@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.138

package/dist/services/memory-historical-corrected-review.js

@@ -0,0 +1,206 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedHistoricalOriginalMemoryReview } from "./memory-historical-original-review.js";
+import { PreparedHistoricalMemoryRepairRegistration } from "./memory-historical-repair-registration.js";
+import { PreparedSettledMemoryRepair } from "./memory-repair-history.js";
+import { readRetainedCorrectedMemoryReviewRegistration } from "./memory-corrected-review-registration.js";
+import { PreparedRetainedMemoryCorrectionChecks } from "./memory-correction-check-receipt.js";
+import { readMemoryReviewWorkSettlement } from "./memory-review-acceptance.js";
+import { validateMemoryReviewWorkResult } from "./memory-review-work-results.js";
+import { memoryCorrectedReviewBatch } from "./memory-corrected-review-batch.js";
+import { correctedMemoryReviewAssignments } from "./memory-corrected-review-inputs.js";
+import { memoryCorrectionAffectedUnits } from "./memory-completed-correction-wave.js";
+import { correctedMemoryReviewUnits } from "./memory-corrected-review-projection.js";
+import { correctedMemoryReviewFindings } from "./memory-corrected-review-findings.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+const token = Symbol("historical-corrected-memory-review");
+function refuse(reason) {
+    throw new AppError("memory_historical_corrected_review_invalid", "Historical selective review lacks independent correction and reviewer custody", 2, { reason, effect: "no_effect" });
+}
+/** Retained metadata consistency only, not SQL/Session/Stage authority. */
+export function assertHistoricalMemoryReviewSources(histories, paths, runInputs, anchor) {
+    if (!Array.isArray(histories) || !histories.length || histories.length > 256
+        || !Array.isArray(runInputs) || runInputs.length > 4096)
+        refuse("invalid_historical_source_inventory");
+    const retainedHistories = histories;
+    let baseline = (anchor ?? retainedHistories[0].before()).withWritePaths(paths);
+    const visibleMemory = new Set(retainedHistories[0].workspaceManifest().entries()
+        .filter(entry => entry.kind === "file" && entry.path.startsWith(".memory-bank/")).map(entry => entry.path));
+    const prefixes = new Set([hybridDigest(baseline.entries())]);
+    for (const history of retainedHistories) {
+        if (!prefixes.has(hybridDigest(history.before().entries())))
+            refuse("historical_input_prefix_changed");
+        baseline = baseline.composeSettledDelta(history.before(), history.after());
+        prefixes.add(hybridDigest(baseline.entries()));
+        const before = new Map(history.before().entries().map(entry => [entry.path, entry]));
+        for (const entry of history.after().entries())
+            if (entry.kind === "file" && hybridDigest(before.get(entry.path) ?? null) !== hybridDigest(entry))
+                visibleMemory.add(entry.path);
+    }
+    const memory = (path) => path === ".memory-bank" || path.startsWith(".memory-bank/");
+    const finalFiles = new Map(baseline.entries().filter(entry => entry.kind === "file" && visibleMemory.has(entry.path)).map(entry => [entry.path, entry.sha256]));
+    const nonMemory = retainedHistories[0].workspaceManifest().entries().filter(entry => !memory(entry.path));
+    const files = (entries) => entries.filter(entry => entry.kind === "file").map(entry => ({ path: entry.path, sha256: entry.sha256 }));
+    const sort = (entries) => [...entries].sort((a, b) => a.path.localeCompare(b.path, "en"));
+    const workspace = runInputs.filter(ref => ref.root === "workspace");
+    if (retainedHistories.some(history => hybridDigest(history.workspaceManifest().entries().filter(entry => !memory(entry.path))) !== hybridDigest(nonMemory))
+        || hybridDigest(sort(files(nonMemory))) !== hybridDigest(sort(workspace.filter(ref => !memory(ref.path)).map(ref => ({ path: ref.path, sha256: ref.sha256 }))))
+        || hybridDigest(sort([...finalFiles].map(([path, sha256]) => ({ path, sha256 }))))
+            !== hybridDigest(sort(workspace.filter(ref => memory(ref.path)).map(ref => ({ path: ref.path, sha256: ref.sha256 }))))
+        || new Set(runInputs.map(ref => `${ref.root}:${ref.path}`)).size !== runInputs.length)
+        refuse("historical_workspace_projection_changed");
+}
+/** Historical full projection only, not Stage receipt acceptance. Expected
+ * input/check hashes must be selected from the independent accepted receipt.
