@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.161

package/dist/services/memory-accepted-composition.js

@@ -0,0 +1,78 @@
+import { AppError } from "../shared/errors.js";
+import { createHash } from "node:crypto";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { selectMemoryCompositionRegistration } from "./memory-composition-registration.js";
+import { PreparedMemoryResultBinding } from "./memory-result-binding.js";
+import { PreparedMemoryStageResult, memorySourceKey } from "./memory-stage-results.js";
+import { PreparedMemoryCompositionAcceptance } from "./memory-composition-acceptance.js";
+import { captureMemoryCompositionSources } from "./memory-compose-handler.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+function refuse(reason) {
+    throw new AppError("memory_accepted_composition_invalid", "Accepted composition lacks original plan and current settled output custody", 2, { reason, effect: "no_effect" });
+}
+/** Shared current-document authority for VERIFY and initial REVIEW. Historical
+ * replay uses separate retained receipts; repaired outputs cannot masquerade
+ * as the original composition. This helper writes nothing and dispatches no Work.
+ */
+export class PreparedAcceptedMemoryComposition {
+    #bundle;
+    #runRoot;
+    #blueprint;
+    #binding;
+    #outputs;
+    #result;
+    constructor(bundle, runRoot, blueprint, binding, outputs, result) {
+        this.#bundle = bundle;
+        this.#runRoot = runRoot;
+        this.#blueprint = blueprint;
+        this.#binding = binding;
+        this.#outputs = outputs;
+        this.#result = result;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const { scope, bundle } = input;
+        if (!(bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
+            refuse("registered_memory_bundle_required");
+        const stage = bundle.descriptor.descriptor.id === "mb-init" ? "compose" : "upgrade";
+        const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), root = readDescriptorRootWork(context, scope, bundle);
+        const registration = selectMemoryCompositionRegistration(context, { ...stageGraphScope(context, scope.projectId, scope.runId, stage), stage, parent_work_id: root.workId });
+        const blueprint = PreparedMemoryResultBinding.prepareRegisteredComposition(context, { ...scope, flow: bundle.descriptor, execution: bundle.execution, bundle, acceptedReplay: true,
+            registrationScope: registration.scope });
+        const outputs = PreparedMemoryCompositionAcceptance.prepare(context, { scope: registration.scope, flow: bundle.descriptor, engine: bundle.engine(), binding: blueprint.binding() });
+        const composed = readAcceptedStageData(context, { ...scope, stage }), runRoot = run.run_root ?? run.run_dir;
+        const binding = PreparedMemoryResultBinding.prepare(context, { ...scope, stage, flow: bundle.descriptor, execution: bundle.execution, bundle, acceptedReplay: true,
+            sources: captureMemoryCompositionSources(context, bundle, runRoot, composed.bytes, outputs), historicalEvidence: outputs.historicalEvidence() });
+        if (!binding.acceptedBytes()?.equals(composed.bytes))
+            refuse("accepted_composition_changed");
+        const result = PreparedMemoryStageResult.prepare(composed.bytes, bundle.descriptor, binding.binding());
+        outputs.assertResult(result);
+        const prepared = new PreparedAcceptedMemoryComposition(bundle, runRoot, blueprint, binding, outputs, result);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    result() { return this.#result; }
+    outputReferences() {
+        const hashes = this.#outputs.outputHashes();
+        return this.#outputs.outputLocations().map(location => ({ ...location, sha256: hashes.get(memorySourceKey(location.root, location.path)) }));
+    }
+    historicalEvidence() { return this.#outputs.historicalEvidence(); }
+    captureSources(context, bytes, checks) {
+        return captureMemoryCompositionSources(context, this.#bundle, this.#runRoot, bytes, this.#outputs, checks, createHash("sha256").update(bytes).digest("hex"));
+    }
+    assertCustody(context) {
+        this.#blueprint.assertCustody(context);
+        this.#binding.assertCustody(context);
+        this.#outputs.assertCustody(context);
+        this.#outputs.assertResult(this.#result);
+    }
+    revalidate(context) {
+        this.#blueprint.revalidate(context);
+        this.#binding.revalidate(context);
+        this.#outputs.revalidate(context);
+        this.assertCustody(context);
+    }
+}

package/dist/services/memory-baseline-preservation.js

@@ -0,0 +1,65 @@
+import { AppError } from "../shared/errors.js";
+import { FrozenGenericExecution } from "./generic-execution.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readMemoryInitBootstrapReadiness } from "./memory-init-bootstrap-readiness.js";
+import { readMemoryInitProjectBootstrap } from "./memory-init-project-bootstrap.js";
+import { assertPublishedMemoryLayerOwnership } from "./memory-layer-publication.js";
+import { observeMemoryInitSourceInventory } from "./memory-init-preflight.js";
+function refuse(reason) {
+    throw new AppError("memory_baseline_preservation_invalid", "Composition cannot accept changed bootstrap sources", 1, { reason, effect: "no_effect" });
+}
+/** Pre-integration source preservation, not semantic scope or stage authority.
