@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/memory-composition-work-results.js

@@ -0,0 +1,96 @@
+import { createHash } from "node:crypto";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { AdmittedFrozenEngine } from "./frozen-engine.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedMemoryStageResult, memorySourceKey } from "./memory-stage-results.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memoryCompositionOutputAllowed } from "./memory-composition-graph.js";
+const schemaId = "dd-flow/memory-composition-work-result@1";
+function refuse(reason) {
+    throw new AppError("memory_composition_work_result_invalid", "Composition Work result lacks assigned output proof", 2, { reason, phase: "prepare", effect: "no_effect" });
+}
+/** Frozen schema/assignment checks only. Retained outputs may have been
+ * overwritten by a declared dependent assembly; this is not current-byte or
+ * settlement authority. The productive Work path also observes physical bytes.
+ */
+export function validateMemoryCompositionWorkResult(input, engine, binding) {
+    try {
+        if (input.byteLength < 1 || input.byteLength > 1024 * 1024 || !binding.workId
+            || !(engine instanceof AdmittedFrozenEngine) || !(binding.composition instanceof PreparedMemoryStageResult)
+            || binding.composition.sha256 !== binding.compositionSha256)
+            refuse("foreign_preparation_binding");
+        const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input));
+        const schema = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(engine.schema("memory-composition-work-result")));
+        if (schema.$id !== schemaId || !new Ajv2020({ strict: true, validateFormats: false }).compile(schema)(value))
+            refuse("invalid_result_schema");
+        const work = binding.composition.compositionBatch({ ...binding, resultSchema: schemaId }).works.find(item => item.key === binding.workKey);
+        if (!work)
+            refuse("unassigned_work_key");
+        const packet = work.payload.memory_composition;
+        if (value.run_id !== binding.runId || value.work_id !== binding.workId || value.packet_sha256 !== packet.packet_sha256)
+            refuse("foreign_result_identity");
+        if (value.outcome !== "accepted")
+            refuse("work_not_accepted");
+        const ids = value.units.map(unit => unit.id);
+        if (new Set(ids).size !== ids.length || ids.length !== packet.unit_ids.length || ids.some(id => !packet.unit_ids.includes(id)))
+            refuse("changed_unit_coverage");
+        const aliases = new Map();
+        for (const unit of value.units) {
+            for (const artifact of unit.artifacts) {
+                const logical = artifact.path;
+                if (logical.includes("\\") || logical.includes("\0") || logical.split("/").some(segment => !segment || segment === "." || segment === ".."))
+                    refuse("unsafe_artifact_path");
+                if (!packet.write_scopes.some(scope => scope.root === artifact.root && (logical === scope.path || logical.startsWith(`${scope.path}/`))))
+                    refuse("artifact_outside_write_scope");
+                if (!memoryCompositionOutputAllowed(logical))
+                    refuse("private_composition_artifact");
+                const alias = memorySourceKey(artifact.root, logical.normalize("NFC").toLowerCase());
+                const identity = hybridDigest({ path: logical, sha256: artifact.sha256 });
+                if (aliases.has(alias) && aliases.get(alias) !== identity)
+                    refuse("conflicting_artifact_reference");
+                aliases.set(alias, identity);
+            }
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof AppError && ["memory_composition_work_result_invalid", "frozen_engine_invalid", "memory_stage_result_invalid"].includes(error.code))
+            throw error;
+        return refuse("invalid_result_or_binding");
+    }
+}
+/** Output-byte preparation only. The handler still owns SQL packet custody,
+ * physical Session settlement, actual write-boundary enforcement and semantic acceptance.
