@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/memory-corrected-review-findings.js

@@ -0,0 +1,108 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { memoryReviewWaveProjection } from "./memory-review-acceptance.js";
+import { isCompletedMemoryRepairClaim } from "./memory-repair-work-results.js";
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_findings_invalid", "Finding resolution lacks causal repair and independent re-review references", 2, { reason, effect: "no_effect" });
+}
+function ref(value) {
+    if (!value || typeof value.path !== "string" || !value.path || value.path.startsWith("/") || value.path.includes("\\")
+        || value.path.includes("\0") || value.path.split("/").some(part => !part || part === "." || part === "..")
+        || !/^[a-f0-9]{64}$/.test(value.sha256))
+        refuse("invalid_result_reference");
+    return { path: value.path, sha256: value.sha256 };
+}
+/** Metadata projection only. The owning fan-in must independently prove all
+ * referenced settlements. Original findings remain visible; their historical
+ * evidence is cited through the original immutable reviewer result instead of
+ * pretending that obsolete workspace bytes are still current. */
+export function correctedMemoryReviewFindings(input) {
+    if (!Array.isArray(input.original) || !input.original.length || input.original.length > 256 || !Array.isArray(input.current)
+        || !Array.isArray(input.affected) || !input.affected.length || input.affected.length > 256
+        || new Set(input.affected).size !== input.affected.length || input.current.length !== input.affected.length
+        || !Array.isArray(input.originalReferences) || !Array.isArray(input.currentReferences) || !Array.isArray(input.repairs)
+        || input.repairs.length > 256)
+        refuse("invalid_wave_inventory");
+    for (const results of [input.original, input.current])
+        if (new Set(results.map(result => result.unit_id)).size !== results.length
+            || new Set(results.map(result => result.work_id)).size !== results.length)
+            refuse("duplicate_review_identity");
+    if (input.current.some(result => !input.affected.includes(result.unit_id) || !input.original.some(old => old.unit_id === result.unit_id))
+        || input.affected.some(id => !input.current.some(result => result.unit_id === id))
+        || input.current.some(result => input.original.some(old => old.work_id === result.work_id)))
+        refuse("foreign_or_reused_review");
+    const references = (results, values) => {
+        if (values.length !== results.length || new Set(values.map(value => value.reviewer_work_id)).size !== values.length)
+            refuse("incomplete_review_references");
+        return new Map(results.map(result => {
+            const selected = values.find(value => value.reviewer_work_id === result.work_id);
+            if (!selected)
+                refuse("incomplete_review_references");
+            return [result.work_id, ref(selected.result)];
+        }));
+    };
+    const originalRefs = references(input.original, input.originalReferences), currentRefs = references(input.current, input.currentReferences);
+    const previous = memoryReviewWaveProjection(input.original, input.diagnostics), fresh = memoryReviewWaveProjection(input.current);
+    if (input.findingHistory !== undefined) {
+        const history = input.findingHistory;
+        if (!Array.isArray(history) || history.length > 1024 || new Set(history.map(finding => finding?.id)).size !== history.length
+            || history.some(finding => !finding || typeof finding.id !== "string" || !finding.id
+                || !input.original.some(result => result.unit_id === finding.unit_id)
+                || !["open", "resolved"].includes(finding.status) || !["minor", "major", "critical"].includes(finding.severity)
+                || !Array.isArray(finding.evidence) || !finding.evidence.length || !Array.isArray(finding.resolution_refs)
+                || (finding.status === "open" && finding.resolution_refs.length !== 0)
+                || (finding.status === "resolved" && finding.resolution_refs.length !== 2)))
+            refuse("invalid_finding_history");
+        if (previous.findings.some(finding => !history.some(retained => retained.id === finding.id && retained.unit_id === finding.unit_id
+            && retained.severity === finding.severity && retained.statement === finding.statement)))
+            refuse("incomplete_effective_finding_history");
+        for (const finding of history) {
+            for (const evidence of finding.evidence) {
+                if (!["run", "workspace"].includes(evidence.root))
+                    refuse("invalid_historical_evidence_root");
+                ref(evidence);
+            }
+            for (const resolution of finding.resolution_refs)