+ * Only the accepted publisher's ownership is checked before using its MB exclusion.
+ * This admits no caller-supplied baseline and never repairs or republishes files.
+ */
+export class PreparedMemoryBaselinePreservation {
+    sourceSha256;
+    #execution;
+    #authoritySha256;
+    #inventorySha256;
+    constructor(execution, authoritySha256, inventorySha256, sourceSha256) {
+        this.#execution = execution;
+        this.#authoritySha256 = authoritySha256;
+        this.#inventorySha256 = inventorySha256;
+        this.sourceSha256 = sourceSha256;
+        Object.freeze(this);
+    }
+    static accepted(context, execution) {
+        if (!(execution instanceof FrozenGenericExecution) || execution.settings.flow_id !== "mb-init")
+            refuse("unprepared_execution");
+        const scope = execution.snapshot().scope;
+        const accepted = readMemoryInitBootstrapReadiness(context, { requestId: scope.requestId, projectRoot: scope.projectRoot, workspaceRoot: scope.workspace });
+        if (!accepted || accepted.authority.binding.execution_sha256 !== execution.sha256)
+            refuse("accepted_bootstrap_required");
+        return accepted;
+    }
+    static observe(context, accepted) {
+        const binding = accepted.authority.binding, scope = binding.scope;
+        const registered = readMemoryInitProjectBootstrap(context, scope);
+        if (!registered)
+            refuse("accepted_bootstrap_required");
+        assertPublishedMemoryLayerOwnership(context.ddFlowHome, { ...scope, targetSha256: registered.receipt.target_sha256,
+            layerSha256: registered.receipt.layer_sha256, packSha256: binding.pack_sha256, installationSha256: binding.installation_manifest_sha256 }, binding.target, registered.receipt.layer_publication_sha256, registered.receipt.draft_identity_sha256);
+        return observeMemoryInitSourceInventory(binding.target, accepted.authority.receipt.baseline_sha256, context.env);
+    }
+    static prepare(context, execution) {
+        const accepted = this.accepted(context, execution);
+        const inventory = this.observe(context, accepted);
+        const prepared = new PreparedMemoryBaselinePreservation(execution, hybridDigest(accepted.authority), inventory.sha256, accepted.authority.binding.target.source_sha256);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    /** SQL-only acceptance fence. Physical checks must precede the writer. */
+    assertCustody(context) {
+        if (hybridDigest(PreparedMemoryBaselinePreservation.accepted(context, this.#execution).authority) !== this.#authoritySha256)
+            refuse("bootstrap_authority_changed");
+    }
+    revalidate(context) {
+        this.assertCustody(context);
+        const accepted = PreparedMemoryBaselinePreservation.accepted(context, this.#execution);
+        const inventory = PreparedMemoryBaselinePreservation.observe(context, accepted);
+        if (inventory.sha256 !== this.#inventorySha256)
+            refuse("baseline_inventory_changed");
+        this.assertCustody(context);
+    }
+}

package/dist/services/memory-completed-correction-wave.js

@@ -0,0 +1,328 @@
+import { assertMemorySqlCustody } from "./memory-custody-snapshot.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedRegisteredMemoryCorrections } from "./memory-repair-registration.js";
+import { PreparedRetainedSecondMemoryRepairs } from "./memory-retained-second-repairs.js";
+import { PreparedSettledMemoryRepair } from "./memory-repair-history.js";
+import { PreparedMemoryRepairWorkspace } from "./memory-repair-workspace.js";
+import { isCompletedMemoryRepairClaim } from "./memory-repair-work-results.js";
+import { reviewSourcePaths } from "./review-copy.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+const token = Symbol("completed-memory-correction-wave");
+const historicalToken = Symbol("historical-second-memory-correction-wave");
+function refuse(reason) {
+    throw new AppError("memory_correction_wave_invalid", "Re-review lacks a completely settled correction graph and current document custody", 2, { reason, effect: "no_effect" });
+}
+/** Pure selection only. A repair claim does not establish current bytes or
+ * resolve a finding. Registered wave custody must validate these claims first.