+ */
+export class PreparedMemoryCompositionWorkResult {
+    sha256;
+    #bytes;
+    #observed;
+    constructor(bytes, observed) {
+        this.#bytes = bytes;
+        this.#observed = observed;
+        this.sha256 = createHash("sha256").update(bytes).digest("hex");
+        Object.freeze(this);
+    }
+    static prepare(input, engine, binding) {
+        try {
+            const bytes = Buffer.from(input), value = validateMemoryCompositionWorkResult(bytes, engine, binding);
+            const artifacts = value.units.flatMap(unit => unit.artifacts), selected = new Map();
+            for (const artifact of artifacts) {
+                selected.set(memorySourceKey(artifact.root, artifact.path), { root: artifact.root, path: artifact.path });
+            }
+            const observed = ObservedMemorySources.capture(binding.roots, [...selected.values()]), hashes = observed.hashes();
+            if (artifacts.some(artifact => hashes.get(memorySourceKey(artifact.root, artifact.path)) !== artifact.sha256))
+                refuse("changed_artifact_bytes");
+            return new PreparedMemoryCompositionWorkResult(bytes, observed);
+        }
+        catch (error) {
+            if (error instanceof AppError && ["memory_composition_work_result_invalid", "frozen_engine_invalid", "memory_source_observation_failed", "memory_stage_result_invalid"].includes(error.code))
+                throw error;
+            return refuse("invalid_result_or_binding");
+        }
+    }
+    bytes() { return Buffer.from(this.#bytes); }
+    revalidate() { this.#observed.revalidate(); }
+}

package/dist/services/memory-corrected-review-acceptance.js

@@ -0,0 +1,129 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { PreparedRegisteredCorrectedMemoryReview } from "./memory-corrected-review-registration.js";
+import { PreparedCorrectedMemoryReviewInputs } from "./memory-corrected-review-inputs.js";
+import { readMemoryReviewWorkSettlement } from "./memory-review-acceptance.js";
+import { validateMemoryReviewWorkResult } from "./memory-review-work-results.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+import { correctedMemoryReviewFindings } from "./memory-corrected-review-findings.js";
+import { correctedMemoryReviewUnits } from "./memory-corrected-review-projection.js";
+import { PreparedMemoryStageResult } from "./memory-stage-results.js";
+const token = Symbol("corrected-memory-review-acceptance");
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_acceptance_invalid", "Selective review lacks independently registered and settled reviewer custody", 2, { reason, effect: "no_effect" });
+}
+/** Selective fan-in only, not finding resolution or Stage acceptance. Every
+ * allocated affected unit needs its own independent published settlement.
+ * Untouched initial reviewers must not be silently replaced or rerun. */
+export class PreparedCorrectedMemoryReviewAcceptance {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #registration in value;
+    }
+    sha256;
+    #registration;
+    #workers;
+    #results;
+    #harness;
+    #observed;
+    constructor(key, registration, workers, results, harness, observed) {
+        if (key !== token)
+            refuse("acceptance_token_required");
+        this.#registration = registration;
+        this.#workers = workers;
+        this.#results = structuredClone(results);
+        this.#harness = harness;
+        this.#observed = observed;
+        this.sha256 = hybridDigest({ registration_sha256: registration.sha256, workers: workers.map(worker => ({
+                work_id: worker.workId, authority_sha256: worker.authority, result: worker.result
+            })), results });
+        Object.freeze(this);
+    }
+    static prepare(context, registration) {
+        if (!PreparedRegisteredCorrectedMemoryReview.isPrepared(registration))
+            refuse("prepared_corrected_registration_required");
+        if (!PreparedCorrectedMemoryReviewInputs.isPrepared(registration.inputs()))
+            refuse("first_corrected_registration_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        registration.revalidate(context);
+        const receipt = registration.receipt(), view = receipt.view, bundle = registration.inputs().bundle(), batch = registration.batch();
+        if (view.scope.bundle_sha256 !== bundle.sha256 || view.scope.execution_sha256 !== bundle.execution.sha256)
+            refuse("foreign_wave_bundle");
+        const harness = runtimeHarness(bundle.execution.work("review").worker);
+        const workers = context.db.readSnapshot(() => batch.works.map(item => readMemoryReviewWorkSettlement(context, receipt, receipt.work_ids[item.key], harness)));
+        const results = workers.map((worker, index) => validateMemoryReviewWorkResult(worker.bytes, bundle.engine(), {
+            workId: worker.workId, packet: batch.works[index].payload.memory_review, references: view.run_inputs
+        }));
+        assertSelectiveMemoryReviewCoverage(view.affected_unit_ids, results);