+ * Current workspace/copies/policy are never adopted or used for re-admission. */
+export class PreparedHistoricalCorrectedMemoryReview {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #original in value;
+    }
+    #original;
+    #repairs;
+    #histories;
+    #checks;
+    #registration;
+    #workers;
+    #projection;
+    #observed;
+    #effective;
+    #reviewSha256;
+    constructor(key, original, repairs, histories, checks, registration, workers, projection, observed, effective, results) {
+        if (key !== token)
+            refuse("historical_review_token_required");
+        this.#original = original;
+        this.#repairs = repairs;
+        this.#histories = histories;
+        this.#checks = checks;
+        this.#registration = structuredClone(registration);
+        this.#workers = workers;
+        this.#projection = structuredClone(projection);
+        this.#observed = observed;
+        this.#effective = structuredClone(effective);
+        this.#reviewSha256 = hybridDigest({ registration_sha256: hybridDigest(this.#registration), workers: this.#workers.map(worker => ({
+                work_id: worker.workId, authority_sha256: worker.authority, result: worker.result
+            })), results });
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (!PreparedHistoricalOriginalMemoryReview.isPrepared(input.original))
+            refuse("historical_original_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const original = input.original, initial = original.registration(), scope = initial.scope, bundle = original.bundle();
+        original.revalidate(context);
+        const registration = context.db.readSnapshot(() => readRetainedCorrectedMemoryReviewRegistration(context, scope, input.correctedInputSha256, input.checkReceiptSha256));
+        if (!registration)
+            refuse("historical_registration_required");
+        const view = registration.view, repairs = PreparedHistoricalMemoryRepairRegistration.prepare(context, original);
+        const histories = repairs.completedWorkOrder(context).map(id => PreparedSettledMemoryRepair.prepare(context, repairs, id));
+        const repairReceipt = repairs.receipt(), repairBatch = repairs.batch();
+        const paths = [...new Set(repairBatch.works.flatMap(item => item.payload.memory_repair.write_paths))].sort();
+        assertHistoricalMemoryReviewSources(histories, paths, view.run_inputs);
+        const repairResults = histories.map(history => ({ work_id: history.workId, result: history.result(), reference: history.reference(), authority_sha256: history.sha256,
+            unit_ids: repairBatch.works.find(item => repairReceipt.work_ids[item.key] === history.workId).payload.memory_repair.unit_ids }));
+        const compose = readAcceptedStageData(context, { projectId: scope.project_id, runId: scope.run_id, stage: "compose" });
+        const affected = memoryCorrectionAffectedUnits(initial.view.unit_inventory, repairResults, JSON.parse(compose.bytes.toString("utf8")).details.works);
+        const assignments = correctedMemoryReviewAssignments({ units: initial.view.unit_inventory, initialAssignments: initial.view.assignments, affected,
+            files: view.run_inputs.filter(ref => ref.root === "workspace"), repairs: repairResults });
+        if (view.schema_id !== "dd-flow/memory-corrected-review-inputs@1" || view.source_policy !== initial.view.source_policy
+            || view.original_review_sha256 !== original.reviewSha256() || view.base !== initial.view.base
+            || hybridDigest(view.unit_inventory) !== hybridDigest(initial.view.unit_inventory)
+            || hybridDigest(view.instruction) !== hybridDigest(initial.view.instruction)
+            || hybridDigest(view.affected_unit_ids) !== hybridDigest(affected) || hybridDigest(view.assignments) !== hybridDigest(assignments)
+            || hybridDigest(view.repairs) !== hybridDigest(repairResults.map(repair => ({ work_id: repair.work_id, authority_sha256: repair.authority_sha256, result: repair.reference }))))
+            refuse("historical_correction_projection_changed");
+        const checks = PreparedRetainedMemoryCorrectionChecks.prepare(context, { projectId: scope.project_id, runId: scope.run_id,
+            correctedInputSha256: registration.input_sha256, receiptSha256: registration.check_receipt_sha256 });
+        if (checks.value(context).completed_correction_sha256 !== view.completed_correction_sha256)
