
+            );
+            if (proofAtBoundary2.kind === "target-rejected") {
+              return targetRejectionResult();
+            }
+            const { proof: proof2 } = proofAtBoundary2;
             switch (proof2.kind) {
               case "no-drift":
                 return {
@@ -11750,7 +11958,14 @@ function createStagedTransitionOrchestrator(registry) {
           );
         }
         const segmentCompare = projectCompareToSingleCandidate(compare, ready);
-        const proof = await prover.prove(segmentCompare, input.target, context);
+        const proofAtBoundary = await proveAtTargetBoundary(
+          segmentCompare,
+          context
+        );
+        if (proofAtBoundary.kind === "target-rejected") {
+          return targetRejectionResult();
+        }
+        const { proof } = proofAtBoundary;
         if (proof.kind !== "proven") {
           return resultWithAggregate(proof.assessment, journals, observations);
         }
@@ -21559,6 +21774,7 @@ export {
   SubqueryBuilder,
   SubqueryExpression,
   TABLE_META,
+  TRANSITION_LESSOR_REJECTION,
   TableNotFoundError,
   UnhandledTypeInDialect,
   UnknownDialectError,
@@ -21569,6 +21785,7 @@ export {
   UpdateBuilder,
   UpsertBuilder,
   WindowBuilder,
+  acquireTransitionLease,
   advisoryObservationId,
   aggOrderBy,
   and,
@@ -21630,6 +21847,7 @@ export {
   createRawCteBuilder,
   createRecursiveMetadata,
   createStagedTransitionOrchestrator,
+  createTransitionLessor,
   decapitalize,
   defaultIndexName,
   defaultLogger,
@@ -21702,6 +21920,7 @@ export {
   isSubqueryExpression,
   export_isSubqueryRef as isSubqueryRef,
   isTableRef,
+  isTransitionLessor,
   export_isUpdateIntent as isUpdateIntent,
   export_isUpsertIntent as isUpsertIntent,
   export_isWhereAnd as isWhereAnd,