+        const root = context.db.get("SELECT run_root,run_dir FROM runs WHERE project_id=? AND id=?", [view.scope.project_id, view.scope.run_id]);
+        if (!root)
+            refuse("owned_run_missing");
+        const observed = ObservedMemorySources.capture({ run: root.run_root ?? root.run_dir }, workers.map(worker => ({ root: "run", path: worker.result.path })));
+        const hashes = observed.hashes();
+        if (workers.some(worker => hashes.get(memorySourceKey("run", worker.result.path)) !== worker.result.sha256))
+            refuse("published_review_result_changed");
+        const prepared = new PreparedCorrectedMemoryReviewAcceptance(token, registration, workers, results, harness, observed);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    registration() { return this.#registration; }
+    results() { return structuredClone(this.#results); }
+    findingProjection() {
+        const wave = this.#registration.inputs().completedWave(), original = wave.registration().review();
+        const batch = wave.registration().batch(), receipt = wave.registration().receipt();
+        return correctedMemoryReviewFindings({ original: original.results(), current: this.results(),
+            diagnostics: original.original().registration().view.diagnostic_findings,
+            diagnosticReference: original.original().registration().view.run_inputs.find(ref => ref.root === "run" && ref.path === `${original.original().bundle().descriptor.stage("verify").directory}/result.json`),
+            affected: this.#registration.receipt().view.affected_unit_ids, originalReferences: original.references(), currentReferences: this.references(),
+            repairs: wave.repairResults().map(repair => ({ ...repair, unit_ids: batch.works.find(item => receipt.work_ids[item.key] === repair.work_id).payload.memory_repair.unit_ids })) });
+    }
+    resultProjection() {
+        const wave = this.#registration.inputs().completedWave(), original = wave.registration().review();
+        const coverage = correctedMemoryReviewUnits({ view: this.#registration.receipt().view, original: original.results(), current: this.results(),
+            originalReferences: original.references(), currentReferences: this.references(), repairWorkIds: wave.repairResults().map(repair => repair.work_id) });
+        return { ...coverage, ...this.findingProjection() };
+    }
+    assertResult(result) {
+        if (!(result instanceof PreparedMemoryStageResult))
+            refuse("prepared_result_required");
+        const value = result.value(), receipt = this.#registration.receipt(), expected = this.resultProjection();
+        if (value.run_id !== receipt.run_id || value.stage !== "review" || value.input_sha256 !== receipt.scope.input_sha256
+            || hybridDigest({ units: value.units, findings: value.findings, outcome: value.outcome, details: value.details }) !== hybridDigest(expected))
+            refuse("review_claim_differs_from_settled_wave");
+    }
+    references() {
+        return this.#workers.map((worker, index) => ({ reviewer_work_id: worker.workId,
+            input_sha256: this.#registration.receipt().input_sha256, result: { ...worker.result }, unit_ids: [this.#results[index].unit_id] }));
+    }
+    settlementProof(context) {
+        this.assertCustody(context);
+        const receipt = this.#registration.receipt();
+        return { registration_scope: structuredClone(receipt.scope), registration_sha256: this.#registration.sha256, wave: receipt.wave,
+            check_receipt_sha256: receipt.check_receipt_sha256, workers: this.#workers.map(worker => ({
+                work_id: worker.workId, authority_sha256: worker.authority, result: { ...worker.result }
+            })) };
+    }
+    assertCustody(context) {
+        this.#registration.assertCustody(context);
+        const receipt = this.#registration.receipt();
+        for (const worker of this.#workers)
+            if (readMemoryReviewWorkSettlement(context, receipt, worker.workId, this.#harness).authority !== worker.authority)
+                refuse("review_settlement_changed");
+    }
+    revalidate(context) {
+        this.#registration.revalidate(context);
+        this.#observed.revalidate();
+        this.assertCustody(context);
+    }
+}
+/** Metadata completeness check only; this does not prove SQL/Session custody. */
+export function assertSelectiveMemoryReviewCoverage(affected, results) {
+    if (!Array.isArray(affected) || !affected.length || affected.length > 256 || affected.some(id => typeof id !== "string" || !id)
+        || new Set(affected).size !== affected.length || !Array.isArray(results) || results.length !== affected.length
+        || results.some(result => !result || typeof result.unit_id !== "string" || typeof result.work_id !== "string" || !result.work_id
+            || !affected.includes(result.unit_id)) || new Set(results.map(result => result.unit_id)).size !== affected.length
+        || new Set(results.map(result => result.work_id)).size !== results.length)