+            refuse("historical_check_wave_changed");
+        const batch = memoryCorrectedReviewBatch(view), harness = runtimeHarness(bundle.execution.work("review").worker);
+        const workers = context.db.readSnapshot(() => batch.works.map(item => readMemoryReviewWorkSettlement(context, registration, registration.work_ids[item.key], harness)));
+        const engine = bundle.engine();
+        const results = workers.map((worker, index) => validateMemoryReviewWorkResult(worker.bytes, engine, {
+            workId: worker.workId, packet: batch.works[index].payload.memory_review, references: view.run_inputs
+        }));
+        const references = workers.map((worker, index) => ({ reviewer_work_id: worker.workId, input_sha256: registration.input_sha256,
+            result: worker.result, unit_ids: [results[index].unit_id] }));
+        const projection = { ...correctedMemoryReviewUnits({ view, original: original.results(), current: results, originalReferences: original.references(),
+                currentReferences: references, repairWorkIds: histories.map(history => history.workId) }),
+            ...correctedMemoryReviewFindings({ original: original.results(), current: results, affected, originalReferences: original.references(), currentReferences: references, repairs: repairResults,
+                diagnostics: original.registration().view.diagnostic_findings, diagnosticReference: original.registration().view.run_inputs.find(ref => ref.root === "run" && ref.path === `${bundle.descriptor.stage("verify").directory}/result.json`) }) };
+        const observed = ObservedMemorySources.capture({ run: workers[0].root }, workers.map(worker => ({ root: "run", path: worker.result.path })));
+        const hashes = observed.hashes();
+        if (workers.some(worker => hashes.get(memorySourceKey("run", worker.result.path)) !== worker.result.sha256))
+            refuse("historical_reviewer_artifact_changed");
+        const originalReferences = original.references();
+        const effectiveResults = original.results().map(old => results.find(result => result.unit_id === old.unit_id) ?? old);
+        const effectiveReferences = effectiveResults.map(result => references.find(reference => reference.reviewer_work_id === result.work_id)
+            ?? originalReferences.find(reference => reference.reviewer_work_id === result.work_id));
+        if (effectiveReferences.some(reference => !reference))
+            refuse("effective_review_reference_missing");
+        const prepared = new PreparedHistoricalCorrectedMemoryReview(token, original, repairs, histories, checks, registration, workers, projection, observed, { results: effectiveResults, references: effectiveReferences, projection }, results);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    projection() { return structuredClone(this.#projection); }
+    /** Retained complete protected document state after the first repair graph.
+     * Not a physical current-source or write-permission admission. */
+    settledDocumentBaseline() {
+        const paths = [...new Set(this.#repairs.batch().works.flatMap(item => item.payload.memory_repair.write_paths))].sort();
+        let baseline = this.#histories[0].before().withWritePaths(paths);
+        const prefixes = new Set([hybridDigest(baseline.entries())]);
+        for (const history of this.#histories) {
+            if (!prefixes.has(hybridDigest(history.before().entries())))
+                refuse("historical_input_prefix_changed");
+            baseline = baseline.composeSettledDelta(history.before(), history.after());
+            prefixes.add(hybridDigest(baseline.entries()));
+        }
+        return baseline;
+    }
+    retainedInputView() { return structuredClone(this.#registration.view); }
+    finalChecks(context) { this.assertCustody(context); return this.#checks.value(context).checks; }
+    /** Effective full review inventory after selective wave one. Results and
+     * references come from retained settlements, never workspace recapture. */
+    effectiveReviewProof(context) {
+        this.assertCustody(context);
+        return structuredClone(this.#effective);
+    }
+    bundle() { return this.#original.bundle(); }
+    verificationProfileHash(context) { this.assertCustody(context); return this.#original.verificationProfileHash(context); }
+    /** Exact live fan-in identity reconstructed from retained settlements.