+                ref(resolution);
+        }
+        previous.findings = history.map(finding => ({ ...structuredClone(finding), evidence: finding.evidence.some(evidence => evidence.root !== "run")
+                ? [{ root: "run", ...originalRefs.get(input.original.find(result => result.unit_id === finding.unit_id).work_id) }]
+                : structuredClone(finding.evidence) }));
+    }
+    const previousIds = new Set(previous.findings.map(finding => finding.id)), claims = new Map();
+    for (const repair of input.repairs) {
+        const reference = ref(repair.reference);
+        if (!isCompletedMemoryRepairClaim(repair.result) || !repair.unit_ids.length)
+            refuse("unsettled_repair_claim");
+        for (const resolution of repair.result.resolutions) {
+            const finding = previous.findings.find(finding => finding.id === resolution.finding_id);
+            if (!finding || finding.status !== "open" || !repair.unit_ids.includes(finding.unit_id) || claims.has(finding.id)
+                || repair.result.outcome !== "reconciled" && !resolution.delta_paths.length
+                || resolution.delta_paths.some(path => !repair.result.changes.some(change => change.path === path && change.before_sha256 !== change.after_sha256)))
+                refuse("foreign_or_noncausal_resolution");
+            claims.set(finding.id, { repair, reference });
+        }
+    }
+    const findings = previous.findings.map(finding => {
+        if (input.findingHistory !== undefined && finding.status === "resolved")
+            return structuredClone(finding);
+        const original = input.original.find(result => result.unit_id === finding.unit_id);
+        const historical = originalRefs.get(original.work_id);
+        const current = input.current.find(result => result.unit_id === finding.unit_id), claim = claims.get(finding.id);
+        const resolved = Boolean(claim && current?.outcome === "accepted");
+        const diagnostic = input.diagnostics?.some(item => `MVF-${hybridDigest({ id: item.id, unit_id: item.unit_id }).slice(0, 32)}` === finding.id);
+        if (diagnostic && !input.diagnosticReference)
+            refuse("diagnostic_reference_required");
+        return { ...finding, evidence: input.findingHistory !== undefined ? structuredClone(finding.evidence) : [{ root: "run", ...(diagnostic ? ref(input.diagnosticReference) : historical) }], status: resolved ? "resolved" : "open",
+            resolution_refs: resolved ? [claim.reference, currentRefs.get(current.work_id)] : [] };
+    });
+    if (fresh.findings.some(finding => previousIds.has(finding.id)))
+        refuse("colliding_finding_identity");
+    findings.push(...fresh.findings);
+    if (findings.length > 1024)
+        refuse("unbounded_finding_history");
+    const effective = input.original.map(old => input.current.find(result => result.unit_id === old.unit_id) ?? old);
+    const outcome = effective.some(result => result.outcome === "blocked") ? "blocked"
+        : effective.some(result => result.outcome === "needs_repair") || findings.some(finding => finding.status === "open" && finding.severity !== "minor") ? "needs_repair" : "accepted";
+    return { outcome, findings };
+}

package/dist/services/memory-corrected-review-inputs.js

@@ -0,0 +1,215 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedCompletedMemoryCorrectionWave } from "./memory-completed-correction-wave.js";
+import { isCompletedMemoryRepairClaim } from "./memory-repair-work-results.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { reviewSourceHash } from "./review-copy.js";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { PreparedRetainedMemoryReviewAuthority } from "./memory-retained-review-authority.js";
+import { PreparedRetainedMemoryReviewResults } from "./memory-retained-review-results.js";
+import { PreparedRegisteredMemoryCorrections } from "./memory-repair-registration.js";
+import { memoryReviewViewWithinLimit } from "./memory-review-limits.js";
+const token = Symbol("corrected-memory-review-inputs");
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_input_invalid", "Re-review inputs lack settled corrections and current source custody", 2, { reason, effect: "no_effect" });
+}
+function reference(path, sha256, root = "workspace") {
+    if (typeof path !== "string" || !path || path.length > 4096 || path.includes("\\") || path.includes("\0")
+        || path.startsWith("/") || /^[A-Za-z]:/.test(path) || path.split("/").some(part => !part || part === "." || part === "..")
+        || typeof sha256 !== "string" || !/^[a-f0-9]{64}$/.test(sha256))
+        refuse("invalid_current_reference");
+    return { root, path, sha256 };
+}
+/** Metadata projection only. Current refs replace obsolete byte identities;
+ * deletions remain explicit historical facts, never phantom readable files.