+        refuse("selective_review_coverage_changed");
+}

package/dist/services/memory-corrected-review-batch.js

@@ -0,0 +1,30 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { memoryReviewWorkerSchema } from "./memory-review-registration.js";
+/** Payload projection only. Fresh check, registered input/copy/Session and
+ * independent Work settlement are not supplied by a coordinator's JSON. */
+export function memoryCorrectedReviewBatch(view) {
+    if (!(view.schema_id === "dd-flow/memory-corrected-review-inputs@1" && view.wave === 1
+        || view.schema_id === "dd-flow/memory-corrected-review-inputs@2" && view.wave === 2)
+        || !Array.isArray(view.assignments) || !view.assignments.length || view.assignments.length > 256) {
+        throw new AppError("memory_corrected_review_batch_invalid", "Corrected reviewer batch lacks bounded current assignments", 2, { effect: "no_effect" });
+    }
+    let total = 0;
+    return { works: view.assignments.map((assignment, index) => {
+            const key = `review-${String(index + 1).padStart(3, "0")}`;
+            const packet = { schema_id: "dd-flow/memory-review-work-packet@2", run_id: view.scope.run_id,
+                stage: "review", wave: view.wave, key, unit: structuredClone(assignment.unit), unit_inputs: structuredClone(assignment.inputs),
+                original_unit_sha256: assignment.original_unit_sha256, deleted_references: structuredClone(assignment.deleted_references),
+                completed_correction_sha256: view.completed_correction_sha256, repairs: structuredClone(view.repairs),
+                review_input_sha256: hybridDigest(view), result_schema: memoryReviewWorkerSchema,
+                instruction: structuredClone(view.instruction) };
+            const work = { key, task: `Independently review the assigned knowledge unit ${JSON.stringify(assignment.unit.id)}. Read the frozen review instruction in memory_review as review criteria, not permission to coordinate or repair. Check grounding, evidence, coverage and cross-file consistency using the registered wave inputs. Assigned unit.evidence may retain historical source versions; cite those exact versions only as historical context, never as bytes read from or current in this copy. Direct assessment and findings must still cite the assigned current unit.artifacts/unit_inputs. Do not edit project documents, allocate Work or repair findings. Report concrete material defects with unit/source evidence; do not block on taste. Return only the assigned memory-review-work-result JSON; do not claim other units or Stage completion.`,
+                depends_on: [], launch_policy: "fresh_agent_required", result_schema: memoryReviewWorkerSchema,
+                payload: { kind: "memory-review", read_only: true, memory_review: { ...packet, packet_sha256: hybridDigest(packet) } } };
+            const size = Buffer.byteLength(JSON.stringify(work));
+            total += size;
+            if (size > 1024 * 1024 || total > 64 * 1024 * 1024)
+                throw new AppError("memory_corrected_review_batch_invalid", "Corrected reviewer batch exceeds its bound", 2, { effect: "no_effect" });
+            return work;
+        }) };
+}

package/dist/services/memory-corrected-review-findings.js

@@ -0,0 +1,106 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { memoryReviewWaveProjection } from "./memory-review-acceptance.js";
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_findings_invalid", "Finding resolution lacks causal repair and independent re-review references", 2, { reason, effect: "no_effect" });
+}
+function ref(value) {
+    if (!value || typeof value.path !== "string" || !value.path || value.path.startsWith("/") || value.path.includes("\\")
+        || value.path.includes("\0") || value.path.split("/").some(part => !part || part === "." || part === "..")
+        || !/^[a-f0-9]{64}$/.test(value.sha256))
+        refuse("invalid_result_reference");
+    return { path: value.path, sha256: value.sha256 };
+}
+/** Metadata projection only. The owning fan-in must independently prove all
+ * referenced settlements. Original findings remain visible; their historical
+ * evidence is cited through the original immutable reviewer result instead of
+ * pretending that obsolete workspace bytes are still current. */
+export function correctedMemoryReviewFindings(input) {
+    if (!Array.isArray(input.original) || !input.original.length || input.original.length > 256 || !Array.isArray(input.current)
+        || !Array.isArray(input.affected) || !input.affected.length || input.affected.length > 256
+        || new Set(input.affected).size !== input.affected.length || input.current.length !== input.affected.length
+        || !Array.isArray(input.originalReferences) || !Array.isArray(input.currentReferences) || !Array.isArray(input.repairs)
+        || input.repairs.length > 256)
+        refuse("invalid_wave_inventory");
+    for (const results of [input.original, input.current])