+     * A digest is an identity, not independent plan or Stage acceptance. */
+    reviewSha256() {
+        return this.#reviewSha256;
+    }
+    settlementProof(context) {
+        this.assertCustody(context);
+        return { registration_scope: structuredClone(this.#registration.scope), registration_sha256: hybridDigest(this.#registration), wave: 1,
+            check_receipt_sha256: this.#registration.check_receipt_sha256, workers: this.#workers.map(worker => ({ work_id: worker.workId,
+                authority_sha256: worker.authority, result: { ...worker.result } })) };
+    }
+    assertCustody(context) {
+        this.#original.assertCustody(context);
+        this.#repairs.assertCustody(context);
+        this.#checks.assertCustody(context);
+        if (hybridDigest(readRetainedCorrectedMemoryReviewRegistration(context, this.#registration.scope, this.#registration.input_sha256, this.#registration.check_receipt_sha256)) !== hybridDigest(this.#registration))
+            refuse("historical_registration_changed");
+        for (const history of this.#histories)
+            history.assertCustody(context);
+        const harness = runtimeHarness(this.#original.bundle().execution.work("review").worker);
+        for (const worker of this.#workers)
+            if (readMemoryReviewWorkSettlement(context, this.#registration, worker.workId, harness).authority !== worker.authority)
+                refuse("historical_reviewer_settlement_changed");
+    }
+    revalidate(context) {
+        this.#original.revalidate(context);
+        this.#repairs.revalidate(context);
+        this.#checks.revalidate(context);
+        for (const history of this.#histories)
+            history.revalidate(context);
+        this.#observed.revalidate();
+        this.assertCustody(context);
+    }
+}

package/dist/services/memory-historical-original-review.js

@@ -0,0 +1,130 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { readRegisteredMemoryReview, memoryReviewBatch } from "./memory-review-registration.js";
+import { readMemoryReviewWorkSettlement } from "./memory-review-acceptance.js";
+import { validateMemoryReviewWorkResult } from "./memory-review-work-results.js";
+import { PreparedAcceptedMemoryVerification } from "./memory-verification-receipt.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+const token = Symbol("historical-original-memory-review");
+function refuse(reason) {
+    throw new AppError("memory_historical_original_review_invalid", "Closed review lacks retained original reviewer custody", 2, { reason, effect: "no_effect" });
+}
+function selected(context, scope, bundle, mode) {
+    const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), index = JSON.parse(run.index_json);
+    const stage = index.stage_runs?.find((item) => item.stage === "review");
+    if (stage?.status !== (mode === "closed" ? "done" : "running") || typeof stage.attempt !== "string" || !/^try-[0-9]{3,}$/.test(stage.attempt)
+        || typeof stage.input_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(stage.input_sha256))
+        refuse(mode === "closed" ? "closed_review_required" : "open_review_required");
+    const root = readDescriptorRootWork(context, scope, bundle);
+    if (mode === "open" && (run.status !== "running" || index.current_stage !== "review" || root.status !== "running"))
+        refuse("open_review_required");
+    const phase = { project_id: scope.projectId, run_id: scope.runId, stage: "review", attempt: stage.attempt,
+        input_sha256: stage.input_sha256, parent_work_id: root.workId, execution_sha256: bundle.execution.sha256, bundle_sha256: bundle.sha256 };
+    const registration = readRegisteredMemoryReview(context, phase, 0), view = registration.view;
+    const compose = readAcceptedStageData(context, { ...scope, stage: "compose" }), verify = readAcceptedStageData(context, { ...scope, stage: "verify" });
+    const review = mode === "closed" ? readAcceptedStageData(context, { ...scope, stage: "review" }) : null;
+    const composed = JSON.parse(compose.bytes.toString("utf8"));
+    if (compose.data_schema_id !== "dd-flow/mb-init-compose-result@1" || composed.schema_id !== compose.data_schema_id
+        || composed.stage !== "compose" || composed.run_id !== scope.runId || composed.outcome !== "accepted"
+        || composed.input_sha256 !== compose.input_sha256 || hybridDigest(composed.units) !== hybridDigest(view.unit_inventory)
+        || (review !== null && (review.data_schema_id !== "dd-flow/mb-init-review-result@1" || review.input_sha256 !== phase.input_sha256))
+        || view.source_policy !== "review-inputs@1" || hybridDigest(view.instruction) !== hybridDigest({
+        sha256: bundle.descriptor.stage("review").instruction.sha256, base64: bundle.descriptor.stageBlob("review", "instruction").toString("base64")
+    }))
+        refuse("historical_original_binding_changed");
+    for (const data of [compose, verify]) {
+        const refs = view.run_inputs.filter(ref => ref.root === "run" && ref.path === data.result.path);
+        if (refs.length !== 1 || refs[0].sha256 !== data.result.sha256)
+            refuse("historical_predecessor_changed");
+    }
+    const batch = memoryReviewBatch(view), harness = runtimeHarness(bundle.execution.work("review").worker);
+    const workers = batch.works.map(item => readMemoryReviewWorkSettlement(context, registration, registration.work_ids[item.key], harness));
+    return { mode, registration, batch, workers, compose, verify, review, runRoot: run.run_root ?? run.run_dir };
+}
+/** Original wave proof after Stage closure, not accepted corrected-review or
+ * repair authority. Never reused by fresh Work allocation or current-view
+ * admission. Only retained RUN files and scoped SQL are observed; no active
+ * coordinator Session or obsolete workspace copy is required. */
+export class PreparedHistoricalOriginalMemoryReview {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #scope in value;
+    }
+    #scope;
+    #bundle;
+    #value;
+    #verification;
+    #observed;
+    #authority;
+    #results;
+    constructor(key, scope, bundle, value, verification, observed, results) {
+        if (key !== token)
+            refuse("historical_token_required");
+        this.#scope = { ...scope };
+        this.#bundle = bundle;
+        this.#value = value;
+        this.#verification = verification;
+        this.#observed = observed;
+        this.#results = structuredClone(results);
+        this.#authority = hybridDigest(value);
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        return this.#prepare(context, input, "closed");
+    }
+    /** Read-only settled original history while review remains open. This does
+     * not admit current source bytes, coordinator mutation or Stage acceptance.