+ * Assigned units always need independent re-review; previously accepted units
+ * only need it when their own evidence/artifacts intersect an actual delta. */
+export function memoryCorrectionCurrentUnits(units, assignments) {
+    if (!Array.isArray(units) || !units.length || units.length > 256 || !Array.isArray(assignments) || assignments.length > 256
+        || units.some(unit => !unit || typeof unit.id !== "string" || !unit.id)
+        || new Set(units.map(unit => unit.id)).size !== units.length
+        || assignments.some(item => !item?.unit || !units.some(unit => unit.id === item.unit.id && unit.aspect === item.unit.aspect
+            && unit.applicability === item.unit.applicability))
+        || new Set(assignments.map(item => item.unit.id)).size !== assignments.length)
+        refuse("invalid_current_unit_inventory");
+    const current = new Map(assignments.map(item => [item.unit.id, item.unit]));
+    return units.map(unit => structuredClone(current.get(unit.id) ?? unit));
+}
+export function memoryCorrectionAffectedUnits(units, repairs, composition = []) {
+    if (!Array.isArray(units) || !units.length || units.length > 256 || !Array.isArray(repairs) || !repairs.length || repairs.length > 256
+        || units.some(unit => !unit || typeof unit.id !== "string" || !unit.id || !["applicable", "not-applicable"].includes(unit.applicability)
+            || !Array.isArray(unit.evidence) || !Array.isArray(unit.artifacts)
+            || [...unit.evidence, ...unit.artifacts].some(ref => !ref || typeof ref.root !== "string"
+                || !["project", "workspace", "canon", "run"].includes(ref.root) || typeof ref.path !== "string" || !ref.path
+                || ref.path.startsWith("/") || /^[A-Za-z]:/.test(ref.path) || ref.path.includes("\\") || ref.path.includes("\0")
+                || ref.path.split("/").some((part) => !part || part === "." || part === "..")
+                || typeof ref.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(ref.sha256)))
+        || new Set(units.map(unit => unit.id)).size !== units.length)
+        refuse("invalid_unit_inventory");
+    const applicable = new Set(units.filter(unit => unit.applicability === "applicable").map(unit => unit.id));
+    const affected = new Set(), changed = new Set();
+    for (const repair of repairs) {
+        if (!repair || !Array.isArray(repair.unit_ids) || !repair.unit_ids.length || new Set(repair.unit_ids).size !== repair.unit_ids.length
+            || repair.unit_ids.some((id) => !applicable.has(id)) || !isCompletedMemoryRepairClaim(repair.result))
+            refuse("invalid_settled_repair_projection");
+        for (const id of repair.unit_ids)
+            affected.add(id);
+        for (const delta of repair.result.changes) {
+            if (!delta || typeof delta.path !== "string" || !delta.path.startsWith(".memory-bank/") || delta.path.includes("\\")
+                || delta.path.includes("\0") || delta.path.split("/").some((part) => !part || part === "." || part === "..")
+                || [delta.before_sha256, delta.after_sha256].some(hash => hash !== null && (typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash)))
+                || delta.before_sha256 === delta.after_sha256)
+                refuse("invalid_settled_delta_projection");
+            changed.add(delta.path);
+        }
+    }
+    for (const unit of units)
+        if (unit.applicability === "applicable" && [...unit.evidence, ...unit.artifacts].some(ref => ["project", "workspace"].includes(ref.root) && changed.has(ref.path)))
+            affected.add(unit.id);
+    if (!Array.isArray(composition) || composition.length > 256 || composition.some(work => !work || typeof work.key !== "string" || !work.key
+        || !Array.isArray(work.unit_ids) || !work.unit_ids.length || work.unit_ids.some((id) => !applicable.has(id))
+        || !Array.isArray(work.depends_on) || new Set(work.depends_on).size !== work.depends_on.length)
+        || new Set(composition.map(work => work.key)).size !== composition.length)
+        refuse("invalid_composition_dependencies");
+    const remaining = new Map(composition.map(work => [work.key, work])), done = new Set(), impacted = new Set();
+    if (composition.some(work => work.depends_on.some((key) => !remaining.has(key) || key === work.key)))
+        refuse("invalid_composition_dependencies");
+    while (remaining.size) {
+        const ready = [...remaining.values()].filter(work => work.depends_on.every((key) => done.has(key)));
+        if (!ready.length)
+            refuse("invalid_composition_dependencies");
+        for (const work of ready) {
+            remaining.delete(work.key);
+            done.add(work.key);
+        }
+    }
+    // Units may span several composition Works. Reach a fixed point rather
+    // than making coverage depend on which independent branch sorted first.