+        if (new Set(results.map(result => result.unit_id)).size !== results.length
+            || new Set(results.map(result => result.work_id)).size !== results.length)
+            refuse("duplicate_review_identity");
+    if (input.current.some(result => !input.affected.includes(result.unit_id) || !input.original.some(old => old.unit_id === result.unit_id))
+        || input.affected.some(id => !input.current.some(result => result.unit_id === id))
+        || input.current.some(result => input.original.some(old => old.work_id === result.work_id)))
+        refuse("foreign_or_reused_review");
+    const references = (results, values) => {
+        if (values.length !== results.length || new Set(values.map(value => value.reviewer_work_id)).size !== values.length)
+            refuse("incomplete_review_references");
+        return new Map(results.map(result => {
+            const selected = values.find(value => value.reviewer_work_id === result.work_id);
+            if (!selected)
+                refuse("incomplete_review_references");
+            return [result.work_id, ref(selected.result)];
+        }));
+    };
+    const originalRefs = references(input.original, input.originalReferences), currentRefs = references(input.current, input.currentReferences);
+    const previous = memoryReviewWaveProjection(input.original, input.diagnostics), fresh = memoryReviewWaveProjection(input.current);
+    if (input.findingHistory !== undefined) {
+        const history = input.findingHistory;
+        if (!Array.isArray(history) || history.length > 1024 || new Set(history.map(finding => finding?.id)).size !== history.length
+            || history.some(finding => !finding || typeof finding.id !== "string" || !finding.id
+                || !input.original.some(result => result.unit_id === finding.unit_id)
+                || !["open", "resolved"].includes(finding.status) || !["minor", "major", "critical"].includes(finding.severity)
+                || !Array.isArray(finding.evidence) || !finding.evidence.length || !Array.isArray(finding.resolution_refs)
+                || (finding.status === "open" && finding.resolution_refs.length !== 0)
+                || (finding.status === "resolved" && finding.resolution_refs.length !== 2)))
+            refuse("invalid_finding_history");
+        if (previous.findings.some(finding => !history.some(retained => retained.id === finding.id && retained.unit_id === finding.unit_id
+            && retained.severity === finding.severity && retained.statement === finding.statement)))
+            refuse("incomplete_effective_finding_history");
+        for (const finding of history) {
+            for (const evidence of finding.evidence) {
+                if (!["run", "workspace"].includes(evidence.root))
+                    refuse("invalid_historical_evidence_root");
+                ref(evidence);
+            }
+            for (const resolution of finding.resolution_refs)
+                ref(resolution);
+        }
+        previous.findings = history.map(finding => ({ ...structuredClone(finding), evidence: finding.evidence.some(evidence => evidence.root !== "run")
+                ? [{ root: "run", ...originalRefs.get(input.original.find(result => result.unit_id === finding.unit_id).work_id) }]
+                : structuredClone(finding.evidence) }));
+    }
+    const previousIds = new Set(previous.findings.map(finding => finding.id)), claims = new Map();
+    for (const repair of input.repairs) {
+        const reference = ref(repair.reference);
+        if (repair.result.outcome !== "accepted" || !repair.result.changes.length || !repair.unit_ids.length)
+            refuse("unsettled_repair_claim");
+        for (const resolution of repair.result.resolutions) {
+            const finding = previous.findings.find(finding => finding.id === resolution.finding_id);
+            if (!finding || finding.status !== "open" || !repair.unit_ids.includes(finding.unit_id) || claims.has(finding.id)
+                || !resolution.delta_paths.length || resolution.delta_paths.some(path => !repair.result.changes.some(change => change.path === path && change.before_sha256 !== change.after_sha256)))
+                refuse("foreign_or_noncausal_resolution");
+            claims.set(finding.id, { repair, reference });
+        }
+    }
+    const findings = previous.findings.map(finding => {
+        if (input.findingHistory !== undefined && finding.status === "resolved")
+            return structuredClone(finding);
+        const original = input.original.find(result => result.unit_id === finding.unit_id);
+        const historical = originalRefs.get(original.work_id);
+        const current = input.current.find(result => result.unit_id === finding.unit_id), claim = claims.get(finding.id);
+        const resolved = Boolean(claim && current?.outcome === "accepted");
+        const diagnostic = input.diagnostics?.some(item => `MVF-${hybridDigest({ id: item.id, unit_id: item.unit_id }).slice(0, 32)}` === finding.id);