+     * The mode is pinned for every custody revalidation, not caller-switchable. */
+    static prepareWhileReviewOpen(context, input) {
+        return this.#prepare(context, input, "open");
+    }
+    static #prepare(context, input, mode) {
+        if (!(input.bundle instanceof RetainedExecutionBundle) || input.bundle.descriptor.descriptor.id !== "mb-init")
+            refuse("registered_memory_bundle_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const value = context.db.readSnapshot(() => selected(context, input.scope, input.bundle, mode));
+        const verification = PreparedAcceptedMemoryVerification.prepare(context, { ...input.scope, bytes: value.verify.bytes });
+        const engine = input.bundle.engine();
+        const results = value.workers.map((worker, index) => validateMemoryReviewWorkResult(worker.bytes, engine, {
+            workId: worker.workId, packet: value.batch.works[index].payload.memory_review, references: value.registration.view.run_inputs
+        }));
+        const refs = [value.compose.result, value.verify.result, ...value.workers.map(worker => worker.result)];
+        const observed = ObservedMemorySources.capture({ run: value.runRoot }, refs.map(ref => ({ root: "run", path: ref.path })));
+        const hashes = observed.hashes();
+        if (refs.some(ref => hashes.get(memorySourceKey("run", ref.path)) !== ref.sha256))
+            refuse("historical_result_artifact_changed");
+        const prepared = new PreparedHistoricalOriginalMemoryReview(token, input.scope, input.bundle, value, verification, observed, results);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    registration() { return structuredClone(this.#value.registration); }
+    bundle() { return this.#bundle; }
+    verificationProfileHash(context) { this.assertCustody(context); return this.#verification.profileHash(context); }
+    reviewSha256() {
+        const value = this.#value, registration = value.registration, phase = registration.scope;
+        const original = hybridDigest({ phase, registration, compose: value.compose.authority_sha256, verify: value.verify.authority_sha256 });
+        const owner = hybridDigest({ registration, original });
+        return hybridDigest({ original: owner, workers: value.workers.map(worker => ({ work_id: worker.workId, authority: worker.authority, result: worker.result })),
+            results: this.results() });
+    }
+    // These bytes were admitted at preparation. Physical artifacts and SQL
+    // settlements remain independently checked by revalidate/assertCustody.
+    results() { return structuredClone(this.#results); }
+    references() {
+        const results = this.results();
+        return this.#value.workers.map((worker, index) => ({ reviewer_work_id: worker.workId, input_sha256: this.#value.registration.input_sha256,
+            result: { ...worker.result }, unit_ids: [results[index].unit_id] }));
+    }
+    assertCustody(context) {
+        this.#verification.assertCustody(context);
+        if (hybridDigest(selected(context, this.#scope, this.#bundle, this.#value.mode)) !== this.#authority)
+            refuse("historical_original_custody_changed");
+    }
+    revalidate(context) { this.#verification.revalidate(context); this.#observed.revalidate(); this.assertCustody(context); }
+}

package/dist/services/memory-historical-repair-registration.js

@@ -0,0 +1,99 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedHistoricalOriginalMemoryReview } from "./memory-historical-original-review.js";
+import { readRetainedMemoryRepairRegistration, assertRetainedMemoryRepairAllocation, memoryRepairBatch, memoryRepairWorkerSchema } from "./memory-repair-registration.js";
+import { validateMemoryReviewCorrectionPlan } from "./memory-review-correction-plan.js";
+import { memoryReviewWaveProjection } from "./memory-review-acceptance.js";
+const token = Symbol("historical-memory-repair-registration");
+function refuse(reason) {
+    throw new AppError("memory_historical_repair_registration_invalid", "Closed review lacks retained repair graph custody", 2, { reason, effect: "no_effect" });
+}
+function selected(context, original) {
+    original.assertCustody(context);
+    const registration = original.registration(), receipt = readRetainedMemoryRepairRegistration(context, registration.scope);
+    const results = original.results(), bundle = original.bundle();
+    if (receipt.original_registration_sha256 !== hybridDigest(registration) || receipt.review_sha256 !== original.reviewSha256()
+        || results.some(result => result.outcome === "blocked"))
+        refuse("historical_original_review_changed");