+    let expanded;
+    do {
+        expanded = false;
+        for (const work of composition) {
+            const dependent = work.depends_on.some((key) => impacted.has(key));
+            if (!impacted.has(work.key) && (dependent || work.unit_ids.some((id) => affected.has(id)))) {
+                impacted.add(work.key);
+                expanded = true;
+            }
+            // Co-packing independent units into one Work is not a dependency.
+            // Only a declared changed predecessor expands its consumer units.
+            if (dependent)
+                for (const id of work.unit_ids)
+                    if (!affected.has(id)) {
+                        affected.add(id);
+                        expanded = true;
+                    }
+        }
+    } while (expanded);
+    return units.filter(unit => affected.has(unit.id)).map(unit => unit.id);
+}
+function assertNoActiveChildren(context, registration) {
+    const scope = registration.receipt().scope;
+    if (context.db.get("SELECT 1 FROM works w JOIN stage_work_memberships m ON m.work_id=w.work_id AND m.project_id=w.project_id AND m.run_id=w.run_id WHERE w.project_id=? AND w.run_id=? AND w.parent_work_id=? AND m.stage='review' AND m.attempt=? AND w.status IN ('created','running','paused') LIMIT 1", [scope.project_id, scope.run_id, scope.parent_work_id, scope.attempt]))
+        refuse("review_children_active");
+}
+function selection(context, registration) {
+    registration.assertCustody(context);
+    const receipt = registration.receipt(), batch = registration.batch(), scope = receipt.scope;
+    if (receipt.wave !== (PreparedRetainedSecondMemoryRepairs.isPrepared(registration) ? 2 : 1))
+        refuse("unsupported_correction_wave");
+    const states = batch.works.map(item => {
+        const workId = receipt.work_ids[item.key];
+        const row = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=? AND parent_work_id=?", [scope.project_id, scope.run_id, workId, scope.parent_work_id]);
+        if (row?.status !== "completed")
+            refuse("correction_graph_not_completed");
+        return { key: item.key, work_id: workId };
+    });
+    const ids = new Set(states.map(item => item.work_id));
+    if (!ids.size)
+        refuse("settlement_history_missing_or_ambiguous");
+    const all = context.db.all(`SELECT id,json_extract(payload_json,'$.work_id') AS work_id FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_settlement' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id') IN (${[...ids].map(() => "?").join(",")}) ORDER BY id LIMIT 257`, [scope.project_id, scope.run_id, ...ids]);
+    if (all.length > 256)
+        refuse("unbounded_settlement_history");
+    const settlements = all.filter(row => ids.has(row.work_id));
+    if (!states.length || settlements.length !== states.length || new Set(settlements.map(row => row.work_id)).size !== states.length)
+        refuse("settlement_history_missing_or_ambiguous");
+    const order = new Map(settlements.map((row, index) => [row.work_id, index]));
+    for (const item of batch.works)
+        for (const dependency of item.depends_on) {
+            const predecessor = receipt.work_ids[dependency], workId = receipt.work_ids[item.key];
+            if (!predecessor || order.get(predecessor) >= order.get(workId))
+                refuse("dependency_settlement_order_changed");
+        }
+    return { registration_sha256: registration.sha256, states, settlements };
+}
+const nonMemory = (entry) => entry.path !== ".memory-bank" && !entry.path.startsWith(".memory-bank/");
+/** Closed second graph custody, not current workspace admission or accepted
+ * review. Reconstruction starts at independently retained first-wave state;
+ * neither current files nor a second writer's claimed before-view are anchors. */
+export class PreparedHistoricalSecondMemoryCorrectionWave {
+    #custodyKey = {};
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #registration in value;
+    }
+    #registration;
+    #selected;
+    #histories;
+    #baseline;
+    #affected;
+    constructor(key, registration, selected, histories, baseline, affected) {
+        if (key !== historicalToken)
+            refuse("historical_second_wave_token_required");
+        this.#registration = registration;
+        this.#selected = structuredClone(selected);
+        this.#histories = histories;
+        this.#baseline = baseline;
+        this.#affected = [...affected];
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const registration = PreparedRetainedSecondMemoryRepairs.prepareAfterReview(context, input);
+        const selected = context.db.readSnapshot(() => selection(context, registration));