+        if (diagnostic && !input.diagnosticReference)
+            refuse("diagnostic_reference_required");
+        return { ...finding, evidence: input.findingHistory !== undefined ? structuredClone(finding.evidence) : [{ root: "run", ...(diagnostic ? ref(input.diagnosticReference) : historical) }], status: resolved ? "resolved" : "open",
+            resolution_refs: resolved ? [claim.reference, currentRefs.get(current.work_id)] : [] };
+    });
+    if (fresh.findings.some(finding => previousIds.has(finding.id)))
+        refuse("colliding_finding_identity");
+    findings.push(...fresh.findings);
+    if (findings.length > 1024)
+        refuse("unbounded_finding_history");
+    const effective = input.original.map(old => input.current.find(result => result.unit_id === old.unit_id) ?? old);
+    const outcome = effective.some(result => result.outcome === "blocked") ? "blocked"
+        : effective.some(result => result.outcome === "needs_repair") || findings.some(finding => finding.status === "open" && finding.severity !== "minor") ? "needs_repair" : "accepted";
+    return { outcome, findings };
+}

package/dist/services/memory-corrected-review-inputs.js

@@ -0,0 +1,210 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedCompletedMemoryCorrectionWave } from "./memory-completed-correction-wave.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { reviewSourceHash } from "./review-copy.js";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { PreparedRetainedMemoryReviewAuthority } from "./memory-retained-review-authority.js";
+import { PreparedRetainedMemoryReviewResults } from "./memory-retained-review-results.js";
+import { PreparedRegisteredMemoryCorrections } from "./memory-repair-registration.js";
+const token = Symbol("corrected-memory-review-inputs");
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_input_invalid", "Re-review inputs lack settled corrections and current source custody", 2, { reason, effect: "no_effect" });
+}
+function reference(path, sha256, root = "workspace") {
+    if (typeof path !== "string" || !path || path.length > 4096 || path.includes("\\") || path.includes("\0")
+        || path.startsWith("/") || /^[A-Za-z]:/.test(path) || path.split("/").some(part => !part || part === "." || part === "..")
+        || typeof sha256 !== "string" || !/^[a-f0-9]{64}$/.test(sha256))
+        refuse("invalid_current_reference");
+    return { root, path, sha256 };
+}
+/** Metadata projection only. Current refs replace obsolete byte identities;
+ * deletions remain explicit historical facts, never phantom readable files.
+ * An empty effective artifact set is preserved for independent assessment,
+ * not silently turned into not-applicable or accepted coverage. */
+export function correctedMemoryReviewAssignments(input) {
+    if (!Array.isArray(input.units) || !input.units.length || input.units.length > 256
+        || !Array.isArray(input.affected) || !input.affected.length || input.affected.length > 256
+        || new Set(input.affected).size !== input.affected.length || !Array.isArray(input.files) || input.files.length > 20_000
+        || !Array.isArray(input.repairs) || !input.repairs.length || input.repairs.length > 256)
+        refuse("invalid_projection_inventory");
+    const selected = new Map();
+    for (const file of input.files) {
+        const ref = reference(file.path, file.sha256);
+        if (selected.has(ref.path))
+            refuse("duplicate_current_reference");
+        selected.set(ref.path, ref);
+    }
+    if (input.units.some(unit => !unit || typeof unit.id !== "string" || !unit.id
+        || !["applicable", "not-applicable"].includes(unit.applicability) || !Array.isArray(unit.evidence) || !Array.isArray(unit.artifacts))
+        || new Set(input.units.map(unit => unit.id)).size !== input.units.length
+        || input.affected.some((id) => !input.units.some(unit => unit.id === id && unit.applicability === "applicable")))
+        refuse("foreign_affected_unit");
+    const finalChanges = new Map();
+    const finalProof = new Map();
+    for (const repair of input.repairs) {
+        reference(repair.reference.path, repair.reference.sha256, "run");
+        if (repair.result.outcome !== "accepted" || !Array.isArray(repair.unit_ids) || !repair.unit_ids.length
+            || repair.unit_ids.some((id) => !input.units.some(unit => unit.id === id && unit.applicability === "applicable"))
+            || !Array.isArray(repair.result.changes) || !repair.result.changes.length)
+            refuse("invalid_repair_projection");
+        for (const change of repair.result.changes) {
+            reference(change.path, change.after_sha256 ?? change.before_sha256);
+            if (change.before_sha256 !== null)
+                reference(change.path, change.before_sha256);
+            if (!change.path.startsWith(".memory-bank/") || change.before_sha256 === change.after_sha256)
+                refuse("invalid_repair_projection");
+            finalChanges.set(change.path, change.after_sha256);