+    const engine = bundle.engine();
+    const plan = validateMemoryReviewCorrectionPlan(Buffer.from(receipt.plan_base64, "base64"), engine, {
+        runId: registration.run_id, wave: 1, reviewSha256: original.reviewSha256(), units: registration.view.unit_inventory,
+        findings: memoryReviewWaveProjection(results, registration.view.diagnostic_findings).findings
+    });
+    for (const item of plan.works)
+        bundle.execution.work("review", item.profile_id ?? undefined);
+    if (JSON.parse(engine.schema("memory-repair-work-result").toString("utf8")).$id !== memoryRepairWorkerSchema)
+        refuse("frozen_repair_schema_required");
+    const batch = memoryRepairBatch({ scope: registration.scope, plan, planSha256: receipt.plan_sha256,
+        originalRegistrationSha256: hybridDigest(registration), references: [...registration.view.run_inputs,
+            ...original.references().map(ref => ({ root: "run", ...ref.result }))], findings: memoryReviewWaveProjection(results, registration.view.diagnostic_findings).findings });
+    assertRetainedMemoryRepairAllocation(context, receipt, batch);
+    return { receipt, batch };
+}
+/** Closed-Stage repair graph only. Deliberately a distinct private-branded
+ * type: fresh repair baseline/copy/start/allocation APIs do not accept it.
+ * Settled-history validation may consume it without requiring live review. */
+export class PreparedHistoricalMemoryRepairRegistration {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #original in value;
+    }
+    sha256;
+    #original;
+    #receipt;
+    #batch;
+    constructor(key, original, value) {
+        if (key !== token)
+            refuse("historical_registration_token_required");
+        this.#original = original;
+        this.#receipt = structuredClone(value.receipt);
+        this.#batch = structuredClone(value.batch);
+        this.sha256 = hybridDigest(value.receipt);
+        Object.freeze(this);
+    }
+    static prepare(context, original) {
+        if (!PreparedHistoricalOriginalMemoryReview.isPrepared(original))
+            refuse("historical_original_owner_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        original.revalidate(context);
+        const value = context.db.readSnapshot(() => selected(context, original));
+        const prepared = new PreparedHistoricalMemoryRepairRegistration(token, original, value);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    receipt() { return structuredClone(this.#receipt); }
+    batch() { return structuredClone(this.#batch); }
+    review() { return { original: () => this.#original }; }
+    completedWorkOrder(context) {
+        this.assertCustody(context);
+        const receipt = this.#receipt, scope = receipt.scope, batch = this.#batch;
+        const all = context.db.all("SELECT id,json_extract(payload_json,'$.work_id') AS work_id FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_settlement' AND json_extract(payload_json,'$.run_id')=? ORDER BY id LIMIT 257", [scope.project_id, scope.run_id]);
+        if (all.length > 256)
+            refuse("unbounded_historical_settlements");
+        const ids = new Set(Object.values(receipt.work_ids)), rows = all.filter(row => ids.has(row.work_id));
+        if (rows.length !== batch.works.length || new Set(rows.map(row => row.work_id)).size !== batch.works.length
+            || rows.some(row => !Number.isSafeInteger(row.id) || row.id <= 0))
+            refuse("historical_settlement_coverage_changed");
+        const order = new Map(rows.map((row, index) => [row.work_id, index]));
+        for (const item of batch.works) {
+            const workId = receipt.work_ids[item.key];
+            const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=? AND parent_work_id=?", [scope.project_id, scope.run_id, workId, scope.parent_work_id]);
+            if (work?.status !== "completed" || item.depends_on.some(key => {
+                const dependency = receipt.work_ids[key];
+                return !dependency || order.get(dependency) >= order.get(workId);
+            }))
+                refuse("historical_dependency_order_changed");
+        }
+        return rows.map(row => row.work_id);
+    }
+    assertCustody(context) {
+        this.#original.assertCustody(context);
+        const receipt = readRetainedMemoryRepairRegistration(context, this.#receipt.scope);
+        if (hybridDigest(receipt) !== this.sha256)
+            refuse("historical_repair_registration_changed");
+        // The immutable plan/batch was admitted by prepare. Custody checks reread
+        // scoped SQL allocation, not the same frozen engine and plan again.