+ * An empty effective artifact set is preserved for independent assessment,
+ * not silently turned into not-applicable or accepted coverage. */
+export function correctedMemoryReviewAssignments(input) {
+    if (!Array.isArray(input.units) || !input.units.length || input.units.length > 256
+        || !Array.isArray(input.affected) || !input.affected.length || input.affected.length > 256
+        || new Set(input.affected).size !== input.affected.length || !Array.isArray(input.files) || input.files.length > 20_000
+        || !Array.isArray(input.repairs) || !input.repairs.length || input.repairs.length > 256)
+        refuse("invalid_projection_inventory");
+    const selected = new Map();
+    for (const file of input.files) {
+        const ref = reference(file.path, file.sha256);
+        if (selected.has(ref.path))
+            refuse("duplicate_current_reference");
+        selected.set(ref.path, ref);
+    }
+    if (input.units.some(unit => !unit || typeof unit.id !== "string" || !unit.id
+        || !["applicable", "not-applicable"].includes(unit.applicability) || !Array.isArray(unit.evidence) || !Array.isArray(unit.artifacts))
+        || new Set(input.units.map(unit => unit.id)).size !== input.units.length
+        || input.affected.some((id) => !input.units.some(unit => unit.id === id && unit.applicability === "applicable")))
+        refuse("foreign_affected_unit");
+    const finalChanges = new Map();
+    const finalProof = new Map();
+    for (const repair of input.repairs) {
+        reference(repair.reference.path, repair.reference.sha256, "run");
+        if (!isCompletedMemoryRepairClaim(repair.result) || !Array.isArray(repair.unit_ids) || !repair.unit_ids.length
+            || repair.unit_ids.some((id) => !input.units.some(unit => unit.id === id && unit.applicability === "applicable")))
+            refuse("invalid_repair_projection");
+        for (const change of repair.result.changes) {
+            reference(change.path, change.after_sha256 ?? change.before_sha256);
+            if (change.before_sha256 !== null)
+                reference(change.path, change.before_sha256);
+            if (!change.path.startsWith(".memory-bank/") || change.before_sha256 === change.after_sha256)
+                refuse("invalid_repair_projection");
+            finalChanges.set(change.path, change.after_sha256);
+            finalProof.set(change.path, reference(repair.reference.path, repair.reference.sha256, "run"));
+        }
+    }
+    for (const [path, sha256] of finalChanges)
+        if ((selected.get(path)?.sha256 ?? null) !== sha256)
+            refuse("current_view_differs_from_settled_delta");
+    return input.units.filter(unit => input.affected.includes(unit.id)).map(original => {
+        const deleted = [];
+        const project = (refs, role) => refs.flatMap(old => {
+            if (!["project", "workspace", "canon", "run"].includes(old.root))
+                refuse("foreign_original_reference");
+            reference(old.path, old.sha256);
+            const initial = input.initialAssignments?.find(assignment => assignment.unit.id === original.id);
+            if (role === "evidence" && initial && !initial.inputs.some(ref => ref.root === (old.root === "run" ? "run" : "workspace")
+                && ref.path === (old.root === "canon" ? `.memory-bank/${old.path}` : old.path) && ref.sha256 === old.sha256))
+                return [];
+            if (old.root === "run")
+                return [{ ...old }];
+            const logical = old.root === "canon" ? `.memory-bank/${old.path}` : old.path;
+            const current = selected.get(logical);
+            if (!current) {
+                if (!old.path.startsWith(".memory-bank/") || !finalChanges.has(old.path) || finalChanges.get(old.path) !== null)
+                    refuse("unexplained_missing_unit_source");
+                deleted.push({ role, path: old.path, original_sha256: old.sha256, repair_result: { ...finalProof.get(old.path) } });
+                return [];
+            }
+            if (current.sha256 !== old.sha256 && !finalChanges.has(old.path))
+                refuse("unexplained_changed_unit_source");
+            return [old.root === "canon" ? { ...old, sha256: current.sha256 } : { ...current }];
+        });
+        const unit = { ...structuredClone(original), evidence: project(original.evidence, "evidence"), artifacts: project(original.artifacts, "artifact") };
+        // Newly created/replacement documents belong only to the explicitly
+        // assigned unit, not every reviewer that happens to share the wave.
+        for (const repair of input.repairs.filter(repair => repair.unit_ids.includes(original.id)))
+            for (const change of repair.result.changes) {
+                const current = selected.get(change.path);
+                if (current && !unit.artifacts.some(ref => ref.path === current.path))
+                    unit.artifacts.push({ ...current });
+            }
+        const inputs = new Map();
+        for (const ref of input.initialAssignments?.find(item => item.unit.id === original.id)?.inputs ?? [])
+            if (ref.root === "run" && /^upgrade-baseline-[a-f0-9]{64}\.bin$/.test(ref.path))
+                inputs.set(memorySourceKey(ref.root, ref.path), { ...ref });
+        for (const ref of [...unit.evidence, ...unit.artifacts, ...input.repairs.map(repair => reference(repair.reference.path, repair.reference.sha256, "run"))]) {
+            const physical = reference(ref.root === "canon" ? `.memory-bank/${ref.path}` : ref.path, ref.sha256, ref.root === "run" ? "run" : "workspace");
+            const key = memorySourceKey(physical.root, physical.path), prior = inputs.get(key);
+            if (prior && prior.sha256 !== ref.sha256)
+                refuse("conflicting_unit_reference");
+            inputs.set(key, physical);
+        }
+        return { unit, original_unit_sha256: hybridDigest(original), deleted_references: deleted,
+            inputs: [...inputs.values()].sort((a, b) => `${a.root}:${a.path}`.localeCompare(`${b.root}:${b.path}`, "en")) };
+    });
+}
+/** First selective re-review preparation only. Fresh checks, independently
+ * registered reviewer allocation/copy and result settlement remain separate.