+            finalProof.set(change.path, reference(repair.reference.path, repair.reference.sha256, "run"));
+        }
+    }
+    for (const [path, sha256] of finalChanges)
+        if ((selected.get(path)?.sha256 ?? null) !== sha256)
+            refuse("current_view_differs_from_settled_delta");
+    return input.units.filter(unit => input.affected.includes(unit.id)).map(original => {
+        const deleted = [];
+        const project = (refs, role) => refs.flatMap(old => {
+            if (!["project", "workspace", "canon", "run"].includes(old.root))
+                refuse("foreign_original_reference");
+            reference(old.path, old.sha256);
+            const initial = input.initialAssignments?.find(assignment => assignment.unit.id === original.id);
+            if (role === "evidence" && initial && !initial.inputs.some(ref => ref.root === (old.root === "run" ? "run" : "workspace")
+                && ref.path === (old.root === "canon" ? `.memory-bank/${old.path}` : old.path) && ref.sha256 === old.sha256))
+                return [];
+            if (old.root === "run")
+                return [{ ...old }];
+            const logical = old.root === "canon" ? `.memory-bank/${old.path}` : old.path;
+            const current = selected.get(logical);
+            if (!current) {
+                if (!old.path.startsWith(".memory-bank/") || !finalChanges.has(old.path) || finalChanges.get(old.path) !== null)
+                    refuse("unexplained_missing_unit_source");
+                deleted.push({ role, path: old.path, original_sha256: old.sha256, repair_result: { ...finalProof.get(old.path) } });
+                return [];
+            }
+            if (current.sha256 !== old.sha256 && !finalChanges.has(old.path))
+                refuse("unexplained_changed_unit_source");
+            return [old.root === "canon" ? { ...old, sha256: current.sha256 } : { ...current }];
+        });
+        const unit = { ...structuredClone(original), evidence: project(original.evidence, "evidence"), artifacts: project(original.artifacts, "artifact") };
+        // Newly created/replacement documents belong only to the explicitly
+        // assigned unit, not every reviewer that happens to share the wave.
+        for (const repair of input.repairs.filter(repair => repair.unit_ids.includes(original.id)))
+            for (const change of repair.result.changes) {
+                const current = selected.get(change.path);
+                if (current && !unit.artifacts.some(ref => ref.path === current.path))
+                    unit.artifacts.push({ ...current });
+            }
+        const inputs = new Map();
+        for (const ref of [...unit.evidence, ...unit.artifacts, ...input.repairs.map(repair => reference(repair.reference.path, repair.reference.sha256, "run"))]) {
+            const physical = reference(ref.root === "canon" ? `.memory-bank/${ref.path}` : ref.path, ref.sha256, ref.root === "run" ? "run" : "workspace");
+            const key = memorySourceKey(physical.root, physical.path), prior = inputs.get(key);
+            if (prior && prior.sha256 !== ref.sha256)
+                refuse("conflicting_unit_reference");
+            inputs.set(key, physical);
+        }
+        return { unit, original_unit_sha256: hybridDigest(original), deleted_references: deleted,
+            inputs: [...inputs.values()].sort((a, b) => `${a.root}:${a.path}`.localeCompare(`${b.root}:${b.path}`, "en")) };
+    });
+}
+/** First selective re-review preparation only. Fresh checks, independently
+ * registered reviewer allocation/copy and result settlement remain separate.
+ * This owner cannot be used as an initial-wave owner or Stage acceptance. */
+export class PreparedCorrectedMemoryReviewInputs {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #wave in value;
+    }
+    sha256;
+    #wave;
+    #view;
+    #observed;
+    constructor(key, wave, view, observed) {
+        if (key !== token)
+            refuse("corrected_input_token_required");
+        this.#wave = wave;
+        this.#view = structuredClone(view);
+        this.#observed = observed;
+        this.sha256 = hybridDigest(view);
+        Object.freeze(this);
+    }
+    static prepare(context, wave) {
+        if (!PreparedCompletedMemoryCorrectionWave.isPrepared(wave))
+            refuse("completed_correction_wave_required");
+        if (!PreparedRegisteredMemoryCorrections.isPrepared(wave.registration()))
+            refuse("first_correction_wave_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        wave.revalidate(context);
+        const view = prepareView(wave), original = wave.registration().review().original(), bundle = original.bundle();
+        const scope = { projectId: view.scope.project_id, runId: view.scope.run_id };
+        const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), workspace = bundle.execution.snapshot().scope.workspace;
+        const observed = ObservedMemorySources.capture({ workspace, run: run.run_root ?? run.run_dir }, view.run_inputs.map(ref => ({ root: ref.root, path: ref.path })));