+        const histories = selected.settlements.map(row => PreparedSettledMemoryRepair.prepare(context, registration, row.work_id));
+        let baseline = registration.initialDocumentBaseline();
+        const prefixes = new Set([hybridDigest(baseline.entries())]);
+        for (const history of histories) {
+            if (!prefixes.has(hybridDigest(history.before().entries())))
+                refuse("unexplained_historical_input_view");
+            baseline = baseline.composeSettledDelta(history.before(), history.after(), history.result().outcome);
+            prefixes.add(hybridDigest(baseline.entries()));
+        }
+        const batch = registration.batch(), receipt = registration.receipt(), first = registration.initialInputView();
+        const compose = readAcceptedStageData(context, { ...input.scope, stage: input.bundle.descriptor.descriptor.id === "mb-upgrade" ? "upgrade" : "compose" });
+        const affected = memoryCorrectionAffectedUnits(memoryCorrectionCurrentUnits(first.unit_inventory, first.assignments), histories.map(history => ({ result: history.result(),
+            unit_ids: batch.works.find(item => receipt.work_ids[item.key] === history.workId).payload.memory_repair.unit_ids })), JSON.parse(compose.bytes.toString("utf8")).details.works);
+        const prepared = new PreparedHistoricalSecondMemoryCorrectionWave(historicalToken, registration, selected, histories, baseline, affected);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    registration() { return this.#registration; }
+    baseline() { return this.#baseline; }
+    histories() { return [...this.#histories]; }
+    affectedUnitIds() { return [...this.#affected]; }
+    repairResults() {
+        const batch = this.#registration.batch(), receipt = this.#registration.receipt();
+        return this.#histories.map(history => ({ work_id: history.workId, result: history.result(), reference: history.reference(),
+            authority_sha256: history.sha256,
+            unit_ids: batch.works.find(item => receipt.work_ids[item.key] === history.workId).payload.memory_repair.unit_ids }));
+    }
+    assertCustody(context) {
+        const registration = this.#registration;
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            if (hybridDigest(selection(context, registration)) !== hybridDigest(this.#selected))
+                refuse("historical_second_graph_changed");
+            for (const history of this.#histories)
+                history.assertCustody(context);
+        });
+    }
+    revalidate(context) {
+        this.#registration.revalidate(context);
+        for (const history of this.#histories)
+            history.revalidate(context);
+        this.assertCustody(context);
+    }
+}
+/** Current post-correction admission, not a historical acceptance receipt.
+ * Every Work must have independently settled publication custody. Shared
+ * documents are compared with composed retained transitions, never adopted
+ * from today's filesystem. This owner neither allocates reviewers nor marks
+ * repair findings resolved; independent re-review must consume it separately. */
+export class PreparedCompletedMemoryCorrectionWave {
+    #custodyKey = {};
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #selected in value;
+    }
+    sha256;
+    #registration;
+    #selected;
+    #histories;
+    #baseline;
+    #workspace;
+    #root;
+    #input;
+    #affected;
+    constructor(key, registration, selected, histories, baseline, workspace, root, input, affected) {
+        if (key !== token)
+            refuse("completed_wave_token_required");
+        this.#registration = registration;
+        this.#selected = structuredClone(selected);
+        this.#histories = histories;
+        this.#baseline = baseline;
+        this.#workspace = workspace;
+        this.#root = root;
+        this.#input = structuredClone(input);
+        this.#affected = [...affected];
+        this.sha256 = hybridDigest({ selected, histories: histories.map(history => history.sha256), baseline_sha256: baseline.sha256,
+            workspace_sha256: workspace.sha256, input, affected_unit_ids: affected });
+        Object.freeze(this);
+    }
+    static prepare(context, registration) {
+        if (!PreparedRegisteredMemoryCorrections.isPrepared(registration)
+            && !PreparedRetainedSecondMemoryRepairs.isPrepared(registration))
+            refuse("registered_corrections_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        // Preparing a read-only current view must also work after its successor
+        // reviewers have been allocated. Only fresh allocation requires no active
+        // children; that fence is consumed by its writer below.