+        assertRetainedMemoryRepairAllocation(context, receipt, this.#batch);
+    }
+    revalidate(context) { this.#original.revalidate(context); this.assertCustody(context); }
+}

package/dist/services/memory-historical-second-review.js

@@ -0,0 +1,128 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedHistoricalSecondMemoryCorrectionWave } from "./memory-completed-correction-wave.js";
+import { assertHistoricalMemoryReviewSources } from "./memory-historical-corrected-review.js";
+import { readRetainedSecondCorrectedMemoryReviewRegistration } from "./memory-corrected-review-registration.js";
+import { PreparedRetainedMemoryCorrectionChecks } from "./memory-correction-check-receipt.js";
+import { secondCorrectedMemoryReviewAssignments, secondCorrectedMemoryReviewReferences } from "./memory-second-corrected-review-inputs.js";
+import { memoryCorrectedReviewBatch } from "./memory-corrected-review-batch.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { readMemoryReviewWorkSettlement } from "./memory-review-acceptance.js";
+import { validateMemoryReviewWorkResult } from "./memory-review-work-results.js";
+import { assertSelectiveMemoryReviewCoverage } from "./memory-corrected-review-acceptance.js";
+import { correctedMemoryReviewUnits } from "./memory-corrected-review-projection.js";
+import { correctedMemoryReviewFindings } from "./memory-corrected-review-findings.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+const token = Symbol("historical-second-memory-review");
+function refuse(reason) {
+    throw new AppError("memory_historical_second_review_invalid", "Closed final review lacks independent second-wave custody", 2, { reason, effect: "no_effect" });
+}
+/** Reconstructs closed wave-two fan-in from retained proofs. Expected hashes
+ * come from an independently accepted receipt, not current workspace policy.
+ * This owner alone neither accepts a Stage nor admits another correction. */
+export class PreparedHistoricalSecondMemoryReview {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #wave in value;
+    }
+    #wave;
+    #registration;
+    #checks;
+    #workers;
+    #previous;
+    #projection;
+    #observed;
+    constructor(key, wave, registration, checks, workers, previous, projection, observed) {
+        if (key !== token)
+            refuse("historical_second_review_token_required");
+        this.#wave = wave;
+        this.#registration = structuredClone(registration);
+        this.#checks = checks;
+        this.#workers = workers;
+        this.#previous = structuredClone(previous);
+        this.#projection = structuredClone(projection);
+        this.#observed = observed;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const wave = PreparedHistoricalSecondMemoryCorrectionWave.prepare(context, input), repairs = wave.repairResults();
+        const retained = wave.registration(), first = retained.initialInputView(), receipt = retained.receipt();
+        const registration = context.db.readSnapshot(() => readRetainedSecondCorrectedMemoryReviewRegistration(context, first.scope, input.correctedInputSha256, input.checkReceiptSha256));
+        if (!registration)
+            refuse("historical_second_registration_required");
+        const view = registration.view, paths = [...new Set(retained.plan().works.flatMap(work => work.write_paths))].sort();
+        assertHistoricalMemoryReviewSources(wave.histories(), paths, view.run_inputs, retained.initialDocumentBaseline());
+        const files = view.run_inputs.filter(ref => ref.root === "workspace");
+        const projected = secondCorrectedMemoryReviewAssignments({ first, affected: wave.affectedUnitIds(), files, repairs });
+        const runInputs = secondCorrectedMemoryReviewReferences({ firstInputs: first.run_inputs,
+            firstWorkers: retained.firstReviewProof(context).workers, repairs, files });
+        if (view.schema_id !== "dd-flow/memory-corrected-review-inputs@2" || view.wave !== 2
+            || view.original_review_sha256 !== receipt.review_sha256 || view.base !== first.base || view.source_policy !== first.source_policy
+            || view.first_review_input_sha256 !== receipt.first_review_input_sha256
+            || view.first_check_receipt_sha256 !== receipt.first_check_receipt_sha256
+            || view.first_review_registration_sha256 !== receipt.first_review_registration_sha256
+            || hybridDigest(view.instruction) !== hybridDigest(first.instruction)
+            || hybridDigest(view.unit_inventory) !== hybridDigest(projected.units)
+            || hybridDigest(view.assignments) !== hybridDigest(projected.assignments)
+            || hybridDigest(view.affected_unit_ids) !== hybridDigest(wave.affectedUnitIds())