+ * This owner cannot be used as an initial-wave owner or Stage acceptance. */
+export class PreparedCorrectedMemoryReviewInputs {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #wave in value;
+    }
+    sha256;
+    #wave;
+    #view;
+    #observed;
+    constructor(key, wave, view, observed) {
+        if (key !== token)
+            refuse("corrected_input_token_required");
+        this.#wave = wave;
+        this.#view = structuredClone(view);
+        this.#observed = observed;
+        this.sha256 = hybridDigest(view);
+        Object.freeze(this);
+    }
+    static prepare(context, wave) {
+        if (!PreparedCompletedMemoryCorrectionWave.isPrepared(wave))
+            refuse("completed_correction_wave_required");
+        if (!PreparedRegisteredMemoryCorrections.isPrepared(wave.registration()))
+            refuse("first_correction_wave_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        wave.revalidate(context);
+        const view = prepareView(wave), original = wave.registration().review().original(), bundle = original.bundle();
+        const scope = { projectId: view.scope.project_id, runId: view.scope.run_id };
+        const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), workspace = bundle.execution.snapshot().scope.workspace;
+        const observed = ObservedMemorySources.capture({ workspace, run: run.run_root ?? run.run_dir }, view.run_inputs.map(ref => ({ root: ref.root, path: ref.path })));
+        const hashes = observed.hashes();
+        if (view.run_inputs.some(ref => hashes.get(memorySourceKey(ref.root, ref.path)) !== ref.sha256))
+            refuse("corrected_input_bytes_changed");
+        const source = reviewSourceHash(workspace, view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path), view.base);
+        if (source !== view.source_sha256)
+            refuse("corrected_copy_source_changed");
+        const prepared = new PreparedCorrectedMemoryReviewInputs(token, wave, view, observed);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    static prepareFromBundle(context, input) {
+        if (!(input.bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(input.bundle.descriptor.descriptor.id))
+            refuse("registered_memory_bundle_required");
+        const original = PreparedRetainedMemoryReviewAuthority.prepare(context, input.scope, input.bundle);
+        const review = PreparedRetainedMemoryReviewResults.prepare(context, original);
+        const corrections = PreparedRegisteredMemoryCorrections.restore(context, review);
+        return this.prepare(context, PreparedCompletedMemoryCorrectionWave.prepare(context, corrections));
+    }
+    value() { return structuredClone(this.#view); }
+    bundle() { return this.#wave.registration().review().original().bundle(); }
+    completedWave() { return this.#wave; }
+    verificationProfileHash(context) {
+        this.assertCustody(context);
+        return this.#wave.registration().review().original().verificationProfileHash(context);
+    }
+    assertCustody(context) { const wave = this.#wave; wave.assertCustody(context); }
+    assertAllocationAllowed(context) { const wave = this.#wave; wave.assertAllocationAllowed(context); }
+    revalidate(context) {
+        const wave = this.#wave;
+        wave.revalidate(context);
+        this.#observed.revalidate();
+        const workspace = wave.registration().review().original().bundle().execution.snapshot().scope.workspace;
+        if (reviewSourceHash(workspace, this.#view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path), this.#view.base) !== this.#view.source_sha256)
+            refuse("corrected_copy_source_changed");
+        this.assertCustody(context);
+    }
+}
+function prepareView(wave) {
+    const registration = wave.registration(), review = registration.review(), original = review.original().registration().view;
+    const files = wave.workspaceManifest().entries().filter(entry => entry.kind === "file").map(entry => ({ path: entry.path, sha256: entry.sha256 }));
+    const receipt = registration.receipt(), batch = registration.batch();
+    const repairs = wave.repairResults().map(repair => ({ ...repair,
+        unit_ids: batch.works.find(work => receipt.work_ids[work.key] === repair.work_id).payload.memory_repair.unit_ids }));
+    // The registered initial copy selects current bytes; its unit metadata also
+    // retains historical blueprint evidence, which is not a repair-time file.