+        const hashes = observed.hashes();
+        if (view.run_inputs.some(ref => hashes.get(memorySourceKey(ref.root, ref.path)) !== ref.sha256))
+            refuse("corrected_input_bytes_changed");
+        const source = reviewSourceHash(workspace, view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path), view.base);
+        if (source !== view.source_sha256)
+            refuse("corrected_copy_source_changed");
+        const prepared = new PreparedCorrectedMemoryReviewInputs(token, wave, view, observed);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    static prepareFromBundle(context, input) {
+        if (!(input.bundle instanceof RetainedExecutionBundle) || input.bundle.descriptor.descriptor.id !== "mb-init")
+            refuse("registered_memory_bundle_required");
+        const original = PreparedRetainedMemoryReviewAuthority.prepare(context, input.scope, input.bundle);
+        const review = PreparedRetainedMemoryReviewResults.prepare(context, original);
+        const corrections = PreparedRegisteredMemoryCorrections.restore(context, review);
+        return this.prepare(context, PreparedCompletedMemoryCorrectionWave.prepare(context, corrections));
+    }
+    value() { return structuredClone(this.#view); }
+    bundle() { return this.#wave.registration().review().original().bundle(); }
+    completedWave() { return this.#wave; }
+    verificationProfileHash(context) {
+        this.assertCustody(context);
+        return this.#wave.registration().review().original().verificationProfileHash(context);
+    }
+    assertCustody(context) { const wave = this.#wave; wave.assertCustody(context); }
+    assertAllocationAllowed(context) { const wave = this.#wave; wave.assertAllocationAllowed(context); }
+    revalidate(context) {
+        const wave = this.#wave;
+        wave.revalidate(context);
+        this.#observed.revalidate();
+        const workspace = wave.registration().review().original().bundle().execution.snapshot().scope.workspace;
+        if (reviewSourceHash(workspace, this.#view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path), this.#view.base) !== this.#view.source_sha256)
+            refuse("corrected_copy_source_changed");
+        this.assertCustody(context);
+    }
+}
+function prepareView(wave) {
+    const registration = wave.registration(), review = registration.review(), original = review.original().registration().view;
+    const files = wave.workspaceManifest().entries().filter(entry => entry.kind === "file").map(entry => ({ path: entry.path, sha256: entry.sha256 }));
+    const receipt = registration.receipt(), batch = registration.batch();
+    const repairs = wave.repairResults().map(repair => ({ ...repair,
+        unit_ids: batch.works.find(work => receipt.work_ids[work.key] === repair.work_id).payload.memory_repair.unit_ids }));
+    // The registered initial copy selects current bytes; its unit metadata also
+    // retains historical blueprint evidence, which is not a repair-time file.
+    const assignments = correctedMemoryReviewAssignments({ units: original.unit_inventory, initialAssignments: original.assignments, affected: wave.affectedUnitIds(), files, repairs });
+    const inputs = new Map();
+    for (const ref of [...original.run_inputs.filter(ref => ref.root === "run"), ...review.references().map(ref => reference(ref.result.path, ref.result.sha256, "run")),
+        ...repairs.map(repair => reference(repair.reference.path, repair.reference.sha256, "run")), ...files.map(file => reference(file.path, file.sha256))]) {
+        const key = memorySourceKey(ref.root, ref.path), prior = inputs.get(key);
+        if (prior && prior.sha256 !== ref.sha256)
+            refuse("conflicting_current_input");
+        inputs.set(key, { ...ref });
+    }
+    if (inputs.size > 4096)
+        refuse("unbounded_current_inputs");
+    const runInputs = [...inputs.values()].sort((a, b) => `${a.root}:${a.path}`.localeCompare(`${b.root}:${b.path}`, "en"));
+    const workspace = review.original().bundle().execution.snapshot().scope.workspace;
+    const source = reviewSourceHash(workspace, runInputs.filter(ref => ref.root === "workspace").map(ref => ref.path), original.base);
+    const view = { schema_id: "dd-flow/memory-corrected-review-inputs@1", wave: 1, scope: original.scope,
+        completed_correction_sha256: wave.sha256, original_review_sha256: review.sha256,
+        source_policy: "review-inputs@1", source_sha256: source, base: original.base, run_inputs: runInputs,
+        unit_inventory: structuredClone(original.unit_inventory), affected_unit_ids: wave.affectedUnitIds(), assignments,
+        instruction: structuredClone(original.instruction), repairs: repairs.map(repair => ({ work_id: repair.work_id, authority_sha256: repair.authority_sha256, result: repair.reference })) };
+    if (Buffer.byteLength(JSON.stringify(view)) > 1024 * 1024)
+        refuse("unbounded_corrected_view");
+    return view;
+}