+            || hybridDigest(view.run_inputs) !== hybridDigest(runInputs)
+            || hybridDigest(view.repairs) !== hybridDigest(repairs.map(repair => ({ work_id: repair.work_id,
+                authority_sha256: repair.authority_sha256, result: repair.reference }))))
+            refuse("historical_second_input_projection_changed");
+        const checks = PreparedRetainedMemoryCorrectionChecks.prepareSecond(context, { ...input.scope,
+            correctedInputSha256: registration.input_sha256, receiptSha256: registration.check_receipt_sha256 });
+        if (checks.value(context).completed_correction_sha256 !== view.completed_correction_sha256)
+            refuse("historical_second_check_wave_changed");
+        const batch = memoryCorrectedReviewBatch(view), harness = runtimeHarness(input.bundle.execution.work("review").worker);
+        const workers = context.db.readSnapshot(() => batch.works.map(item => readMemoryReviewWorkSettlement(context, registration, registration.work_ids[item.key], harness)));
+        const results = workers.map((worker, index) => validateMemoryReviewWorkResult(worker.bytes, input.bundle.engine(), {
+            workId: worker.workId, packet: batch.works[index].payload.memory_review, references: view.run_inputs
+        }));
+        assertSelectiveMemoryReviewCoverage(view.affected_unit_ids, results);
+        const references = workers.map((worker, index) => ({ reviewer_work_id: worker.workId, input_sha256: registration.input_sha256,
+            result: worker.result, unit_ids: [results[index].unit_id] }));
+        const previous = retained.firstEffectiveReviewProof(context);
+        const coverage = correctedMemoryReviewUnits({ view, original: previous.results, current: results,
+            originalReferences: previous.references, currentReferences: references, repairWorkIds: repairs.map(repair => repair.work_id) });
+        const findings = correctedMemoryReviewFindings({ original: previous.results, current: results, affected: view.affected_unit_ids,
+            originalReferences: previous.references, currentReferences: references, findingHistory: previous.projection.findings, repairs });
+        const projection = { ...coverage, ...findings, outcome: findings.outcome === "accepted" ? "accepted" : "blocked" };
+        const observed = ObservedMemorySources.capture({ run: workers[0].root }, workers.map(worker => ({ root: "run", path: worker.result.path })));
+        const hashes = observed.hashes();
+        if (workers.some(worker => hashes.get(memorySourceKey("run", worker.result.path)) !== worker.result.sha256))
+            refuse("historical_second_reviewer_artifact_changed");
+        const prepared = new PreparedHistoricalSecondMemoryReview(token, wave, registration, checks, workers, previous, projection, observed);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    projection() { return structuredClone(this.#projection); }
+    retainedInputView() { return structuredClone(this.#registration.view); }
+    finalChecks(context) { this.assertCustody(context); return this.#checks.value(context).checks; }
+    settlementProof(context) {
+        this.assertCustody(context);
+        return { registration_scope: structuredClone(this.#registration.scope), registration_sha256: hybridDigest(this.#registration), wave: 2,
+            check_receipt_sha256: this.#registration.check_receipt_sha256, first_review_proof_sha256: hybridDigest(this.#previous),
+            workers: this.#workers.map(worker => ({ work_id: worker.workId, authority_sha256: worker.authority, result: { ...worker.result } })) };
+    }
+    assertCustody(context) {
+        this.#wave.assertCustody(context);
+        this.#checks.assertCustody(context);
+        const receipt = this.#registration;
+        if (hybridDigest(readRetainedSecondCorrectedMemoryReviewRegistration(context, receipt.scope, receipt.input_sha256, receipt.check_receipt_sha256)) !== hybridDigest(receipt))
+            refuse("historical_second_registration_changed");
+        if (hybridDigest(this.#wave.registration().firstEffectiveReviewProof(context)) !== hybridDigest(this.#previous))
+            refuse("first_review_history_changed");
+        const harness = runtimeHarness(this.#wave.registration().bundle().execution.work("review").worker);
+        for (const worker of this.#workers)
+            if (readMemoryReviewWorkSettlement(context, receipt, worker.workId, harness).authority !== worker.authority)
+                refuse("historical_second_reviewer_settlement_changed");
+    }
+    revalidate(context) {
+        this.#wave.revalidate(context);
+        this.#checks.revalidate(context);
+        this.#observed.revalidate();
+        this.assertCustody(context);
+    }
+}