+    const assignments = correctedMemoryReviewAssignments({ units: original.unit_inventory, initialAssignments: original.assignments, affected: wave.affectedUnitIds(), files, repairs });
+    const inputs = new Map();
+    for (const ref of [...original.run_inputs.filter(ref => ref.root === "run"), ...review.references().map(ref => reference(ref.result.path, ref.result.sha256, "run")),
+        ...repairs.map(repair => reference(repair.reference.path, repair.reference.sha256, "run")), ...files.map(file => reference(file.path, file.sha256))]) {
+        const key = memorySourceKey(ref.root, ref.path), prior = inputs.get(key);
+        if (prior && prior.sha256 !== ref.sha256)
+            refuse("conflicting_current_input");
+        inputs.set(key, { ...ref });
+    }
+    if (inputs.size > 4096)
+        refuse("unbounded_current_inputs");
+    const runInputs = [...inputs.values()].sort((a, b) => `${a.root}:${a.path}`.localeCompare(`${b.root}:${b.path}`, "en"));
+    const workspace = review.original().bundle().execution.snapshot().scope.workspace;
+    const source = reviewSourceHash(workspace, runInputs.filter(ref => ref.root === "workspace").map(ref => ref.path), original.base);
+    const view = { schema_id: "dd-flow/memory-corrected-review-inputs@1", wave: 1, scope: original.scope,
+        completed_correction_sha256: wave.sha256, original_review_sha256: review.sha256,
+        source_policy: "review-inputs@1", source_sha256: source, base: original.base, run_inputs: runInputs,
+        unit_inventory: structuredClone(original.unit_inventory), affected_unit_ids: wave.affectedUnitIds(), assignments,
+        ...(original.upgrade_baseline ? { upgrade_baseline: structuredClone(original.upgrade_baseline), preservation_invariants: structuredClone(original.preservation_invariants ?? []) } : {}),
+        instruction: structuredClone(original.instruction), repairs: repairs.map(repair => ({ work_id: repair.work_id, authority_sha256: repair.authority_sha256, result: repair.reference })) };
+    if (!memoryReviewViewWithinLimit(view))
+        refuse("unbounded_corrected_view");
+    return view;
+}

package/dist/services/memory-corrected-review-projection.js

@@ -0,0 +1,78 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { memorySourceKey } from "./memory-stage-results.js";
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_projection_invalid", "Review result differs from retained inventory and independent selective coverage", 2, { reason, effect: "no_effect" });
+}
+/** Pure full-coverage projection, not Stage acceptance. Untouched units retain
+ * their original reviewer and unchanged source identities. Affected units use
+ * the separately admitted current assignment, including explicit deletions. */
+export function correctedMemoryReviewUnits(input) {
+    const { view } = input, inventory = view.unit_inventory;
+    if (!((view.wave === 1 && view.schema_id === "dd-flow/memory-corrected-review-inputs@1")
+        || (view.wave === 2 && view.schema_id === "dd-flow/memory-corrected-review-inputs@2"))
+        || !Array.isArray(inventory) || !inventory.length || inventory.length > 256
+        || new Set(inventory.map(unit => unit.id)).size !== inventory.length
+        || !Array.isArray(view.assignments) || !Array.isArray(view.affected_unit_ids)
+        || new Set(view.affected_unit_ids).size !== view.affected_unit_ids.length
+        || view.assignments.length !== view.affected_unit_ids.length || input.current.length !== view.assignments.length
+        || input.repairWorkIds.length !== view.repairs.length
+        || new Set(input.repairWorkIds).size !== input.repairWorkIds.length
+        || hybridDigest([...input.repairWorkIds].sort()) !== hybridDigest(view.repairs.map(repair => repair.work_id).sort()))
+        refuse("invalid_projection_inventory");
+    const applicable = inventory.filter(unit => unit.applicability === "applicable");
+    const reviews = (results, refs, ids) => {
+        if (results.length !== ids.length || refs.length !== ids.length
+            || new Set(results.map(result => result.unit_id)).size !== ids.length || new Set(results.map(result => result.work_id)).size !== ids.length
+            || new Set(refs.map(reference => reference.reviewer_work_id)).size !== refs.length
+            || results.some(result => !ids.includes(result.unit_id)))
+            refuse("changed_review_coverage");
+        return new Map(results.map(result => {
+            const reference = refs.find(reference => reference.reviewer_work_id === result.work_id);
+            if (!reference || hybridDigest(reference.unit_ids) !== hybridDigest([result.unit_id]))
+                refuse("changed_review_reference");
+            return [result.unit_id, { result, reference: structuredClone(reference) }];
+        }));
+    };
+    const original = reviews(input.original, input.originalReferences, applicable.map(unit => unit.id));