+        const selected = context.db.readSnapshot(() => selection(context, registration));
+        const histories = selected.settlements.map(row => PreparedSettledMemoryRepair.prepare(context, registration, row.work_id));
+        const paths = [...new Set(registration.plan().works.flatMap(work => work.write_paths))].sort();
+        let baseline = (PreparedRetainedSecondMemoryRepairs.isPrepared(registration)
+            ? registration.initialDocumentBaseline() : histories[0].before()).withWritePaths(paths);
+        const known = new Set([hybridDigest(baseline.entries())]);
+        for (const history of histories) {
+            if (!known.has(hybridDigest(history.before().entries())))
+                refuse("unexplained_historical_input_view");
+            baseline = baseline.composeSettledDelta(history.before(), history.after(), history.result().outcome);
+            known.add(hybridDigest(baseline.entries()));
+        }
+        const view = PreparedRetainedSecondMemoryRepairs.isPrepared(registration) ? registration.initialInputView()
+            : registration.review().original().registration().view;
+        const bundle = PreparedRetainedSecondMemoryRepairs.isPrepared(registration) ? registration.bundle()
+            : registration.review().original().bundle();
+        const root = bundle.execution.snapshot().scope.workspace;
+        baseline.revalidate(root);
+        const input = { base: view.base, explicit_inputs: view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path) };
+        const candidates = reviewSourcePaths(root, input.explicit_inputs, input.base);
+        if (!candidates)
+            refuse("source_inventory_unavailable");
+        const available = new Set(baseline.entries().filter(entry => entry.kind === "file").map(entry => entry.path));
+        const exported = baseline.exported(candidates.filter(logical => logical.startsWith(".memory-bank/") && available.has(logical)));
+        const workspace = PreparedMemoryRepairWorkspace.capture(root, input, exported);
+        const sourceSha256 = hybridDigest(workspace.entries().filter(nonMemory));
+        if (histories.some(history => hybridDigest(history.workspaceManifest().entries().filter(nonMemory)) !== sourceSha256))
+            refuse("non_memory_source_changed");
+        const batch = registration.batch(), receipt = registration.receipt();
+        const compose = readAcceptedStageData(context, { projectId: receipt.scope.project_id, runId: receipt.run_id, stage: bundle.descriptor.descriptor.id === "mb-upgrade" ? "upgrade" : "compose" });
+        const dependencies = JSON.parse(compose.bytes.toString("utf8")).details.works;
+        const currentUnits = PreparedRetainedSecondMemoryRepairs.isPrepared(registration)
+            ? memoryCorrectionCurrentUnits(registration.initialInputView().unit_inventory, registration.initialInputView().assignments)
+            : view.unit_inventory;
+        const affected = memoryCorrectionAffectedUnits(currentUnits, histories.map(history => ({
+            unit_ids: batch.works.find(item => receipt.work_ids[item.key] === history.workId).payload.memory_repair.unit_ids,
+            result: history.result()
+        })), dependencies);
+        const prepared = new PreparedCompletedMemoryCorrectionWave(token, registration, selected, histories, baseline, workspace, root, input, affected);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    registration() { return this.#registration; }
+    affectedUnitIds() { return [...this.#affected]; }
+    baseline() { return this.#baseline; }
+    workspaceManifest() { return this.#workspace; }
+    repairResults() { return this.#histories.map(history => ({ work_id: history.workId, result: history.result(), reference: history.reference(), authority_sha256: history.sha256 })); }
+    /** Only SQL custody is inspected inside the future review-allocation writer. */
+    assertCustody(context) {
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            const selected = this.#selected;
+            if (hybridDigest(selection(context, this.#registration)) !== hybridDigest(selected))
+                refuse("completed_wave_custody_changed");
+            for (const history of this.#histories)
+                history.assertCustody(context);
+        });
+    }
+    /** Fresh allocation fence, before adding successor reviewers. General
+     * custody deliberately stays valid when those admitted children exist. */
+    assertAllocationAllowed(context) {
+        this.assertCustody(context);
+        assertNoActiveChildren(context, this.#registration);
+    }
+    revalidate(context) {
+        const root = this.#root;
+        this.assertCustody(context);
+        this.#registration.revalidate(context);
+        for (const history of this.#histories)
+            history.revalidate(context);
+        this.#baseline.revalidate(root);
+        this.#workspace.revalidateSource();
+        // Re-read the selected inventory as well as observed files: a newly added
+        // non-MB source must not slip between preparation and reviewer allocation.
+        this.#workspace.verifySelectedSourceInputs(root, this.#input, this.#baseline);
+        this.assertCustody(context);
+    }
+}