+    const current = reviews(input.current, input.currentReferences, view.affected_unit_ids);
+    if (input.current.some(result => input.original.some(old => old.work_id === result.work_id)))
+        refuse("reused_review_work");
+    const sources = new Map(view.run_inputs.map(ref => [memorySourceKey(ref.root, ref.path), ref.sha256]));
+    const references = [];
+    const units = inventory.map(old => {
+        if (!["applicable", "not-applicable"].includes(old.applicability))
+            refuse("unresolved_unit_applicability");
+        if (old.applicability === "not-applicable") {
+            if (view.affected_unit_ids.includes(old.id))
+                refuse("excluded_unit_reviewed");
+            return { ...structuredClone(old), outcome: "not-applicable" };
+        }
+        const changed = view.affected_unit_ids.includes(old.id), review = changed ? current.get(old.id) : original.get(old.id);
+        if (!review)
+            refuse("missing_unit_review");
+        references.push(review.reference);
+        const assignments = view.assignments.filter(assignment => assignment.unit.id === old.id);
+        if (changed && (assignments.length !== 1 || assignments[0].unit.applicability !== "applicable"
+            || assignments[0].unit.aspect !== old.aspect || assignments[0].original_unit_sha256 !== hybridDigest(old)))
+            refuse("changed_unit_assignment");
+        const effective = changed ? assignments[0].unit : old;
+        if (!["accepted", "needs_repair", "blocked"].includes(review.result.outcome)
+            || (review.result.outcome === "accepted" && !effective.artifacts.length))
+            refuse("invalid_unit_assessment");
+        const normalize = (refs) => refs.map(ref => {
+            const root = ref.root === "run" ? "run" : "workspace", path = ref.root === "canon" ? `.memory-bank/${ref.path}` : ref.path;
+            if (!["workspace", "project", "canon", "run"].includes(ref.root) || sources.get(memorySourceKey(root, path)) !== ref.sha256)
+                refuse("stale_unit_reference");
+            return { root: ref.root === "project" ? "workspace" : ref.root, path: ref.path, sha256: ref.sha256 };
+        });
+        const evidence = effective.evidence.filter(ref => changed || !["project", "workspace", "canon", "run"].includes(ref.root) || !inventory.flatMap(unit => unit.artifacts).some(artifact => (artifact.root === "run" ? "run" : "workspace") === (ref.root === "run" ? "run" : "workspace")
+            && (artifact.root === "canon" ? `.memory-bank/${artifact.path}` : artifact.path) === (ref.root === "canon" ? `.memory-bank/${ref.path}` : ref.path)
+            && artifact.sha256 !== ref.sha256 && sources.get(memorySourceKey(artifact.root === "run" ? "run" : "workspace", artifact.root === "canon" ? `.memory-bank/${artifact.path}` : artifact.path)) === artifact.sha256));
+        return { ...structuredClone(effective), evidence: normalize(evidence), artifacts: normalize(effective.artifacts), outcome: review.result.outcome };
+    });
+    if (view.assignments.some(assignment => !view.affected_unit_ids.includes(assignment.unit.id))
+        || view.affected_unit_ids.some(id => !applicable.some(unit => unit.id === id)))
+        refuse("foreign_assignment");
+    return { units, details: { reviews: references, repair_wave: view.wave, repair_work_ids: [...input.repairWorkIds] } };
+}

package/dist/services/memory-corrected-review-receipt.js

@@ -0,0 +1,178 @@
+import { assertMemorySqlCustody } from "./memory-custody-snapshot.js";
+import { AppError } from "../shared/errors.js";
+import { appendAudit } from "./audit.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedCorrectedMemoryReviewAcceptance } from "./memory-corrected-review-acceptance.js";
+import { PreparedSecondMemoryReviewAcceptance } from "./memory-second-review-acceptance.js";
+import { PreparedMemoryStageResult } from "./memory-stage-results.js";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { PreparedHistoricalOriginalMemoryReview } from "./memory-historical-original-review.js";
+import { PreparedHistoricalCorrectedMemoryReview } from "./memory-historical-corrected-review.js";
+import { PreparedHistoricalSecondMemoryReview } from "./memory-historical-second-review.js";
+const token = Symbol("memory-corrected-review-receipt"), event = "memory.corrected_review_acceptance";
+function refuse(reason) {
+    throw new AppError("memory_corrected_review_receipt_invalid", "Corrected review lacks independently accepted selective-wave custody", 2, { reason, effect: "no_effect" });
+}
+function selected(context, scope) {
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id=? AND id=?", [scope.projectId, scope.runId]);
+    if (!run)
+        refuse("run_missing");
+    const index = JSON.parse(run.index_json), stage = index.stage_runs?.find((item) => item.stage === "review");
+    if (index.current_stage !== "review" || stage?.status !== "running" || typeof stage.attempt !== "string"
+        || !/^try-[0-9]{3,}$/.test(stage.attempt) || typeof stage.input_sha256 !== "string"
+        || !/^[a-f0-9]{64}$/.test(stage.input_sha256))
+        refuse("active_review_required");
+    return { attempt: stage.attempt, input_sha256: stage.input_sha256 };
+}
+function records(context, scope) {
+    return context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? LIMIT 2", [scope.projectId, event, scope.runId]);
+}
+function receipt(context, scope, wave, result) {
+    wave.assertResult(result);
+    const proof = wave.settlementProof(context), stage = selected(context, scope), value = result.value();
+    const expectedWave = PreparedSecondMemoryReviewAcceptance.isPrepared(wave) ? 2 : 1;
+    if (proof.wave !== expectedWave || proof.registration_scope.project_id !== scope.projectId || proof.registration_scope.run_id !== scope.runId
+        || proof.registration_scope.stage !== "review" || proof.registration_scope.attempt !== stage.attempt
+        || proof.registration_scope.input_sha256 !== stage.input_sha256 || value.outcome !== "accepted")
+        refuse("accepted_owned_wave_required");
+    const retained = { schema_id: "dd-flow/memory-corrected-review-acceptance@1", project_id: scope.projectId, run_id: scope.runId,
+        stage: "review", ...stage, result_sha256: result.sha256, projection_sha256: hybridDigest(wave.resultProjection()),
+        corrected_input_sha256: wave.registration().receipt().input_sha256, ...proof };
+    if (Buffer.byteLength(JSON.stringify(retained)) > 2 * 1024 * 1024)
+        refuse("unbounded_receipt");
+    return retained;
+}
+/** Fresh receipt only: the generic Stage acceptance writer must record this
+ * atomically. It does not close a Stage or authorize historical replay. */
+export class PreparedMemoryCorrectedReviewReceipt {
+    #scope;
+    #wave;
+    #result;
+    #receipt;
+    constructor(key, scope, wave, result, value) {
+        if (key !== token)
+            refuse("receipt_token_required");
+        this.#scope = { ...scope };
+        this.#wave = wave;
+        this.#result = result;
+        this.#receipt = structuredClone(value);
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if ((!PreparedCorrectedMemoryReviewAcceptance.isPrepared(input.wave) && !PreparedSecondMemoryReviewAcceptance.isPrepared(input.wave))
+            || !(input.result instanceof PreparedMemoryStageResult))
+            refuse("prepared_wave_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        input.wave.revalidate(context);
+        if (records(context, input.scope).length)
+            refuse("fresh_receipt_already_exists");
+        return new PreparedMemoryCorrectedReviewReceipt(token, input.scope, input.wave, input.result, receipt(context, input.scope, input.wave, input.result));
+    }
+    record(context) {
+        if (!context.db.isOwnedWriteTransaction?.())
+            refuse("owned_acceptance_writer_required");
+        if (records(context, this.#scope).length || hybridDigest(receipt(context, this.#scope, this.#wave, this.#result)) !== hybridDigest(this.#receipt))
+            refuse("fresh_review_custody_changed");
+        appendAudit(context, { projectId: this.#scope.projectId, eventType: event, payload: this.#receipt });
+        const rows = records(context, this.#scope);
+        if (rows.length !== 1 || hybridDigest(JSON.parse(rows[0].payload_json)) !== hybridDigest(this.#receipt))
+            refuse("receipt_readback_failed");
+    }
+}
+function acceptedReceipt(context, scope, flowId) {
+    const data = readAcceptedStageData(context, { ...scope, stage: "review" }), rows = records(context, scope);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+        refuse("accepted_receipt_missing");
+    let retained;
+    try {
+        retained = JSON.parse(rows[0].payload_json);
+    }
+    catch {
+        return refuse("invalid_accepted_receipt");
+    }
+    if (!retained || typeof retained !== "object" || Array.isArray(retained)
+        || retained.schema_id !== "dd-flow/memory-corrected-review-acceptance@1" || retained.project_id !== scope.projectId
+        || retained.run_id !== scope.runId || retained.stage !== "review" || ![1, 2].includes(retained.wave)
+        || (retained.wave === 2 && (typeof retained.first_review_proof_sha256 !== "string"
+            || !/^[a-f0-9]{64}$/.test(retained.first_review_proof_sha256)))
+        || typeof retained.corrected_input_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(retained.corrected_input_sha256)
+        || typeof retained.check_receipt_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(retained.check_receipt_sha256)
+        || data.data_schema_id !== (flowId === "mb-upgrade" ? "dd-flow/mb-upgrade-stage-result@1" : "dd-flow/mb-init-review-result@1") || retained.result_sha256 !== data.result.sha256
+        || retained.input_sha256 !== data.input_sha256)
+        refuse("accepted_receipt_changed");
+    return { data, retained, authority: hybridDigest({ data: data.authority_sha256, receipt: retained }) };
+}
+/** Closed Stage replay proves exact independently accepted bytes and rebuilt
+ * historical coverage/findings. Own Stage projection may be missing after
+ * commit: generic settlement restores it; reviewers/checks/repairs may not be
+ * substituted or re-admitted from today's project policy or documents. */
+export class PreparedAcceptedMemoryCorrectedReview {
+    #custodyKey = {};
+    #scope;
+    #authority;
+    #history;
+    #flowId;
+    constructor(key, scope, authority, history, flowId) {
+        if (key !== token)
+            refuse("receipt_token_required");
+        this.#scope = { ...scope };
+        this.#authority = authority;
+        this.#history = history;
+        this.#flowId = flowId;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (!(input.bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(input.bundle.descriptor.descriptor.id)
+            || !(input.bytes instanceof Uint8Array) || !input.bytes.length || input.bytes.length > 1024 * 1024)
+            refuse("registered_memory_result_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const accepted = context.db.readSnapshot(() => acceptedReceipt(context, input.scope, input.bundle.descriptor.descriptor.id));
+        if (!accepted.data.bytes.equals(Buffer.from(input.bytes)))
+            refuse("accepted_result_bytes_changed");
+        const hashes = { correctedInputSha256: accepted.retained.corrected_input_sha256, checkReceiptSha256: accepted.retained.check_receipt_sha256 };
+        const history = accepted.retained.wave === 2
+            ? PreparedHistoricalSecondMemoryReview.prepare(context, { scope: input.scope, bundle: input.bundle, ...hashes })
+            : PreparedHistoricalCorrectedMemoryReview.prepare(context, {
+                original: PreparedHistoricalOriginalMemoryReview.prepare(context, { scope: input.scope, bundle: input.bundle }), ...hashes
+            });
+        const projection = history.projection(), proof = history.settlementProof(context), scope = proof.registration_scope;
+        const expected = { schema_id: "dd-flow/memory-corrected-review-acceptance@1", project_id: input.scope.projectId, run_id: input.scope.runId,
+            stage: "review", attempt: scope.attempt, input_sha256: scope.input_sha256, result_sha256: accepted.data.result.sha256,
+            projection_sha256: hybridDigest(projection), corrected_input_sha256: accepted.retained.corrected_input_sha256, ...proof };
+        if (hybridDigest(expected) !== hybridDigest(accepted.retained))
+            refuse("accepted_review_custody_changed");
+        const value = JSON.parse(accepted.data.bytes.toString("utf8"));
+        const verify = readAcceptedStageData(context, { ...input.scope, stage: "verify" });
+        if (value.run_id !== input.scope.runId || value.stage !== "review" || value.schema_id !== accepted.data.data_schema_id
+            || value.input_sha256 !== scope.input_sha256 || projection.outcome !== "accepted"
+            || hybridDigest(value.predecessors) !== hybridDigest([{ stage: "verify", result: verify.result, input_sha256: verify.input_sha256 }])
+            || hybridDigest({ units: value.units, findings: value.findings, outcome: value.outcome, details: value.details }) !== hybridDigest(projection))
+            refuse("accepted_result_projection_changed");
+        const schema = JSON.parse(input.bundle.descriptor.stageBlob("review", "result_schema").toString("utf8"));
+        if (!new Ajv2020({ strict: true, strictRequired: false, validateFormats: false }).compile(schema)(value))
+            refuse("accepted_result_schema_changed");
+        const prepared = new PreparedAcceptedMemoryCorrectedReview(token, input.scope, accepted.authority, history, input.bundle.descriptor.descriptor.id);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    assertCustody(context) {
+        const history = this.#history;
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            history.assertCustody(context);
+            if (acceptedReceipt(context, this.#scope, this.#flowId).authority !== this.#authority)
+                refuse("accepted_review_custody_changed");
+        });
+    }
+    /** Final wave inputs selected by the independently accepted receipt. */
+    reviewedSources(context) {
+        this.assertCustody(context);
+        return this.#history.retainedInputView().run_inputs;
+    }
+    settledDocumentBaseline(context) { this.assertCustody(context); return this.#history.settledDocumentBaseline(); }
+    finalChecks(context) { this.assertCustody(context); return this.#history.finalChecks(context); }
+    revalidate(context) { this.#history.revalidate(context); this.assertCustody(context); }
+}